HAKC THE POLICE
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Swearingen, Bill
PULL OVER! No, it is a cardigan, but thanks for noticing! After getting a nasty speeding ticket, OG SecKC HA/KC/ER hevnsnt decided enough was enough, and set out to fully understand police speed measurement devices, and develop homebrew countermeasures that are legal in some states (and some that are not). Come learn how police RF (X, K, KA) and Laser speed detection systems work and how to implement your own homebrew jamming countermeasures on the cheap, essentially making your vehicle invisible to law enforcement. HOP IN and BUCKLE UP, this talk is going to FUEL your hardware hacking desires! You better be able to think fast to keep up with this talk and prepare to get home in record time. Bill Swearingen Bill Swearingen (hevnsnt) has been in the hacking scene for decades, which is odd because his twitter profile says he is only 23 years old. Having spent his life dedicated to understanding how how things work, he is has focused this curiosity and knowledge to take advantage of our world in any way possible. His interests have always been focused on hardware hacking and loves releasing easy to replicate projects using cheap computing platforms such as Arduino and RaspberryPi.
 Our next speaker is Bill Swaringen. Bill Swaringen is a hacker from Kansas City. Bill has been coming to DEF CON for a long time. He is a veteran of the Alexis Park. Yeah, all these new people. But just because he's been coming here, he hasn't ever spoken before. But believe it or not, a lot of you may have felt the influence of Bill Swaringen before. For example, if you drive past a construction information sign and you think every single time that should say, zombie's ahead, and I know how to do that, that's this guy. If you live in a non-major metropolitan area and you have a hacker space or have been to a hacker space, that is in part this guy. He helped co-found the Cowtown Computer Congress in Kansas City a few years ago. What else? If you have come to a little thing that we call SecKC, which is the world's largest and the greatest monthly Infosec meetup, that's this guy. But probably the largest reach that this man has had. How many people in here are either still drunk or hung over off of booze that somebody else paid for? These are my friends. This guy is the better looking part of Defconn parties. Defconn parties! So this is Bill's first time. This is a banger of a talk. I've seen this thing before. You guys are in for a real treat. Give my friend and yours Bill Swearingen a big welcome to Defconn. That was a good fucking time, man. Hello. Yeah, so, Juris, thanks for that great introduction. But you actually mentioned some of the things I want to talk about. So this is my 15th year at Defconn in a row. And last year I decided it's time for me to start giving back. And so those of you that have attended and those kind of things, I would say that you do the same. Start giving back to this community. Okay, so who's ready to hack some cops? Okay, so I'm going to tell you that right away this talk is illegal. Okay, and it's illegal in all 50 states. And so I am a little nervous being in front of you all. And it's not a little bit, not about speaking in front of you. It's not really about the legality of the talk. It's really that I run with the SecKC crew and they're pretty wild. And I see a lot of them right up front here and I'm a little bit nervous of what they're going to do. And so as I'm thinking about it, right. So this morning when I was saying, okay, how's this going to go? I realized that there's probably going to be a few times in this talk where people yell, Bill, you suck. Right. And so about 50% of those times I expect those might actually be my friends. So just take that as it is. I don't think that guy was my friend. Okay, but I am serious. So some of the things we're going to talk about today that if used are a federal offense. Okay. And so what I'm here to do is just kind of talk about it and explore it and explain how they work. Right. So I'm going to try and do a good job and explain what is a good idea to do and what is a bad idea to do. But I'm going to leave that up to you for your own interpretation. Okay. And also I do realize that the talk that I'm about to give is very US centric. And so when we talk about the technologies that are used and the laws that we will break, you know, they're US. But so for those of you that traveled a long way to get here to attend DEF CON. I think that the technologies will translate pretty well, but do a lot of your own research about your own laws and go from there. Okay. So given the topic and the nature of this topic, I'm not exactly sure if I will or will not get arrested during this talk. And so I have consulted with my attorney and everything like that. But I figure just in case it would probably be good to go ahead and post the slides up right now. So there they are. And I wanted to give a shout out to Seth Casey. Let's hear it one more time. Seth Casey. All right. Next, if anybody has any questions after the talk or whatever, please see if I am in jail. And if I am, bail me out and I'll be happy to answer any of those questions. So Benson already kind of talked about, I've been in the space before. So about 10 years ago, I owned a website called IHACT. And one of the things that I released was a device that would trigger the emergency preemptive devices that would turn street lights green. And it was awesome. It was really cool. We'd be driving around just like it was green lights all the way and you can go as fast as you want. And I got a lot of attention about it. I got interviewed by a lot of different media. Wired was one of them. And I thought that was pretty cool. So I've grown since then. That was 10 years ago. And I've learned a few things. You really probably should consider talking to the media about committing federal offenses. That was not, that didn't actually work out very good for me. And also it was really interesting the quotes that came out of that. So I was giving a very technical interview to Wired in talking about 555 timers and the way that we can interact with the preemptive devices. And my quote that I got was that I'd take the highway to work. Right? All right. But more importantly, don't talk publicly about committing felonies. So it turns out that it is a felony to sell, buy, or use, a MIRT, so the preemptive device, punishable by up to two years in prison with a maximum fine of 10K. Or both. So, well, I'm out of jail. Finds her page. Let's do this again. All right. So here's the thing. I am a hacker. I've always been a hacker. I'll always be a hacker. And when I think about what that means to me and why and how I ended up this way, I really do think it really kind of goes back to my dad. Right? So my dad was an engineer. I mean, he spent the time with me as I was growing up to question and try to understand and explain the way that things work in our world. Right? And just question how it works. So I've spent my life, you know, very curious, trying to understand how do things work and why. Right? And how can I make sure that I am in a position that I can influence those devices to make my life better? Right? So I want to take advantage of my world in any way possible. And I think that as hackers, this is our game that we can win. So before I get started, I do want to read an excerpt from the hacker manifestor real quick. And it says, and it just clicked off, but it says, I'll paraphrase here, but yes, I am a hacker and my crime is that of curiosity. I do not judge people by how they look, but what they do and what they know. Right? And so I think that really is a good ethos as hackers to have. And I hope that our community stays strong that way. Okay, please, if there are any local or federal law enforcement in the audience, please raise your hand. And I understand that that might not be, you probably don't want to do that, but it's for a reason. So first, I'm going to be using some audience participation and you do not want to be selected as that audience member. So any local federal law enforcement, please raise your hand. Okay, I got a couple. How about any undercover? Okay, you're right. Yeah, so I can't believe that worked, but I do believe that I just won spot the Fed right there. Okay. But really, really why I want to do that is I don't want to live in a society without laws. I really do respect what you do, your mission, and that's not the point of this talk, right? And so I don't want you to feel like targeted or, you know, or anything like that in this talk. It's really about the technology and understanding and being very curious about how that works. Okay. And I will tell you specifically for those that are in law enforcement, there's going to be a couple slides in here where you get a little nervous and it's okay. Like just trust me. We'll get through it together, you know, and everything's okay. So what we're talking about, it just gets right up to that spot and then I stop. So trust me on that. Okay. All right. So story time. I've always also been a speed junkie. I mean, if you take a look at some of the things that we've done, you know, when preemptive traffic lights, those kind of things, just always kind of been a speed junkie. Fast cars, motorcycles, et cetera. I love them, right? But what I don't enjoy is all the speeding tickets to go along with it. And so a few months ago, I'm sitting on the side of the road with some blinking lights in my mirror. And I started thinking, like, what is radar? Like how does this work? How can I outsmart this? How can I take advantage of my position to make sure that I'm going to win this game? And an interesting thing is, as I'm sitting there, I thought about a story my dad told me one time, and this goes back when I was very little. He told me that he had some friends that were taking apart microwaves and using the magnetron in the microwaves to jam radar. And you know, as a kid, I didn't really understood what that meant. I didn't understand how that worked. I didn't really understand. But for some reason, that stuck with me, right? So that little, that story that my dad told me, it stuck with me. And so as I'm sitting there, I decided, well, I should probably figure that out. OK. So it turns out that radar works just by measuring the Doppler shift of sound waves. So we've all seen that before. We've heard that sound. And probably everybody here has a very basic understanding of how radar works. We know that a signal is sent, is reflected, and it comes back to the sending device, and it measures our speed. And what's really interesting is when you start looking at how, like how does this work? It's actually very basic. So when you take a look at the Doppler shift and the way that we measure that, what we can see is that police use high-frequency radio waves, and they're actually microwaves, actually, to bounce off objects. And then they measure the shift using this equation in the return frequency to measure the speed. Now, what's really important, and I'll keep calling this out during this talk, but this is a very important point here, radar measures speed. So what does radar measure? Come on, tell me. Speed. OK, that's very important, and you'll understand here in a little bit. And here you can see the equation, but basically you can read that they measure the change in frequency over the scent frequency, and it equals two times the velocity of the target over the sea with constant of time. And now that I do understand that now that I've shown the math, we can kind of all go home, right? Because everybody understands what we're going to do. I get that. OK. But OK, so let's shift gears a little bit. And before we start hacking, let's look at how police use radar. And I do want to say I apologize for the quality of this image here, the video here, but 100% of the police pulled would not let me film them radaring people. And they started asking a lot of questions, and so I left. I found this one on YouTube. OK. But one of the really neat things about RF radar is that the officer could kind of just set it and forget it. Just look at the video. It's just sitting there. It's radaring the cars as they go by, and the officer doesn't have to do much. Also, what's incredibly neat about RF-based radar is they can drive while they're doing it. We've all been radared by police passing by those kind of things. And what's neat is the way that these radios work is they're transmitting this frequency, and they're receiving signals back from multiple objects, right? The device can determine its current speed by the reflections that are coming back from stationary objects, like trees or signs or other station buildings, other stationary objects, and then calculate the speed of the moving objects based off of that. Some of the more advanced radar systems that police can use can even track multiple targets and even show which lane of traffic that they're in. I just think that's really cool. I think that that's very interesting the way that this technology works. And as we really start to dig in and understand what is happening with our radar, this light is also very important. So a very tiny fraction of the signal scent is actually reflected back to the police radar system, right? The rest of the RF signal continues to go on, bouncing off of trees, scattering off the car. But it continues to go. And that's really all I'm trying to show in this slide is that it's just a little tiny fraction of what is sent that's returned back. OK. So. Expand. Oh, I forgot about that one. Sorry, I didn't get it right. So police radar, it really comes in three major forms. And you guys all probably know this, right? But this slide, if I were to take a picture of a slide, it would be this one. And you'll understand why. But Expand was kind of the de facto back in the day, right? So it's kind of like the older radar systems that really aren't used much in today's. Next is K-Band. And believe it or not, K-Band is used worldwide. But it is the most commonly used radar in the United States. And so if you were to take a poll, K-Band still remains the default radar system. It's also classified as the grocery store band, because it's the same frequency that grocery stores use. And so if any of you guys have radar detectors and seen false alerts, it was likely K. K-A is the new multimode version of K. It's the emerging system, and it's definitely in use around. Now, there's also the KU-Band. Do I have any KU? Any people from KU? All right, so KU-Band exists, but no one's ever paid a ticket for that. So, right? Yeah. Actually, KU-Band is the European K.A. So for anybody in Europe, I have the frequencies there. OK, so does everybody at least have a basic understanding of what radar is? OK, does anybody remember what does radar measure? OK, thank you. That's very important. I really only wanted to make sure that that point was driven home. OK, so it's time for a live demo. What should we not do at DEFCON live demos, but we're going to give it a shot? OK, so I do want to take a volunteer up on the audience. And as I was looking across, one person's gotten a sticking out. I have, sir, would you please join me on stage? Oh, my god. That's the other half of DEFCON parties right there. OK, so what we're going to do, the demo that we're going to show is that I'm going to give our Mr. Police Officer here a radar gun. I am going to walk towards him, and I am going to return the same frequency that he is sending to me, which should indicate that I am standing still. OK, then I am going to slightly adjust the frequency sending, and I will stand still, and I will indicate that I'm moving. And I realize that I don't have any good way of demonstrating this to prove to you that this is happening. So you're just going to have to trust me that this wasn't all lies, OK? Good there. So what you're going to do is just head over there and point it at me and hold down the radar gun. OK, so I have two different versions of radar guns here. One just commonly off the shelf radar system and a Hot Wheels one. But it turns out the Hot Wheels one was a little bit easier to modify for my needs. Oh, and if there are any people from the FCC here, I want to tell you that it's all good. I stayed within the legal limits. OK. OK, so the first demo is going to be you holding down the button, radaring me. I'm going to return the same frequency to you. And hopefully, if all goes well, you will not get a reading. Here we go. OK, you ready? We believe you. OK. Now on the second demo, what I'm going to do is I'm going to slightly adjust the frequency of this gun. And what I'm doing is now using the Doppler shift, because I know the exact frequency that that gun transmit, I am going to return a signal that says I'm going a certain speed. So don't wait on me yet. So 111 miles an hour. Yeah, sorry. But all right, you want to do one of those? All right, it is 5 o'clock somewhere, right? OK. This is where it gets good. Oh, man, that was good. OK. So can we do the same thing to police radar? Yep. We could build a device that says and transmits that we are always going 65 miles an hour. Since we know the vehicle speed that we want to go, we just have to solve the equation for two other variables, right? And that would be the frequency that's sending to us. And well, I guess that's it. I only have to solve for one. And the change of frequency from there, but using the math. And so it turns out that if I needed to defeat X-band radar and say that I'm going 65 miles an hour, all I have to do is transmit at 10.5 gigahertz. I don't have to do any kind of a special encoding. There's no packets. It is truly just a microwave signal at 10.5 gigahertz. If I would like to do the same to K-band radar, which, once again, is the most commonly used radar in the world and the US, all I have to do is transmit at 24.12 gigahertz. And that will return that I'm going 65 miles an hour. If I would like to, so KA is a little bit different. It's a multi-mode transmission. But believe me, if you were to transmit at 33.8, you're going to get away. And as I was doing the math here, I started to think, OK, remember my dad? You remember the story about the microwave? Did that work? And it turns out it did. If we would have had our microwave oven transmitting back in the day when they were using X-band radar, the cops would have seen that I was going negative 97 million miles an hour. OK. Raise your hand if you know where this is going. Yeah, all right. Well, here we go. So the interesting thing, though, is, so let's take that 65 mile an hour example. We have a little bit of a problem with that, right? So if I was always transmitting 65 miles an hour, or if I was always transmitting at a certain frequency, I've already shown you that some of those frequencies, they're ranges, right, and the calculation matters. But really, the biggest problem is, is if I was always going 65 miles an hour, what happens when I go through a school zone, right? And we don't actually know what frequency the police radar is sending. Well, friends, I gotta tell you, we live in interesting times. So we live in the future, right? The world's information is at our hands right now, right? And we can do with it as we please. And the newer radar detectors, specifically the Valentine 1 and the Escort 360, detect the radar signals about two to three miles ahead and via Bluetooth can share exactly which frequency we're being radared with. Do you understand? OK. So real quick, I do want to give a shout out to TriWolf. Thank you so much for where you are. There she is for finding. She was able to find me a very consistent location to run some tests, would be a good way. Testing, yeah. Perfectly legal, official business. OK. Oop. I went one, two, four. OK. So all we need to do is we would just need to build an app that knew exactly what the current speed was, the current speed limit, using the Rhodes API, a way to detect what frequency that we're going to be radared in about two miles. The current generation of radar detectors do this, and then calculate the frequency of the speed that we wish to go based upon the current speed limit and transmit, right? All we need a very, very small processor to do this. Up here, I'm showing an ESP8266. We don't need much to do that. One of the issues is that currently, that the commonly available SDRs, or software-defined radios that are available to us, currently aren't working in that high frequency or microwave space, right? So they're actually much lower on the spectrum. But if you take a look at the hardware that it would take, and just even the way that SDR is progressing, we could build this device very, very trivially for about $700 right now. And most of that cost would be around the SDR, right? And the high frequency transmission. But the FCC is not going to want you to do that. So the FCC is very strict about radar jamming. And they've actually been illegal since 1996. And that means that anyone that uses or sells the devices, it could be a federal offense, right? And they are serious about it. And not only that, they're so serious that you're not even able to, like, they are so concerned about radar jamming, that you're not even able to advertise. So it's actually against the law to advertise radar jammers, not even just use or sell. And so right now, when you take a look at it, $700 device, it's really not that cost effective anyway. Yeah, I mean, it'll get there. And knowing the way that we can do this, and when those devices become available, that's when you can make a good decision. So the FCC won't let us speed, or let me be me. So let's see. What other effective countermeasures are available to us? And they're the common things. They're the common things. But if you have not used the current generation radar detectors, they're tremendous. So earlier, I showed you how the radio frequency continues to scatter, right? It continues to go, and it continues to bounce around. And the current generation of radar detectors are picking that up very good, about two miles, and weighs is really good. But the problem with radar detectors, the problem is that they suck when it comes to detecting laser, right? So you've probably heard that radar detectors today, when you get hit with a laser, all you're going to do is that just tells you that you're going to get a ticket, right? And most people probably feel like the cops are using laser anyway. Well, we'll slow down trigger, because we've got some neat things to talk about. So the FCC doesn't even regulate the light spectrum. That's done by the FDA. So let's hear it for light. Come on, light. And it also turns out that these laser guns, they're very different than their RF cousins. They use an eye finder to single out a specific target. And if you take a look at the picture I have here, you'll notice that there's two lenses, one that's the transmit. That's the smaller lens, and then one to receive. That's the larger. And that'll be important here in a second. And what's really interesting and what I love about laser is the officer has to treat it like a weapon. They have to be stable. They have to point. They have to single out a target. And they have to find a reflective surface on your car to get a signal back, OK? So generally speaking, what they're after is they're looking for your headlights or your license plate or those sweet, sweet, fancy, blingy grills, right? And here's what an officer sees when they're targeting your car. What you can see in this video is you see an officer trying to get a lock on a car. And then the second one, it's a little bit harder to see when they do, OK? But because laser is regulated by the FDA, lasers have to be a class one laser. That is the same class as a laser pointer. Laser guns are laser pointers, OK? They have to be eye safe, which means that pretty much the amount of reflected laser that's coming back to the police officer is very, very little. OK. Also, because it's regulated by the FDA, they are restricted to the actual frequency of laser that they can use. They have to use an eye safe laser, and they have standardized on 904 nanometers. This is an invisible laser beam. But what's great about this is it's standard. There's one. And it's very weak. And we can buy them too. OK. Now, another thing, what does radar measure? Well, laser does not measure speed. Laser measures distance. OK. Super important slide here. I'm going to give you guys time to write the equation down. Like, if we have any math majors, you can kind of tell people, explain how this works. But speed is a result of distance over time. I saw somebody take a picture of that slide. OK. Now, the issue is that laser guns, when they do measure distance, they're doing it at a rate that's very aggressive, usually around 100 to 200 measurements per second. And so that really kind of goes back to, by the chimera radar detector has gone off, the laser gun has already acquired your speed, and in fact, many times over. And that's the calculation that the gun is using for distance. But here's where it gets interesting. OK. Here we go. All right. It turns out that in about 2 thirds of our country, represented by the green states that are super cool, laser jamming is perfectly legal. The yellow states are not as cool. And I just literally don't know what the fuck is going on in Virginia. So we have a couple options. This is the one that I'm going to go with. It's not really effective, but it's hilarious, and it makes it very hard for the police officer to get a lock in my car. OK. Or, or, or we can attack the gun. Let's attack the gun. All right. Here we go. So first, we have to know exactly how these laser guns work. And before we get started, I'm going to show you an example of timings. OK. So the timings that we're going to talk about here will not be for every gun, but the frequency that we're using is. And what I want you to understand is that once you understand how they work, you will understand how to attack every single one. It only comes down to a matter of timings. OK. So the things that are really important here are the pulse width, how long the laser is on, and the period cycle, which is how often it shoots. So in this demonstration, I show a pulse width, 1, 2, 3, 4, 5, pulse, pulse, pulse, pulse, pulse. Those are pulse width, right? And the period cycle of a five millisecond period cycle. OK. You'll understand here in a second. OK. But this part gets really important. OK. So when the gun sends a series of pulses, what it's expecting is a return. OK. And that return measures what? Does anybody remember? Booze. Distance. Distance. The pulse measures distance. OK. So when your car gets hit by the first pulse, does that officer have a lock on your speed? No. No. They only know how far away that car is. It's not until the second, third, right? Until they can start, that gun can start getting a lock on your speed. And so that's why they measure so many times, and in one second, 100 to 200 to get your speed. OK. So let's go ahead and zoom into this pulse period, and let's talk about some countermeasures. All right. So these red lines indicate pulses from the gun, pulse. Pulse. Pulse. OK, everybody good? All right. And it expects to get a return. Pulse, return. OK. But we have a five millisecond window that we can return our own. OK. And what does laser measure? Distance. OK. So it does not measure speed. Right. So if we were to return a pulse before the reflected one, we can tell them how far away we are. All right. So what I'm going to show you is a brute forcing method. So just imagine driving around knowing exactly which frequency you're going to be lasered with. It's always the same 904, right? And every one millisecond, putting a pulse. OK. So what, now the interesting thing is in your brain, I know where you're going because I went the same way as, well, if I turn an immediate response, am I telling the cop that I'm going 97 million miles an hour? No. No. What I'm telling them is that I'm very close. Right? I'm 100 feet away. But then they get another one. He's 100 feet away. Then they get another one. He's 100 feet away. I'm going zero. Right? Yeah. And so most of the guns, believe it or not, so there's probably, I don't know, nine or 10 different models of laser guns on the market. This method comes back with an error message. Just a simple brute force, one millisecond pulse will return an error message to the gun. Now there are a few models that have implemented countermeasures to countermeasures. And we'll talk about that here in a second. So commercial, so some of the newer guns, what they will do is they will recognize, I sent one pulse out and I got four back. So that's not right. So they'll actually laser shift. They'll shift their pulse width to account for that, to find an empty spot in the return signal. But we can counter those too. So once we understand how the gun laser shifts, what is expected result, we can shift our response to that just as easily. Now what's interesting is because of the pulse width and the timing, we can identify the gun by the second pulse. So when we get once and then we measure how long to, so then we move immediately into brute force mode, right? Then we receive another one. Now we can identify exactly which gun we're being targeted with and we can implement countermeasures from there. And so I'll go through those here real quickly. So what you're seeing here on the screen, the red lines indicate a pulse from the laser gun. The orange indicates our reflection. And the green is what we're returning to the gun. So what we can do is we can vary our own returns. So imagine if we understood that we have a five millisecond window to return, that the first time we return a very early signal. We're at 600 feet away. And then on that second pulse, we've identified who the gun is. We know exactly which gun we're being targeted with. And we can move into countermeasures of that. But we then say that we're further away, perhaps 1,000 feet away. Now to that gun, we're going in reverse, right? And then we can continue on with strategies like that that continue to even bypass even the most laser guns. And commercial laser jammers are already doing this. There is a couple different commercial products that you can purchase that are already implementing these countermeasures. And so I just want to let you know that those are available. OK, so a few years ago, I released a tool called Cotch. It's an ESP-based Wi-Fi hacking tool. And basically what I've done is like, OK, let's build on that platform. Let's continue to stay with the ESP-8266. It's a build platform that I'm very comfortable with. It uses the Arduino and the Arduino platform. And we can build off of that. Well, so what I'm going to release here is Natchikacha. And so what Natchikacha is, is an ESP-8266-based laser jammer. It's based on 12-volt circuitry for easy automotive installation. And it uses on the same 940 brute force mode, meaning that it's pulsing at a 1 millisecond pulse rate. That will bypass 80% of the laser jammers that are in use right now. It will not jam the more advanced dragon eye systems that implement countermeasures to brute force mode. However, we're doing this open source. And so because commercial jammers exist, it shouldn't be too difficult for us to reverse engineer the pulse cycles that those more. Actually, I don't know if that's illegal or not. Let's not do that. Let's build around. So wireless connectivity, Android app. It's legal in some states. Remember those green states? Oh, I forgot to mention. I don't know if you saw that. But on that map where laser jamming was legal, Colorado wasn't on there. And I'm like, come on, Colorado. I thought you were cool. Like, I just can't. I don't know. It also can emulate laser guns. So you can test your own. You can test it. You can test your radar detectors, et cetera. Yeah, and it turns out Mert mode would work OK, too, which would be green lights. But that's a super bad idea. And probably shouldn't do that. OK, well, so I'm just going to tell you, like, not to conscious freedom. And this is how we can take control of any systems that are targeting us. We, hey, audio guy is going to get louder in a second. Just FYI. And I just want to say go America, except for Virginia, because I don't know what's going on there. So real quick, this is kind of what it looks like. Bill of material is super simple. We're looking at an ESP 8266 and an LED array, essentially, and a 12-volt circuit. Cost is $8. So code's available now. It's kind of janky. But that's how it goes, Defcon. And I actually meant to bring one. I have one here, but I broke it yesterday when we were prepping for the talk. I know, Bill, I know. So seriously, so it is being released open source. The brute force mode works. Because I tested it. I live in Kansas, legal there. And so really, there's only around one. I'll continue to post code. And I would really hope or would appreciate if anybody would like to help me build a fully open source laser jammer that competes with the commercial grade equipment. So with that, guys, thank you very much. I had a great time. Really appreciate it.
 Our next speaker is Bill Swaringen.  Bill Swaringen is a hacker from Kansas City.  Bill has been coming to DEF CON for a long time.  He is a veteran of the Alexis Park.  Yeah, all these new people.  But just because he's been coming here,  he hasn't ever spoken before.  But believe it or not, a lot of you may have felt the influence  of Bill Swaringen before.  For example, if you drive past a construction information sign  and you think every single time that should say,  zombie's ahead, and I know how to do that, that's this guy.  If you live in a non-major metropolitan area  and you have a hacker space or have been to a hacker space,  that is in part this guy.  He helped co-found the Cowtown Computer Congress  in Kansas City a few years ago.  What else?  If you have come to a little thing that we call SecKC,  which is the world's largest and the greatest monthly  Infosec meetup, that's this guy.  But probably the largest reach that this man has had.  How many people in here are either still drunk or hung over  off of booze that somebody else paid for?  These are my friends.  This guy is the better looking part of Defconn parties.  Defconn parties!  So this is Bill's first time.  This is a banger of a talk.  I've seen this thing before.  You guys are in for a real treat.  Give my friend and yours Bill Swearingen a big welcome  to Defconn.  That was a good fucking time, man.  Hello.  Yeah, so, Juris, thanks for that great introduction.  But you actually mentioned some of the things  I want to talk about.  So this is my 15th year at Defconn in a row.  And last year I decided it's time for me to start giving back.  And so those of you that have attended and those kind of  things, I would say that you do the same.  Start giving back to this community.  Okay, so who's ready to hack some cops?  Okay, so I'm going to tell you that right away this talk is  illegal.  Okay, and it's illegal in all 50 states.  And so I am a little nervous being in front of you all.  And it's not a little bit, not about speaking in front of you.  It's not really about the legality of the talk.  It's really that I run with the SecKC crew and they're pretty  wild.  And I see a lot of them right up front here and I'm a little bit  nervous of what they're going to do.  And so as I'm thinking about it, right.  So this morning when I was saying, okay, how's this going to go?  I realized that there's probably going to be a few times in this  talk where people yell, Bill, you suck.  Right.  And so about 50% of those times I expect those might actually be  my friends.  So just take that as it is.  I don't think that guy was my friend.  Okay, but I am serious.  So some of the things we're going to talk about today that if  used are a federal offense.  Okay.  And so what I'm here to do is just kind of talk about it and  explore it and explain how they work.  Right.  So I'm going to try and do a good job and explain what is a good  idea to do and what is a bad idea to do.  But I'm going to leave that up to you for your own interpretation.  Okay.  And also I do realize that the talk that I'm about to give is very  US centric.  And so when we talk about the technologies that are used and the  laws that we will break, you know, they're US.  But so for those of you that traveled a long way to get here to  attend DEF CON.  I think that the technologies will translate pretty well, but  do a lot of your own research about your own laws and go from  there.  Okay.  So given the topic and the nature of this topic, I'm not  exactly sure if I will or will not get arrested during this  talk.  And so I have consulted with my attorney and everything like  that.  But I figure just in case it would probably be good to go  ahead and post the slides up right now.  So there they are.  And I wanted to give a shout out to Seth Casey.  Let's hear it one more time.  Seth Casey.  All right.  Next, if anybody has any questions after the talk or whatever,  please see if I am in jail.  And if I am, bail me out and I'll be happy to answer any of those  questions.  So Benson already kind of talked about, I've been in the space  before.  So about 10 years ago, I owned a website called IHACT.  And one of the things that I released was a device that would  trigger the emergency preemptive devices that would turn street  lights green.  And it was awesome.  It was really cool.  We'd be driving around just like it was green lights all the  way and you can go as fast as you want.  And I got a lot of attention about it.  I got interviewed by a lot of different media.  Wired was one of them.  And I thought that was pretty cool.  So I've grown since then.  That was 10 years ago.  And I've learned a few things.  You really probably should consider talking to the media  about committing federal offenses.  That was not, that didn't actually work out very good for  me.  And also it was really interesting the quotes that came out of  that.  So I was giving a very technical interview to Wired in talking  about 555 timers and the way that we can interact with the  preemptive devices.  And my quote that I got was that I'd take the highway to work.  Right?  All right.  But more importantly, don't talk publicly about committing  felonies.  So it turns out that it is a felony to sell, buy, or use,  a MIRT, so the preemptive device, punishable by up to two  years in prison with a maximum fine of 10K.  Or both.  So, well, I'm out of jail.  Finds her page.  Let's do this again.  All right.  So here's the thing.  I am a hacker.  I've always been a hacker.  I'll always be a hacker.  And when I think about what that means to me and why and how I  ended up this way, I really do think it really kind of goes  back to my dad.  Right?  So my dad was an engineer.  I mean, he spent the time with me as I was growing up to  question and try to understand and explain the way that things  work in our world.  Right?  And just question how it works.  So I've spent my life, you know, very curious, trying to  understand how do things work and why.  Right?  And how can I make sure that I am in a position that I can  influence those devices to make my life better?  Right?  So I want to take advantage of my world in any way possible.  And I think that as hackers, this is our game that we can  win.  So before I get started, I do want to read an excerpt from the  hacker manifestor real quick.  And it says, and it just clicked off, but it says, I'll paraphrase  here, but yes, I am a hacker and my crime is that of curiosity.  I do not judge people by how they look, but what they do and  what they know.  Right?  And so I think that really is a good ethos as hackers to have.  And I hope that our community stays strong that way.  Okay, please, if there are any local or federal law enforcement  in the audience, please raise your hand.  And I understand that that might not be, you probably don't  want to do that, but it's for a reason.  So first, I'm going to be using some audience participation and  you do not want to be selected as that audience member.  So any local federal law enforcement, please raise your  hand.  Okay, I got a couple.  How about any undercover?  Okay, you're right.  Yeah, so I can't believe that worked, but I do believe that I  just won spot the Fed right there.  Okay.  But really, really why I want to do that is I don't want to  live in a society without laws.  I really do respect what you do, your mission, and that's not  the point of this talk, right?  And so I don't want you to feel like targeted or, you know,  or anything like that in this talk.  It's really about the technology and understanding and being  very curious about how that works.  Okay.  And I will tell you specifically for those that are in law  enforcement, there's going to be a couple slides in here where  you get a little nervous and it's okay.  Like just trust me.  We'll get through it together, you know, and everything's okay.  So what we're talking about, it just gets right up to that  spot and then I stop.  So trust me on that.  Okay.  All right.  So story time.  I've always also been a speed junkie.  I mean, if you take a look at some of the things that we've  done, you know, when preemptive traffic lights, those kind of  things, just always kind of been a speed junkie.  Fast cars, motorcycles, et cetera.  I love them, right?  But what I don't enjoy is all the speeding tickets to go along  with it.  And so a few months ago, I'm sitting on the side of the road  with some blinking lights in my mirror.  And I started thinking, like, what is radar?  Like how does this work?  How can I outsmart this?  How can I take advantage of my position to make sure that I'm  going to win this game?  And an interesting thing is, as I'm sitting there, I thought  about a story my dad told me one time, and this goes back when  I was very little.  He told me that he had some friends that were taking apart  microwaves and using the magnetron in the microwaves to  jam radar.  And you know, as a kid, I didn't really  understood what that meant.  I didn't understand how that worked.  I didn't really understand.  But for some reason, that stuck with me, right?  So that little, that story that my dad told me, it stuck  with me.  And so as I'm sitting there, I decided, well, I should  probably figure that out.  OK.  So it turns out that radar works just by measuring the  Doppler shift of sound waves.  So we've all seen that before.  We've heard that sound.  And probably everybody here has a very basic understanding of  how radar works.  We know that a signal is sent, is reflected, and it comes  back to the sending device, and it measures our speed.  And what's really interesting is when you start looking at how,  like how does this work?  It's actually very basic.  So when you take a look at the Doppler shift and the way  that we measure that, what we can see is that police use  high-frequency radio waves, and they're actually microwaves,  actually, to bounce off objects.  And then they measure the shift using this equation in the  return frequency to measure the speed.  Now, what's really important, and I'll keep calling this out  during this talk, but this is a very important point here,  radar measures speed.  So what does radar measure?  Come on, tell me.  Speed.  OK, that's very important, and you'll understand here in a  little bit.  And here you can see the equation, but basically you can  read that they measure the change in frequency over the  scent frequency, and it equals two times the velocity of the  target over the sea with constant of time.  And now that I do understand that now that I've shown the  math, we can kind of all go home, right?  Because everybody understands what we're going to do.  I get that.  OK.  But OK, so let's shift gears a little bit.  And before we start hacking, let's look at how police use  radar.  And I do want to say I apologize for the quality of this  image here, the video here, but 100% of the police pulled  would not let me film them radaring people.  And they started asking a lot of questions, and so I left.  I found this one on YouTube.  OK.  But one of the really neat things about RF radar is that  the officer could kind of just set it and forget it.  Just look at the video.  It's just sitting there.  It's radaring the cars as they go by, and the officer  doesn't have to do much.  Also, what's incredibly neat about RF-based radar is they  can drive while they're doing it.  We've all been radared by police passing by those kind of  things.  And what's neat is the way that these radios work is  they're transmitting this frequency, and they're receiving  signals back from multiple objects, right?  The device can determine its current speed by the  reflections that are coming back from stationary objects,  like trees or signs or other station buildings, other  stationary objects, and then calculate the speed of the  moving objects based off of that.  Some of the more advanced radar systems that police can use  can even track multiple targets and even show which lane of  traffic that they're in.  I just think that's really cool.  I think that that's very interesting the way that this  technology works.  And as we really start to dig in and understand what is  happening with our radar, this light is also very important.  So a very tiny fraction of the signal scent is actually  reflected back to the police radar system, right?  The rest of the RF signal continues to go on, bouncing  off of trees, scattering off the car.  But it continues to go.  And that's really all I'm trying to show in this slide is  that it's just a little tiny fraction of what is sent that's  returned back.  OK.  So.  Expand.  Oh, I forgot about that one.  Sorry, I didn't get it right.  So police radar, it really comes in three major forms.  And you guys all probably know this, right?  But this slide, if I were to take a picture of a slide, it  would be this one.  And you'll understand why.  But Expand was kind of the de facto back in the day,  right?  So it's kind of like the older radar systems that really  aren't used much in today's.  Next is K-Band.  And believe it or not, K-Band is used worldwide.  But it is the most commonly used radar in the United States.  And so if you were to take a poll, K-Band still remains  the default radar system.  It's also classified as the grocery store band, because  it's the same frequency that grocery stores use.  And so if any of you guys have radar detectors and seen  false alerts, it was likely K.  K-A is the new multimode version of K. It's the emerging  system, and it's definitely in use around.  Now, there's also the KU-Band.  Do I have any KU?  Any people from KU?  All right, so KU-Band exists, but no one's ever paid a  ticket for that.  So, right?  Yeah.  Actually, KU-Band is the European K.A. So for  anybody in Europe, I have the frequencies there.  OK, so does everybody at least have a basic understanding  of what radar is?  OK, does anybody remember what does radar measure?  OK, thank you.  That's very important.  I really only wanted to make sure that that point was  driven home.  OK, so it's time for a live demo.  What should we not do at DEFCON live demos, but we're  going to give it a shot?  OK, so I do want to take a volunteer up on the audience.  And as I was looking across, one person's  gotten a sticking out.  I have, sir, would you please join me on stage?  Oh, my god.  That's the other half of DEFCON parties right there.  OK, so what we're going to do, the demo that we're going to  show is that I'm going to give our Mr. Police Officer here  a radar gun.  I am going to walk towards him, and I am going to return  the same frequency that he is sending to me, which should  indicate that I am standing still.  OK, then I am going to slightly adjust the frequency  sending, and I will stand still, and I will indicate that  I'm moving.  And I realize that I don't have any good way of  demonstrating this to prove to you that this is happening.  So you're just going to have to trust me that this wasn't all  lies, OK?  Good there.  So what you're going to do is just head over there and point  it at me and hold down the radar gun.  OK, so I have two different versions of radar guns here.  One just commonly off the shelf radar system and a  Hot Wheels one.  But it turns out the Hot Wheels one was a little bit  easier to modify for my needs.  Oh, and if there are any people from the FCC here, I want to  tell you that it's all good.  I stayed within the legal limits.  OK.  OK, so the first demo is going to be you holding down the  button, radaring me.  I'm going to return the same frequency to you.  And hopefully, if all goes well, you will not get a reading.  Here we go.  OK, you ready?  We believe you.  OK.  Now on the second demo, what I'm going to do is I'm going  to slightly adjust the frequency of this gun.  And what I'm doing is now using the Doppler shift, because I  know the exact frequency that that gun transmit, I am going  to return a signal that says I'm going a certain speed.  So don't wait on me yet.  So 111 miles an hour.  Yeah, sorry.  But all right, you want to do one of those?  All right, it is 5 o'clock somewhere, right?  OK.  This is where it gets good.  Oh, man, that was good.  OK.  So can we do the same thing to police radar?  Yep.  We could build a device that says and transmits  that we are always going 65 miles an hour.  Since we know the vehicle speed that we want to go,  we just have to solve the equation for two other variables,  right?  And that would be the frequency that's sending to us.  And well, I guess that's it.  I only have to solve for one.  And the change of frequency from there,  but using the math.  And so it turns out that if I needed  to defeat X-band radar and say that I'm going 65 miles an hour,  all I have to do is transmit at 10.5 gigahertz.  I don't have to do any kind of a special encoding.  There's no packets.  It is truly just a microwave signal at 10.5 gigahertz.  If I would like to do the same to K-band radar, which, once  again, is the most commonly used radar in the world and the US,  all I have to do is transmit at 24.12 gigahertz.  And that will return that I'm going 65 miles an hour.  If I would like to, so KA is a little bit different.  It's a multi-mode transmission.  But believe me, if you were to transmit at 33.8,  you're going to get away.  And as I was doing the math here, I started to think,  OK, remember my dad?  You remember the story about the microwave?  Did that work?  And it turns out it did.  If we would have had our microwave oven transmitting  back in the day when they were using X-band radar,  the cops would have seen that I was going negative 97  million miles an hour.  OK.  Raise your hand if you know where this is going.  Yeah, all right.  Well, here we go.  So the interesting thing, though, is, so let's take that 65  mile an hour example.  We have a little bit of a problem with that, right?  So if I was always transmitting 65 miles an hour,  or if I was always transmitting at a certain frequency,  I've already shown you that some of those frequencies,  they're ranges, right, and the calculation matters.  But really, the biggest problem is,  is if I was always going 65 miles an hour,  what happens when I go through a school zone, right?  And we don't actually know what frequency the police radar  is sending.  Well, friends, I gotta tell you, we  live in interesting times.  So we live in the future, right?  The world's information is at our hands right now, right?  And we can do with it as we please.  And the newer radar detectors, specifically the Valentine 1  and the Escort 360, detect the radar signals about two  to three miles ahead and via Bluetooth  can share exactly which frequency we're being radared with.  Do you understand?  OK.  So real quick, I do want to give a shout out to TriWolf.  Thank you so much for where you are.  There she is for finding.  She was able to find me a very consistent location  to run some tests, would be a good way.  Testing, yeah.  Perfectly legal, official business.  OK.  Oop.  I went one, two, four.  OK.  So all we need to do is we would just  need to build an app that knew exactly what the current speed  was, the current speed limit, using the Rhodes API,  a way to detect what frequency that we're going to be radared  in about two miles.  The current generation of radar detectors do this,  and then calculate the frequency of the speed  that we wish to go based upon the current speed limit  and transmit, right?  All we need a very, very small processor to do this.  Up here, I'm showing an ESP8266.  We don't need much to do that.  One of the issues is that currently,  that the commonly available SDRs,  or software-defined radios that are available to us,  currently aren't working in that high frequency or microwave  space, right?  So they're actually much lower on the spectrum.  But if you take a look at the hardware that it would take,  and just even the way that SDR is progressing,  we could build this device very, very trivially  for about $700 right now.  And most of that cost would be around the SDR, right?  And the high frequency transmission.  But the FCC is not going to want you to do that.  So the FCC is very strict about radar jamming.  And they've actually been illegal since 1996.  And that means that anyone that uses or sells the devices,  it could be a federal offense, right?  And they are serious about it.  And not only that, they're so serious that you're not even  able to, like, they are so concerned about radar jamming,  that you're not even able to advertise.  So it's actually against the law to advertise radar jammers,  not even just use or sell.  And so right now, when you take a look at it,  $700 device, it's really not that cost effective anyway.  Yeah, I mean, it'll get there.  And knowing the way that we can do this,  and when those devices become available,  that's when you can make a good decision.  So the FCC won't let us speed, or let me be me.  So let's see.  What other effective countermeasures are available to us?  And they're the common things.  They're the common things.  But if you have not used the current generation radar  detectors, they're tremendous.  So earlier, I showed you how the radio frequency continues  to scatter, right?  It continues to go, and it continues to bounce around.  And the current generation of radar detectors  are picking that up very good, about two miles,  and weighs is really good.  But the problem with radar detectors,  the problem is that they suck when it comes to detecting  laser, right?  So you've probably heard that radar detectors today,  when you get hit with a laser, all you're going to do  is that just tells you that you're going to get a ticket,  right?  And most people probably feel like the cops are using laser  anyway.  Well, we'll slow down trigger, because we've  got some neat things to talk about.  So the FCC doesn't even regulate the light spectrum.  That's done by the FDA.  So let's hear it for light.  Come on, light.  And it also turns out that these laser guns,  they're very different than their RF cousins.  They use an eye finder to single out a specific target.  And if you take a look at the picture I have here,  you'll notice that there's two lenses, one that's the transmit.  That's the smaller lens, and then one to receive.  That's the larger.  And that'll be important here in a second.  And what's really interesting and what I love about laser  is the officer has to treat it like a weapon.  They have to be stable.  They have to point.  They have to single out a target.  And they have to find a reflective surface on your car  to get a signal back, OK?  So generally speaking, what they're after  is they're looking for your headlights or your license  plate or those sweet, sweet, fancy, blingy grills, right?  And here's what an officer sees when  they're targeting your car.  What you can see in this video is  you see an officer trying to get a lock on a car.  And then the second one, it's a little bit harder  to see when they do, OK?  But because laser is regulated by the FDA,  lasers have to be a class one laser.  That is the same class as a laser pointer.  Laser guns are laser pointers, OK?  They have to be eye safe, which means that pretty much  the amount of reflected laser that's coming back  to the police officer is very, very little.  OK.  Also, because it's regulated by the FDA,  they are restricted to the actual frequency of laser  that they can use.  They have to use an eye safe laser,  and they have standardized on 904 nanometers.  This is an invisible laser beam.  But what's great about this is it's standard.  There's one.  And it's very weak.  And we can buy them too.  OK.  Now, another thing, what does radar measure?  Well, laser does not measure speed.  Laser measures distance.  OK.  Super important slide here.  I'm going to give you guys time to write the equation down.  Like, if we have any math majors, you can kind of tell people,  explain how this works.  But speed is a result of distance over time.  I saw somebody take a picture of that slide.  OK.  Now, the issue is that laser guns, when they do measure  distance, they're doing it at a rate that's very aggressive,  usually around 100 to 200 measurements per second.  And so that really kind of goes back to,  by the chimera radar detector has gone off,  the laser gun has already acquired your speed,  and in fact, many times over.  And that's the calculation that the gun is using for distance.  But here's where it gets interesting.  OK.  Here we go.  All right.  It turns out that in about 2 thirds of our country,  represented by the green states that are super cool,  laser jamming is perfectly legal.  The yellow states are not as cool.  And I just literally don't know what the fuck is going on  in Virginia.  So we have a couple options.  This is the one that I'm going to go with.  It's not really effective, but it's hilarious,  and it makes it very hard for the police officer  to get a lock in my car.  OK.  Or, or, or we can attack the gun.  Let's attack the gun.  All right.  Here we go.  So first, we have to know exactly how these laser guns  work.  And before we get started, I'm going  to show you an example of timings.  OK.  So the timings that we're going to talk about here  will not be for every gun, but the frequency  that we're using is.  And what I want you to understand  is that once you understand how they work,  you will understand how to attack every single one.  It only comes down to a matter of timings.  OK.  So the things that are really important here  are the pulse width, how long the laser is on,  and the period cycle, which is how often it shoots.  So in this demonstration, I show a pulse width,  1, 2, 3, 4, 5, pulse, pulse, pulse, pulse, pulse.  Those are pulse width, right?  And the period cycle of a five millisecond period cycle.  OK.  You'll understand here in a second.  OK.  But this part gets really important.  OK.  So when the gun sends a series of pulses,  what it's expecting is a return.  OK.  And that return measures what?  Does anybody remember?  Booze.  Distance.  Distance.  The pulse measures distance.  OK.  So when your car gets hit by the first pulse,  does that officer have a lock on your speed?  No.  No.  They only know how far away that car is.  It's not until the second, third, right?  Until they can start, that gun can  start getting a lock on your speed.  And so that's why they measure so many times,  and in one second, 100 to 200 to get your speed.  OK.  So let's go ahead and zoom into this pulse period,  and let's talk about some countermeasures.  All right.  So these red lines indicate pulses from the gun, pulse.  Pulse.  Pulse.  OK, everybody good?  All right.  And it expects to get a return.  Pulse, return.  OK.  But we have a five millisecond window  that we can return our own.  OK.  And what does laser measure?  Distance.  OK.  So it does not measure speed.  Right.  So if we were to return a pulse before the reflected one,  we can tell them how far away we are.  All right.  So what I'm going to show you is a brute forcing method.  So just imagine driving around knowing exactly which  frequency you're going to be lasered with.  It's always the same 904, right?  And every one millisecond, putting a pulse.  OK.  So what, now the interesting thing is in your brain,  I know where you're going because I went the same way as,  well, if I turn an immediate response,  am I telling the cop that I'm going 97 million miles an hour?  No.  No.  What I'm telling them is that I'm very close.  Right?  I'm 100 feet away.  But then they get another one.  He's 100 feet away.  Then they get another one.  He's 100 feet away.  I'm going zero.  Right?  Yeah.  And so most of the guns, believe it or not,  so there's probably, I don't know,  nine or 10 different models of laser guns on the market.  This method comes back with an error message.  Just a simple brute force, one millisecond pulse  will return an error message to the gun.  Now there are a few models that have implemented countermeasures  to countermeasures.  And we'll talk about that here in a second.  So commercial, so some of the newer guns,  what they will do is they will recognize,  I sent one pulse out and I got four back.  So that's not right.  So they'll actually laser shift.  They'll shift their pulse width to account for that,  to find an empty spot in the return signal.  But we can counter those too.  So once we understand how the gun laser shifts,  what is expected result, we can shift our response to that  just as easily.  Now what's interesting is because of the pulse width  and the timing, we can identify the gun by the second pulse.  So when we get once and then we measure how long to,  so then we move immediately into brute force mode, right?  Then we receive another one.  Now we can identify exactly which gun  we're being targeted with and we can implement countermeasures  from there.  And so I'll go through those here real quickly.  So what you're seeing here on the screen,  the red lines indicate a pulse from the laser gun.  The orange indicates our reflection.  And the green is what we're returning to the gun.  So what we can do is we can vary our own returns.  So imagine if we understood that we have a five millisecond  window to return, that the first time we  return a very early signal.  We're at 600 feet away.  And then on that second pulse, we've identified who the gun is.  We know exactly which gun we're being targeted with.  And we can move into countermeasures of that.  But we then say that we're further away, perhaps 1,000  feet away.  Now to that gun, we're going in reverse, right?  And then we can continue on with strategies  like that that continue to even bypass even the most laser guns.  And commercial laser jammers are already doing this.  There is a couple different commercial products  that you can purchase that are already implementing  these countermeasures.  And so I just want to let you know that those are available.  OK, so a few years ago, I released a tool called Cotch.  It's an ESP-based Wi-Fi hacking tool.  And basically what I've done is like, OK, let's build on that  platform.  Let's continue to stay with the ESP-8266.  It's a build platform that I'm very comfortable with.  It uses the Arduino and the Arduino platform.  And we can build off of that.  Well, so what I'm going to release here is Natchikacha.  And so what Natchikacha is, is an ESP-8266-based laser jammer.  It's based on 12-volt circuitry for easy automotive  installation.  And it uses on the same 940 brute force mode, meaning  that it's pulsing at a 1 millisecond pulse rate.  That will bypass 80% of the laser jammers  that are in use right now.  It will not jam the more advanced dragon eye systems  that implement countermeasures to brute force mode.  However, we're doing this open source.  And so because commercial jammers exist,  it shouldn't be too difficult for us to reverse engineer  the pulse cycles that those more.  Actually, I don't know if that's illegal or not.  Let's not do that.  Let's build around.  So wireless connectivity, Android app.  It's legal in some states.  Remember those green states?  Oh, I forgot to mention.  I don't know if you saw that.  But on that map where laser jamming was legal,  Colorado wasn't on there.  And I'm like, come on, Colorado.  I thought you were cool.  Like, I just can't.  I don't know.  It also can emulate laser guns.  So you can test your own.  You can test it.  You can test your radar detectors, et cetera.  Yeah, and it turns out Mert mode would work OK, too,  which would be green lights.  But that's a super bad idea.  And probably shouldn't do that.  OK, well, so I'm just going to tell you,  like, not to conscious freedom.  And this is how we can take control of any systems that  are targeting us.  We, hey, audio guy is going to get louder in a second.  Just FYI.  And I just want to say go America, except for Virginia,  because I don't know what's going on there.  So real quick, this is kind of what it looks like.  Bill of material is super simple.  We're looking at an ESP 8266 and an LED array, essentially,  and a 12-volt circuit.  Cost is $8.  So code's available now.  It's kind of janky.  But that's how it goes, Defcon.  And I actually meant to bring one.  I have one here, but I broke it yesterday  when we were prepping for the talk.  I know, Bill, I know.  So seriously, so it is being released open source.  The brute force mode works.  Because I tested it.  I live in Kansas, legal there.  And so really, there's only around one.  I'll continue to post code.  And I would really hope or would appreciate  if anybody would like to help me build a fully open source  laser jammer that competes with the commercial grade  equipment.  So with that, guys, thank you very much.  I had a great time.  Really appreciate it.
Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_0_3395.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_3396_3515.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_3516_3779.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_3780_5891.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_5892_10427.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_10428_11351.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_11352_17015.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_17016_21095.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_21096_25775.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_25776_25823.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_25824_25871.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_25872_26987.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_26988_27035.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27036_27095.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27096_27143.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27144_27191.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27192_27251.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27252_27299.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27300_27611.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27612_27659.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27660_27707.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27708_27779.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_27780_28163.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28164_28211.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28212_28283.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28284_28415.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28416_28463.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28464_28511.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28512_28559.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_28560_29099.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29100_29147.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29148_29207.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29208_29255.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29256_29303.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29304_29519.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29520_29567.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29568_29651.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29652_29723.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_29724_32627.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_32628_33467.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_33468_34319.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_34320_34379.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_34380_41279.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_41280_44711.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_44712_46679.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_46680_60011.png Bill_Swearingen_-_HAKC_THE_POLICE_-_DEF_CON_27_Con_vQtLms02PFM_60012_61929.png