DEF CON 23 - Van Albert and Banks - Looping Surveillance Cameras through Live Editing

[@Dreadlockyx]

"Zach is also a recent MIT graduate with over 0 years of security experience." laughed my ass off

[@JonThomas92]

"Everyone who cheered is a fed" that was the most I laughed at anyone's defcon intro ever.

[@jodelboy]

This is now one of my top Defcon-talks. THANKS!

[@MrKinir]

Yes it was amazing! Thanks guys!

[@sirdouglashowel5thseat776]

very good talk!~

[@jimothyus]

i love the description "Zach is also a recent MIT graduate with over 0 years of security experience" look at all that experience

[@jenn5774]

these guys may not be the best speakers, and while high level this seems pretty self explanatory, these guys went all out and really committed to doing it properly, one of the best talks ive seen. Im happy they explained the lower levels without just showing how "cool" it is like some other talks do.

[@lilliansmith6996]

10:03 His statement about them being invisible to cable analyzers. It depends. The generic $100 ones you'll see many self-employed contractors use wouldn't see a difference. The test kits we lug around on a cart at work get fussy if we untwist the wires before terminating them. So it's likely they'd throw an error of some sort. But most cables are only certified and tested when they are installed, or if the devices they are connected to are having issues. So it's unlikely that a system like this would be discovered unless it caused a significant drop in performance.

[@scotshabalam2432]

That's what I was thinking with oscilloscopes. 50mhz might not spot it but a 1ghz would see the cable moving when they touched it. I agree with the conclusion unless it starts saying "you are being haxed lol, gg" with a cartoon dog dancing around the vault, which by the way I would love to see played out in a movie with a guard trying to figure out what's going on.

[@spacepirateivynova]

I don't think it was mentioned (Or I might have missed it during the talk), but the twisting itself is also extremely important, and untwisting them too much can cause degradation in the signal. You can tell a good network engineer and a wiremonkey using punchdown by how long the leads are before they twist up. It's a good idea to untwist as LITTLE as possible. Also, same thing with those who crimp their own cables, try to untwist as little as possible. It not only works better, it looks professional :)

[@hyperhektor7733]

i learned that up to 1,5cm ( 13/25 of an inch) is the max to go without problems

[@arbyyyyh]

Yeah, they covered that in the talk.

[@johnbrown1381]

Ahhh yes, thanks to common-mode rejection, any interference introduced on one single wire also gets introduced on the other wire in a twisted pair. Then the interference gets canceled out. This only works if they are twisted due to the fact that if the interference is allowed into only one single wire and not the other in the twisted pair, it gets accepted as a valid signal.

[@ultraviper1884]

why does the con logo get more screen space than the actual presenters? wtf

[@hyperhektor7733]

its a scam

[@tissuepaper9962]

Because they can't really change the aspect ratio of the video, so, with the way they arranged the two streams, there is inevitably going to be a bunch of wasted screen real estate, which they decided to use for the logo.

[@agumonkey]

Forget looping, time to play Mission Impossible level video games now

[@over00lordunknown12]

This was an amazing topic to cover, and I think that they covered it very well! However, I do not support bagging on Riley from National Treasure, that was what sparked my interest in technology as a kid.

[@DrTune]

Excellent work, I really like the Python stack for hacking the various protocol layers. Nice!

[@gl_tonight]

with access to two segments far enough apart im sure one could passively resolve individual bits streams from each end of a gigabit ethernet link with reasonable effectiveness

[@ronanderson1023]

*Public Butt *Private Butt *Hybrid Butt *??? *Profit!

[@mikemikson2565]

I never though it's possible to connect to Ethernet without disturbing connection :D

[@DrTune]

It isn't, not Gig-E anyway. You can (passively) tap 100mbit ethernet (see Great Scott's "Throwing Star Lan Tap") but the point of this is to modify the data not just sniff it). What their board is doing is the fancy equivalent of quickly unplugging the a network cable then reconnecting it to a dual-port NIC that is passing/modifying the packets. If you do it quickly it's pretty unlikely that anyone would notice. You're right to some degree - they point out in the Q+A that it's possible to optimize the renegotiation of the intercepting NICs so that there's no obvious up/down transition on the PHYs on network being patched;.

[@davidthacher1397]

Wild card L2 forward ports or force VLAN ports on switch. Granted the switch has to support it but it would do this pretty easily. No POE outage, link log entries, or wire cuts. Isn't software just grand.

[@JBFromOZ]

fantastic demo, love the giggling like a school girl!

[@moth.monster]

What's next, they're gonna get Robert ')DROP TABLE Students;-- to present?

[@Semperverus0]

Little Bobby Tables we call him

[@iDerekMC]

the "cloud to butt" technique is awesome

[@BierBart12]

The Advantages of Public Butt

[@constantincolac1993]

Brilliant guys! Enjoyed the talk.

[@NolePTR]

With MITM on HDMI you should be able to fake HDCP authentication, and forward decrypted steam elsewhere. Could just use multiple cables tho :/

[@TekkGnostic]

Couldn't the signal be passively tapped (relative to the cable) with some opamps and a small battery? I'd think a simple voltage follower/unity-gain amp could feed off the lines and reproduce the signal with nearly zero current loss. (ed: nm I'm guessing that's what's being done with the usb supply.)

[@ElectronicMarine]

hmmm nice ideea, the only problem i could think is the capacitance of the lines... but they took it to the next level with the live editing of the live stream

[@DrTune]

A passive tap isn't very useful is it - the point is to intercept and modify the video, not just copy it.

[@lmaoroflcopter]

Dr Tune I'd consider a passive tap useful. Being able to confirm viewing angles of camera feeds, occupation of rooms and movement of staff, etc.

[@JoeArbiter]

Is there a device that can do this without splicing the wires even if the connection is broken for a few seconds? (ex taking the cat 5e and plugging it into the device while its connected into the system)

[@stocktonjoans]

would be good to somehow connect 8, or at least 4 of the punch connector tools so you can make multiple conections at once

[@nicholasosczypko2248]

These guys are great...don't get me wrong....but, this reminds me of early Beavis and Butthead episodes. "Hey Beavis....yeah?... I totally changed their website to butt...huh..hee hee...ugh huh hee...TP my bunghole!"

[@zwei-p1993]

best opening ever

[@ZeroG84]

hmm. Easy low level safety against this would be a clock on top of that safe that can't be manipulated and would be easy to detect if looped. Cool show still.

[@SonOfNone]

.... or just Gigabit infrastructure as he stated at the beginning... If you have a business which has a safe which is being monitored by camera on a 10[0]baseT network...

[@ebouwman034]

They basically covered that with the timestamp thing. Just merge that part of the stream.

[@wagyourtai1]

the vault looks like it's probably a ch751 anyway :P

[@rkpetry]

[00:00] Introducer does a good 'Trump' imitation before that became popular... [07:39] couldn't you tap in two places and combine differentially for direction... [12:29] "without ever interrupting"-but it is interrupting impedance-matching... gradual-transition might be done with a ferrite clamp and 'smart' terminators...

[@rkpetry]

[30:45] You could try Trojan-joke-ware to make it look like the camera fell off its mount and is dangling-about on its cable-distracting viewers a few seconds....

[@iDerekMC]

23:09 and what about RTMP :D

[@OlafurArons]

Amazing stuff.

[@washboardman7435]

But how do we know they didn't live edit the camera showing the video feed to look like they looped the feed, but didn't?

[@jean-jacqueschirac8733]

Anyone else think of payday ?

[@netraft_4435]

Jean-Jacques Chirac guys the thermal drill, go get it

[@alanstone3125]

almost like beavis and butthead but for entertainment sheer brilliance

[@Bigonewsnetwork808]

You can run it on the new pi lol its 64 bits now .

[@damianhardouin1137]

throw in a gsm sim for a remote connection

[@AgentOffice]

incredible

[@unixfreak]

Awesome

[@amstorm8954]

NSA like ''hold my beer''

[@tokenlectronix5223]

HAK5 now has man in the middle for hdmi

[@LemonChieff]

this is epic

[@Add12this]

Guy asking question: "...ninth degree." ...you mean n'th degree?? lol.

[@DerUnbekannte]

a ninth degree of most things is also a lot

[@famousamoso7]

Freudian slip

[@davemann6030]

Most security guards don't give a shit what happens you won't even need that. Most of the videos are very small and they don't even look at them it is just when something happens they have to spend a lot of time rerunning the video to see what happened by that time they bad guys are long gone.

[@Crucizer]

Someone: What Do You Do? Me: I Do Shit.

[@verymuchgoodgaming132]

cool shit ;)

[@chickenlivers]

The only other evidence is the punched/spliced wires :)

[@eleftherios11]

which won't have to be inspected if nothing breaks up

[@SomeGuyFromCrowd]

Solution: Lots of thermite

[@lmaoroflcopter]

Steven Haussmann go the route of "badboys 2" and when you're out the building, blow up the tap device.

[@redd_cat]

I think the wires are the least of a banks problem if this were to happen to them.

[@hackbitchhackingbaarbi3426]

good

[@jasonportnoy7866]

love this shit

[@DoRC]

Cool concept.... But man that delivery....

[@timothyferrell245]

@22:00 I was laughing along.

[@3rdgig]

10/10 good shit

[@sadface]

cool shit

[@paul123701]

Guys has anyone seen bain, I have an idea to tell him

[@mariarahelvarnhagen2729]

Cool Down Down Date & Time For A Minute

[@opiniondiscarded6650]

I'd tap that

[@DaltonR121]

2 people got caught trying to rob a bank without this method.

[@SouravBasuRoy]

this dude talks exactly like Jesse Eisenberg did you notice?

[@noobvisual1588]

Vigil players when they use erc-7

[@izafas]

kid in black laughs like a dweeb

[@over00lordunknown12]

I haven't seen anyone use that insult in a long time... But it is true. x)

[@PeterVanHertum]

it's called a nerdgasm

[@alexoja2918]

Cute girl though

[@XDRosenheim]

_inhales_ heee

[@HylianOverlord]

'tism laughing.

[@claudiahampton9946]

If Anyone is looking to buy one of these tap boards "PCB Board Only" I've purchased 20 of them to get into programming. Just be aware that the project can get quite pricey. The Boards are cheap to produce, but some of the components to complete a working board can cost around 190 bucks all together. I'm selling the boards for 15 bucks each with shipping included. I bought them in bulk before I knew how much all the components to complete the board cost. If you'd like a picture of the boards I have just shoot me a message.

[@claudiahampton9946]

if you download REV 3 from their Github. From there you should see the DOM. That is a list of all the components. All you have to do is import the DOM into digikey. All the components cost around 212 USD.

[@pierrekircher4383]

github.com/ervanalb/lens/blob/master/hardware/release/bom.txt its all in there , the expensive part are the relays all other parts are cheap

[@randall3981]

Claudia Hampton do you have any additional boards available for purchase?

[@Mastermodr94]

Do you have any pcbs? I would be willing to buy one or two off you and pay for shipping.

[@GhostsPlace]

Can't you use cheaper relays?

[@Cray2TheZ]

A brilliant presentation despite the ANNOYING PERSON GIGGLING IN HIS MIC. Amazing work anyway !

[@radekwysocki7875]

BEEF!!

[@jonascurry9996]

thats alot of shit lol haha

[@ApexPredatorChrisHansen]

intro from king cringe

[@AholicKnight]

he said a lot of cool shit

[@fredhauser7357]

anyone here that girly mouse laugh lol!!!

[@Rising_Pho3nix_23]

The easier solution is not to tap the ethernet traffic, but the video feed. Duplicate what goes into the glass lenses, and then feed that into the circuit directly. That's the same as the "low tech" that they said was "too easy"...Gotta love it when people pride themselves in making things harder and more risky than required.

[@Mostlyharmless1985]

brandon day the video feed IS the Ethernet traffic.

[@over00lordunknown12]

Am I the only one that gets annoyed by people with speech patterns like the guy in orange?

[@maxmanwar]

They've DEFINATELY never seen any decent cable diag machine. I've practiced with one this year in school and a tiny 1500€ monster knows every fucking twist in the cable in 30 km radius. They're monsters to detect any change in the cable. The Rtp&video part was boring af.

[@yepee1]

Incredible