Transcription
Everyone, David Bumble coming to you from Black Hat with a very special guest. Matt, great to have you on the show.
>> Dave, thanks for having me. It's Lana.
>> So, I remember you showing this demo and I'm really excited to see the update for it. Tell me, well, take us on the journey, right? If I understand correctly, using a Raspberry Pi to make sure that people aren't following you or something like that.
>> Yes, correct. So, it's funny. I give it a lot of conference talks and I never really spend time at the beginning talking about the motivation for the stock or the story behind it. This one was different because I think it's really a key piece of the story. And what it is is no one likes to be how this all started is many many years ago, no one likes to be surprised by their boss showing up unannounced. And so they moved me to a warehouse in the back corner of a military base. And so what I did, I built a small wireless device that let me know anytime my boss was going to be in the area. my boss enter the building, it would give me the heads up. Not that I was doing anything wrong, just no one likes surprises.
>> So you looking for SSID or something?
>> Exactly. MAC address is coming off, SSID is coming off. Exactly. Because some things randomize, but you can't account for that. So you kind of got to look both ways. And so I had given a talk for the government and I theorized on using that to tell if you were being followed because if you think about it, even a nation state, very well-trained group, they're going to have cell phones in their pockets, right? They're going to have TPMS sensors in the tires. they're going to have Bluetooth headsets. And so I basically said, "Hey, I'm just going to go to three different locations and then see what devices were at all three."
Fast forward many years later, a acquaintance of mine who worked for a separate government agency came to me. They had a confidential informant with ties to a very legitimate terrorist organization that we are all aware of. Yeah. And this person, they weren't worried about their own safety. They were worried about the safety of their informant. They were afraid that if they were followed, it would get their informant killed. He said he asked his agency's tech people. They had nothing like that. He looked for it, couldn't find anything. So, he was like, "Hey, do you know of anything?" And I thought and I looked and I said, "No." I said, "If you give me a couple weeks, I think I can actually build it for you." And so, that's kind of uh where it led. And I I got to tell you, it blew up way bigger than I thought. Speaking here at Black Hat Wire did an article on me. And the emails that I got for still to this day, people um using it for search and rescue. I think one of the biggest tearjerkers was a gentleman who reached out and said his wife was uh worked in an emergency room in a hospital. Okay. And pretty much every week doctors and nurses there were getting death threats from people and they were using this to help give him a little piece of mind. And he's like your device is helping people safe like feel safe. And I was just like helping people sleep. It's like, it's getting dusty in here. You know, I'm trying I'm sitting there at my desk in my office like trying to fight back a little tear reading this email. So it's been amazing. It has been and to say like the improved and updated version. I wrote this before AI. It was me writing the code and I am a lot of things. A programmer is not one of them. And so now that we have AI to help me write the code, an update was long overdue.
I really want to thank Danny and the team at Straight Locker for sponsoring my trip to Black Hat and allowing me to enjoy this amazing conference. Deny by default is the way that we need to implement security these days. You cannot permit everything and then try and find the bad traffic in 2025. Deny by default. So I'm sure everyone's interested. Tell us what's in the box and you know explain what's going on.
>> Yeah, the original version if you go back and look at the talk was much much smaller than this. I'm presenting it here at Black Hat Arsenal and so I wanted a little bit bigger form factor so people could actually see it and sitting there. So yeah. So we have a small Raspberry Pi 5 right there hooked up to a little alpha wireless card. There's four USBs if you wanted to plug more in. This is actually a Bluetooth GPS.
>> So the original version that you that I saw was only doing Wi-Fi, but you're doing more than that now.
>> It was doing Wi-Fi and Bluetooth. This is doing both. So the purpose of the GPS is this. One of the things that I really wanted to one of the natural evolutions in my mind was listen, if someone is following you, can we flip it around? Can we tell where they hang out? Can we tell where they spend their time? Maybe where they work. And the answer is many times absolutely. And so with this, with having the GPS enabled, you can go back. This can generate reports of where you were followed, what the devices were, and then if you give it a Wiggle API key. It actually goes out to Wiggle and it queries the networks that the devices were following you, the where are they located, and you can flip it around. So, I had a buddy of mine test it. He is still federal law enforcement, I would say, what agency, but I had him kind of follow me around and do this. And then I went and looked and it's like, "Okay, yep. It saw the device following me. Saw this name of this unique Wi-Fi that it was looking for, do the probe requests, put it in there, and it's a building where at the front it's no ties to the government. If you Google it, it will say what government agency it is." And so I didn't want to blow up anyone's spot, but absolutely like cuz his phone had been there because he works there sometimes. So
>> wow.
>> Yeah, that was kind of cool.
>> So just a Raspberry Pi, right?
>> It is. And honestly, it's anything that could run Kismmet. So even a Raspberry Pi 50, anything else similar to a Raspberry 5, anything that can run Kismmet, which is fairly lowowered, this can work with.
>> And you got a screen that's just connected to the to the Raspberry Pi. Um, I don't want to put words in your mouth, so just take us on a journey, right? So So explain why you need the screen and why the interface looks like the way it does.
>> Why the interface looks like it's a FisherPrice toy, Dave. You can say it. You can say it.
>> No, not at all.
>> I mentioned that in my original talk. It's funny is originally when I thought this up, I was going off location like location one, location two, location 3. Very quickly I realized that does not work in the desert when you're driving for maybe an hour, hour and a half straight. And so what I had to do is I have to shift from locations. Do I have to shift to temporal? Am I seeing any devices now that I also saw 5 to 10 minutes ago, 15 to 10 minutes ago, etc. And once again, if you think about it, this is designed for an individual maybe by themselves driving at a high rate of speed. I I can't have them on a small screen going through menus looking a lot of options. And so I have big massive buttons that even me with my big paw can tap on correct and hit the correct button. So that's why the interface kinds of looks the way it does. And so there's also a little bit of logic in here. For instance, you see things like delete lists and ignore lists. And so Dave, if you and I if we were going to go do surveillance, if we were going to follow someone or we were maybe wanted this to see if we were being followed, what we would do is we would go into the car, right? get set up, have all of our equipment there, everything turned on, leave this running for a couple minutes,
>> and then we would create the ignore list. And so basically what we've done then is everything you've seen up to this point since I started you up, ignore it, never alert on it.
>> You didn't see anything,
>> right? Otherwise, we're alerting on oursel.
>> Yeah, exactly.
>> So yeah, we have the create the ignore list, delete the ignore list, a check system status, start chasing your tail, which we can push that right now and start it up. That was all in the original. Now the difference is one of the things that I wanted to do with this code is to really add the post analysis to be able to add in the GPS data as I said to be able to create maps of what your route of travel was. Yeah. Where you were being followed what devices you saw and then basically flipping it around on the purple little following you. Okay. Where are they going to where they Yeah,
>> that is really good.
>> It is.
>> Matt, before we go any further, I got to ask you, is this free? Is it open source or do I have to pay a bunch of money to get hold of this?
>> It is 100% free. It is open source. Before you had to deal with my horrible, horrible Python code.
>> It's horrible. Horrible. Just horrible.
>> As you can see, the uh sticker right there. Now, AI has helped me improve the code quite a bit. So, it is free open source. I think it's um I I got to tell you, if you're in this space, David, be perfectly honest with you. Now, I'm going to flip it around. I'm going to ask you a question. How many Raspberry Pies do you have laying around your house doing absolutely nothing right?
>> I don't want to even say cuz I, as a content creator, I have way too many. I must have at least 10 of them. Exactly. I think I have five. That's why it's funny. The person I gave this to is like, "How much do I owe you?" Like, "You don't owe me anything." And I'm like, "I have like five of these laying around my house." I think we pretty much all have a Raspberry Pi. Get that up and running. Get Kisman on it. Hook it up to a small screen, which depending on the form factor, the size, $20, $30 on Amazon. A lot of us probably have some Alpha or Panda wireless cards capable of being put in monitor mode as well too. We got to hook up to it. And then you're good. If you want a GPS, those USB are usually $10 or so on eBay. If you want to get a Bluetooth, which is obviously nice in a vehicle, depending on how you're going to use it, I was able to get the Bluetooth GPS on this for about $50 on eBay. So,
>> yeah, cuz I saw you got an Alpha adapter. I think you the story was you went and asked the community, right, which adapter?
>> Exactly. Yeah. I mean, there's these people that do this and they just swim in these waters deeply every day and they're far deeper in the tech than I am. So if we don't reach out and leverage and ask them what they're using, what they're having great success with, I'm being a. And so yeah, the alpha, the panda, those are usually the two best recommendations. As
>> long as they support monitoring and injection.
>> Exactly. You just got to be able to put it. We don't even need injection for this. Yeah, we just got to be able to put it in monitor mode. So
>> So Matt, let's get a bit technical. Right. So it's Kismmet is what you're using on the back end,
>> correct?
>> Is it a Python script? Because the last time I saw this, you you wrote a Python script. Is that what you're still doing or has it been changed, updated?
>> Correct. Yeah. And if you're not familiar with Kisman, Kisman is an amazing free open- source tool that works with wireless, it works with Bluetooth, it works with some software defined radios, and it brings everything in. It gives you a nice menu. And what it does is it saves everything into something that's akismmet file. Now, it's akismmet file, but really all it is is a SQLite database. And so, real time, I don't have to worry about processing Wi-Fi, Bluetooth, being able to bring in software to find radios for other radio types. I can just use kismmet and then parse that database real time. And so then the code itself is actually a Python script. It used to be one single script. Now it's a collection of scripts. With the help of AI, I was able to make it much more modular. It'll be much easier for other people to contribute to the project to be able to add into additional functionality. But yeah, it's just a collection of Python scripts that grabs the data from the DB, performs some analysis on it, starts looking for devices, and then generates obviously, like I said, the post reports for the maps and the things like that. But it's all Python.
>> Sorry, the code is on GitHub. Is that right?
>> It is. It's posture on GitHub. So, yeah.
>> Okay, great. So, people can just download it.
>> Absolutely. Chasing your tail.
>> Just need a Raspberry Pi. Yes. So, Chasing Your Tail.
>> Yeah, it's under my Argalius Labs, my small consulting company. It's on our GitHub. If you check that out, it's right there. So,
>> I'll put links below. Yep. Um, so just any does it have to be a really modern Raspberry Pi or is it
>> It does not. The original one was either on a two or a three, I forget. This is a five. I haven't tried it yet, but it should run fine on a zero. I think Kismmet right now when it's humming uses up about 25% of the CPU on this, so it's not nothing, but anything Kismmet will run on, this will run on because the code itself is actually very, very lightweight.
>> So when you set this up, I mean, you obviously had an adapter, you had the Raspberry Pi, so there was only the monitor that cost you about $20 or something, right?
>> Exactly. Exactly. And obviously this is a much bigger smaller form or a much larger form factor because it's going to be sitting in a booth where people standing around so they can see the screen, but the original one is much much tighter than this. Much much smaller and tighter. So
>> So this is YouTube and sometimes the comments on YouTube aren't don't meet reality. So I'm going to I'm going to hit you with some of the comments that I'm sure we're going to get.
>> Let it rip.
>> Matt, no one's going to use a unique ID, especially if they work for the military. So you're not going to be able to find them. I have to tell you, I have been in rooms where I was the only one there who was not an SF operator. And this is not a government thing. Private sector does it too. We have a horrible habit of naming our you Wi-Fi the names of our specialty units. So, I've sat there in rooms where literally I was the only one that was not a special forces operator. And I love these guys. They're all my friends. I talked to them all. And it's like, okay, which one of you guys is stationed in 10th Mountain? Which one of you guys is a firstteamer? Which one of you guys? We had a lieutenant colonel walk in. His name was Chris and he was hanging out in the room. Very nice guy. After a couple minutes, I pull up on Google Maps a house. I'm like, "Sir, is this your house?" He's like,
>> "Oh, wow."
>> Yeah, Yeah, it is. So,
>> and that's Wiggle that you found. You found the address, right?
>> Exactly. Yeah, it's Wiggle. So, obviously, if you have a MAC address, if you're performing forensics, then it's no ambiguity. If you're going off Wi-Fi names, which is all you have for a probe request, then it's obviously depending on the if it's just Starbucks, if it's Lynxis, you're not. But once again, we have a horrible, horrible habit of naming our Wi-Fi names that are funny and clever and unique, trying to impress our neighbors and friends. Funny and clever is great. Unique is not.
>> Okay, but what about MAC addresses? Right? Because phones randomize the MAC addresses, and I'm assuming you're looking for someone carrying a phone in their pocket or something like that. So, how do you how do you manage that? cuz the MAC address could be changing all the time.
>> Exactly. So, one nice thing about living in the desert like I do, Dave, is it's very easy for me to get away from everyone and everything and just start turning on devices and seeing what happens. And the iPhone in my pocket right now for probe requests, it was literally randomizing the Mac per every request. Every once in a while, I double dip and use it twice, but otherwise, every single request as I'm going through the pcaps and look at what's going on. And so a lot of people think that well that solves this problem. Randomize back solves the problem. But what they don't think about is it's the name of the networks you're looking for.
>> Okay?
>> So even if nothing sits there and shouts out Matt's house,
>> right? Starbucks where Dave hangs out. It's the signature of like I don't care what MAC addresses you're using. When I see a device come in looking for these five things and I know it's yours, I know that's your device there. And that itself becomes a signature. I was doing a site assessment several years ago for a um government building here in the United States. And as I walked around the building, I was wearing some baggie jeans. I had everything running on a tablet. So, I just put it in my back pocket. And afterwards, you could see obviously where a lot of people worked to where a lot of people vacationed, hung out, etc. And I noticed that a lot of devices were looking for a network name that was very, very unique, but I had no idea what it was. It didn't give away the name of something. But when I put that into Wiggle, it was actually the federal courthouse up in Tempe in Phoenix, Arizona. And so just the fact of even if you don't know their names, if you if you didn't know what agency they work for, they're at the federal courthouse in Phoenix often enough that they've got that saved on there. And so that was one of the things that I would the reason I was doing that is they wanted me to present it from a force protection, from an awareness. It's like, you know, normally when I'm walking through the mall, when I'm walking through Costco, if my phone is broadcasting out where I look for, I I don't really care. But obviously when you come to places like hacker conventions or you go into countries where maybe we're not the most favored then you know you want to think about shutting that off.
>> So explain the five I think it's 5 minute 10 minute 15 minute or something. Explain what that's about because I'm assuming that's how you know if someone's tracking you or following you right
>> exactly as I said earlier the um my original thought was location. I'm going to go to location one. Going to go to location two. Going to go to location three. In a big city that works great. But with the environment that this was in when it was a desert and you'd be me driving for 60, 90, 120 minutes, there are no locations. And so then, like I said, I had to quickly shift to temporal.
>> I had to say, do I see a device right now within the past minute
>> that I also saw 5 to 10 minutes ago that I also saw 15 to, you know, 10 to 15 minutes ago, 15 to 20 minutes ago. Cuz if so,
>> that's, you know, something worth noting. Exactly. Something worth noting. There's something going on. So,
>> Matt, I got to ask you stories. Have you got any examples where people have used this and told you like, "Okay, I found out some interesting things."
>> Uh, have I had any stories where I found out interesting things. The best results I've had is people using it for search and rescue. They've all been heartwarming. They've been good stories using it for search and rescue, which I found. I was in Washington DC a uh this is just about a month ago and at this point my black tack talk was three years ago this event and I had someone I don't want to say what agency it was but I had someone coming up to me and they said hey you're the guy from chasing your tail and I said yeah I am he's like and the agency he worked for one of their huge mandates is force protection protecting executives protecting facilities he's like oh no that was like a siminal talk for us and we actually like oh yeah no we basing a lot of stuff off that and everything I'm like I'm actually presenting an updated version this year. So, good news for you if you've tried to get up and running. There's some great improvements. So, yeah, it's been some of that. I haven't ever had the um thankfully in a lot of ways I haven't ever had the oh, I found a stalker because of you. It was just more of like I said, helping people have a little bit of a peace of mind from the ER search and rescue or protecting locations. Those have been the uh I think my favorite stories that I've gotten back so far.
>> Okay. So, you are checking for SSIDs, you're checking for MAC addresses, is that right? Correct.
>> Did you say doing something with Bluetooth as well?
>> Yeah, Bluetooth. Exactly. You were checking for Bluetooth the same way as we're checking for Wi-Fi because once again comes back to the even a nationstate group, even a group of trained operators are likely going to have cell phones. A lot of us have Bluetooth headsets now, AirPods or those, etc. And so that's one of those things that we can start to track for too. And anything that Kismmet can detect, we can start to look for. So we can easily modify this to just start looking for air tags too
>> because you were mentioning about tires. Sorry to interrupt you. So,
>> Oh, no, no, yeah, the tires, that's another thing. It's um fairly short distance, but the uh the low pressure sensors in tires, the TPMS, that is actually if you want to go software defined radio route capability in this, that can be something you could look for, too. Obviously, it's got a little bit shorter distance. It's a little longer than people think. Like, you can still detect it from your house of cars going by your road if your house is fairly closer to your road. So, it's a little bit longer than just like 6 ft away, but it's Wi-Fi and Bluetooth. You're going to get better range.
>> Okay. So, cell phones, um, any Bluetooth device like headsets, stuff like that, tires on cars, anything that's basically giving a signal, Bluetooth or Wi-Fi.
>> Exactly. A lot of people don't realize now too. This is the way a lot of detecting, one of the things that I teach is detecting modern drones and modern drones now are giving out that beacon on a lot of usually now it's long range Bluetooth. People think of Bluetooth, right? We think about it as something for our keyboards or think about something as our AirPods. No, we're detecting drones a kilometer out on a device that costs less than $100 to build.
>> Do you want people to reach out to you or you you don't want
>> that? They're welcome to. Yeah, I got so many people reaching out to me last time. And it was funny. I've since retired from the government, but at that point, I was a federal agent. I was a federal agent for 22 years. And I had so many people, it's comical, reaching out to me. It's like, well, how do I know you're really the one from Black Hat and Wired? How do I know? How do I know you're not a Fed? And I'm like, I am literally a Fed.
>> I said that in my talk. So,
>> so I mean assuming that no one's wanted by the FBI, can they reach out to you on like LinkedIn or somewhere?
>> Absolutely. I am the world's easiest person to get a hold of on LinkedIn on Twitter. My account name is Matt0177 everywhere. So, if you uh if you can't get a hold of me, you're not trying.
>> Matt, you were demoing this at Sorry, you are demoing this at the Arsenal section in Black Hat. What is What is the Arsenal section about?
>> Arsenal is fantastic. So, you can present to Blackat on a variety of topics. Arsenal is down here in the business hall. So pretty much anyone with any form of Black Hat Pass can get to it. And it's basically it's a new tool or an updated tool that you have that you want to share with the community. So it's got to be open source. It's the focus has to be on the tool, not a company. Right. It can't be a thinly veiled way to just Exactly. trying to sell a product or anything. It has to be open source. The focus has to be on a tool. And it's constantly rotating. So you'll go there, you'll see everything they have, and there's be like 10 different booths. Then you'll come back an hour and a half later and it's 10 new tools. So I always every time I come to black hat always pop my head into Arsenal and walk around and always find out like oh that's kind of cool. So yeah, I've never actually presented at Arsenal before. This will be my first time. So I'm excited.
>> De thanks so much for sharing it. Thank you. Appreciate him.