[00:00.000 --> 00:05.000]  I have been reading 2600 Magazine for almost as long as I can remember.
[00:05.440 --> 00:08.580]  I think it definitely is over 25 years.
[00:09.480 --> 00:10.280]  Thank you.
[00:10.840 --> 00:12.100]  I wear that proudly.
[00:13.300 --> 00:17.520]  And about 15 years ago, I actually won like the lifetime subscription.
[00:17.520 --> 00:19.420]  So that was actually really pretty cool.
[00:19.920 --> 00:24.620]  But being at HOPE is kind of like winning an Oscar.
[00:24.960 --> 00:37.200]  I mean, it really feels like it because this is a conference I heard about, wanted to go to, and relocated outside of New York City to this other place that they call Second City because it is Chicago.
[00:37.900 --> 00:38.960]  Friends are over there.
[00:39.540 --> 00:40.880]  Yeah, you're all alone there, buddy.
[00:42.020 --> 00:45.340]  And so this is actually a really thrilling moment for me.
[00:45.440 --> 00:47.060]  So I hope you enjoy this talk.
[00:47.060 --> 00:48.940]  I really appreciate you folks coming here.
[00:49.080 --> 00:52.940]  And let's talk about Mesh-tastic, Attack-tastic.
[00:53.440 --> 00:59.060]  To open with, I went down this route with Mesh-tastic.
[00:59.400 --> 01:02.700]  Well, backpedal a little bit, not backpedal, back up a little bit.
[01:03.280 --> 01:14.980]  A year ago at DEF CON in August, a friend of mine, Eric, was walking down the hallway and he had a little thing like this attached to his backpack shoulder strap.
[01:15.120 --> 01:17.700]  And I was like, Dude, I've been seeing these things all over the place.
[01:17.800 --> 01:18.220]  What is that?
[01:18.280 --> 01:19.660]  And he goes, Oh, it's Mesh-tastic.
[01:19.740 --> 01:20.340]  It's really cool.
[01:20.340 --> 01:22.000]  And all the passion came out.
[01:22.120 --> 01:24.420]  And essentially, he's an avid backpacker.
[01:24.640 --> 01:28.980]  So for him, it's very useful when he's with a group of folks and they get divided.
[01:29.320 --> 01:31.320]  And for example, if they need water.
[01:31.740 --> 01:32.600]  So I say, Hey, is water over there?
[01:32.700 --> 01:32.780]  Yeah.
[01:32.860 --> 01:35.480]  And they see where they're located because it has GPS.
[01:36.060 --> 01:39.700]  And, you know, when you're in backcountry like that, you don't have a signal.
[01:39.940 --> 01:40.800]  We all know that.
[01:40.900 --> 01:41.480]  You don't have Wi-Fi.
[01:41.580 --> 01:41.900]  You don't have Internet.
[01:42.180 --> 01:43.880]  So a tool like this is super handy.
[01:44.740 --> 01:47.640]  Other things is like mass emergencies, right?
[01:48.040 --> 01:49.260]  I'll get into that in a bit more.
[01:49.460 --> 01:51.420]  But he got me excited and hooked on that.
[01:51.580 --> 01:54.360]  I literally, while talking to him, put something into my Amazon cart.
[01:54.820 --> 01:56.260]  And it was a Helltech V2.
[01:56.540 --> 02:02.000]  And then from there, I just kind of like lost mental control and spent a lot of money on these things.
[02:02.100 --> 02:04.520]  And you can see a few of them are here, but there's more at home.
[02:06.080 --> 02:16.740]  So I got the idea of looking into the security of MeshTastic about four months or so into the hobby, which when I saw that there was really no research done.
[02:16.980 --> 02:18.720]  There were no best practices.
[02:19.100 --> 02:23.700]  There was just a tool that a lot of people were adopting very quickly.
[02:23.860 --> 02:25.560]  It's like the typical IT problem.
[02:25.820 --> 02:26.860]  There's a new toy.
[02:27.000 --> 02:27.720]  People love it.
[02:27.880 --> 02:28.760]  People start using it.
[02:28.860 --> 02:30.240]  And then they think about security later.
[02:30.400 --> 02:32.960]  So I'm doing this because I'm trying to raise awareness.
[02:32.960 --> 02:43.120]  If there are people out there who can contribute by writing secure code or teaching other people some of these best practices I'm going to show you, that's the point of this talk.
[02:45.320 --> 02:47.160]  So Chris gave you an introduction.
[02:47.160 --> 02:48.740]  I'm going to give you a slightly different one.
[02:49.240 --> 02:50.760]  I wear many, many hats.
[02:51.380 --> 02:54.000]  First off, I go by Heel.
[02:54.140 --> 02:56.960]  It's short for Heel with Hans or Hands.
[02:57.340 --> 03:00.360]  Very creative 14-year-old playing Dungeons and Dragons and a cleric.
[03:00.480 --> 03:02.480]  And that was the extent of my creativity at the time.
[03:03.360 --> 03:07.120]  So we shortened it to Heel because I got tired of being called Heel Wands.
[03:07.920 --> 03:09.980]  I was originally born in Port Jefferson.
[03:09.980 --> 03:11.200]  So I'm a native New Yorker.
[03:11.740 --> 03:11.960]  Woo!
[03:15.930 --> 03:17.190]  Moved to Queens.
[03:17.690 --> 03:18.890]  Went to Queens College.
[03:19.210 --> 03:23.090]  And St. John's was always kind of almost that rival school, even though we did not have a sports team.
[03:23.230 --> 03:26.110]  It was just people who couldn't afford St. John's anymore would go to Queens College.
[03:26.110 --> 03:28.190]  And they would just talk about how great St. John's was.
[03:29.610 --> 03:34.130]  And then I moved to Chicago suburbs because I met my wife here.
[03:34.350 --> 03:35.230]  She's from the suburbs.
[03:35.410 --> 03:40.030]  And about 22, 23 years ago, we relocated.
[03:40.550 --> 03:44.270]  Since then, I've accumulated more and more experience in the industry.
[03:44.270 --> 03:51.150]  I'm probably closer to 30 years now in IT and cybersecurity, mostly cybersecurity and InfoSec.
[03:51.650 --> 03:53.250]  I work at Cisco Systems.
[03:53.930 --> 03:54.970]  Don't boo me.
[03:55.210 --> 03:56.310]  It's a great company.
[03:57.010 --> 03:58.010]  I know, I know.
[03:58.150 --> 03:59.790]  New vulnerability every once in a while.
[04:00.250 --> 04:07.730]  And then, I've been there for a little while, but I'm a security architect there for customers to help them protect their environments, like what Chris described.
[04:09.410 --> 04:13.170]  2014, I created Hack for Kids with my buddy over there, Mr. Minion.
[04:13.990 --> 04:19.070]  Because I went to DEFCON, and there was this eight-year-old who did a little solder kit.
[04:19.090 --> 04:20.830]  It was called a SparkFun Weevil Eye.
[04:20.990 --> 04:24.090]  And the kid was so excited about learning how to solder.
[04:24.230 --> 04:29.150]  I'm like, how do I get my kid exposed to this, but without bringing him to DEFCON?
[04:29.150 --> 04:30.490]  Because at that point, he was six.
[04:30.830 --> 04:35.630]  And I'm not having a six-year-old, like, stay up till two in the morning with me, hanging out, talking to my buds.
[04:36.670 --> 04:48.270]  So the idea, and it took a couple of years to figure out how to do this, but we brought that kind of a conference to kids in Chicago every year, first or second weekend of June.
[04:48.850 --> 04:50.690]  We've had people from New York show up.
[04:50.750 --> 04:52.310]  So it is accessible for you folks.
[04:52.490 --> 04:53.370]  It's a full day.
[04:53.370 --> 04:54.090]  We feed you.
[04:54.190 --> 04:54.850]  We give swag.
[04:55.010 --> 04:55.650]  Lots of prizes.
[04:55.890 --> 04:57.010]  It's a great time.
[04:57.010 --> 05:02.950]  So if you know any kids between ages of seven and 17, you can bring them to Hack for Kids in Chicago, June 6th, next year.
[05:03.890 --> 05:04.190]  Also...
[05:05.950 --> 05:06.790]  Yeah, thank you.
[05:07.630 --> 05:08.990]  My PR person as well.
[05:10.470 --> 05:11.390]  We have done this.
[05:11.550 --> 05:17.470]  So for example, at Gurkhan, if you heard of Gurkhan in Grand Rapids, Michigan, we do like a Hack for Kids village there.
[05:17.670 --> 05:18.490]  We've run...
[05:18.490 --> 05:18.610]  Yep.
[05:19.030 --> 05:19.550]  Go Gurkhan.
[05:20.670 --> 05:23.030]  Here's my Gurkhan water bottle.
[05:23.350 --> 05:23.690]  It's awesome.
[05:24.110 --> 05:24.910]  Great conference.
[05:25.110 --> 05:26.010]  It's really a good conference.
[05:26.190 --> 05:31.510]  So we can also partner with another conference like HOPE and put on like a kids track or something like that.
[05:33.130 --> 05:36.250]  About three years ago, we thought about actually doing an adult conference.
[05:36.390 --> 05:37.770]  So we started B-Sides 312.
[05:38.310 --> 05:40.690]  If you've heard of B-Sides Chicago, that's not us.
[05:40.790 --> 05:41.350]  They're in November.
[05:41.490 --> 05:43.830]  We're in May, June, depending on the year.
[05:44.530 --> 05:45.830]  Right adjacent to Thalkon.
[05:45.910 --> 05:51.130]  So if you're going to Thalkon, you can spend an extra day in the city and have a great time and catch other talks you may have missed at Thalkon.
[05:51.630 --> 05:53.970]  So very busy, got a lot going on.
[05:55.170 --> 05:58.490]  I'm also a badge life creator officially since 2019.
[05:58.850 --> 06:00.270]  So this is the one badge.
[06:00.430 --> 06:03.790]  Actually, you'll see that on the next slide, but I made something for Defcon 33.
[06:05.130 --> 06:06.650]  Also, a hacker dad.
[06:06.830 --> 06:10.390]  I got three kids, ages 19, 17 and 13.
[06:10.390 --> 06:15.830]  All of them have varying degrees of hacking skills, but my oldest has always been my biggest adversary on my network.
[06:15.830 --> 06:19.310]  He has stolen my Mac address to bypass security controls.
[06:19.550 --> 06:23.850]  He has changed his DNS to use Cloudflare to get past Cisco Umbrella.
[06:24.310 --> 06:29.630]  He has somehow stolen my PayPal account, and to this day, he has not confessed how he found it.
[06:29.710 --> 06:35.150]  But I think it was left written on a piece of paper on my wife's desk, but he swears he hacked it somehow.
[06:35.670 --> 06:38.010]  It was not a brute forceable password, I promise you.
[06:38.910 --> 06:39.970]  So he got it.
[06:41.150 --> 06:43.170]  And then I'm also very active in scouting.
[06:43.330 --> 06:44.630]  Any other fellow scouters here?
[06:44.950 --> 06:47.470]  Not scouts, but scouters, adults who volunteer.
[06:47.730 --> 06:47.990]  Awesome.
[06:48.130 --> 06:49.150]  Yeah, that's the sign.
[06:49.750 --> 06:51.590]  I was a scout master for nine years.
[06:51.710 --> 06:52.890]  I'm now a committee chair of a unit.
[06:52.970 --> 06:54.190]  I was a cub master for years.
[06:54.290 --> 07:02.990]  I'm now taking a troop to Jamboree next year for like about 36 scouts in West Virginia.
[07:04.030 --> 07:11.130]  And I'm also Silver Beaver, which if you know what Silver Beaver is in scouting, it's a pretty cool award recognizing you for all your contributions in scouting.
[07:11.310 --> 07:13.150]  So how the hell do I do all this?
[07:13.510 --> 07:15.450]  Lots of caffeine and stimulants.
[07:16.610 --> 07:20.090]  So this is the badge that I just made for DEFCON this year.
[07:20.130 --> 07:21.610]  So if you're a Freemason, you're going to love this.
[07:21.730 --> 07:22.510]  It's got four puzzles.
[07:23.830 --> 07:29.430]  It's designed to kind of teach you a little bit more about circuitry, a little bit more about soldering.
[07:29.430 --> 07:33.950]  And then there's a puzzle built into it and how to get all the lights and everything turned on.
[07:34.050 --> 07:35.370]  And that's what it looks like solved.
[07:35.790 --> 07:37.070]  And my battery is dead.
[07:37.210 --> 07:38.090]  Otherwise, I'd show it to you.
[07:38.410 --> 07:39.270]  Let me know if you're interested.
[07:39.750 --> 07:40.850]  It supports Hack for Kids.
[07:41.030 --> 07:46.950]  Everything I do to generate money is for Hack for Kids because it's so hard to get sponsor money these days.
[07:47.310 --> 07:49.450]  So anything would be really appreciated.
[07:49.950 --> 07:50.250]  All right.
[07:50.410 --> 07:51.790]  Let's get into what you came here for.
[07:52.430 --> 07:53.970]  So we're going to cover MeshTastic.
[07:54.230 --> 07:54.890]  Quick introduction.
[07:55.570 --> 07:56.690]  Quick show of hands also.
[07:57.110 --> 07:58.590]  Who knows nothing about MeshTastic?
[07:58.590 --> 07:59.670]  You heard about it.
[07:59.730 --> 08:00.670]  It sounds really cool.
[08:00.950 --> 08:02.310]  And you want to learn more.
[08:03.510 --> 08:04.570]  Higher in the sky, please.
[08:04.710 --> 08:05.850]  So just everybody can see.
[08:05.990 --> 08:06.210]  All right.
[08:06.310 --> 08:06.390]  Cool.
[08:06.950 --> 08:10.590]  Now, who's been using MeshTastic and is having a great time with it?
[08:10.650 --> 08:14.050]  You feel really comfortable with it and might be interested in teaching other people?
[08:15.510 --> 08:16.030]  All right.
[08:16.190 --> 08:17.250]  Maybe not the teaching.
[08:17.410 --> 08:17.610]  Okay.
[08:17.990 --> 08:24.210]  But for those of you who are, so now the people like this, the first group of people who raise your hand, now you know who to go after.
[08:24.650 --> 08:26.290]  When we're done, they'll help you.
[08:26.290 --> 08:27.890]  But we have great workshops here too.
[08:28.010 --> 08:29.410]  Not every conference has been doing this.
[08:29.610 --> 08:31.210]  This is really cool that there's some workshops.
[08:32.310 --> 08:37.450]  We're going to cover key features, go over the security concerns that I have, what some attacks look like.
[08:37.550 --> 08:41.110]  We have like a real POC on this, proof of concept.
[08:41.110 --> 08:43.570]  So I'll get into that in a bit more.
[08:43.690 --> 08:59.590]  But that's what made this talk really cool is not just so much the awareness of what's going on with MeshTastic and the security concerns, but somebody from Burbset, which is in the Chicago CitySec, thank you, community actually came up with an attack.
[09:00.110 --> 09:01.130]  It was really cool.
[09:01.130 --> 09:05.090]  And then we'll go through best practices and some stuff like that.
[09:05.410 --> 09:08.090]  So, let's see if this actually works.
[09:13.450 --> 09:14.470]  You guys hear that?
[09:14.750 --> 09:15.090]  No?
[09:15.470 --> 09:15.850]  It's okay.
[09:23.970 --> 09:24.630]  All right.
[09:24.890 --> 09:31.830]  So, for those of you who are not too familiar with MeshTastic, it's basically this open-source, decentralized communications platform.
[09:31.910 --> 09:32.950]  It's very open.
[09:32.950 --> 09:37.870]  It allows off-grid communications like the example that I used going into backcountry.
[09:38.330 --> 09:42.030]  Also, it's fairly long range for the low power consumption that it has.
[09:42.270 --> 09:45.170]  And I got a pretty cool example of that coming up in a bit.
[09:45.970 --> 09:48.650]  So, the price point is also very low.
[09:48.910 --> 09:50.250]  It's fairly inexpensive.
[09:50.470 --> 09:57.370]  Like the POC, which these are the pieces that we use for the POC other than my phone, is about $90 pre tariff prices.
[09:57.550 --> 09:59.450]  Probably about $900 post tariff prices.
[10:00.770 --> 10:02.990]  And it's using a technology called LoRa.
[10:03.570 --> 10:06.730]  LoRa is a brilliant acronym for long range.
[10:06.950 --> 10:10.530]  Not to be confused with LoRaWAN, which I'll cover in a few minutes.
[10:10.730 --> 10:16.130]  But it's essentially being used for things like transmitting text messages and GPS locations if your device has it.
[10:16.210 --> 10:19.490]  So, for example, these two do not have GPS and these two do.
[10:20.690 --> 10:22.510]  And there's so many different options, right?
[10:22.990 --> 10:24.930]  So, there's like the fun ones from LilyGo.
[10:25.630 --> 10:29.430]  There's also the one like the Nano G2 that you kind of see in the lower screen.
[10:29.430 --> 10:30.170]  The lower right-hand corner.
[10:30.330 --> 10:31.990]  That's usually my go-to device.
[10:32.490 --> 10:33.570]  It just stopped working.
[10:33.890 --> 10:35.490]  And that's also the fun thing about these things.
[10:35.590 --> 10:37.070]  They just break for random reasons.
[10:37.330 --> 10:40.670]  So, you go buy a new one or something better because there's constant upgrades.
[10:42.250 --> 10:47.390]  And then you can also go fairly far depending upon your antenna and the terrain.
[10:47.590 --> 10:49.850]  So, when you're in the city, obviously there's going to be a lot more attenuation.
[10:49.990 --> 10:50.810]  Things are going to get in the way.
[10:50.910 --> 10:51.830]  They're going to absorb the signal.
[10:52.050 --> 10:55.930]  Like these little tiny stubby antennas, they're fairly good for a couple of blocks.
[10:55.930 --> 10:58.690]  Like this one here, it could probably reach a lot further.
[10:58.950 --> 11:01.010]  And it kind of, again, depends upon your terrain.
[11:01.130 --> 11:07.110]  But when I looked at my app, it looked like I was reaching out at least 15 blocks in different directions.
[11:07.110 --> 11:07.970]  So, it was pretty cool.
[11:10.530 --> 11:17.770]  So, this map, when I went to ShowMeCon, I thought it would be fun to turn on one of the features which tracks your routes.
[11:18.070 --> 11:20.690]  Which again, is another security concern of mine.
[11:20.990 --> 11:22.630]  But I just said, hey, you know, I'm on a train.
[11:23.450 --> 11:27.110]  And let me turn this on and see what it looks like when I get to St. Louis from Chicago.
[11:27.570 --> 11:28.810]  It's a boring straight line.
[11:28.810 --> 11:36.770]  But you can kind of see that if I did want to trace my route for a valid reason, maybe I'm in a hot air balloon or I'm on an airplane.
[11:36.770 --> 11:41.470]  I've seen that where people have left like San Francisco or Las Vegas.
[11:41.630 --> 11:44.970]  And you can see that while on their airplane, there's like a line being drawn across the country.
[11:45.890 --> 11:52.430]  And this is also kind of like the far right one is a heat map of when I was in St. Louis to give them a sense of kind of the communities.
[11:53.250 --> 11:55.970]  I have not picked up anything on this device.
[11:56.150 --> 11:57.130]  This was going to be my primary.
[11:57.390 --> 12:00.850]  And I don't know if it's because it's the DEF CON firmware that I'm using.
[12:01.070 --> 12:06.550]  If anybody's on MeshTastic and you're able to get into the mesh and I'm not, I've got to update my firmware tonight.
[12:06.690 --> 12:11.790]  Because apparently it seems like the DEF CON one is not compatible very much with the stock one from MeshTastic.
[12:12.030 --> 12:15.110]  But you can see like there's a lot of activity going on in different cities.
[12:16.850 --> 12:18.370]  So let's talk about LoRa for a minute.
[12:19.630 --> 12:21.710]  LoRa operates in the ISM radio bands.
[12:21.710 --> 12:24.390]  Anybody know what ISM stands for?
[12:25.930 --> 12:27.470]  Industrial Fantastic Medical.
[12:27.710 --> 12:28.210]  Perfect.
[12:28.550 --> 12:28.990]  Love that.
[12:29.750 --> 12:33.550]  There are also different frequencies depending upon which continent you're in.
[12:33.630 --> 12:37.190]  So if you're in the EU, it's going to operate at a different band.
[12:37.310 --> 12:38.170]  Does anybody know the band?
[12:39.210 --> 12:39.770]  433.
[12:40.310 --> 12:41.050]  Very good.
[12:41.410 --> 12:44.670]  Usually I hear nobody cares, but 433 is correct.
[12:45.050 --> 12:47.010]  There's another range that's more specific.
[12:47.410 --> 12:49.610]  See, people from the EU are now laughing right now.
[12:49.930 --> 12:50.850]  Sorry, folks.
[12:51.790 --> 12:53.570]  There's another band also for EU.
[12:55.550 --> 12:55.970]  Boom.
[12:56.330 --> 12:56.930]  That's awesome.
[12:57.190 --> 12:58.430]  I know I'm in the right place.
[12:58.890 --> 13:01.470]  In North America, does anybody know what the frequency is?
[13:02.150 --> 13:02.570]  915.
[13:02.890 --> 13:03.690]  915 megahertz.
[13:03.810 --> 13:04.850]  And by the way, these are all megahertz.
[13:04.950 --> 13:06.650]  So it's all sub gigahertz, which is cool.
[13:07.550 --> 13:10.090]  And these are bands that are open.
[13:10.830 --> 13:13.510]  So you don't need a ham license.
[13:14.050 --> 13:17.330]  So you can use this without a license.
[13:17.450 --> 13:22.550]  But if you do have a license and you choose to use your call sign, I do have that kind of conversation that's come up a few times.
[13:22.590 --> 13:23.030]  Hang on, sir.
[13:23.030 --> 13:29.130]  If you do put your call sign in there, that actually shows up on the heat map and you cannot encrypt your traffic.
[13:29.830 --> 13:31.490]  One question that's come up before.
[13:31.710 --> 13:41.750]  Well, if I'm using my license, I'm not able to forward encrypted packets because I have to only transmit and clear.
[13:42.870 --> 13:44.550]  Who wants to challenge me on that?
[13:46.350 --> 13:48.370]  And I intentionally muddled the sentence.
[13:48.810 --> 13:51.030]  So some of you guys are like, yeah, this sounds good.
[13:51.250 --> 13:51.590]  Okay.
[13:51.610 --> 13:57.750]  So the argument literally was, and there was a nerd fight in the room between two groups saying you can't do it and others you can.
[13:58.490 --> 14:05.690]  If you are transmitting, you are the originator, the source of that transmission, and you're using your license, you cannot encrypt.
[14:05.690 --> 14:16.430]  But if you have a device that is receiving packets and just pushing them to the next hop, and you're not inspecting them, you're not looking at them, you're just basically a conduit, they can remain encrypted.
[14:17.530 --> 14:18.110]  Argument over.
[14:19.470 --> 14:20.290]  You had a question?
[14:20.810 --> 14:21.610]  Why do I need a license?
[14:23.110 --> 14:24.270]  Why do you need a license?
[14:24.610 --> 14:25.590]  A HAM license?
[14:26.630 --> 14:27.430]  Not for this.
[14:27.610 --> 14:29.130]  You do not need a HAM license for this.
[14:29.490 --> 14:32.610]  I think you should go talk to the HAM radio people because we all have different opinions.
[14:32.610 --> 14:34.150]  Look for a guy named Ed.
[14:34.550 --> 14:35.170]  I'm very good.
[14:35.970 --> 14:37.470]  Son of a bitch!
[14:38.270 --> 14:39.810]  All right, Ed, good to see you again.
[14:40.030 --> 14:43.350]  You got someone who's going to want to talk, you got a new convert outside in a little while.
[14:44.590 --> 14:53.250]  And then the data rates are at the whopping, whopping .09 kilobits, all the way up to 21.88 kilobits.
[14:53.430 --> 14:56.370]  But based on what the information we're sending, it doesn't really matter.
[14:57.190 --> 14:59.610]  And you also can configure these different things.
[14:59.610 --> 15:05.090]  But if you do want to use your HAM radio license, you are allowed to transmit at a higher power rate.
[15:05.270 --> 15:11.230]  I think you can go up to like 30 dB versus what it's normally transmitting at, which is whatever the device handles.
[15:12.150 --> 15:13.490]  And there is some encryption.
[15:14.790 --> 15:24.390]  There's a primary channel using 8-bits, where my opinion is like, unless the protocol is forcing the encryption, why even bother having the 8-bit overhead?
[15:24.390 --> 15:26.290]  These devices are not that powerful.
[15:26.550 --> 15:31.110]  But you can go to 128 or 256-bit encryption for your channels.
[15:31.610 --> 15:32.770]  And it's AES.
[15:32.930 --> 15:36.590]  And you need a PSK, or pre-shared key, in order to join the channel.
[15:36.790 --> 15:43.910]  So this is a somewhat technical talk, but it's also introductory to kind of get folks who know nothing about Meshtastic aware of some of these things.
[15:44.570 --> 15:45.990]  This is an architecture slide.
[15:46.190 --> 15:50.070]  I'm going to start with the computer by your perspective, the lower right-hand corner.
[15:50.610 --> 15:55.510]  So when you first plug these things into a computer, you usually need to load firmware, the stock firmware.
[15:55.670 --> 15:58.530]  It's basically whatever they put on there to prove that it's working.
[15:59.010 --> 15:59.570]  Sorry about that.
[15:59.730 --> 16:00.610]  My peas are popping.
[16:01.610 --> 16:06.630]  But when you plug in using serial, and after you flash the firmware, there's client.meshtastic.org.
[16:06.770 --> 16:07.530]  Don't need to write this down.
[16:07.610 --> 16:08.850]  I got a resource slide at the end.
[16:09.190 --> 16:10.590]  And you can configure your device.
[16:10.730 --> 16:12.530]  First thing it's going to want to know is where are you?
[16:12.650 --> 16:14.370]  In the US, EU, wherever.
[16:14.730 --> 16:24.170]  And once you've done that, you can configure all those different settings, a little bit of the settings that I talked about, like hops and speed or a mode and a client type, or you could do it through Bluetooth.
[16:24.630 --> 16:31.730]  And that's kind of the really fun, cool thing, which is where this attack was able to happen, which I'll get into in a bit.
[16:31.830 --> 16:36.550]  So once you've configured everything, your device is then going to join a mesh.
[16:36.690 --> 16:39.210]  It's going to be a node on that LoRa network.
[16:39.330 --> 16:40.890]  And that's what it looks like, right?
[16:41.090 --> 16:45.390]  So you can have devices relaying or sending hops to other devices.
[16:45.390 --> 16:47.050]  Devices could be routers.
[16:47.330 --> 16:50.370]  Devices could just be receiving and not forwarding.
[16:50.550 --> 16:52.050]  It's really up to you on what you want.
[16:52.610 --> 16:58.550]  The ideal client is basically your phone using Bluetooth to your node.
[16:59.170 --> 17:00.050]  Works pretty well.
[17:00.170 --> 17:03.470]  There's a Meshtastic app for Android and iPhone.
[17:03.650 --> 17:07.890]  So you can just download that at their stores and you're ready to go once you connect to your device.
[17:09.170 --> 17:10.990]  Connection, usually folks are thinking like Bluetooth.
[17:11.470 --> 17:12.230]  I got a pair.
[17:12.530 --> 17:15.490]  So if it has a display, a random key is usually pretty good.
[17:15.790 --> 17:18.490]  If it doesn't have a display, then you can go with a static key.
[17:18.770 --> 17:24.930]  But then if somebody gets hold of your device and they're able to plug into it serially, they're going to find out what your static key is.
[17:25.490 --> 17:26.650]  Or does it matter?
[17:26.810 --> 17:27.270]  Maybe not.
[17:27.390 --> 17:28.030]  You lost your device.
[17:28.130 --> 17:28.410]  Who cares?
[17:29.890 --> 17:32.110]  So some of the features I mentioned before.
[17:32.470 --> 17:37.870]  So it is primarily going to be used for relaying messages through whatever to the other nodes.
[17:38.390 --> 17:45.490]  The distance is... that number right there is the highest recorded distance of transmission.
[17:45.870 --> 17:52.330]  I believe they were using very high-powered antennas and they were like pretty much on mountaintops.
[17:52.650 --> 17:56.430]  Anybody know what 331 kilometers is in miles?
[17:57.710 --> 17:58.670]  Who cares?
[17:59.770 --> 18:01.110]  You guys learn fast.
[18:01.690 --> 18:02.290]  What did you say?
[18:03.110 --> 18:03.790]  Somebody said something.
[18:03.810 --> 18:05.010]  It's about 222 miles.
[18:05.030 --> 18:06.210]  It's about 222 miles.
[18:06.310 --> 18:06.570]  Very good.
[18:06.830 --> 18:07.490]  Did you do that in your head?
[18:08.070 --> 18:08.870]  Yeah, roughly.
[18:09.150 --> 18:09.670]  All right.
[18:10.010 --> 18:11.730]  I think the NSA is looking for you.
[18:12.610 --> 18:12.750]  He's Canadian.
[18:12.750 --> 18:13.210]  He's Canadian.
[18:13.630 --> 18:14.130]  Oh, God.
[18:14.690 --> 18:15.390]  It's not fair.
[18:15.410 --> 18:16.070]  Unfair advantage.
[18:16.770 --> 18:17.830]  One of the...
[18:17.830 --> 18:18.650]  We don't care.
[18:18.730 --> 18:19.690]  We don't care.
[18:19.970 --> 18:22.410]  So by default, it's going to do a three hops.
[18:22.590 --> 18:29.390]  So if you're not familiar with hops, that basically means when I transmit from here, it's going to look for another node that it's able to reach.
[18:29.630 --> 18:34.370]  And then this node is also going to look for other nodes that are within its range and that it can forward it on.
[18:34.470 --> 18:36.170]  It would forward it on to more than one node.
[18:36.770 --> 18:38.710]  That's what also routers are really good for.
[18:38.790 --> 18:45.570]  Because you can put like a router on top of a building and then transmit to many nodes without impacting your hop count.
[18:45.570 --> 18:47.370]  So you can hit like a wider range of folks.
[18:49.890 --> 18:51.930]  The GPS features, those are nice.
[18:52.130 --> 18:55.630]  A little like almost adding like an extra 10 bucks or so to whatever your purchase is.
[18:56.210 --> 18:58.150]  You got to ask yourself, do I really need it?
[18:58.230 --> 18:59.670]  What is my purpose for this device?
[18:59.710 --> 19:03.610]  If I'm here just to do chatting with folks, then don't get the GPS feature.
[19:03.970 --> 19:06.890]  Or if you're not using the GPS, then just turn it off.
[19:08.050 --> 19:09.290]  The low power consumption.
[19:09.530 --> 19:15.790]  One of the things that I think is one of the coolest things is when you get your custom case, you can actually even get whatever battery size you want.
[19:15.930 --> 19:18.930]  So if you want something with like 1200 milliamps, it's a little tinier.
[19:19.050 --> 19:27.010]  You can maybe last the day or you can get something that's honking like big and a little space added to the back for like a 3000 milliamp.
[19:27.570 --> 19:30.970]  And again, depending like, you know, with the display and everything, it's going to burn through them a little quicker.
[19:31.410 --> 19:33.830]  But, you know, you may not need to charge as often.
[19:34.110 --> 19:36.110]  And there's tons of case examples.
[19:36.250 --> 19:40.150]  Go printables, Thingiverse, download a case or just join a group.
[19:40.350 --> 19:41.270]  There's Discord servers.
[19:41.670 --> 19:43.750]  And then just people say, hey, check out this case.
[19:43.890 --> 19:44.830]  I'm like, oh, that looks good.
[19:45.090 --> 19:46.710]  And I send it to my library to print.
[19:48.310 --> 19:50.870]  The device on the right, that's black and green.
[19:51.030 --> 19:52.230]  That is my ham radio one.
[19:52.570 --> 19:53.830]  Just to kind of give you an example.
[19:53.990 --> 19:55.090]  I picked this one.
[19:55.250 --> 19:56.810]  It's got like the little lanyard clip on it.
[19:56.870 --> 19:57.510]  You can walk around.
[19:58.010 --> 20:00.790]  I'm a ham and I got Mesh-tastic and I'm transmitting and clear.
[20:01.510 --> 20:02.970]  Or you can put it on top of the building.
[20:03.170 --> 20:08.970]  So with one of the folks in the Chicago community, we built a solar node and we put it on top of their building.
[20:09.470 --> 20:12.990]  One of the pictures I have actually was a picture of some guys on a roof.
[20:13.230 --> 20:14.630]  That was them installing this.
[20:14.770 --> 20:16.110]  I don't know if you guys know Johnny Christmas.
[20:16.570 --> 20:19.390]  It's kind of like an international cybersecurity phenomenon.
[20:20.210 --> 20:22.090]  He put this on the roof of his building.
[20:22.090 --> 20:24.510]  So if you do find this node, you know where he lives.
[20:26.510 --> 20:27.370]  Something to think about.
[20:27.850 --> 20:30.410]  The top right photo is the inside of that box.
[20:30.410 --> 20:34.170]  But since then, because I wanted a fancy power module and do all these other cool things.
[20:34.290 --> 20:35.630]  And he's like, don't need this.
[20:35.730 --> 20:36.290]  Don't need this.
[20:36.470 --> 20:37.290]  Just replace everything.
[20:37.470 --> 20:40.670]  So now he really rebuilt the whole thing and kept the case in the antenna.
[20:41.090 --> 20:42.770]  A little bit of a close up of it.
[20:42.890 --> 20:43.870]  It's kind of cool, right?
[20:43.950 --> 20:44.690]  It's like sitting there.
[20:44.910 --> 20:47.970]  There's like nothing in the way of that node.
[20:48.150 --> 20:52.770]  And it's got a nice 8 dB antenna that's transmitting fairly far.
[20:52.770 --> 20:59.610]  I mean, there are people like I live about, I guess you could say 26 miles from how the crow flies from downtown Chicago.
[20:59.870 --> 21:07.370]  And I am seeing people transmitting from the city, but I don't have anything powerful enough to transmit to them.
[21:07.470 --> 21:13.830]  So I need to get somebody who's not afraid of heights like me to go on my roof and install an antenna so I can transmit outward.
[21:14.070 --> 21:18.230]  And then actually start to do stuff in my area because it's just basically me.
[21:19.650 --> 21:25.030]  I mean, talking to yourself is okay, but when you're answering, that's when you have a problem.
[21:26.370 --> 21:28.570]  Let's look at some of the things too.
[21:28.770 --> 21:34.390]  Oh, when I first started doing research on this, you know, like, hey, is there any security issues?
[21:34.490 --> 21:35.250]  Where do we go first?
[21:35.870 --> 21:40.090]  CVE details or some kind of website that keeps track of any type of vulnerabilities.
[21:41.030 --> 21:42.690]  And when I went through, I couldn't find any.
[21:42.790 --> 21:49.810]  So then I kind of thought about it and I sat down and I'm like, what are the typical problems with anything that's transmitting radio?
[21:50.410 --> 21:52.650]  And these are generally all of the main concerns.
[21:52.810 --> 21:58.150]  So whatever the concern is for Wi-Fi or whatever, whatever it might be that's transmitting.
[21:58.610 --> 22:00.630]  Mesh-tastic is not exempt from that.
[22:00.770 --> 22:10.250]  Mesh-tastic has the concerns, but for the sake of time and your sanity and mine, we're only going to focus on three physical attacks, privacy leaks and weaknesses and key management.
[22:11.330 --> 22:12.730]  Does that sound good for everybody?
[22:13.150 --> 22:14.010]  Works for me too.
[22:14.010 --> 22:16.670]  Let's look at some physical attacks.
[22:19.430 --> 22:20.250]  Mesh-tastic.
[22:43.990 --> 22:45.070]  You gotta laugh.
[22:47.490 --> 22:49.510]  I don't know if he bounced back that quickly, sir.
[22:50.030 --> 22:51.070]  It looks like it hurt.
[22:52.710 --> 22:57.690]  So, working at Cisco, once a year, we have this big convention that we have to go.
[22:57.870 --> 22:59.050]  And it's back in Las Vegas.
[22:59.210 --> 23:00.690]  So last week I was in Vegas for DEF CON.
[23:00.890 --> 23:01.410]  Now I'm here.
[23:01.690 --> 23:02.550]  And guess where I'm going?
[23:02.690 --> 23:05.210]  A week from Saturday, back to freaking Vegas.
[23:05.370 --> 23:10.090]  Back to Vegas happily, in case anyone's watching, for this convention.
[23:10.090 --> 23:15.230]  And last year I brought my node with me, because there's this, like at Cisco, there's a whole MeshTastic community.
[23:15.670 --> 23:17.290]  I think that's really pretty cool.
[23:17.470 --> 23:27.990]  So maybe where you work, unless it's like just you at your personal company and private company, look around in your company, see if there's other people, either whether they're ham radio operators or they're getting into MeshTastic.
[23:28.090 --> 23:31.890]  There might be some group at your company that they just come up with really fun, cool ideas.
[23:32.250 --> 23:34.630]  So I had my node, but I didn't have a case with me.
[23:34.710 --> 23:36.610]  I didn't have anything that was like 3D printed yet.
[23:36.610 --> 23:46.130]  And I finished a cup of coffee and I thought I'd like hide it in an empty cup of coffee, and then put an antenna on and just walk around with a cup of coffee with an antenna to see if anybody questioned me.
[23:46.530 --> 23:47.270]  Nobody cared.
[23:49.350 --> 23:50.470]  Maybe because it's Cisco.
[23:50.630 --> 23:51.130]  No, just kidding.
[23:51.270 --> 23:51.670]  Just kidding.
[23:51.830 --> 23:52.190]  Just kidding.
[23:53.790 --> 23:57.510]  But the point here is these devices are really pretty tiny.
[23:57.510 --> 23:59.430]  Like I could take this, hide it in my pocket.
[23:59.490 --> 24:08.710]  I can go into an office building where I may already set something up, like with an attack like this and pretend to be, you know, maintenance worker, like, you know, HVAC or something.
[24:08.990 --> 24:11.650]  And I'm now actually collecting data and doing stuff.
[24:11.790 --> 24:18.850]  And nobody knows it's on me unless you're doing stuff to block radio frequencies, which companies are starting to consider this more and more.
[24:19.030 --> 24:21.750]  Hey, is anything transmitting around 915 megahertz?
[24:21.990 --> 24:23.330]  Well, what is it doing?
[24:23.330 --> 24:24.790]  It looks like it's a MeshTastic node.
[24:24.790 --> 24:28.490]  Shut it down because we could do this stuff with like air defense and whips and stuff like that.
[24:29.470 --> 24:34.090]  Also, the physical attacks like that node that's on Johnny Christmas's roof.
[24:34.550 --> 24:35.610]  Who could go up there?
[24:36.090 --> 24:36.830]  Virtually anybody.
[24:37.130 --> 24:42.110]  Really, what's stopping anybody from getting on the roof is a trap door with a lock, like a padlock.
[24:43.010 --> 24:43.530]  Cut it.
[24:43.810 --> 24:44.670]  Now you have access.
[24:44.810 --> 24:47.550]  Now, I don't think anyone's going to go on a roof to go after a node.
[24:47.770 --> 24:48.610]  That's kind of bizarre.
[24:48.890 --> 24:50.130]  Maybe just hate somebody.
[24:50.250 --> 24:50.670]  I don't know.
[24:50.770 --> 24:52.050]  I don't know what the motivation would be.
[24:52.050 --> 24:54.870]  But if you are up there and you go, what the hell is this?
[24:54.930 --> 24:55.690]  This doesn't belong here.
[24:55.770 --> 24:57.150]  And you start whacking it with a stick.
[24:57.510 --> 25:00.750]  Now, you know, the person that uses that's going to say like, what the hell are you doing?
[25:00.770 --> 25:02.090]  This thing cost me a lot of money.
[25:02.370 --> 25:06.330]  Well, that's my point is there's nothing really stopping anybody from attacking it.
[25:06.410 --> 25:08.430]  Now, you might be thinking, put a camera on it.
[25:08.550 --> 25:09.970]  We'll break the camera and then attack it up.
[25:10.070 --> 25:12.350]  It's like, there's always a way around some physical attack.
[25:12.350 --> 25:16.710]  So just kind of be aware of that as a possible threat.
[25:17.010 --> 25:24.110]  And if this is something important, I'm hearing more and more companies are starting to look at MeshTastic to do things with like OT networks.
[25:24.230 --> 25:35.230]  Well, now, if your transmission node or whatever sensor, maybe, you know, weather detection, you now have that risk of your device that you're relying on being physically attacked.
[25:35.230 --> 25:38.050]  So keep that in mind, come up with a countermeasure.
[25:40.210 --> 25:45.970]  Calvin, who works with me at Cisco and who I met through the whole MeshTastic community, that's his shed in his backyard.
[25:46.610 --> 25:50.850]  And Calvin was trying to like, he's trying to reach Chicago because he's in Des Moines, Iowa.
[25:51.290 --> 25:52.170]  Sorry, I doxxed you.
[25:52.730 --> 25:57.110]  So he's in Iowa and he's seeing people from Chicago in Iowa.
[25:57.790 --> 25:58.550]  Holy shit.
[25:59.230 --> 26:01.050]  So he's trying to transmit back.
[26:01.050 --> 26:06.330]  So he put it on his shed and then he realized there was too much in the way and it's not reaching.
[26:07.030 --> 26:08.850]  So he put it on a grain silo.
[26:11.050 --> 26:13.210]  I mean, I'm from New York.
[26:13.370 --> 26:14.450]  I live in Chicago suburbs.
[26:14.970 --> 26:15.970]  I've been to Iowa.
[26:16.150 --> 26:19.550]  But I guess in Iowa, you can walk down the street and there's a grain silo.
[26:20.330 --> 26:22.110]  I don't know any other world that has that.
[26:22.210 --> 26:24.050]  But he went up there and he put his node.
[26:24.170 --> 26:25.050]  That's the far right one.
[26:25.190 --> 26:26.070]  And he put it up there.
[26:26.190 --> 26:30.370]  Now, I mentioned before, I do have a little bit of fear of heights.
[26:30.370 --> 26:31.610]  And I love cookies.
[26:32.050 --> 26:34.010]  You could put the world's best cookies on there.
[26:34.330 --> 26:37.730]  I ain't fucking going up there to steal that radio and the cookies.
[26:38.330 --> 26:39.850]  That's safe against me.
[26:39.970 --> 26:41.030]  But maybe not other people.
[26:42.570 --> 26:43.130]  All right.
[26:44.150 --> 26:44.830]  Excuse me?
[26:44.950 --> 26:45.810]  Was he successful?
[26:46.210 --> 26:46.450]  No.
[26:46.730 --> 26:46.890]  No.
[26:47.250 --> 26:47.850]  Lack of power.
[26:49.110 --> 26:49.710]  All right.
[26:49.830 --> 26:52.850]  Let's talk about privacy leaks and some kinds of exposure.
[27:05.210 --> 27:06.490]  You're very astute, sir.
[27:06.930 --> 27:08.110]  Yeah, there's a theme.
[27:10.990 --> 27:16.250]  Now, the Meshtastic devices that support GPS, it's pretty cool, right?
[27:16.250 --> 27:16.850]  They're tiny.
[27:17.130 --> 27:18.130]  They're transmitting.
[27:18.350 --> 27:19.470]  You know, your phones do this.
[27:20.890 --> 27:24.390]  But what are the issues with somebody knowing where you are?
[27:25.090 --> 27:31.290]  What if you are, say, a CEO of an insurance company walking down the street in New York City?
[27:33.010 --> 27:40.890]  Well, I don't think they had a Meshtastic node on them, but, you know, it could happen for somebody who might be a higher asset target.
[27:42.910 --> 27:51.650]  I'm hearing terrorist organizations are using Meshtastic now because it's off-grid computing and there's no way to trace it back to a carrier.
[27:51.830 --> 27:56.010]  Remember, you don't need, you know, Verizon or AT&T or any of those other companies.
[27:56.010 --> 27:56.850]  You don't need the Internet.
[27:57.130 --> 28:03.190]  So if you're off-grid and you've got nefarious intentions, this is the perfect tool for that.
[28:04.250 --> 28:12.050]  Law enforcement is already working on ways of triangulating and figuring out who's doing what based on the addresses that are coming off of these devices.
[28:12.490 --> 28:20.090]  So those folks need to do a little bit more homework and figure out that just because it feels like it's anonymous doesn't necessarily mean it is.
[28:20.830 --> 28:21.830]  And there's other things.
[28:22.030 --> 28:27.170]  So there was a CVE that came out April this year.
[28:27.370 --> 28:29.650]  So before there were none, now there is one.
[28:29.870 --> 28:33.970]  And there's more and more research being done specifically on how to track these devices.
[28:33.970 --> 28:41.550]  So my advice, and I'm probably repeating this too many times, use the GPS when you need it.
[28:41.970 --> 28:52.450]  Use it for good intentions like finding water when you're backpacking wherever or camping or on a river and there's no way to really communicate with folks.
[28:53.470 --> 28:55.610]  Put it in a bag so it doesn't get wet, a little short.
[28:56.090 --> 29:02.170]  But turn it off when you're done because if somebody really wants to get at you, they will.
[29:02.170 --> 29:12.070]  And if you're using this, they'll find you because if there's stuff that law enforcement's using, eventually that stuff is also available open-source or the other way around.
[29:12.070 --> 29:15.870]  It's available by open-source and law enforcement's in using it.
[29:16.730 --> 29:20.170]  I also wanted to show you kind of like this Chicago activity, right?
[29:20.470 --> 29:22.450]  These are folks beaconing their positions.
[29:23.630 --> 29:26.470]  So I know where CCTA is.
[29:27.730 --> 29:32.390]  That's a node that's by the transit authority by California Ave.
[29:33.250 --> 29:36.490]  Or sorry, not the transit authority, the rail, the L.
[29:36.690 --> 29:38.030]  We call it an L, you call it a subway.
[29:38.830 --> 29:40.730]  They call it an L, we call it a subway.
[29:41.290 --> 29:42.270]  Or any of these others.
[29:42.390 --> 29:43.310]  There's one like pasta.
[29:43.310 --> 29:44.350]  There's one called pizza.
[29:44.350 --> 29:46.170]  There's one of a Christmas tree.
[29:46.950 --> 29:47.830]  Johnny Christmas.
[29:48.210 --> 29:51.970]  So you can give away your position unintentionally.
[29:52.170 --> 29:54.290]  And some people feel like that's okay.
[29:54.970 --> 29:58.330]  But it depends upon what you're doing and who you are.
[29:58.510 --> 29:59.950]  You may not want that.
[30:00.190 --> 30:03.390]  You might just be better off not having a device with a GPS at all.
[30:04.130 --> 30:05.850]  Or don't even use MeshTastic.
[30:07.250 --> 30:07.770]  Sorry.
[30:07.770 --> 30:10.310]  The other nice feature is in the map.
[30:10.490 --> 30:12.950]  So there's in the app on your phone.
[30:13.190 --> 30:17.230]  When you go to the map, there's a feature called Map Route.
[30:17.570 --> 30:20.670]  And you can see where I was like walking around downtown Chicago.
[30:21.490 --> 30:24.410]  I don't remember being that drunk and walking around all those places.
[30:24.450 --> 30:25.590]  But that's what it said I did.
[30:25.810 --> 30:30.530]  And I guess it's true because I walked on somebody's building or across a roof.
[30:30.670 --> 30:33.090]  But you know, there's these capabilities as well.
[30:34.450 --> 30:35.810]  So let's look at key management.
[30:35.810 --> 30:40.030]  I mentioned before, the primary channel is 8-bit.
[30:40.510 --> 30:41.050]  Fine.
[30:41.210 --> 30:41.990]  It's a public channel.
[30:42.110 --> 30:42.510]  Who cares?
[30:44.130 --> 30:45.590]  There's an issue for me.
[30:45.810 --> 30:49.090]  What do we tell our users to do with their passwords?
[30:51.450 --> 30:52.770]  Yeah, write them down.
[30:53.170 --> 30:53.930]  Change them.
[30:54.190 --> 30:55.030]  Rotate them.
[30:55.350 --> 30:58.710]  You know, we enforce certain lengths and policies and complexities.
[30:59.010 --> 31:01.810]  And you can have it generate like a random one for you.
[31:02.830 --> 31:06.330]  But there's no requirement in the software to do that.
[31:06.650 --> 31:07.510]  Now, I get it.
[31:07.690 --> 31:20.710]  If you're sharing your AES 256-bit key with a group of folks like the channel called Hackercoms, which I could share with people if you want to get it and go on to any conference in the Hackercom channel and chit chat with other hackers.
[31:21.270 --> 31:23.610]  But don't you think we need to rotate that over time?
[31:23.830 --> 31:26.110]  Like, this is a practice we tell people regularly.
[31:26.270 --> 31:28.070]  It's not built into the firmware.
[31:28.550 --> 31:29.690]  That's an issue for me.
[31:30.150 --> 31:31.470]  And the randomness is okay.
[31:31.470 --> 31:38.570]  But anybody that knows anything about entropy, is anything truly random created by us?
[31:39.310 --> 31:41.470]  Unless you have very expensive devices.
[31:41.990 --> 31:43.710]  And is this a very expensive device?
[31:43.970 --> 31:44.030]  No.
[31:44.550 --> 31:44.810]  Exactly.
[31:45.230 --> 31:46.470]  So it's not truly random.
[31:47.290 --> 31:51.690]  I know people that used to work at the NSA that'll argue there's no such thing as true randomness except nature.
[31:51.810 --> 31:52.470]  And we're not nature.
[31:52.810 --> 31:55.950]  If it's quantum effects, I'll argue with him on it.
[31:56.490 --> 31:56.810]  Okay.
[31:57.170 --> 31:58.890]  I'll get you introduced to him.
[32:00.510 --> 32:02.430]  Also, the keys, they're fairly static.
[32:02.430 --> 32:05.350]  I think when you're setting up your device, creating like an ephemeral key.
[32:05.430 --> 32:10.130]  And if you're not familiar with that, it's basically a key that's generated for a single purpose and a use.
[32:10.230 --> 32:14.710]  And you use it, you get your device set up, maybe get it registered or added to something.
[32:14.990 --> 32:18.750]  And then it goes away and you're using another key that's a little bit more long term.
[32:19.530 --> 32:22.250]  And also the key exchange is basically sneaker net.
[32:22.390 --> 32:23.330]  It's copy and paste.
[32:23.470 --> 32:26.770]  There's no other way to say, hey, we want you to join this channel.
[32:26.770 --> 32:33.930]  Come here and once we validate who you are, and maybe throw down a little MFA, then you can have access to this stuff.
[32:34.210 --> 32:39.570]  You just drop it into Discord server, put it on the Internet, willy nilly, there's no control.
[32:39.650 --> 32:40.810]  In some cases, it doesn't matter.
[32:40.970 --> 32:41.970]  I accept that argument.
[32:42.170 --> 32:52.230]  But when it does, if you're using it for life saving reasons, or reasons related to your company's capitalism, well, you're going to want to protect it.
[32:53.730 --> 33:01.450]  The keys there are also, if you want to do any kind of administrative management remotely, you can use PKI keys.
[33:01.550 --> 33:04.410]  So it'll create a key for you or certificate, whatever you want to call it, but it's more of a key.
[33:05.050 --> 33:11.030]  And when you put that key in there, again, no rotation, no ways to share it other than copy pasta.
[33:11.610 --> 33:12.410]  It sucks.
[33:12.930 --> 33:17.210]  When I'm setting up my device, I'm plugged into my computer through a serial port.
[33:17.210 --> 33:21.090]  I'm going to client.meshtastic.org to configure it.
[33:21.310 --> 33:32.510]  Since I'm already on the Internet and I'm already having physical access to the device, why wouldn't I want to use like a PKI that's in the cloud somewhere or managed by Komodo?
[33:33.190 --> 33:35.050]  Sorry, I can't say their name without laughing.
[33:35.350 --> 33:38.030]  Some other company that does key distribution.
[33:38.030 --> 33:50.670]  And, you know, I'll pay them 10 bucks a year to do that, to create a key for me and do some validation and to make sure, hey, when I'm done using this key, you're now going to say it's expired and it no longer has a purpose or a use.
[33:50.810 --> 33:53.650]  And if anybody else happens to have it, well, they're SOL.
[33:54.110 --> 33:55.210]  None of that exists.
[33:55.250 --> 33:57.370]  Well, we should build that.
[33:57.570 --> 34:03.490]  I think our community can put something like that together and make this tool a little better, maybe a lot better.
[34:04.730 --> 34:08.070]  The platform also, they're fairly weak and low powered.
[34:08.350 --> 34:12.350]  So for you to say, hey, well, why don't we just do it on the device?
[34:12.350 --> 34:14.230]  You're really asking for way too much.
[34:14.350 --> 34:20.710]  You're better opportunity to boil the ocean where this thing is just going to sit there and churn and it may even break.
[34:20.890 --> 34:25.150]  So we'd have to do something offline or in the cloud.
[34:25.390 --> 34:28.470]  But this platform is only really intended for what it does.
[34:28.470 --> 34:33.570]  It's just to transmit radio signals, low power, pretty far sometimes.
[34:33.850 --> 34:37.670]  Otherwise, it doesn't have many, many, many other uses.
[34:38.390 --> 34:42.750]  And also my last complaint is it was built by IT people.
[34:43.010 --> 34:46.910]  And not that it's built by IT people, but they're thinking like IT people.
[34:47.050 --> 34:48.970]  It has a very focused use.
[34:49.210 --> 34:51.250]  It's not super user friendly.
[34:51.670 --> 35:01.430]  When you look at the configurations, when you try to get into advanced configs, there's nothing in here that's really educating folks like, hey, by the way, if you do something like this, here's the implications.
[35:02.410 --> 35:04.750]  I will add a little asterisk to the bottom.
[35:04.950 --> 35:06.350]  They are getting better at that.
[35:06.470 --> 35:11.630]  So now when you go use the tool, they do have some warning pop-ups here and there for certain things.
[35:11.810 --> 35:24.790]  But if you turn on remote admin and you're publishing your key with your group and someone's mad at you and they make it available, anyone that has near access physicality to your device can now also remotely admin your device.
[35:25.050 --> 35:28.110]  Great example of the remote admin is the one on the grain silo.
[35:28.330 --> 35:34.950]  Because if you want to just make a small change or do some update, you don't want to climb all the way up there and plug in.
[35:35.110 --> 35:38.470]  You just want to like be able to do it over the wire, which is what it's built for.
[35:38.950 --> 35:42.110]  So more education and better offline distribution.
[35:42.110 --> 35:44.190]  Now, here's the best part.
[35:45.110 --> 35:46.150]  Radio Jack.
[35:46.930 --> 35:49.950]  So one of our community members in BurbSec.
[35:50.770 --> 35:51.650]  Thank you.
[35:52.570 --> 35:52.890]  Varks.
[35:53.290 --> 35:56.730]  He's a software developer for medical devices.
[35:57.150 --> 36:04.750]  He was doing some tabletop exercises and he threw out, Hey, this meshtastic phenomenon.
[36:04.870 --> 36:14.710]  This is something that somebody could potentially use to break into our OT network and possibly compromise, you know, maybe a heart lung machine or something like that.
[36:15.390 --> 36:18.570]  And right away, that ain't gonna happen.
[36:19.310 --> 36:21.870]  Never tell a hacker it's impossible.
[36:22.330 --> 36:24.530]  Well, it's possible now.
[36:24.710 --> 36:25.690]  And it's right in front of you.
[36:25.930 --> 36:27.310]  So he went to work.
[36:27.310 --> 36:33.190]  He found one of these, these lovely little Lily go T dongles.
[36:33.430 --> 36:35.250]  And it has a display and it's really cute.
[36:35.350 --> 36:38.770]  Cause when you plug it in, he changed the default to a laughing skull.
[36:39.250 --> 36:40.970]  Kind of gives you a clue.
[36:40.970 --> 36:49.450]  If you find this in a parking lot, not to plug it in, or when it plugs in, you pull it out really fast, but you could change it to a puppy, a cute little puppy.
[36:49.650 --> 36:51.230]  And maybe they'll leave it in their computer.
[36:51.590 --> 36:54.210]  Um, and it's essentially an Arduino device.
[36:54.570 --> 36:58.030]  So he wrote Arduino code, which is really easy to write.
[36:58.610 --> 36:59.390]  It's Wi-Fi.
[37:00.530 --> 37:05.430]  And you take one of these devices and you configure it to be managed through Wi-Fi.
[37:05.710 --> 37:09.850]  Cause a part of the protocol is there's a channel to send commands back and forth over Wi-Fi.
[37:10.210 --> 37:11.530]  So you pair these two up.
[37:12.150 --> 37:15.990]  So the way the attack works is you leave this in a parking lot or several of them.
[37:16.150 --> 37:16.730]  It's 10 bucks.
[37:17.350 --> 37:19.270]  Um, somebody plugs it in.
[37:19.270 --> 37:24.730]  And this is hiding behind a bush or maybe somewhere you can get some sunlight with like a power bank.
[37:24.850 --> 37:25.990]  That's got a solar panel on it.
[37:26.050 --> 37:30.210]  So it stays alive and you just kind of leave it someplace outside their building.
[37:30.650 --> 37:37.730]  When this is plugged in, it's going to like every 30 seconds, it sends a command like, Hey, I'm here.
[37:37.950 --> 37:38.630]  Are you there?
[37:38.890 --> 37:41.990]  It doesn't exactly say that, but it's just beaconing to let you know it's active.
[37:42.670 --> 37:46.310]  And then you take your device and you go in on the network.
[37:46.490 --> 37:47.930]  Now you're not using the primary channel.
[37:48.090 --> 37:51.730]  You're using your own custom radio jack channel, which you'll see in the demo.
[37:52.870 --> 37:55.050]  But these two are talking to each other over Laura.
[37:55.790 --> 37:57.370]  This guy's talking to my phone.
[37:57.870 --> 38:02.350]  So when I go into that channel on my phone and it's seeing that, Hey, are you there?
[38:02.570 --> 38:08.210]  Like I know I have a target, but that's basically what that does or what that's showing.
[38:09.470 --> 38:10.310]  Let's see the demo.
[38:10.750 --> 38:11.650]  Oh, it's okay.
[38:16.680 --> 38:17.460]  There's no audio.
[38:17.620 --> 38:19.140]  It's for me to describe to you what's going on.
[38:19.260 --> 38:21.020]  So let me pause it for a second.
[38:21.020 --> 38:21.940]  So I catch up.
[38:23.300 --> 38:27.080]  Just so you know, this is my 13 year old's computer.
[38:27.260 --> 38:28.260]  Mine doesn't look this cool.
[38:29.040 --> 38:30.940]  It's default background wallpaper.
[38:31.160 --> 38:34.320]  I am super boring and I'm mirroring my iPhone.
[38:35.040 --> 38:38.540]  So just so you know, this is not something the victim would see.
[38:38.640 --> 38:40.300]  This is something just for this demo.
[38:40.520 --> 38:42.960]  They would see some of the other stuff that I'll point out in a bit.
[38:44.380 --> 38:48.700]  Now, when it's plugged in, I am typing the word menu on my phone.
[38:50.840 --> 38:51.460]  There we go.
[38:51.600 --> 38:52.460]  It's catching up to us.
[38:52.820 --> 38:55.840]  When I type in menu, it's going to tell me what my command options are.
[38:55.940 --> 38:56.660]  You guys can see them.
[38:56.800 --> 38:57.820]  Sorry for the folks over there.
[38:58.700 --> 39:03.880]  Once you've got connectivity, then you drop your payload, which is PowerShell.
[39:04.020 --> 39:08.580]  So basically, Arduino code is outputting PowerShell and it's telling the window to minimize.
[39:08.940 --> 39:12.060]  Most users are used to admin people using PowerShell.
[39:12.060 --> 39:13.540]  So this is normal to them.
[39:14.200 --> 39:16.240]  Then I told it to use...
[39:17.040 --> 39:18.300]  Oh, to echo hello.
[39:18.560 --> 39:18.980]  Hello world.
[39:19.260 --> 39:23.800]  The echo is a test to make sure I have connectivity, but I forgot to type in the serial command.
[39:24.220 --> 39:25.160]  I'm human too.
[39:25.440 --> 39:29.460]  And then once I get hello world back, now I know I'm in control of this device.
[39:30.300 --> 39:32.660]  Then I also copied and pasted.
[39:32.800 --> 39:33.620]  Then it echoes back.
[39:33.860 --> 39:34.300]  Hello world.
[39:34.620 --> 39:35.080]  There it goes.
[39:35.580 --> 39:40.460]  Then let's launch something to see that if we can actually run an application.
[39:41.080 --> 39:42.400]  So we're going to run Calc.
[39:42.800 --> 39:43.900]  Calc is fairly safe.
[39:44.360 --> 39:45.180]  It's working.
[39:45.380 --> 39:48.680]  And I got back the positive confirmation that I wanted, which was that output.
[39:49.080 --> 39:50.080]  Let's use something.
[39:50.260 --> 39:52.040]  Let's attack this machine with Notepad.
[39:52.280 --> 39:53.700]  So we're going to launch Notepad.
[39:53.820 --> 39:54.300]  There we go.
[39:54.620 --> 39:57.460]  This literally could be a bit more malicious.
[39:58.400 --> 39:59.240]  You can launch Outlook.
[39:59.240 --> 40:00.920]  You can launch whatever's on that device.
[40:01.220 --> 40:06.740]  So if you want to do like living off the land type attacks, you can totally launch these devices or those applications.
[40:07.120 --> 40:09.080]  So then you tell it to turn off.
[40:09.240 --> 40:10.000]  And did you sell the command?
[40:10.120 --> 40:11.780]  It was radio jack off.
[40:12.420 --> 40:13.620]  I didn't make it up.
[40:13.720 --> 40:14.420]  This is not me.
[40:14.880 --> 40:16.660]  So you got to turn serial off.
[40:16.820 --> 40:21.420]  So when you're flipping between like keyboard, echo, and serial, you turn, you run that command.
[40:21.720 --> 40:22.860]  So here it says keyboard.
[40:23.520 --> 40:27.020]  Means I'm going to now send some keyboard commands to Notepad.
[40:27.020 --> 40:33.160]  In this demo on my kid's machine, I clicked on the emulated iPhone window.
[40:33.380 --> 40:34.820]  So I went off a Notepad.
[40:34.960 --> 40:35.760]  So it didn't work.
[40:36.540 --> 40:38.800]  As you see me typing, this could have been something else.
[40:38.940 --> 40:40.820]  It could have been email or IM.
[40:41.020 --> 40:42.720]  It didn't send it because it lost focus.
[40:43.140 --> 40:45.440]  In a normal attack, it would not lose focus.
[40:46.380 --> 40:48.420]  It's just simulated environment.
[40:50.460 --> 40:51.240]  Paste it.
[40:53.260 --> 40:53.740]  Boom.
[40:54.220 --> 40:55.000]  Sends a command.
[40:55.300 --> 41:02.100]  And there's the keystrokes appearing on that remote device from my phone to a Windows 11 machine.
[41:02.300 --> 41:03.820]  Or Windows 10, whichever you prefer.
[41:04.200 --> 41:05.660]  And that was the end of the demo.
[41:06.000 --> 41:07.480]  So, I don't know folks, what do you think?
[41:07.600 --> 41:08.840]  But I think VARCS killed it.
[41:09.040 --> 41:09.980]  Want to give it up for VARCS?
[41:14.490 --> 41:15.710]  So we're coming near the end.
[41:15.830 --> 41:16.810]  I think I got a few minutes left.
[41:16.970 --> 41:18.370]  We're going to talk about some best practices.
[41:33.110 --> 41:34.050]  That's the best part.
[41:34.050 --> 41:34.130]  All right.
[41:34.430 --> 41:35.770]  So, best practices.
[41:35.950 --> 41:37.010]  Never do that.
[41:38.570 --> 41:44.350]  Going back to those initial security concerns, we're going to now break this down.
[41:44.890 --> 41:45.670]  First, physical.
[41:46.330 --> 41:48.790]  You want to secure and monitor the device, right?
[41:48.810 --> 41:50.890]  I talked about the person going up there and hitting it with a stick.
[41:51.350 --> 41:54.650]  Come up with a better countermeasure that can't be bypassed with like a lock cutter.
[41:55.270 --> 41:56.770]  Or something tamper-evident.
[41:56.790 --> 42:03.090]  If you're not familiar with that, those are those locks that once they pull and somebody messes with it, then you kind of know it was tampered with.
[42:05.050 --> 42:06.650]  Always use the strongest algorithms.
[42:06.890 --> 42:09.870]  And if you're using a tool that does not have it, file a feature request.
[42:10.090 --> 42:13.210]  Tell the developers, I want you to use stronger code.
[42:13.470 --> 42:14.790]  Or excuse me, stronger keys.
[42:15.070 --> 42:16.250]  Or write your code better.
[42:17.330 --> 42:21.430]  You want to be able to share these keys remotely and enforce some kind of rotation schedule.
[42:21.430 --> 42:27.190]  And you don't want to always share them on the Internet or even if it's in a group like BurbSec and you drop the keys.
[42:27.450 --> 42:30.650]  Again, there could be somebody who joined your group that has malicious intent.
[42:31.210 --> 42:32.370]  There's more to come, sir.
[42:34.150 --> 42:36.810]  Avoid using GPS unless you really need to.
[42:36.970 --> 42:37.710]  I've said this before.
[42:38.090 --> 42:40.070]  And then when you don't need it, turn it off.
[42:40.730 --> 42:42.930]  I have it running just kind of as a point.
[42:43.110 --> 42:47.650]  But if you really want to protect yourself and your privacy and your location, use it if you need it.
[42:47.730 --> 42:49.630]  Or don't even get a device with a GPS in it.
[42:51.170 --> 42:53.190]  Pay attention to what's going on in your network.
[42:53.530 --> 42:55.050]  Use things like WIPs or WIDs.
[42:55.210 --> 42:57.450]  Just basically wireless IDS or IPS.
[42:57.450 --> 43:01.570]  And if somebody's broadcasting in your network on 915 megahertz.
[43:01.670 --> 43:03.070]  I'm repeating myself on purpose.
[43:03.710 --> 43:04.990]  Do something to stop it.
[43:05.090 --> 43:05.510]  Air defense.
[43:05.510 --> 43:09.130]  There's a lot of tools out there that if they see rogue APs, they shut them down.
[43:09.330 --> 43:14.910]  You should be doing the same thing, especially if you're in an environment that has anything to do with people's lives.
[43:16.690 --> 43:17.450]  Always patch.
[43:17.610 --> 43:18.390]  Update the firmware.
[43:18.710 --> 43:23.150]  The folks that developed this, they do have a regular cadence of updates and patches.
[43:23.450 --> 43:27.210]  And I've been running beta code where most of their code is beta.
[43:27.210 --> 43:28.430]  And they're fairly stable.
[43:28.590 --> 43:32.770]  So I strongly recommend keep an eye on their updates and keep patching your devices.
[43:33.910 --> 43:37.370]  On your endpoints to protect against this particular attack.
[43:37.690 --> 43:42.570]  There's a lot of things you can do like break the USB ports or put glue in them.
[43:42.810 --> 43:45.350]  Or use some kind of device control, which could be bypassed.
[43:45.790 --> 43:48.530]  And I'll introduce you to Dr. Polster if you want to see how that works.
[43:48.870 --> 43:52.710]  But you want to do something to prevent people from being able to just plug in anything.
[43:52.950 --> 43:54.970]  And again, you're going to have like salespeople, whoever.
[43:54.970 --> 43:57.250]  That's the only way I can share things with users.
[43:57.370 --> 43:58.190]  No, there are better ways.
[43:58.330 --> 43:59.570]  But avoid it.
[43:59.850 --> 44:00.230]  Avoid it.
[44:01.730 --> 44:02.270]  All right.
[44:02.550 --> 44:03.350]  This is the wrap up.
[44:03.550 --> 44:04.690]  These are my three asks.
[44:04.870 --> 44:06.790]  One, support the mesh.
[44:07.390 --> 44:11.810]  Whether you're just going to add a node or if you can write code, add some code.
[44:11.990 --> 44:15.290]  Do something to contribute or teach people.
[44:15.470 --> 44:16.370]  Raise some kind of awareness.
[44:16.990 --> 44:20.730]  If you're really good at checking code, can you vet it?
[44:21.470 --> 44:23.770]  Because one vulnerability was found in April.
[44:23.890 --> 44:24.970]  There's a CVE out there.
[44:25.230 --> 44:26.650]  I'm sure there are many more.
[44:26.790 --> 44:33.850]  And if somebody can modify the code, the firmware loaded on their device, which can then infect other devices across the network.
[44:34.230 --> 44:35.890]  Well, now we got a bigger problem.
[44:36.810 --> 44:40.430]  And just stay safe out there because we're a community.
[44:40.630 --> 44:41.170]  We're a family.
[44:41.350 --> 44:46.910]  Even though we don't know some of each other's names, we all have the same intent to make the world a little safer the best way we can.
[44:47.230 --> 44:48.630]  So look out for one another.
[44:49.430 --> 44:50.370]  Unlike this guy.
[44:52.710 --> 44:53.530]  Yo, Ben.
[44:53.950 --> 44:55.370]  Do you know where my leftovers went?
[44:56.990 --> 44:58.490]  I know where that leftover cake went.
[45:03.550 --> 45:04.350]  All right.
[45:05.190 --> 45:06.170]  Ended on a high note.
[45:07.170 --> 45:08.830]  So here's a resource slide.
[45:08.990 --> 45:10.010]  You can take a picture of that.
[45:10.170 --> 45:12.610]  These are some of the things in the websites that I already mentioned.
[45:13.410 --> 45:14.750]  There's a lot of stuff out there.
[45:14.890 --> 45:16.490]  There's more tools that are coming out.
[45:16.490 --> 45:23.050]  People's Git Hubs are filling up with ways of getting into MeshTastic and breaking it and modifying it, doing other cool fun things.
[45:23.870 --> 45:25.030]  We are good on Q&A.
[45:26.450 --> 45:28.510]  So if we run out of time, you know where to find me.
[45:28.910 --> 45:29.310]  LobbyCon.
[45:29.610 --> 45:30.410]  First question.
[45:31.110 --> 45:34.170]  First, I want to say I'm never coming to anyone in your talks again with those videos.
[45:34.730 --> 45:35.710]  You know what, sir?
[45:35.910 --> 45:37.130]  I appreciate that.
[45:37.130 --> 45:38.850]  And I'm going to definitely hold you to that.
[45:39.110 --> 45:43.330]  But I gave this talk at least five other places and I added these just for hope.
[45:43.810 --> 45:44.190]  Thank you.
[45:44.190 --> 45:44.430]  Yeah.
[45:45.130 --> 45:51.230]  My question is regarding, have you ever seen anybody use this stuff for malicious tracking?
[45:51.430 --> 45:55.110]  You know, there used to be, there used to be a Bluetooth cloud card.
[45:55.430 --> 45:55.710]  Yeah.
[45:57.410 --> 45:59.430]  There's more tools to be able to discover those.
[45:59.610 --> 46:05.370]  But have you ever seen anybody using, I have a seed studio, like a credit card size one that has a GPS.
[46:05.950 --> 46:11.110]  Have you ever seen anybody using the security, using those for violating those privacy or tracking?
[46:11.790 --> 46:15.350]  So the question is, I'm going to press it down, make it more concise.
[46:16.310 --> 46:19.570]  Are any, is anybody out there using these devices for malicious intent?
[46:20.410 --> 46:21.330]  Have I seen it?
[46:21.410 --> 46:21.570]  No.
[46:21.990 --> 46:22.570]  Do I believe it?
[46:22.750 --> 46:23.010]  Yes.
[46:23.170 --> 46:23.810]  It's happening.
[46:24.430 --> 46:26.310]  There are good, good intents.
[46:26.430 --> 46:37.090]  Like for example, if you do go to some national park, more and more, they're making like they, they put up a Mesh-tastic router and you could see the board and see what the communications are.
[46:37.210 --> 46:43.050]  So if somebody is like trapped, so like, oh, they're trapped and using Mesh-tastic and they don't have a radio.
[46:43.050 --> 46:46.190]  And you know, that is freaking phenomenal, right?
[46:46.750 --> 46:52.630]  But as far as what's going on malicious, unless they post it in a paste bin or on a blog, we don't know about it, right?
[46:53.070 --> 46:59.330]  So it's a good question and it's reasonable, but it will come out more and more once it's becoming a bit more mainstream.
[47:00.230 --> 47:01.130]  Another question.
[47:03.890 --> 47:08.290]  Can you use this on moving objects or speed requirements?
[47:08.990 --> 47:13.410]  The question is, can this be used on moving objects for speed requirements?
[47:14.770 --> 47:21.270]  Like if you're going 60, 100 or 200 miles an hour, is that like, is there a problem with communication at that point?
[47:22.390 --> 47:25.670]  Oh, specifically, can the device handle going at high speeds?
[47:26.030 --> 47:26.070]  Yes.
[47:26.070 --> 47:28.930]  Well, you need to connect to another node on the mesh.
[47:29.030 --> 47:33.870]  And if that takes a bit of a handshake and you're not able to perform that handshake, then yes.
[47:35.510 --> 47:39.710]  I have driven and I've seen people use it on an airplane and I was on a train.
[47:39.910 --> 47:41.490]  I wasn't communicating with people.
[47:41.630 --> 47:42.910]  I was doing that to map my route.
[47:43.270 --> 47:45.170]  So it works at higher speeds.
[47:45.350 --> 47:49.510]  But as far as communicating, unless they're going the same speed, I think it's hit or miss.
[47:50.190 --> 47:52.970]  I mean, if you want to do a proof of concept with me, we can try it.
[47:55.570 --> 47:56.310]  Hang on, sorry.
[47:56.530 --> 47:57.210]  One at a time, sorry.
[47:57.490 --> 48:00.890]  I'm willing to bet from a plane it would work because of just the ridiculous line of sight.
[48:01.130 --> 48:04.150]  Because, you know, you're up there with an unobstructural view of that.
[48:04.230 --> 48:06.310]  But if you're on the ground, you're not going to pair up.
[48:07.570 --> 48:10.710]  So if two people on an airplane moving at the same speed, yeah, it's going to work.
[48:10.790 --> 48:12.490]  But one person on the ground, it's not going to work.
[48:12.750 --> 48:14.010]  Who was the other person that was talking?
[48:14.010 --> 48:17.010]  I was going to say, hams tend to call that picket fencing.
[48:17.310 --> 48:20.930]  That's when you put a sound on the radio, if you're using voice.
[48:21.290 --> 48:23.370]  So if you look that up, you can get a view of order.
[48:25.970 --> 48:27.910]  That picket fencing, you know what he's talking about?
[48:28.210 --> 48:37.750]  So the gentleman back there was saying in ham radios, there's like a term that, if you hear the up and out, like, it's called picket fencing, because it's like you're walking through like a picket fence that's got spaces.
[48:37.750 --> 48:45.650]  So it's a comparable, it's actually a pretty good comparison on how it might be able to connect with somebody, but then you're not going to be able to transmit everything.
[48:48.070 --> 48:49.110]  This guy was next.
[48:49.550 --> 48:54.610]  I've actually, a couple messages go back and forth to somebody on a plane flying over.
[48:56.730 --> 49:03.530]  You guys must have hit the max 21.88 kilovits, because, I mean, like, how did you do that?
[49:05.570 --> 49:07.430]  I think there was a repeater up on the mountain.
[49:07.890 --> 49:08.850]  Oh, you cheated.
[49:10.590 --> 49:13.630]  So the repeater got it and then you people on the ground got it.
[49:13.830 --> 49:15.890]  It wasn't like direct, but no, I'm just messing with you.
[49:16.010 --> 49:16.350]  It wasn't direct.
[49:16.550 --> 49:18.390]  Yeah, but that's what the routers are for.
[49:19.310 --> 49:19.970]  Yeah, absolutely.
[49:20.590 --> 49:20.790]  All right.
[49:21.210 --> 49:22.030]  How much more time?
[49:22.150 --> 49:22.970]  I got one minute left.
[49:24.230 --> 49:25.850]  We heard from this side of the room too much.
[49:26.010 --> 49:26.890]  Anybody on this side?
[49:27.110 --> 49:27.710]  All right, screw you.
[49:28.210 --> 49:29.270]  The guy in the back in the room.
[49:29.450 --> 49:34.270]  I work for a hospital and we try to keep spectrum hygiene in our critical care spaces.
[49:34.510 --> 49:39.670]  Do you know of anybody who's using spectrum analysis to look at Laura right now in those kind of spaces?
[49:40.070 --> 49:44.790]  So the question was, he works in a hospital using spectrum analysis for hygiene?
[49:45.690 --> 49:47.030]  The certain bands clean.
[49:47.170 --> 49:47.710]  Oh, okay.
[49:48.390 --> 49:50.750]  They want a clean wireless network.
[49:50.930 --> 49:53.050]  And he's wondering if there's anybody doing...
[49:53.050 --> 49:56.710]  Anybody looking at the Laura band in those sorts of spaces right now?
[49:56.870 --> 49:57.790]  No one told me.
[49:57.990 --> 49:59.970]  That's kind of why I'm doing this is try to get the word out.
[49:59.970 --> 50:03.330]  So people, if you're not, then you should start 950 megahertz.
[50:03.650 --> 50:05.890]  But no one's come back and said, yeah, you know, we're doing that.
[50:06.030 --> 50:10.710]  Maybe Varks is in his environment, but people should be.
[50:10.950 --> 50:12.850]  And if you want to be the first, let us know.
[50:13.690 --> 50:14.190]  Thank you.
[50:15.590 --> 50:16.490]  It is ISM.
[50:16.490 --> 50:16.710]  It is ISM, yeah.
[50:17.390 --> 50:20.350]  So you're going to see it anywhere or anyway, but all right, folks.
[50:20.490 --> 50:21.050]  Thank you so much.
[50:21.170 --> 50:21.910]  I really appreciate you guys.
[50:22.030 --> 50:22.710]  Fantastic audience.
[50:23.550 --> 50:24.350]  HOPE 17.
[50:24.790 --> 50:25.570]  HOPE you see you then.
[50:26.090 --> 50:26.230]  HOPE 17.