Multiprotocol FRAD/PAD Packet Switches - RADProductsOnline, Buy
A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf ·...
Transcript of A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf ·...
![Page 1: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/1.jpg)
A Fillory of PHYSergey Bratus, Travis Goodspeed, Ange Albertini,
Debanjum S. Solanky
![Page 2: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/2.jpg)
PHY gap?
PHY1 PHY2
?
![Page 3: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/3.jpg)
PHY Chimera?
![Page 4: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/4.jpg)
Outline
• How did we get here
• Cross-talking PHYs and where to find them
• A periodic table of PHY?
![Page 5: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/5.jpg)
Packet-in-packet (WOOT 2012)
![Page 6: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/6.jpg)
Packet-in-packet obstructed
• 802.11: b switches rates, g switches modulation mid-frame
• Whitening: 7-bit LFSR state is unknown
• Illegal strings (bypassable in 802.15.4)
• Encryption: can't predict bits on air from payload
![Page 7: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/7.jpg)
"PHY dialects, shaped charges"
![Page 8: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/8.jpg)
"PHY dialects, shaped charges"
![Page 9: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/9.jpg)
PHY Surprises
• Frame received may look nothing like the frame transmitted
• Not even share a single byte! ("1/8th of a nybble")
![Page 10: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/10.jpg)
PHY Surprises
• Frame received may look nothing like the frame transmitted
• Not even share a single byte! ("1/8th of a nybble")
• Signal received may be from another PHY entirely!
• PHYs can cross-talk & cross-inject
![Page 11: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/11.jpg)
No PHYA ϕ
ω
AFSK
Phase
Amplitude
Frequency
APSK
HERE BE DRAGONS
is an island
![Page 12: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/12.jpg)
A Mathematician and a Ham walk into a bar
• A(t) * sin( ω(t) + φ(t) ) for some choice of A, ω, φ
• Radio Spectrum downshifted to Audio frequency
• FSK or PSK
• The frequency or the phase changes
• Low data rate
• The signal must fit in an audio channel
![Page 13: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/13.jpg)
Why ham radio?
![Page 14: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/14.jpg)
RTTY
• Ancient military protocol (1940s), now used by amateurs (since 1970s)
• 2FSK modulation, Baudot Coding
• Low frequency, High frequency.
• 5/N/2 -- 5 Data Bits, No parity, 2 Stop Bits
![Page 15: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/15.jpg)
![Page 16: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/16.jpg)
![Page 17: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/17.jpg)
Radio Frequency (Carrier)
![Page 18: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/18.jpg)
Downshifted Audio Signal
![Page 19: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/19.jpg)
![Page 20: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/20.jpg)
PSK31
• 1990's Replacement for RTTY
• 31.25 Baud
• This is for human typing speed
• ~60Hz Wide
![Page 21: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/21.jpg)
![Page 22: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/22.jpg)
![Page 23: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/23.jpg)
Building PSK31 Encoder
• PSK31 is generated as *AUDIO*
• Audio cable runs from sound card to radio
![Page 24: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/24.jpg)
PSK31 Modulation• Phase is Inverted to mark a Zero
• Fancy way to say that SIN(x) becomes COS(x)
• Or COS(x) to SIN(x)
• Phase is Not Inverted to mark a One
• No change at all
![Page 25: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/25.jpg)
PSK31 Modulation• You can't just abruptly invert the phase
• This hurts your ears, hurts the speaker
• Drop the amplitude to zero before the shift
• Raise it back by mid-symbol
• So the amplitude drops for every Zero
![Page 26: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/26.jpg)
PHY Polyglots!
![Page 27: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/27.jpg)
Morse/PSK Polyglot• Dahs encode letters.
• E is shorter, fits in a Dit.
• Left is waterfall of letter K.
• Dah-Di-Dah
![Page 28: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/28.jpg)
Morse/PSK Polyglot• First Dah has K (dah-di-
dah) encoded.
• Dit is all Zeroes.
• Final Dah is all Zeroes
![Page 29: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/29.jpg)
PSK31/RTTY Polyglot
• RTTY cares about Relative Power
• PSK31 is tolerant to changes in power
• Only cares about Phase!
• We can combine the two!
![Page 30: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/30.jpg)
Not so easy• Bandwidth is different
•
• PSK31: phase RTTY: frequency
• Human operator actually looks at the waterfall!
![Page 31: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/31.jpg)
Welcome to Fillory!
![Page 32: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/32.jpg)
A diversion into 802.3
![Page 33: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/33.jpg)
• Data runs over Ethernet
• You control a bit of data
• But not very well (HTTP over Tor, for example)
• You want to exfiltrate a signal
• THE CLIENT IS HERE, GUYS!
• If the wiring is bad, it's not that hard
Madeline; or, The Accidental Tempest
![Page 34: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/34.jpg)
Madeline
![Page 35: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/35.jpg)
Back to ham radio
![Page 36: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/36.jpg)
Care to play along?
• Let's have a big CTF!
• 20 meter transmission from Northeast USA
• Receive by USB in most of Western Hemisphere.
![Page 37: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/37.jpg)
Conclusions• PHY is pliable and should be played with
• start with simpler protocols like PSK31, RTTY, ...
• more complex protocols are built of similar pieces
• parser differentials abound & should be understood
• Digital radio parsers allow polyglots with modulation, encoding, and even error correction
• not only in PDF/ZIP/GIF/JPEG/... of PoC||GTFO ;)
![Page 38: A Fillory of PHY - Department of Computer Sciencesergey/phy/fillory-of-phy-slides.pdf · Packet-in-packet obstructed • 802.11: b switches rates, g switches modulation mid-frame](https://reader033.fdocuments.net/reader033/viewer/2022052409/605f6a75ac25324c0e370be0/html5/thumbnails/38.jpg)
Image credits
• Manul drawings by Natalia Pavlushina http://www.animalist.ru/?action=show_gallery&artist=pavlushina and Olga Zakharovahttp://www.savemanul.org/images/full/manul_3w.jpg
• Map of Filloryhttp://brakebillskids.tumblr.com/post/141686464777/pawtersimms-so-i-finally-put-up-my-map-of-fillory