Horseless Carriage Exploits and Eavesdropping Defenses Boston 2009 Copyright 2009, James M. Atkinson

Speaker Contact James M. Atkinson (978)

What Are We Looking For? Any Threat or Risk, Period Any Threat or Risk, Period Tracking DevicesTracking Devices Video DevicesVideo Devices Audio DevicesAudio Devices Telemetry DevicesTelemetry Devices Exploitable HardwareExploitable Hardware Other Hazards or RisksOther Hazards or Risks

Vehicle Sweep Basics 1. Make a Plan 2. Follow the Plan 3. “Show Your Work” - Documentation 4. Work From Shop Manuals 5. Essential Tools and Test Equipment 6. Place to Work 7. Knowledge of Threats What is out there? What is out there?

Essential Resources Shop Manuals Shop Manuals Original Hardcopy Shop ManualsOriginal Hardcopy Shop Manuals Avoid “Chilton Style”, or Multi-Year Books Avoid “Chilton Style”, or Multi-Year Books Avoid CD’s, or Hardcopy Them Avoid CD’s, or Hardcopy Them Make, Model, Year, Trim?Make, Model, Year, Trim? Trim and Powertrain Variations Trim and Powertrain Variations Electrical Diagrams are CriticalElectrical Diagrams are Critical These are VERY ExpensiveThese are VERY Expensive NOT the Owners ManualNOT the Owners Manual

Essential Resources Flashlights Flashlights Plus, lots of extra batteriesPlus, lots of extra batteries Compact Mirror System Compact Mirror System Thin Nitrile Gloves Thin Nitrile Gloves Keeps the grease out of the carKeeps the grease out of the car Protective Tarp or Covers for Seats Protective Tarp or Covers for Seats Ground Tarp (if appropriate) Ground Tarp (if appropriate) Warm Weather is optional Warm Weather is optional

Critical Test Equipment Broadband Signal Detector Broadband Signal Detector One for each Mobile “Uplink”One for each Mobile “Uplink” Sharp Band Pass Filters AND Matching Antenna Sharp Band Pass Filters AND Matching Antenna Most of the U.S. Requires 4 Filters Most of the U.S. Requires 4 Filters Spectrum Analyzers Spectrum Analyzers Amplifiers and Antennas Amplifiers and Antennas DC Adapter/HP FilterDC Adapter/HP Filter Digital Voltmeter Digital Voltmeter PCM Tools (Power Train Control Module Interface) PCM Tools (Power Train Control Module Interface) Bluetooth Dongle Bluetooth Dongle Cell Phone Service Monitor Cell Phone Service Monitor

Important In a Perfect World: In a Perfect World: Performed in a sq ft GaragePerformed in a sq ft Garage Have a Hydraulic Lift, Four Mechanics, etc. Have a Hydraulic Lift, Four Mechanics, etc. Contain Every Known Mechanics Tool Contain Every Known Mechanics Tool Sterile Clean Room, Epoxy Floors, Lab Coats Sterile Clean Room, Epoxy Floors, Lab Coats In Reality? In Reality? Work With What You HaveWork With What You Have In the Amount of Time Are Given In the Amount of Time Are Given Always bring cleaning supplies Always bring cleaning supplies …and a first aid kit

PCM Scanners Generic Generic BnB, AutoTapBnB, AutoTap ActronActron One-Size-Fits-All MentalityOne-Size-Fits-All Mentality Proprietary Proprietary DealershipsDealerships Snap On, MacTools, etcSnap On, MacTools, etc Snap-On MODIS

Common Vehicle Exploits Cell Phone Cell Phone Concierge Services (more to follow) Concierge Services (more to follow) On-Star/GM, Ford, ToyotaOn-Star/GM, Ford, Toyota Lethal To PrivacyLethal To Privacy “Listen-In” Feature“Listen-In” Feature Vulnerable >12-bit Security Systems Vulnerable >12-bit Security Systems Garage Door Openers >8 bits Garage Door Openers >8 bits Similar “Conveniences” Similar “Conveniences” SpeedPass/RFID SpeedPass/RFID

Vehicle Sweep Basics It takes the spy less then 60 seconds to install a bug or tracking device in a car. <60 seconds It takes the spy less then 60 seconds to install a bug or tracking device in a car. <60 seconds But it only take 15 seconds or less to exploit something that you already have. <15 seconds But it only take 15 seconds or less to exploit something that you already have. <15 seconds

Detection Modalities RF Analysis RF Analysis Signals on the AirwaysSignals on the Airways Variety of Equipment Variety of Equipment “Tickle the Sleeping Dragon”“Tickle the Sleeping Dragon” Make it wake up and make noiseMake it wake up and make noise Voltage/Current Analysis Voltage/Current Analysis What Does the PCM and Radio Draw?What Does the PCM and Radio Draw?

Detection Modalities Physical Inspection Physical Inspection Dismantle As NeededDismantle As Needed Always Limited by Time Always Limited by Time

Detection Modalities NLJ Ping on GPS and Cell/PCS Bands NLJ Ping on GPS and Cell/PCS Bands Generic NLJD Good for 800/900 MHzGeneric NLJD Good for 800/900 MHz GPS/PCS Needs a Different UnitGPS/PCS Needs a Different Unit Sweep Generators with Off-Set Non Contiguous Sweep is Very ProductiveSweep Generators with Off-Set Non Contiguous Sweep is Very Productive

Manual Under Vehicle Inspection Reality: Reality: A Lot Of Crawling Under CarsA Lot Of Crawling Under Cars Less Then Optimal SituationLess Then Optimal Situation Takes Hours, and it is MessyTakes Hours, and it is Messy

Tracking Most Often a GPS Receiver, and Cell Phone Repeater Most Often a GPS Receiver, and Cell Phone Repeater Could Be an On-Star System Could Be an On-Star System Sold Under Many Names/VariantsSold Under Many Names/Variants Lo-Jack, Remote Activation Lo-Jack, Remote Activation Security System Elements Security System Elements SiRF State of the Art Smaller than your thumb, and shrinking…

On-Star Surveillance Module Almost All GM Vehicles, Lexus, etc Almost All GM Vehicles, Lexus, etc Simple Module Simple Module GPS Tracking GPS Tracking Telemetry Telemetry Engine Control Engine Control Audio Surveillance Audio Surveillance

On-Star Surveillance Module Factory Installed Factory Installed Highly Exploitable Highly Exploitable Hybrid Device Hybrid Device Note the Size… Note the Size…

On-Star Surveillance Module Easy to Find with Spectrum Analyzer Easy to Find with Spectrum Analyzer

On-Star Surveillance Module Easy to Find with Screwdriver Easy to Find with Screwdriver

Similar European Module Easy to Find with Screwdriver Easy to Find with Screwdriver

Vehicle Video Surveillance Normally, it is Less Important to Know What is Going on Inside a Vehicle Normally, it is Less Important to Know What is Going on Inside a Vehicle Important to Know What is Being Said Important to Know What is Being Said Most Important to Know Where the Vehicle is Going, or Has Been in the Past. Most Important to Know Where the Vehicle is Going, or Has Been in the Past. Thus, Video is of Less Value to Most Spy Thus, Video is of Less Value to Most Spy

Video Case Reverse Police Dash Cams Reverse Police Dash Cams Officers Didn’t Know the Chief Did ItOfficers Didn’t Know the Chief Did It Officers Sleeping In CruisersOfficers Sleeping In Cruisers Chief Re-Aimed the Dash CamsChief Re-Aimed the Dash Cams Result: Three Suspended OfficersResult: Three Suspended Officers

Video Case Parental Supervision Parental Supervision Old Owners Never Removed ItOld Owners Never Removed It Video Cameras and Recording Sys.Video Cameras and Recording Sys. Old Owners Honestly Forgot to RemoveOld Owners Honestly Forgot to Remove Originally Installed to Supervise KidsOriginally Installed to Supervise Kids

Video Case Car Rental Companies Car Rental Companies “Liability Recorders”“Liability Recorders” High Risk RentersHigh Risk Renters Customers Not AmusedCustomers Not Amused Records a Video of the CrashRecords a Video of the Crash

Video Case Suspicious Spouse Suspicious Spouse “That’s not my brand of lipstick…”“That’s not my brand of lipstick…” Very Common SituationVery Common Situation Marital InfidelityMarital Infidelity Results: Divorce (device found too late)Results: Divorce (device found too late) Multi-Billion Dollar Divorce Multi-Billion Dollar Divorce

Typical GPS Tracker Passive Tracker/Recorder Passive Tracker/Recorder Computes Location Computes Location Stores Fixes Stores Fixes Later Retrieved Later Retrieved Spy Downloads Spy Downloads Very, Very Cheap Very, Very Cheap Millions Sold Millions Sold

Typical GPS Tracker Drop In and Record Drop In and Record Easy User Interface Easy User Interface

Typical GPS Tracker Active GPS Tracker Active GPS Tracker Cellular Data Link Cellular Data Link AT+CTK CommandsAT+CTK Commands Default PasswordDefault Password “ “ ” Default Unit ID “ ” Spies Rarely Set the Unit ID or Password off of the Factory Default

Typical GPS Tracker 98% Detected with: AT+CTKP=“ ”,””,””,” ” AT+CTKC=10,10,10,3600,0,1,1,1,0,0,0 “Screams Itself to Sleep”“Screams Itself to Sleep” Kills the Battery in Minutes Kills the Battery in Minutes Max Out Spies AccountMax Out Spies Account Easy To Find – just DFEasy To Find – just DF Change PasswordChange Password Seize Control Seize Control Smoke Out the SpySmoke Out the Spy Burn the SpyBurn the Spy

Active GPS Tracker Typical “Classified” Tracker Typical “Classified” Tracker

Active GPS Tracker Detection of “Classified” Tracker Detection of “Classified” Tracker

GPS Tracker Current Draw

Audio Risks Microphones, Microphones, Easy enough to findEasy enough to find Usually on mirror, A-Pillars, Head LinersUsually on mirror, A-Pillars, Head Liners Speakers Speakers All speakers are a issueAll speakers are a issue Follow those wires closelyFollow those wires closely Be Suspicious of “Dead” SpeakersBe Suspicious of “Dead” Speakers Audio Recorders Audio Recorders Often under seats or inside upholsteryOften under seats or inside upholstery Transmitters Transmitters Mind your vehicle beltlinesMind your vehicle beltlines

Vehicle Audio Bug

Truck Telemetry System MHz Sat Uplink

Truck GPS + Telemetry System

Telemetry Primarily for Trucks and Service Veh. Primarily for Trucks and Service Veh. Little Black BoxesLittle Black Boxes PCM Interface PCM Interface Airbag Controllers Airbag Controllers Accident Recorders, Remembers Everything Accident Recorders, Remembers Everything Attorneys and DOT Love These Attorneys and DOT Love These Who Did What, When, and WhyWho Did What, When, and Why May Be Interfaced To:May Be Interfaced To: Tracking System Tracking System Video, or Imaging Video, or Imaging Voice Recording Voice Recording

70-80’s Era Bumper Beeper “Bumper Beeper” Transmitter Direction towards Car Direction Finder Receiver Victims Car Spies Car

Early 90’s Era Bumper Beeper Note the Big Magnets Note the Big Magnets

2004 Era Bumper Beeper Range is Blocks to Miles Range is Blocks to Miles Batteries Last Hours to Weeks Batteries Last Hours to Weeks Does Not Use GPS as All Does Not Use GPS as All Attached with Magnets Attached with Magnets

2005 Typical DHS Tracker 1.6"x1.1"x.85“ (with 9 days of battery life)

2006 Era Bumper Beeper Smaller Then a Quarter Smaller Then a Quarter

LoJack Tracking System MHz Effective radiated power (ERP) of approximately mw.

LoJack Tracking System What It Looks Like What It Looks Like Nothing Special Nothing Special

LoJack Schematic

LoJack Detected

LoJack Period “Covert Burst” Every 16 or 360 Seconds

Other Hazards or Risks Safety Issues Safety Issues Damaged WiresDamaged Wires Battery LoadsBattery Loads Bad BulbsBad Bulbs Security Security Bad Locks or Bypassed AlarmBad Locks or Bypassed Alarm Missing Grease, or Scraped Area under CarMissing Grease, or Scraped Area under Car Observations Observations Leaking Fluids, Bad Things Under SeatsLeaking Fluids, Bad Things Under Seats Missing Jewelry, etcMissing Jewelry, etc

Use The TSCM Professionals Highly Specialized Skills Highly Specialized Skills Laboratory Test Gear Laboratory Test Gear Long, Tedious Tests Long, Tedious Tests Hundreds of Test Forms Hundreds of Test Forms Takes Hours Takes Hours A Full ExamA Full Exam Hours Per Vehicle Hours Per Vehicle Cursory TestingCursory Testing Four Hours Four Hours

TSCM Technical Surveillance Counter Measures Inspection by a technician or engineer of a physical item or place Inspection by a technician or engineer of a physical item or place Highly Technically Trained Highly Technically Trained Vast Equipment Required Vast Equipment Required Specialized Protocols Specialized Protocols Scientific Voice of Reason

Illicit Eavesdropping In the United States over six million dollars worth of surveillance devices are sold each day In the United States over six million dollars worth of surveillance devices are sold each day - This number is very conservative

Lay Person Defenses Against the Dark Arts

Install Vehicle Security System Install Vehicle Security System Consider Removal of On-Star, etc Consider Removal of On-Star, etc Minimize Cell Phone Usage Minimize Cell Phone Usage Minimize Bluetooth Usage Minimize Bluetooth Usage Buy Foil Bag for Speed-Pass Buy Foil Bag for Speed-Pass

Parking Countermeasures Always Lock Vehicles in Attached Garage (with LOCKING doors) Always Lock Vehicles in Attached Garage (with LOCKING doors) Do Not Use Wireless Door Openers Do Not Use Wireless Door Openers Always Park in Well Lit Lot Always Park in Well Lit Lot

Tampering Countermeasures Watch for “Scuffed” Interiors Watch for “Scuffed” Interiors Watch for Missing Screws, and Wires. Watch for Missing Screws, and Wires. Be Wary of Panels being Ajar Be Wary of Panels being Ajar Seats Moved? Seats Moved? Supervise Vehicle While In Shop Supervise Vehicle While In Shop

Bugged Vehicle Counter Measures Use a Flashlight and Gloves Use a Flashlight and Gloves Inspect Every Square cm outside Inspect Every Square cm outside Pay attention to lights and underside Pay attention to lights and underside

Bugged Vehicle Counter Measures Remove EVERYTHING from Car Remove EVERYTHING from Car Remove Boot/Trunk Liners Remove Boot/Trunk Liners Remove Rear Seats Remove Rear Seats Remove Spare Tire Remove Spare Tire Identify all wires and trace Identify all wires and trace

Bugged Vehicle Counter Measures Inspect Upholstery Inspect Upholstery Inspect Consoles Inspect Consoles Inspect Glove Boxes Inspect Glove Boxes Inspect Dash Inspect Dash Inspect Balance of Every Thing Else Inspect Balance of Every Thing Else

Essential Vehicle Data Vehicle Location Plate and VIN # Make and Model Trim Code Engine Size ColorModifications Date Manuf. Service Records, list of all prior work Type of Audio Video Entertainment Equipment SIRIUS/XM? On-Star, or Similar Service Security System Model Lo-Jack or Similar

Vehicle Tasking Protocol Results = Average of 324+ Pages on Any Vehicle for a Full Inspection This Analysis is Usually Manually Intensive, but is always based on what is found in the shop manual for your specific vehicle.

Search Methodology 1. Stand Off RF 2. Exterior Search 3. Trunk/Liner 4. Fast Access to Interior 5. Engine Compartment 6. Electrical Tie Ins 7. Upholstery 8. Dash and Consoles 9. Everything Else 10. Repeat, and Reverse 11. “Shake and Tickle”

Caution We have barely touched on: 1.How a vehicles can be bugged 2.How vehicle bugs are found There are many other methods You Must Pay Close Attention to Detail Think about how YOU can find bugs

TSCM Mantra Always Assume that the Vehicle is Bugged Until You Can Scientifically Prove Otherwise.

Detection Tools Premium Handheld Digital Volt Meter Fluke 289

Detection Tools Premium Handheld Oscilloscope Fluke 199CS FFT Spectrum Analyzer Mode

Detection Tools Spectrum Analyzer

Detection Tools Broadband RF Detector Broadband RF Detector Use these in sets, with filters Use these in sets, with filters

Vehicle Detection Tools Audio Amp with DC Bias Circuit Audio Amp with DC Bias Circuit Look for Hidden Microphones Look for Hidden Microphones

Bug/Wiretap Detection Tools Totally Avoid Spy Shop Toys Totally Avoid Spy Shop Toys Use Only Laboratory Grade Test Equipment and Procedures Use Only Laboratory Grade Test Equipment and Procedures Take All the Time You Need Take All the Time You Need Never Miss the Details, Ever Never Miss the Details, Ever

Cardinal Rule Convenience and Privacy are Inversely Proportional™

Please Keep In Touch

Questions? Thank You ? ? ? ? ? ?