[00:03.250 --> 00:06.490]  When you're done, grab the camera and just head over there so you can catch a closing sermon.
[00:06.870 --> 00:15.630]  Let me just make this clear again, because we've got a guy down here in the front who's saying, boo, boo, use open source, boo.
[00:16.410 --> 00:24.490]  One of your fellow people here at the con stole the power supply to my laptop, which I do use that on, and I can't use my laptop because the battery's dead.
[00:24.710 --> 00:28.050]  And I had to put this together at the last minute so I could still give this lecture.
[00:28.270 --> 00:29.810]  So as I said before...
[00:30.570 --> 00:31.450]  Not DSD?
[00:31.510 --> 00:32.450]  Not DSD, yes.
[00:33.570 --> 00:34.910]  It's not DSD, what is it?
[00:35.590 --> 00:37.390]  Center for Recovery from DSD.
[00:39.690 --> 00:40.130]  Okay.
[00:43.410 --> 00:45.910]  I'm not going to bend over for the entire time.
[00:47.250 --> 00:49.510]  Okay, everyone, first of all, thank you all for coming.
[00:49.870 --> 00:55.770]  If I seem a little not quite who I usually am, it's because I've had two hours of sleep for the past four days each day.
[00:55.910 --> 00:57.910]  I've been working the con downstairs in the DJ room.
[00:58.630 --> 01:03.770]  And this is my last gig before getting some sleep, some food, and maybe a little bit of sanity in my life.
[01:03.890 --> 01:05.230]  So, bear with me.
[01:05.730 --> 01:08.910]  My name is Delchi, also known as the Entropy Technician.
[01:09.770 --> 01:13.210]  What I'm going to be doing is giving you a talk here on a theoretical device.
[01:13.630 --> 01:15.710]  And I now have a working model.
[01:15.710 --> 01:18.530]  The device is named the Spider Box.
[01:18.790 --> 01:23.610]  And this has to do with proximity card identification and security systems.
[01:24.170 --> 01:28.470]  Mostly in so much as physical security, but also in data security as well.
[01:29.210 --> 01:35.390]  The first thing I wanted to mention is that this is sort of a large community, all of us people out here.
[01:35.850 --> 01:39.190]  And the first thing I want to say is I did not do this on my own.
[01:39.730 --> 01:45.210]  A lot of other members of the hacker community have helped me with their advice, their ideas.
[01:45.630 --> 01:47.810]  And I want to thank a lot of them.
[01:48.210 --> 01:55.830]  Most specifically, Roadie, who's been the head of security this week, has been really helpful with me, helping me find some obscure hardware.
[01:56.370 --> 02:00.250]  And things to experiment on, because when you experiment with these things, sometimes they go boom.
[02:01.110 --> 02:04.930]  And I've worked my way through a lot of parts to get as far as I have.
[02:05.510 --> 02:13.670]  Also, the CDC, members of the CDC and the Ninja Strike Force also gave some invaluable help, as well as 303.
[02:14.170 --> 02:18.010]  So, word to my 303 people out there when you watch this on the net later on.
[02:19.410 --> 02:22.930]  How many people here have had experience with proximity cards before?
[02:25.850 --> 02:35.030]  I want to tell you, originally, the original version of this box, I was going to walk right down the middle of the road here and read your cards, and then tell you to pull them out and turn them over and look at the ID numbers on them and read them to you.
[02:35.570 --> 02:39.790]  That's not going to happen, thanks to the unfavorable market economy.
[02:39.790 --> 02:42.610]  I wasn't able to get the wide reader, but I do have a smaller demo.
[02:44.070 --> 02:50.930]  I'm not going to get too technical about the cards, but I want to give a quick overview of what I'm talking about when I talk about the spider box.
[02:51.550 --> 02:52.930]  First of all, what is it?
[02:53.370 --> 03:00.230]  It's a device that can theoretically clone, store, recall, generate the required signals to operate proximity-based badge security systems.
[03:01.210 --> 03:05.810]  Now, that right there, a lot of people read that and they said, whoa, that's some bad stuff.
[03:06.250 --> 03:07.590]  What are you doing?
[03:07.890 --> 03:12.490]  When I say theoretically, the only reason I say that is because I have not built the device.
[03:12.490 --> 03:13.850]  Why are they not built the device?
[03:14.130 --> 03:18.550]  Because I have no urgent need to be the star on next week's edition of Oz.
[03:21.090 --> 03:22.690]  The concept is this.
[03:23.150 --> 03:28.350]  Proximity cards are used widely for physical security in, well, let's see, where have we seen them?
[03:28.410 --> 03:29.410]  You see them in your offices.
[03:29.870 --> 03:31.610]  You see them in businesses.
[03:32.050 --> 03:35.570]  There are some housing developments that use it, some housing projects that use it.
[03:35.570 --> 03:42.790]  There are some larger facilities, did I say the word, that use them on a regular basis.
[03:43.570 --> 03:48.210]  And while this is strictly theoretical, as you're going to find out, the theory is very solid.
[03:49.870 --> 03:54.250]  Now, the one thing that people have asked me a lot this weekend is, where did this name come from?
[03:54.350 --> 03:55.710]  Where did I get the spider box?
[03:56.330 --> 04:01.570]  An associate of mine is a great artist, and he's involved in a project called Transmetropolitan.
[04:04.410 --> 04:11.370]  And any of you who have read Transmet, you know the episode, the episode, look at me, the issue where Spider is first going after the smiler.
[04:11.630 --> 04:17.090]  And he says, you know, fire it up, you know, give me fire, give me smoke, give me information.
[04:17.450 --> 04:21.650]  And when his assistant says, how are you going to find all this information?
[04:22.430 --> 04:30.030]  He is quoted as saying, I have devices that 99% of the security companies around the world have no idea about.
[04:30.790 --> 04:32.710]  And no one has really thought of it this way.
[04:32.850 --> 04:40.690]  I've talked to a lot of people who deal with proximity systems, and no one has ever really sat there and said, now wait a minute, how do you hack this thing?
[04:41.370 --> 04:43.190]  Let me tell you how I came to that conclusion.
[04:43.670 --> 04:49.010]  Our wonderful market economy led to a series of layoffs at one of my former employers.
[04:49.570 --> 05:00.090]  And one day I was sysadmin, and the next day I was sysadmin, programmer for the PBX, security person, and mop boy.
[05:01.650 --> 05:04.010]  Yes, I actually pushed mops as well as bits.
[05:04.010 --> 05:05.190]  It's kind of scary, but true.
[05:05.930 --> 05:10.770]  So I started pulling the system apart and trying to see how it worked because that's where it comes from.
[05:10.910 --> 05:15.590]  I mean, how many people out here when you were a kid ran around and said, you know, hey dad, how's the TV work?
[05:15.710 --> 05:16.350]  Give me a screwdriver.
[05:17.770 --> 05:21.850]  And when you got back from the ER, they said, you know, okay son, never do that again.
[05:24.750 --> 05:26.090]  My experience was a little different.
[05:26.250 --> 05:30.610]  I grew up in a very rural community, and the only closest thing to technology we had was the telephone guy.
[05:31.150 --> 05:35.010]  And I used to run behind the telephone guy, rip out all his work, and redo it all over again.
[05:35.890 --> 05:38.310]  So that's where it came from.
[05:38.530 --> 05:39.930]  That is where the name came from.
[05:41.010 --> 05:41.630]  Oh, stop it.
[05:42.790 --> 05:45.890]  Okay, the first thing I want to do is talk about what a proximity card is.
[05:46.790 --> 05:50.750]  A lot of you people, if you have a proximity card on, you pull it out for a second and take a look at it.
[05:51.430 --> 05:54.330]  You'll see it's a very small, thin piece of plastic.
[05:54.810 --> 05:59.030]  Some of you may see two part ones, where it looks like two pieces that are glued together.
[05:59.470 --> 06:03.110]  And some of you may see a single piece one, which are some of the newer ones.
[06:04.510 --> 06:07.610]  So there's three basic parts to the proximity card.
[06:08.010 --> 06:10.810]  The transponder, the antenna, and the protective coating.
[06:10.930 --> 06:13.110]  The protective coating is what you're holding onto right now.
[06:13.510 --> 06:15.950]  That coating protects the coil from being damaged.
[06:15.950 --> 06:19.150]  It also means that when you put it through the laundry accidentally, it won't get destroyed.
[06:20.750 --> 06:23.010]  The antenna is actually inside of it.
[06:23.110 --> 06:26.090]  And what I have here is a proximity card that I've dissected.
[06:26.550 --> 06:28.830]  And they will tell you, you cannot do this.
[06:29.430 --> 06:33.850]  And what I'm holding here is proof that, in fact, you cannot only dissect a proximity card.
[06:33.950 --> 06:36.090]  You can also run it through a laminator at Kinko's.
[06:39.010 --> 06:43.810]  Now, that's not to say that you don't have a few mistakes made in the process.
[06:44.870 --> 06:48.210]  But this proximity card, as mangled as it is, does still work.
[06:48.850 --> 06:51.250]  But this is the inside of the proximity card.
[06:51.250 --> 06:52.330]  I know it's hard to see.
[06:52.850 --> 06:55.990]  And if you really want to get a close look at it, please come up later.
[06:56.110 --> 06:57.370]  I'll be more than happy to show it to you.
[06:59.070 --> 07:02.710]  The transponder is this little black piece right here.
[07:02.810 --> 07:03.970]  You can barely see it.
[07:04.390 --> 07:08.330]  It's actually a small chip enclosed in some very nasty plastic.
[07:08.630 --> 07:12.250]  If you try to melt the plastic, chip the plastic, you will destroy the card.
[07:12.250 --> 07:20.290]  Also, the antenna you see right here is actually a single strand of wire, wrapped around and around and around and around and around.
[07:20.530 --> 07:24.010]  Any break anywhere in that wire will render the card useless.
[07:24.610 --> 07:26.550]  And how do I know this?
[07:26.830 --> 07:32.330]  Well, let's just say I had a few setbacks early on.
[07:34.350 --> 07:37.550]  So, that's the basics of the card itself.
[07:38.030 --> 07:41.830]  The cards are write once, read many times.
[07:42.210 --> 07:47.270]  What that means is that the information stored on this card is burned into it at the time of inception.
[07:47.690 --> 07:49.210]  There's two ways of doing this.
[07:49.330 --> 07:51.970]  The first way to do it is you pre-buy them in a box.
[07:52.190 --> 07:55.090]  And they come pre-coded for you and you pay out the nose for it.
[07:55.210 --> 08:06.490]  Or, you can spend two days with a bunch of lawyers, some NDAs and swear on a Bible and they will give you a device that will allow you to program blank cards and you can buy blank cards and make them yourself as you need them.
[08:06.490 --> 08:11.310]  One thing about this device though is that it's keyed very heavily.
[08:12.270 --> 08:19.090]  When you get the device, after you've signed your life away, you get a CD-ROM, a physical key and the writing device.
[08:19.530 --> 08:22.610]  All three of those devices are mated to each other indefinitely.
[08:23.070 --> 08:26.210]  That CD-ROM, that reader, that card.
[08:26.370 --> 08:27.970]  They cannot be used anywhere else.
[08:28.390 --> 08:31.510]  And it's one of the... you have to go through a lot of hoops to get one of these.
[08:31.510 --> 08:36.470]  I've only laid my eyes on one of them and it was... it's a scary process.
[08:37.390 --> 08:40.930]  Once the information is burned into here though, that's it, at infinim.
[08:41.310 --> 08:46.210]  And they say that the cards have a life of 100,000 to 200,000 reads.
[08:46.610 --> 08:48.670]  I've never seen one that's lived that far.
[08:48.830 --> 08:51.310]  They either get destroyed, ripped apart or what have you.
[08:51.310 --> 08:56.730]  And when you see this card, it looks... it looks like it's all fairly simple to go from a regular...
[08:56.730 --> 08:58.470]  from a card you have in your hand to this.
[08:58.830 --> 09:08.670]  In order to dissect one of these, it takes a very special, unique tool that is very, very difficult to find.
[09:09.130 --> 09:13.430]  And if you go across the street to the drugstore, you can buy it for about $1.15.
[09:13.430 --> 09:14.670]  It's called acetone.
[09:16.510 --> 09:20.670]  Those of you who still live at home, if your mom has fingernail polish remover, go ahead and use it.
[09:20.670 --> 09:25.510]  The key is, though, to be very careful while dissecting these.
[09:25.590 --> 09:32.310]  The reason why I say that is the same adhesive that makes it stick to the front and rip apart like this is also embedded in the coils.
[09:32.770 --> 09:38.110]  So if you leave it in there too long, what it actually does is the coil comes apart.
[09:39.010 --> 09:42.390]  Also, don't use the extra strength that eats the plastic and the card itself.
[09:43.890 --> 09:46.850]  And that's pretty much the lay of the land on the cards.
[09:48.410 --> 09:50.050]  I think I covered this pretty well.
[09:50.050 --> 09:51.790]  Now, how do these cards work?
[09:52.110 --> 09:57.870]  What happens is the reader, a little thing with a red light on it, will emit an RF signal.
[09:58.690 --> 10:00.870]  Normally, this is... I can't say normally.
[10:00.950 --> 10:02.090]  There are a lot of different standards.
[10:02.290 --> 10:03.210]  There are a lot of different protocols.
[10:03.490 --> 10:06.390]  So for all intents and purposes, I'm going to stay with the standard that I've used.
[10:07.090 --> 10:09.110]  It's a 125 kilohertz signal.
[10:09.450 --> 10:10.610]  It's an RF signal.
[10:10.830 --> 10:12.170]  It excites the card.
[10:12.170 --> 10:19.470]  The antenna grabs the energy, puts it back into here, and it spits out the ID information for your card.
[10:19.850 --> 10:26.510]  Once it does that, it retransmits the information back along into the security system for verification and authentication.
[10:34.090 --> 10:39.450]  Okay, now a basic proximity system, a security system, not just the card.
[10:39.670 --> 10:42.370]  It's composed of a few very simple pieces.
[10:42.710 --> 10:48.490]  A central computer, which normally holds the database information and does all the comparisons, approvals and disapprovals.
[10:49.290 --> 10:51.730]  Panels, readers, and your locking devices.
[10:51.730 --> 10:56.650]  Now, a panel and a reader are actually two different devices, although some people may think they're one.
[10:56.850 --> 10:58.570]  There are exceptions to this rule.
[10:58.670 --> 11:00.270]  There are readers that act as panels.
[11:00.850 --> 11:09.750]  But, for the most part, you will have a PC, a central panel, which is what you see in those little squat gray boxes, and then the individual readers.
[11:10.650 --> 11:13.390]  I even believe I have a diagram here for you.
[11:13.530 --> 11:14.070]  There we go.
[11:15.050 --> 11:19.470]  Now, this is just a really quick and dirty diagram of how it works.
[11:19.470 --> 11:22.190]  The reader you see right here is what you see at your door.
[11:22.690 --> 11:25.770]  That's what you present your card to, and that's how you tell it who you are.
[11:25.990 --> 11:31.530]  The locking device is the device that actually keeps your door or your access point locked.
[11:32.070 --> 11:39.410]  These vary from physical locks that are built into the handle to those nice 300-volt magnets you see all the time that you have to try and pull and pull and pull.
[11:39.830 --> 11:41.610]  I have to tell you a funny story about those.
[11:41.890 --> 11:44.610]  Those systems are very secure, those nice little electromagnets.
[11:45.070 --> 11:46.570]  There's two things you have to consider.
[11:46.850 --> 11:48.110]  Number one is power loss.
[11:48.710 --> 11:51.330]  And number two is if it's not installed correctly.
[11:51.750 --> 11:58.510]  A company whose name will remain what it was, since they went under, had one that was misinstalled and only one leg of it was energized.
[11:58.850 --> 12:04.330]  And you could walk up to it, assume a nice Zen pose, grab a hold of the handle, and it would come right open.
[12:04.930 --> 12:07.770]  Also, a lot of times the magnetic door locks don't catch.
[12:07.910 --> 12:08.950]  You'll hear a nice little...
[12:09.550 --> 12:11.530]  Buzzing noises popping back and forth.
[12:12.250 --> 12:21.050]  Or, as I've seen in my history with physical security audits, you can get a nice big fat piece of cardboard and the thing is useless.
[12:22.590 --> 12:26.030]  So anyhow, what happens is the reader attaches to the panel.
[12:26.190 --> 12:28.450]  Now, you come up and you present your card to the reader.
[12:28.570 --> 12:29.290]  You'll hear beep.
[12:29.830 --> 12:32.910]  Now, what happens is the reader will send that information to the panel.
[12:33.170 --> 12:43.850]  The panel will look at your card ID number and compare it against a database that's built inside of it, which includes your ID number, what time of day, what time of week you can or cannot access.
[12:44.270 --> 12:47.830]  And it will make an accept or reject decision.
[12:48.470 --> 12:53.110]  Either way, the panel will return the information back to the central computer.
[12:53.110 --> 13:01.570]  The central computer will record either that, A, this card was used, B, it was accepted or rejected, what time, and so on.
[13:01.830 --> 13:10.630]  In more advanced systems, the central computer will also pull up for more information for you and display it on a terminal at the security access point.
[13:10.770 --> 13:11.750]  I'll get to that in a bit.
[13:12.110 --> 13:18.370]  The important thing here to remember, though, is the central computer does not do, in most cases, any decision-making.
[13:18.370 --> 13:20.630]  It's simply there for a database and an interface.
[13:21.290 --> 13:31.170]  When a person comes into the system, the information is input here, but it's sent to the individual panels as a re-sync after every time you do this.
[13:31.390 --> 13:33.190]  There's an important reason for doing this.
[13:33.250 --> 13:41.070]  If for some reason the central computer goes down or is... it will not affect the system.
[13:41.350 --> 13:43.150]  It will not affect the system at all.
[13:43.150 --> 13:44.790]  The system will still run perfectly normal.
[13:44.790 --> 13:47.330]  I've done a lot of crash testing with this.
[13:47.770 --> 13:52.050]  And the panels will continue to run, so long as they have some form of power.
[13:52.190 --> 13:56.250]  Some of them can actually run on 12 to 14 volts DC, if need be.
[13:57.890 --> 14:02.870]  And the... so assuming that you're okay, the panel will send a signal to the relay to the locking device.
[14:03.010 --> 14:07.210]  And depending on how it's programmed, it will stay open for five, ten seconds.
[14:07.210 --> 14:10.470]  It will open the garage door and will raise a little barrier, what have you.
[14:10.470 --> 14:12.870]  These systems are not limited to doors.
[14:13.450 --> 14:22.370]  They are adaptable, very adaptable, to anything from a garage door, a barrier, a pass-through, any such device.
[14:22.930 --> 14:30.130]  One thing I'll talk about a little later though, the Achilles heel of this, is that people don't always program it correctly.
[14:30.390 --> 14:33.510]  People do not always take the time to do things correctly.
[14:33.510 --> 14:36.510]  And a lot of times, pass-backs are not checked.
[14:37.170 --> 14:38.690]  Illegal entries are not checked.
[14:39.030 --> 14:43.490]  If you force the door open, the panel will recognize that the door is open and it will make a log entry.
[14:43.550 --> 14:45.710]  But if you don't look, you'll never know.
[14:46.210 --> 14:47.910]  And that is one major flaw.
[14:48.490 --> 14:49.750]  But it's human error.
[14:50.070 --> 14:50.770]  You're used to that, right?
[14:53.130 --> 14:54.810]  So, how do you get into a system?
[14:55.410 --> 14:55.790]  Enrollment.
[14:55.870 --> 15:00.110]  The user is enrolled, data is entered into the computer, it's sent to the panel, your badge is printed.
[15:00.110 --> 15:04.870]  Sometimes you'll see badges that have dye sub printing on them.
[15:05.350 --> 15:06.750]  Similar to this one right here.
[15:06.950 --> 15:09.650]  This one has a nice little photograph of me on it.
[15:09.930 --> 15:11.190]  And a company logo.
[15:11.850 --> 15:13.710]  And take a good look at this.
[15:13.810 --> 15:16.290]  Now, if you were a security guard, you can see...
[15:16.290 --> 15:19.090]  The black tape is on here because of the name that's on the card.
[15:19.230 --> 15:20.070]  But that's aside the point.
[15:20.630 --> 15:22.510]  You can see it's a legitimate proximity card.
[15:22.710 --> 15:24.270]  And there's a photograph on it.
[15:24.810 --> 15:27.130]  And it says, Operations Manager.
[15:27.670 --> 15:28.810]  Has a nice little company logo.
[15:28.810 --> 15:31.770]  Now, if you were Joe's security guard and you saw that, what would you say?
[15:31.890 --> 15:32.370]  Yes or no?
[15:34.530 --> 15:35.070]  Let's hear it.
[15:35.290 --> 15:35.470]  Hand.
[15:35.590 --> 15:36.050]  Let's see hands.
[15:36.290 --> 15:36.490]  Yes?
[15:38.150 --> 15:38.550]  Congratulations.
[15:38.670 --> 15:40.150]  You all just lost your jobs.
[15:40.290 --> 15:41.530]  This is 100% fake.
[15:42.410 --> 15:47.550]  This is 10 minutes of Photoshop, a laminator, and a block of high glossy photograph paper.
[15:48.950 --> 15:51.770]  This also passes for a second ID.
[15:51.990 --> 15:53.370]  When people say, do you have a work ID?
[15:53.730 --> 15:54.090]  Sure.
[15:54.570 --> 15:57.270]  My name is Arthur Phillip Delchi.
[15:57.550 --> 16:01.770]  And I'm an Operations Manager for Dewey, Cheatham, and Howe.
[16:02.150 --> 16:07.450]  And, you know, I've really got to get upstairs because we just had a PGP explosion and there's bits all over the floor.
[16:07.470 --> 16:08.690]  And I've really got to get up there.
[16:09.090 --> 16:10.110]  You know how the boss gets?
[16:10.230 --> 16:10.930]  I mean, my God.
[16:11.370 --> 16:13.150]  Look, there's electrons all over the floor.
[16:13.270 --> 16:14.250]  Somebody's got to clean them up.
[16:14.250 --> 16:14.650]  Oh, oh.
[16:14.810 --> 16:15.250]  Yep, sir.
[16:15.410 --> 16:15.530]  Hey.
[16:16.310 --> 16:17.010]  There you go.
[16:17.470 --> 16:18.770]  Well, that's called social engineering.
[16:19.190 --> 16:20.830]  But don't feel bad.
[16:21.030 --> 16:26.850]  Because certain people at a certain security checkpoint were fooled by this equally as well.
[16:27.870 --> 16:29.050]  So you have your badge.
[16:29.190 --> 16:35.570]  And by the way, if you want a legitimate badge, if you want a badge that is not Photoshop, how many of you have $200 to spare?
[16:38.750 --> 16:40.050]  E is for eBay.
[16:40.110 --> 16:41.470]  And that's good enough for you.
[16:42.930 --> 16:49.950]  Entire security badge printing systems can be had for as little as $200 on eBay and various other places on the net.
[16:50.290 --> 16:52.950]  So, I think that's a little bit of a security hole.
[16:53.030 --> 16:53.530]  What do you think?
[16:55.370 --> 16:55.810]  Okay.
[16:57.930 --> 16:59.690]  Oh, this is the part that I should...
[16:59.690 --> 16:59.930]  Okay.
[17:00.190 --> 17:08.830]  So, in a normal situation, user presents a card, the data is read from the card, it's sent back to the panel, access is granted, transaction is logged.
[17:08.970 --> 17:09.650]  We covered that.
[17:09.650 --> 17:11.450]  So, what's wrong with this picture?
[17:11.670 --> 17:13.070]  Why is this a bad thing?
[17:13.770 --> 17:16.570]  Well, first of all, the reader is constantly emitting.
[17:17.230 --> 17:21.490]  What that means is that 125 kHz signal is out there in the air all the time.
[17:21.710 --> 17:25.470]  It doesn't care what time of day, night, or in between that signal is out there.
[17:25.590 --> 17:27.890]  It's always ready to read no matter what.
[17:29.050 --> 17:30.050]  Why is this bad?
[17:30.130 --> 17:31.230]  I'll get to that, you'll see.
[17:31.510 --> 17:35.150]  The card will respond to any device emitting the proper frequency.
[17:35.150 --> 17:38.050]  If you come up with the right signal, it doesn't care.
[17:38.770 --> 17:46.710]  You couldn't make a device, and the spider box is such a device, that will emit the appropriate frequency.
[17:46.910 --> 17:51.670]  And there doesn't have to be a card present, because all it knows is, I'm getting a signal, card is present.
[17:51.890 --> 17:55.010]  Because nobody believes that anything else could possibly exist.
[17:55.970 --> 17:57.830]  It's a one-way data exchange.
[17:58.070 --> 18:01.690]  What that means is, the card emits, the reader reads, end of story.
[18:03.490 --> 18:04.350]  Fixed data.
[18:04.830 --> 18:06.630]  Now how hard is fixed data to hack?
[18:07.030 --> 18:08.670]  And yes, no encryption.
[18:08.930 --> 18:10.330]  Well, why would there be encryption?
[18:10.710 --> 18:13.830]  Even if you could encrypt it, how good could it be?
[18:13.950 --> 18:15.050]  You could never change the key.
[18:17.150 --> 18:20.090]  Once it's there, eh, so why bother?
[18:21.170 --> 18:23.610]  So what about read-write cards?
[18:24.130 --> 18:26.350]  Read-write cards do exist.
[18:26.830 --> 18:31.150]  They're used in vending machines, laundromats, and photocopy shops.
[18:31.350 --> 18:32.470]  And that's it.
[18:33.910 --> 18:34.550]  Why?
[18:35.010 --> 18:37.390]  Well, they're expensive as hell.
[18:38.330 --> 18:47.170]  Even in the best systems right now that are used in college campuses for money exchange, how it works is the card holds half a key, the reader holds half a key.
[18:47.950 --> 18:54.590]  The reader takes the half of the key from the card, pieces it together with its half of the key, and decides, okay, you're legitimate.
[18:55.070 --> 19:04.170]  And then it sends a signal back to the card, which re-edits the card, and increments or decrements your debit or credit on the card.
[19:06.070 --> 19:09.990]  Again, incredibly simple to hack if you have the time and the luxury.
[19:11.830 --> 19:14.350]  So, the bottom line becomes money.
[19:15.630 --> 19:17.310]  It's all about money.
[19:17.530 --> 19:29.330]  It is cheaper to make 10,000 simple little cards like this than make 100 cards that are a little more secure, a little more solid, a little less likely to hack.
[19:29.330 --> 19:36.030]  Also, legacy systems, systems that are already in existence, in order to go to read-write, it's a substantial amount of money.
[19:36.230 --> 19:41.230]  Not because it's more expensive, not because it's trickier, but it's what I call the President's Yacht Fund.
[19:42.250 --> 19:45.590]  You have the capacity to charge X, why not charge 2X?
[19:45.670 --> 19:46.390]  Why not charge 3X?
[19:47.010 --> 19:50.110]  Why not charge 4X and get yourself a new Lexus while you're at it?
[19:50.790 --> 19:54.350]  That's a lot of the thinking that goes behind some physical security systems.
[19:54.630 --> 19:57.030]  And it's scary, and in my opinion, it's wrong.
[19:58.870 --> 20:00.090]  And so is this.
[20:00.570 --> 20:01.730]  So, what would it take?
[20:01.870 --> 20:04.810]  What would it take to spoof a proximity system?
[20:05.050 --> 20:07.870]  Well, first of all, you've got to emit the appropriate RF signal.
[20:08.250 --> 20:11.070]  Now, how do you figure out the RF signal?
[20:11.330 --> 20:14.630]  How do you know what type you have, what type you do?
[20:14.630 --> 20:24.550]  Well, there's a tool you use to figure out exactly how do you figure out the frequency and the encoding on a proximity card.
[20:24.830 --> 20:27.390]  It's a very technologically advanced tool.
[20:27.630 --> 20:32.030]  In fact, it's one of the most advanced tools of its kind right now.
[20:32.630 --> 20:36.950]  And it's right on the cutting edge of technology, of its technology.
[20:37.190 --> 20:38.650]  Anybody have an idea what that tool might be?
[20:41.110 --> 20:41.710]  Google.
[20:44.930 --> 20:51.130]  90% of the proximity card companies publish what they call technical notes on the internet.
[20:53.150 --> 20:58.590]  Included in these technical notes are little things like, yes, well, it takes X many volts, Y many volts.
[20:59.110 --> 21:02.130]  And, well, by the way, the encoding methodology is such.
[21:02.470 --> 21:04.210]  Two bits of this, two bits of that.
[21:04.370 --> 21:13.810]  And, oh, but if you want more information, you're going to need to go to our special site, which is only for our customers and clients, and you need your user ID and password.
[21:14.650 --> 21:21.670]  Well, password is testing, and the user ID is tester.
[21:22.850 --> 21:24.790]  And then you end up with application notes.
[21:24.970 --> 21:29.670]  And these will tell you how to encode and decode the information on or about the system.
[21:31.110 --> 21:40.470]  Also, though, if you happen to misspell the name of the company that makes some of these proximity cards, you get a great website with about 110 recipes for different kinds of martinis.
[21:42.690 --> 21:48.970]  And I've got to tell you, gin and it, the Cordial Martini, and the Flying Dutchman are my favorite.
[21:49.830 --> 22:00.970]  And I have to say, I have to thank one company in particular, the Bombay Sapphire Gin Company, because I drank so much Bombay in the process of developing this.
[22:00.970 --> 22:05.970]  And it was thanks to this, they were a real big help in the process of developing this whole system.
[22:06.430 --> 22:06.870]  So...
[22:09.490 --> 22:13.090]  Now, that is not an endorsement of their company, nor do they endorse me.
[22:13.190 --> 22:15.090]  I just drink their product and they just take my money.
[22:16.510 --> 22:22.610]  So anyway, what we have to do is, we emit the RF signal, we capture the response from the card.
[22:22.770 --> 22:24.190]  Now we have the card information.
[22:24.550 --> 22:26.210]  We need to store that information.
[22:26.570 --> 22:29.390]  And down the road later, we retransmit the information.
[22:29.710 --> 22:34.950]  But since it's only a string of digits, and I didn't cover that yet, bad on me.
[22:35.550 --> 22:39.370]  The format of the cards, the most common format, is the Weigand standard.
[22:39.630 --> 22:42.150]  And some of you may pronounce it We-Gand, We-Gand, Wa-Gand.
[22:42.250 --> 22:44.630]  I pronounce it We-Gand, and for me that's correct.
[22:45.150 --> 22:47.730]  And there's several different versions of this format.
[22:47.990 --> 22:48.710]  I'm going to read them.
[22:48.770 --> 22:50.130]  There's a 26-bit format.
[22:50.510 --> 22:52.350]  There's a 37-bit format.
[22:52.630 --> 22:54.910]  And there are about two or three others.
[22:55.610 --> 22:59.530]  The one format that's odd is what's called the Corporate 1000 format.
[23:00.070 --> 23:04.530]  The basic format of these cards is a simple data stream.
[23:05.250 --> 23:09.390]  Header, parity, data, parity, footer, end of story.
[23:10.570 --> 23:13.350]  Most often, the number is split in two.
[23:13.630 --> 23:17.710]  The first half of it is a site code.
[23:17.930 --> 23:19.510]  The second half is your card number.
[23:19.710 --> 23:25.490]  The reason why they have site codes is so that you can use card number one, two, three, four, five, anywhere in the world.
[23:25.490 --> 23:28.310]  But if your site code doesn't match, it'll be instantly rejected.
[23:29.450 --> 23:31.290]  This has been enhanced over the years.
[23:31.450 --> 23:40.670]  The reason I've mentioned the Corporate 1000 system is because it's a modification of the standard format that allows you to have up to 100,000 cards within a single site code.
[23:40.930 --> 23:43.370]  This is used by large international corporations.
[23:43.370 --> 23:48.430]  So if you work for Corporation X up here in New York City, they issue you an ID card.
[23:48.630 --> 23:51.170]  It's good anywhere in the world at any one of their facilities.
[23:51.690 --> 23:57.070]  This does mean, however, that the computers have to link up at some time during the day and talk back and forth to each other.
[23:57.190 --> 24:01.490]  Which, by the way, if any of you have a good sniffer, it's fine to take a look at.
[24:02.630 --> 24:04.150]  So here you have this string of data.
[24:05.590 --> 24:06.930]  Facility code, ID code.
[24:07.970 --> 24:09.150]  But what if you don't have that?
[24:09.250 --> 24:10.650]  What if you just want to say, what the heck?
[24:10.790 --> 24:12.050]  Well, how about a newer keypad?
[24:12.270 --> 24:17.110]  How about a little keypad so you can go, facility one, two, three, card, nine, eight, seven, six, five, four.
[24:17.610 --> 24:18.530]  It is possible.
[24:18.530 --> 24:22.210]  It is also possible, if you do this, to do it by brute force.
[24:23.090 --> 24:25.810]  One, two, three, you know, doing it Shipley style.
[24:27.390 --> 24:28.590]  What, nobody got that?
[24:29.210 --> 24:30.630]  Nobody here sort of war dialing?
[24:31.370 --> 24:31.850]  Yes!
[24:32.930 --> 24:36.730]  Okay, so, thus becomes, is it really possible?
[24:37.190 --> 24:38.750]  Is it possible to do this?
[24:39.210 --> 24:42.210]  There is a device for the Palm Pilot that will do this.
[24:42.210 --> 24:52.250]  The company, whose webpage I keep missing, because Missing Link keeps sending it to me, and I keep forgetting to put it down, actually sells a device that says, forget all your proximity cards.
[24:52.490 --> 25:00.130]  You just wave it in front of this little device, in front of your proximity reader, and they're all stored in your Palm Pilot, and you just pick which one you want, and it'll retransmit it.
[25:02.730 --> 25:09.230]  Oddly enough, that site disappeared about four months after I initially talked about this at PumpCon.
[25:10.390 --> 25:11.030]  Go figure.
[25:11.530 --> 25:19.890]  I won't mention the little girl who sat in the front row who was jumping up and down and going, ooh, ooh, ooh, what about, what about, what about, what about, and handed me a business card that said CIA later on.
[25:23.610 --> 25:25.330]  So, I am going to do a demo for you.
[25:25.410 --> 25:27.890]  I'm going to show you that this toy actually can and does exist.
[25:28.090 --> 25:30.750]  But, why is the demo read-only?
[25:31.490 --> 25:32.770]  I think I covered this earlier.
[25:32.910 --> 25:36.470]  If anyone missed it, I don't feel like being the guest star on Oz next week.
[25:37.310 --> 25:45.350]  The concept of developing a system like this that can, in fact, go through and go do-do-do-do and swim through, that's pretty scary.
[25:45.890 --> 25:52.310]  And what's even scarier is that once you make it portable, I can walk by you in a subway.
[25:52.750 --> 25:54.770]  I can stand next to you in an elevator.
[25:55.030 --> 25:58.130]  I can bump into you on the street and go, ooh, excuse me.
[25:59.730 --> 26:01.310]  I just got your card information.
[26:01.790 --> 26:02.770]  Thank you very much.
[26:02.830 --> 26:03.470]  Have a nice day.
[26:04.230 --> 26:14.570]  Now, in the olden days, you had to actually steal somebody's wallet, which meant taking them out, getting them drunk, dancing a few times in the country line dance, and going, oh, you're my best friend in the world.
[26:16.210 --> 26:17.850]  I'll get you a beer, don't worry.
[26:17.950 --> 26:19.790]  And then what you do is you take their card away.
[26:20.610 --> 26:22.990]  And then they go, oh, damn, I lost my card.
[26:23.050 --> 26:24.950]  And if they're smart, they report it to security.
[26:25.550 --> 26:28.650]  Now, how many people of you here have lost your proximity cards before?
[26:30.010 --> 26:31.610]  How long did it take you to report it?
[26:33.370 --> 26:34.050]  One day?
[26:34.530 --> 26:35.630]  Over the weekend maybe?
[26:35.770 --> 26:36.410]  Three-day weekend?
[26:36.530 --> 26:37.350]  You never reported it?
[26:38.270 --> 26:39.070]  Dog ate it?
[26:40.390 --> 26:41.950]  I don't know what happened to it.
[26:41.990 --> 26:44.610]  I was walking my dog and all of a sudden it was gone.
[26:44.850 --> 26:47.630]  I'm following him around with a baggie, but I haven't found it yet.
[26:49.170 --> 26:52.270]  It can take up to two to three days sometimes.
[26:52.310 --> 26:54.530]  The average is before people report these things.
[26:54.630 --> 26:55.910]  There's a security report on that.
[26:56.370 --> 26:58.110]  Now, the other part comes in is this.
[26:58.590 --> 27:01.110]  Let's say I physically stole your card, okay?
[27:01.690 --> 27:07.190]  Now, if I go walking into your office, even in my best Sunday go to meet and close, and I say, hey, how are you doing?
[27:08.010 --> 27:08.730]  I'm new here.
[27:08.850 --> 27:09.730]  I'm Bill.
[27:09.950 --> 27:10.890]  I program computers.
[27:11.250 --> 27:12.210]  And they go, yeah, yeah.
[27:12.330 --> 27:13.570]  Hey, did you watch Friends last night?
[27:13.670 --> 27:14.990]  And you go, oh, got to get that coffee.
[27:15.570 --> 27:17.910]  So then you see me walking around with your stolen badge.
[27:18.030 --> 27:19.830]  Now, if my stolen badge is just sitting right here.
[27:21.030 --> 27:22.250]  My photo is on it.
[27:23.210 --> 27:24.550]  Maybe it is, maybe it isn't.
[27:24.550 --> 27:25.290]  A lot of times.
[27:25.410 --> 27:26.350]  How many have photo IDs?
[27:26.590 --> 27:27.650]  How many of these have photos on them?
[27:28.890 --> 27:29.210]  Okay.
[27:29.450 --> 27:30.130]  That's a good start.
[27:31.150 --> 27:33.310]  So what happens if you see me and the photo doesn't match?
[27:33.350 --> 27:35.030]  Or I don't happen to be Bill so-and-so.
[27:35.110 --> 27:36.870]  You grab me by the neck and you throw me outside.
[27:37.790 --> 27:39.290]  That's why you dissect the card.
[27:41.050 --> 27:46.450]  How many people here would consider this to be an odd device if I had this in my pocket, in my briefcase, what have you?
[27:47.730 --> 27:49.530]  It's a simple, cheap pocket calculator.
[27:49.530 --> 27:52.990]  To be honest with you, I got this in a kit at Kmart for $19.95.
[27:53.630 --> 27:56.290]  Fake leather bag, fake Mont Blanc pen and calculator.
[27:57.130 --> 27:58.490]  Well, here's the kicker.
[27:59.130 --> 28:01.590]  Open it up and there's a proximity card inside of it.
[28:06.340 --> 28:09.060]  This card was registered as I'm a calculator.
[28:10.320 --> 28:15.340]  And when the people reviewed the security logs at my office and they said, who is I'm a...
[28:16.740 --> 28:17.480]  I'm a who?
[28:17.660 --> 28:18.420]  I'm a...
[28:18.420 --> 28:19.300]  Calculate?
[28:21.580 --> 28:22.060]  Calculator?
[28:22.660 --> 28:23.700]  I'm a calculator.
[28:27.620 --> 28:30.500]  But, forgetting that part, let's make it easy on ourselves.
[28:30.640 --> 28:35.800]  Like I said, it's entirely possible to simply walk past you and read this information.
[28:36.920 --> 28:39.000]  Now, how do we get around this?
[28:40.100 --> 28:41.420]  What's the saving grace?
[28:42.220 --> 28:45.720]  The answer is, there are a couple ways to protect yourself from this.
[28:45.960 --> 28:48.340]  But, in reality, they're all pretty stupid.
[28:50.100 --> 28:52.760]  Number one, photo ID verification.
[28:53.800 --> 28:57.100]  Now, what this means is not just that it has a photograph on the front.
[28:57.260 --> 29:04.540]  How many people since 9-11 have seen some people being really, really strict about security and they want to stop you every inch of the way you go through a building?
[29:04.640 --> 29:05.480]  Have you ever had that happen?
[29:06.180 --> 29:11.620]  Now, you see those people sitting there, those $5, $4 an hour people sitting behind the terminal all day long watching you.
[29:11.680 --> 29:12.760]  You ever wonder what's on that terminal?
[29:13.820 --> 29:19.120]  Most of these systems have the capacity to store a photograph in the database along with your card information.
[29:19.120 --> 29:21.820]  You swipe that card and the guard just looks down.
[29:21.940 --> 29:26.660]  You think he's reading WWF Weekly and he's actually looking at a computer terminal that pulls up your photograph.
[29:27.240 --> 29:32.280]  If that photograph doesn't match who you are, he pushes the big red button and the guys with shotguns come running.
[29:34.160 --> 29:35.940]  Who knows the line that movie is from?
[29:37.300 --> 29:40.380]  It was playing this morning when I woke up, so I felt good about that.
[29:41.700 --> 29:42.360]  Due diligence.
[29:42.720 --> 29:47.000]  Due diligence is the next thing and probably one of the biggest holes you will find in this.
[29:47.280 --> 29:50.280]  People do not practice due diligence with their security systems.
[29:50.660 --> 29:55.980]  I have gone into places to do audits and found employees that are no longer there still in the system.
[29:56.460 --> 29:59.000]  Oh, well, yeah, he's been terminated.
[29:59.240 --> 30:00.540]  Maybe we turned his card off.
[30:00.660 --> 30:01.380]  I'm not really sure.
[30:01.860 --> 30:05.180]  Meanwhile, that guy is sitting at home going, Okay, I want to take this guy's laptop.
[30:05.340 --> 30:06.300]  I want to take this guy's palm pie.
[30:06.380 --> 30:07.840]  I'm going to pull this information out.
[30:08.720 --> 30:11.840]  And he opens another Budweiser and goes back to thinking about it.
[30:12.220 --> 30:14.260]  But due diligence is the big loop.
[30:15.120 --> 30:19.220]  How many of you out here are actually in charge of or work in physical security?
[30:20.420 --> 30:22.040]  How often do you read your logs?
[30:24.560 --> 30:26.280]  No, your physical access logs.
[30:27.400 --> 30:28.080]  All right.
[30:29.580 --> 30:31.180]  How many times have you seen it?
[30:31.820 --> 30:33.560]  Oh, door left open.
[30:33.820 --> 30:35.100]  Door opened without read.
[30:37.280 --> 30:37.800]  Exactly.
[30:38.940 --> 30:42.020]  And it's funny how people don't even think to look at that.
[30:42.400 --> 30:43.980]  They don't review their logs.
[30:44.200 --> 30:47.760]  They see a door malfunction and they maybe write it up in a security log.
[30:47.980 --> 30:48.280]  Maybe.
[30:48.540 --> 30:50.380]  Maybe somebody looks at it down the line.
[30:50.380 --> 30:55.920]  Due diligence is probably one of the best tools you have against this kind of physical access hacking.
[30:56.640 --> 30:58.260]  And almost no one uses it.
[30:59.080 --> 31:02.360]  And as far as protecting yourself from being read, yeah, there's a way of doing it.
[31:02.400 --> 31:03.460]  How many people have an easy pass?
[31:05.140 --> 31:07.420]  You have that little baggie that came with the easy pass.
[31:07.520 --> 31:10.260]  So in case you don't want to use the easy pass, you put it in the little baggie.
[31:10.580 --> 31:12.480]  It's a little miniature Faraday cage.
[31:13.600 --> 31:15.740]  And that will stop it.
[31:16.180 --> 31:19.740]  Now how many people want to do that to keep yourself safe from your proximity card being read?
[31:21.040 --> 31:24.220]  Well, there's a few people who are good, you know, hardcore security people.
[31:24.500 --> 31:26.980]  Most people want the proximity card because of its convenience.
[31:27.200 --> 31:30.020]  They go, oh damn, I gotta take this out of my wallet.
[31:30.160 --> 31:31.660]  Take it out of this little baggie.
[31:33.200 --> 31:33.600]  Coffee.
[31:34.340 --> 31:35.500]  Watch TV last night.
[31:35.680 --> 31:36.600]  People don't want that.
[31:37.120 --> 31:37.760]  They want...
[31:38.180 --> 31:38.580]  Beep.
[31:38.820 --> 31:39.340]  Hey, Phil.
[31:40.280 --> 31:41.220]  And off they go.
[31:41.500 --> 31:42.380]  That's what they want.
[31:42.640 --> 31:45.040]  That's the same mistake they make in physical access systems.
[31:45.180 --> 31:48.100]  Have you ever seen a physical access system that has a card reader on one side?
[31:48.400 --> 31:50.460]  And on the other side you see nothing but a sensor?
[31:51.720 --> 31:53.500]  And you walk up there and you hear...
[31:53.500 --> 31:53.780]  Beep.
[31:53.940 --> 31:55.160]  And you open the door again.
[31:55.300 --> 31:56.240]  You know what's wrong with that?
[31:57.080 --> 31:58.700]  Take a good close look at the door.
[31:58.700 --> 32:01.000]  I'll bet you you'll find about a half inch gap.
[32:02.260 --> 32:03.320]  That's not eight inches.
[32:03.520 --> 32:05.780]  That's a half inch gap in the door.
[32:06.400 --> 32:07.260]  Go down to the closet.
[32:07.380 --> 32:09.480]  Get a coat hanger and a piece of eight and a half by eleven.
[32:10.060 --> 32:11.180]  Straighten out the coat hanger.
[32:11.580 --> 32:13.040]  Pierce the paper in two places.
[32:13.560 --> 32:14.340]  Set it through there.
[32:14.500 --> 32:15.360]  Turn it a few degrees.
[32:15.500 --> 32:16.100]  And wait for the beep.
[32:16.220 --> 32:17.600]  And then walk in and have a nice day.
[32:19.060 --> 32:23.300]  To date, I have surprised 18 executives with that trick.
[32:25.540 --> 32:28.320]  Oh, we'll be fine in our physical security audit.
[32:28.320 --> 32:29.940]  And they come down to their nice leather office.
[32:30.120 --> 32:31.400]  And there I am with my feet up in the chair.
[32:31.460 --> 32:32.100]  I'm cooking my hand.
[32:32.260 --> 32:32.760]  Going, hi guys.
[32:34.880 --> 32:36.520]  They call that unprofessional.
[32:39.600 --> 32:41.080]  I don't highly recommend it.
[32:42.260 --> 32:43.820]  That's all I have for that part of it.
[32:44.060 --> 32:50.100]  But for right now, I'm sure you're going to give me a little more grief over this.
[32:50.220 --> 32:51.260]  You know, you're welcome to.
[32:52.100 --> 32:54.640]  How about I show you what I'm talking about?
[32:56.020 --> 32:57.340]  Let's go over here.
[32:57.620 --> 32:59.860]  Another super secret program that we need.
[33:02.180 --> 33:06.080]  Now, I'm using hyperterminal and a big honking machine right here.
[33:06.460 --> 33:08.400]  Because that's what I have available.
[33:08.960 --> 33:12.940]  In reality, however, set the secret code.
[33:12.940 --> 33:15.240]  9600 8N1.
[33:16.500 --> 33:17.500]  Write that down.
[33:17.720 --> 33:18.480]  It'll be a test later.
[33:19.640 --> 33:27.940]  You could use a Palm Pilot, a laptop, any device that happens to spew out RS-232.
[33:29.040 --> 33:31.040]  So, now comes the tricky part.
[33:31.220 --> 33:33.280]  I'm going to actually turn this thing on and show it to you.
[33:33.500 --> 33:36.660]  This is going to require something really, really sneaky though.
[33:37.760 --> 33:40.640]  I need someone with some good experience of being the, you know.
[33:40.800 --> 33:46.880]  Someone who's like your average person, but not too, not too, too technically up there.
[33:47.240 --> 33:48.200]  How about a celebrity?
[33:48.360 --> 33:49.460]  Do we have any celebrities in the house?
[33:50.540 --> 33:52.280]  I think I see a celebrity in the house.
[33:52.400 --> 33:53.540]  Does he feel like being a guinea pig?
[33:56.960 --> 33:59.060]  Okay, do we have anybody from the NSF?
[34:00.280 --> 34:01.540]  Oh, it's okay, it's okay.
[34:01.600 --> 34:02.340]  I won't bust you.
[34:02.760 --> 34:04.740]  Who here is wearing a Ninja Strike Force t-shirt?
[34:06.140 --> 34:08.200]  Someone in here has got to be wearing a CDC Ninja Strike Force t-shirt.
[34:09.420 --> 34:10.840]  I saw two of you.
[34:12.400 --> 34:14.440]  Now see, that just goes to show you something.
[34:15.300 --> 34:19.440]  Not only is the Ninja Strike Force invisible, but they're very well disciplined.
[34:21.880 --> 34:22.740]  Okay, anybody.
[34:22.960 --> 34:24.200]  Who wants to be a volunteer here?
[34:25.760 --> 34:27.100]  Oh, someone different.
[34:28.740 --> 34:29.400]  You there.
[34:30.280 --> 34:31.080]  Step on up.
[34:31.220 --> 34:33.220]  I'm going to put this mic up here and I'll walk around to the front.
[34:44.330 --> 34:47.590]  Now just for effect, who here can hum the James Bond theme while I see?
[34:47.590 --> 34:48.250]  I'm going to set this up.
[34:49.190 --> 34:49.970]  Everybody, come on.
[34:50.090 --> 34:50.730]  All together now.
[35:25.690 --> 35:27.090]  Here's what I want you to do.
[35:27.990 --> 35:29.030]  Rub your eyes a little bit.
[35:29.070 --> 35:30.310]  Pretend you just woke up in the morning.
[35:31.030 --> 35:31.610]  Oh, God.
[35:31.810 --> 35:32.470]  I've got to go to work.
[35:32.570 --> 35:32.950]  I've got to go to work.
[35:33.010 --> 35:34.510]  Let me grab my proximity card.
[35:34.930 --> 35:36.570]  Let me put that in my back pocket.
[35:38.410 --> 35:38.730]  Okay.
[35:38.970 --> 35:40.590]  Now, you're doing your morning commute.
[35:40.770 --> 35:41.990]  Chugga-chugga-chugga-chugga-doo-doo.
[35:42.150 --> 35:44.150]  I'm going to stand over here in front of the train, the B train.
[35:44.650 --> 35:46.190]  Now, turn around and face these people.
[35:47.290 --> 35:48.490]  Back pocket's right over there.
[35:49.390 --> 35:51.430]  And I'm going to come up and go...
[35:52.550 --> 35:53.290]  Excuse me, sir.
[35:53.910 --> 35:55.150]  I'd like to...
[35:56.030 --> 35:57.030]  Oh, what was that?
[35:58.590 --> 35:59.710]  554-69-B75.
[35:59.890 --> 36:00.410]  Okay, let's try that again.
[36:00.510 --> 36:00.570]  Ready?
[36:01.230 --> 36:01.810]  Excuse me.
[36:01.970 --> 36:02.770]  Hey, move it, buddy.
[36:03.090 --> 36:03.510]  Oh, oh.
[36:03.690 --> 36:04.650]  There's that number again.
[36:05.950 --> 36:06.890]  Hey, get out of my way.
[36:06.910 --> 36:07.650]  I'm late for work.
[36:07.810 --> 36:08.110]  Beep.
[36:08.230 --> 36:08.810]  Oh, move it.
[36:08.890 --> 36:09.250]  Move it.
[36:09.250 --> 36:09.750]  Come on.
[36:10.730 --> 36:13.030]  Oh, well, there's your proximity card information.
[36:14.770 --> 36:15.810]  It's that simple.
[36:16.050 --> 36:16.870]  Give this man a hand.
[36:22.330 --> 36:23.930]  Give me info.
[36:24.550 --> 36:25.730]  We can try that one.
[36:25.810 --> 36:29.170]  The thing is, this is a really cheap reader, and it will not do YGAN standard.
[36:29.510 --> 36:31.290]  And this is a phone card.
[36:31.530 --> 36:31.930]  Let's see.
[36:33.730 --> 36:34.170]  Yeah.
[36:34.610 --> 36:39.750]  This one is locked down to read only YGAN format from a particular company that I bought it from because it was cheap.
[36:40.570 --> 36:47.230]  If I had had a couple hundred dollars more, it would have been a lot easier to make one that could read from 2, 3, 4, 10 feet.
[36:48.190 --> 36:49.750]  But just to prove it's not a trick card...
[36:51.170 --> 36:51.830]  Ah, okay.
[36:53.190 --> 36:54.830]  Let's just see if I have a spare card.
[36:56.190 --> 36:57.090]  A different number.
[36:59.090 --> 37:01.350]  You can barely even hear the beep, but it's there.
[37:04.930 --> 37:12.930]  Now, all we have to do is develop a device, which already exists, that has a little bit stronger, a little bigger field.
[37:14.470 --> 37:15.650]  Now, how hard is that?
[37:16.510 --> 37:18.990]  It's about $450 worth of hard.
[37:19.710 --> 37:22.750]  And you think that this is some great, amazing thing.
[37:22.870 --> 37:23.530]  You've seen what happened.
[37:23.550 --> 37:26.170]  I can walk right past someone and read the card right out of his pocket.
[37:26.630 --> 37:28.070]  But who can do this?
[37:29.750 --> 37:30.790]  The transmit side?
[37:31.170 --> 37:32.090]  We'll get to that in a second.
[37:32.810 --> 37:33.890]  Who can do this?
[37:34.490 --> 37:35.910]  How hard is it to do this?
[37:36.030 --> 37:43.130]  You have to be an uber elite, 2600 reading, I know the movie Hackers back and forth.
[37:43.410 --> 37:47.550]  I live with someone who looks just like Angelina, so that part doesn't count.
[37:47.690 --> 37:48.150]  Trust me.
[37:49.130 --> 38:05.690]  Actually, anybody with $285 total can go out and buy a modifiable reader, a coil, and a good old-fashioned, out of the back of the pickup truck, 12-volt lantern battery.
[38:06.650 --> 38:08.710]  At 12 volts, I can get six inches.
[38:08.830 --> 38:10.650]  At 48 volts, I can get a little bit more.
[38:11.730 --> 38:13.230]  Anybody can do this.
[38:15.290 --> 38:16.110]  Not always.
[38:16.350 --> 38:17.290]  It depends on the standards.
[38:18.610 --> 38:20.250]  But that's all I have.
[38:20.430 --> 38:22.110]  That is the show.
[38:22.630 --> 38:24.090]  That is the proof of concept.
[38:24.090 --> 38:31.850]  It is not a big leap from here to a device that can store this information, retransmit it, swap it, share it.
[38:32.010 --> 38:33.110]  Not unlike credit cards.
[38:34.070 --> 38:36.430]  And at that point, I want to take a few questions.
[38:36.590 --> 38:38.870]  I just want to get back up here with the microphone at all.
[38:39.390 --> 38:40.470]  Droom up some good questions.
[38:40.650 --> 38:41.250]  I'll be right back.
[38:51.410 --> 38:53.010]  First contestant, come on down.
[38:55.670 --> 38:57.670]  All right, are you ready to play our pricing game?
[38:59.290 --> 39:02.070]  Okay, this Motorola radio is made by Motorola.
[39:02.350 --> 39:02.770]  It's encrypted.
[39:02.970 --> 39:03.330]  It's digital.
[39:03.470 --> 39:03.870]  How much?
[39:05.230 --> 39:06.470]  Can we have the mic in front, please?
[39:07.610 --> 39:08.410]  Hello, hello, hello.
[39:08.690 --> 39:09.130]  Test, test.
[39:09.330 --> 39:09.930]  All right, go on.
[39:10.610 --> 39:12.730]  Well, it's well known that the cards can be read.
[39:12.950 --> 39:14.130]  They're read all over the world.
[39:14.250 --> 39:15.570]  You demonstrated they can be read.
[39:15.810 --> 39:17.970]  Now, how do you generate the bit stream?
[39:18.630 --> 39:21.190]  The output bit stream and walk up to a reader and...
[39:21.190 --> 39:23.690]  Okay, what you have to do,
[39:32.020 --> 39:37.000]  you go to the website, and you find the protocol breakdown.
[39:37.890 --> 39:42.020]  Once you have the protocol breakdown, you know the format for the code.
[39:42.160 --> 39:43.430]  You know how the parity works.
[39:43.450 --> 39:45.750]  You know which bit to flop, which should be flipped.
[39:46.350 --> 39:54.640]  And then the other side of the webpage, they will show you the frequency shift, how to send the data stream, at what rates, and how often.
[39:55.620 --> 39:58.890]  I do not have that information to give away for two reasons.
[39:58.890 --> 40:03.450]  I am not giving that information away to anyone because, again, Oz, you know, all that good stuff.
[40:04.060 --> 40:05.480]  Also, it's freely available.
[40:05.850 --> 40:07.230]  It's freely available.
[40:07.350 --> 40:07.890]  You shake your head.
[40:07.960 --> 40:08.450]  You say no.
[40:08.810 --> 40:10.950]  But let me ask you one question.
[40:11.120 --> 40:11.250]  No, no, no.
[40:11.250 --> 40:12.250]  Who uses...
[40:12.250 --> 40:14.600]  I mean, that's just stuff from the HID website, right?
[40:15.000 --> 40:18.480]  Actually, it's from the technical support section of another company that uses HID.
[40:18.680 --> 40:19.930]  It's not from the HID website itself.
[40:20.320 --> 40:21.200]  You say no.
[40:21.330 --> 40:23.180]  I mean, you can laugh and say, oh, you're not going to jail.
[40:23.270 --> 40:25.960]  But you know who uses these proximity cards the most in this city?
[40:27.330 --> 40:28.960]  A little company you may have heard of.
[40:30.870 --> 40:38.290]  Now, if it got out that this system can be cracked, can be broken, can be exploited, don't you think they'd pitch a fit?
[40:39.000 --> 40:40.960]  It's well known that it can be exploited.
[40:41.930 --> 40:44.450]  That's why some people still use Max Stripe cards.
[40:44.730 --> 40:44.910]  Exactly.
[40:45.520 --> 40:48.980]  Because Prox cards have had these vulnerabilities for years and it's well known.
[40:49.500 --> 40:57.730]  There are other technologies like, for example, Prox smart cards with challenge response or with...
[40:57.730 --> 40:58.120]  Right.
[40:59.120 --> 41:00.200]  That's something...
[41:00.200 --> 41:02.100]  My favorite Prox cards were demoed at RSA.
[41:02.430 --> 41:02.700]  Right.
[41:02.700 --> 41:04.450]  Two years ago, they're commercially available now.
[41:05.100 --> 41:08.020]  There are people who are using those who really care about this sort of thing.
[41:08.020 --> 41:08.540]  I agree.
[41:09.160 --> 41:14.930]  A physical access card, a physical contact card, whether it be an eye button or some other kind of physical medium.
[41:15.600 --> 41:16.930]  Smart cards, absolutely.
[41:17.160 --> 41:17.750]  But you know what?
[41:17.850 --> 41:18.520]  They're expensive.
[41:19.950 --> 41:22.890]  And a lot of ma and pa kettle places are not going to pay for them.
[41:29.020 --> 41:37.460]  I didn't say they're expensive to you or to me, but there are a lot of companies out there that think that that's an extraordinary expense when you have 10,000, 20,000, 30,000 employees.
[41:38.520 --> 41:39.040]  Shoot.
[41:39.600 --> 41:41.870]  Well, how's the...
[41:41.870 --> 41:44.480]  How far is the range on the card?
[41:45.250 --> 41:48.230]  Like, you can make that transmit 20 feet with the card?
[41:48.250 --> 41:49.140]  It depends on the reader.
[41:49.500 --> 41:53.730]  The more powerful the reader, the more powerful the field it admits, the more likely...
[41:53.730 --> 41:54.980]  The longer distance it'll work.
[41:55.290 --> 41:57.100]  Units exist that can go up...
[41:57.100 --> 41:58.870]  I've seen that go to 10 to 15 feet.
[42:00.390 --> 42:02.290]  It's not unheard of for them to go farther.
[42:03.330 --> 42:03.580]  Okay.
[42:04.080 --> 42:08.080]  And the mobile speed pass, is that the same thing?
[42:08.330 --> 42:08.540]  No.
[42:08.660 --> 42:10.660]  Mobile speed pass is a different system altogether.
[42:10.660 --> 42:15.560]  It does not work on RF, and it's something else I'm actually working on.
[42:16.370 --> 42:18.160]  I'm working on that with some other people.
[42:18.520 --> 42:21.670]  Also, mobile speed pass does not use a direct correlation.
[42:22.770 --> 42:28.230]  Your mobile speed pass is just an ID number that is linked back real-time, matched up with your credit card number.
[42:28.390 --> 42:28.680]  And the information...
[42:29.230 --> 42:31.930]  Yeah, that information never leaves their databanks.
[42:31.980 --> 42:33.100]  It never goes to the gas station.
[42:33.100 --> 42:34.450]  It's just done in their billing system.
[42:34.790 --> 42:35.520]  But it will be...
[42:35.520 --> 42:37.730]  Well, I'm curious if it's not RF, what is it?
[42:38.360 --> 42:39.080]  I believe...
[42:39.080 --> 42:41.080]  I don't have the specs on it, but I believe it's a microwave.
[42:43.060 --> 42:43.430]  The...
[42:43.430 --> 42:46.180]  Well, the physical speed pass itself is...
[42:46.180 --> 42:47.580]  There's a physical touch version.
[42:47.830 --> 42:51.930]  I have not seen an RF version, but the transmission back and forth.
[42:52.330 --> 42:52.730]  It's true.
[42:52.790 --> 42:53.350]  It's an RFI.
[42:54.000 --> 42:54.520]  Is it?
[42:54.770 --> 42:55.120]  Okay.
[42:55.180 --> 42:56.660]  Well, like I said, I don't have one of them.
[42:56.960 --> 42:58.520]  If you have one...
[42:58.520 --> 42:58.750]  Hmm?
[42:59.020 --> 42:59.790]  DI makes sense.
[42:59.930 --> 43:04.350]  Well, you know, I haven't put a lot of research into mobile speed pass, but now you're giving me an idea of something to go home and play with.
[43:08.390 --> 43:08.790]  Yeah.
[43:09.160 --> 43:12.290]  I'm actually more familiar with contact smart cards, but...
[43:12.290 --> 43:12.430]  Okay.
[43:13.370 --> 43:22.350]  I don't think that the right word for this is cloning the proximity cards, because you're just considering one application here.
[43:22.450 --> 43:23.830]  You're just considering access control.
[43:24.180 --> 43:33.980]  You could use this for, like, holding it up to a terminal, where they have, like, a read-write to the card.
[43:34.870 --> 43:35.230]  Could...
[43:35.230 --> 43:35.450]  Is that...
[43:35.450 --> 43:36.680]  Well, that's a read-write card.
[43:36.770 --> 43:42.540]  When I say cloning, what I'm talking about is taking the information off of a card, putting it into another device, and then using it again.
[43:42.770 --> 43:43.000]  Yeah.
[43:43.140 --> 43:50.100]  That's generally considered cloning, whether you do it with a K card, or with a prox card, or with any other device, or with a CD, what have you.
[43:50.100 --> 43:55.020]  You're taking the data from one source, and you're duplicating it in another place, and it's an exact replica.
[43:55.230 --> 43:55.790]  That's cloning.
[43:56.860 --> 43:56.940]  Okay.
[43:58.340 --> 43:58.750]  Um...
[43:58.750 --> 43:59.280]  Because you can...
[43:59.700 --> 44:01.290]  Could you store other...
[44:01.290 --> 44:02.750]  Like, how much memory is on these cards?
[44:03.160 --> 44:03.680]  Very little.
[44:03.770 --> 44:06.020]  Usually no more than the 26-bit needed.
[44:06.140 --> 44:06.660]  26-bit.
[44:06.820 --> 44:06.980]  Yeah.
[44:07.440 --> 44:08.840]  There are cards that store more.
[44:09.120 --> 44:12.790]  There are cards that have other information, and then that's not the cards that I've worked with.
[44:13.400 --> 44:13.540]  Okay.
[44:14.060 --> 44:14.460]  Because...
[44:14.460 --> 44:17.320]  Are there, like, directory structures on these cards?
[44:17.500 --> 44:17.620]  No.
[44:17.750 --> 44:19.230]  It's simply a data stream.
[44:19.640 --> 44:19.820]  Okay.
[44:19.920 --> 44:22.000]  It's just an RF-transmitted data stream.
[44:23.300 --> 44:23.820]  Mm-hmm.
[44:23.940 --> 44:24.400]  That's it.
[44:24.660 --> 44:25.180]  What did he say?
[44:27.700 --> 44:34.900]  With the reader, the portable reader that you created, how far away can you be and still pick it up?
[44:35.040 --> 44:35.180]  Okay.
[44:35.250 --> 44:37.880]  As I said, that is a variant to the reader.
[44:38.200 --> 44:41.290]  Different readers have different areas of influence.
[44:41.660 --> 44:43.700]  That reader there only goes a couple of inches.
[44:43.940 --> 44:46.120]  There are readers that can go up to a number of feet.
[44:46.790 --> 44:47.640]  It's very...
[44:47.640 --> 44:50.060]  It's based on the reader and how much power you feed into it.
[44:53.170 --> 44:59.650]  So are any of these companies actually planning on making the more secure model, like with a key and stuff?
[44:59.670 --> 45:00.030]  Absolutely.
[45:00.110 --> 45:01.410]  There are more secure models.
[45:01.490 --> 45:02.550]  No, I'm saying with the RF...
[45:02.550 --> 45:03.650]  I'm just curious if you...
[45:03.650 --> 45:08.310]  Are you aware of another RF device like this card that will have a key on it?
[45:08.630 --> 45:08.810]  Yes.
[45:09.110 --> 45:11.470]  There are two-way exchange cards that exist.
[45:11.710 --> 45:15.590]  Like I said, they're used mostly in vending machines and photocopier places.
[45:15.590 --> 45:17.850]  Okay, so the two-way card has a key on it?
[45:17.850 --> 45:19.210]  The two-way card does exist.
[45:19.490 --> 45:21.550]  Is it used for security purposes?
[45:21.890 --> 45:22.450]  Very rarely.
[45:22.710 --> 45:24.070]  It has a key on it?
[45:24.470 --> 45:25.910]  Yeah, it'll have a key on it.
[45:26.950 --> 45:36.530]  The example I gave earlier was the vending machine system, where the card holds one half of the key, the reader holds the other half of the key, and the reader puts the two halves together to determine if it's legitimate or not.
[45:36.530 --> 45:40.810]  But you could still grab that data and then send that half of the key.
[45:40.850 --> 45:41.130]  Absolutely.
[45:41.430 --> 45:43.830]  Okay, so that isn't actually like a key-based system.
[45:45.090 --> 45:51.250]  If you're thinking about a key, like a random seed key or something like that, I have not seen that yet outside of smart cards.
[45:51.390 --> 45:51.610]  Really?
[45:51.810 --> 45:53.370]  Outside of smart cards, I have not seen that.
[45:53.590 --> 45:54.810]  That doesn't mean it doesn't exist.
[45:55.210 --> 45:57.850]  Do you know anything about Easy Pass or any of the toll payment systems?
[45:57.850 --> 46:00.510]  Okay, the toll payment system is a whole other ball game.
[46:00.510 --> 46:05.570]  I've only had my hands on one of those devices, and I blew it up.
[46:07.430 --> 46:09.050]  So if anyone has one, they want to donate.
[46:09.390 --> 46:10.730]  Those, though, I do know.
[46:10.890 --> 46:18.230]  Those I have heard, and this is all secondhand information, so feel free to call me out on this too, but I do believe Easy Pass does work in the microwave range.
[46:19.010 --> 46:24.450]  And that also explains the big, honking devices that are up over the top that you drive under.
[46:24.570 --> 46:26.690]  But that, I do not have a certainty on that.
[46:27.550 --> 46:29.190]  You don't know if the cards are passive?
[46:30.070 --> 46:33.090]  As far as I understand, the Easy Pass is a passive device.
[46:33.830 --> 46:34.490]  It is.
[46:34.610 --> 46:38.610]  It still takes energy, turns it into itself, and retransmits back.
[46:40.670 --> 46:44.070]  I'm not personally familiar with any of the challenge response type devices.
[46:44.370 --> 47:00.250]  I don't know whether they have any kind of rate limiting so far as feeding them challenges, but I imagine that they're vulnerable to the same kind of thing, in that the challenge is unauthenticated and can be from anywhere, and that theoretically if you could bump into somebody for long enough and be in proximity long enough,
[47:00.430 --> 47:04.670]  you could potentially issue every possible challenge and receive all of those replies.
[47:04.830 --> 47:06.790]  Oh yeah, that's at the reader, not a person.
[47:06.990 --> 47:13.590]  Yeah, if I walk to your office and there's a reader sitting there, I can go to the little potted plant next to you and put this little device down there and transmit one a day.
[47:13.590 --> 47:15.550]  But the thing is how I would I know it was successful?
[47:16.350 --> 47:19.450]  I mean, yeah it is possible to brute-force it, but it could be pretty obvious.
[47:19.710 --> 47:21.310]  Also this is where due- diligence comes in.
[47:21.370 --> 47:23.130]  Well it's not really brute-force, it much is building a dictionary.
[47:23.470 --> 47:23.750]  Right.
[47:24.450 --> 47:27.170]  Well I mean, a dictionary attack, brute force attack.
[47:28.550 --> 47:29.310]  We're not brute force?
[47:29.390 --> 47:32.590]  I mean you never know which challenge is going to be issued by the actual reader.
[47:32.710 --> 47:34.170]  So you issue every possible challenge.
[47:34.370 --> 47:37.610]  And you encounter the actual reader and you receive the challenge.
[47:37.610 --> 47:39.790]  You look at that challenge and you already know the correct response.
[47:39.790 --> 47:39.990]  Right.
[47:40.190 --> 47:42.010]  And that's where due diligence comes in.
[47:42.230 --> 47:47.290]  If someone sees 8,000 attempts that failed and one that succeeded, that means somebody's up to something.
[47:47.390 --> 47:48.450]  I think you're thinking backwards.
[47:48.590 --> 47:51.750]  You're saying you need brute force in your briefcase.
[47:52.570 --> 47:53.710]  There's only a brute force.
[47:53.830 --> 47:54.790]  It's a one-time signal.
[47:54.790 --> 47:55.470]  The signal goes out.
[47:55.550 --> 47:55.910]  That's it.
[47:56.570 --> 48:01.790]  Now, he talks about, but since it was the time, he gets all the responses from the time.
[48:02.010 --> 48:02.310]  Okay.
[48:02.390 --> 48:03.690]  Well, that doesn't exist.
[48:04.350 --> 48:08.490]  The challenge response system is usually based around a smart card.
[48:08.490 --> 48:12.010]  The smart cards are not vulnerable to this because you have to have physical contact in order to read them.
[48:12.130 --> 48:13.850]  No, there are wireless smart cards.
[48:14.730 --> 48:15.470]  You've seen these?
[48:15.610 --> 48:15.890]  Yes.
[48:16.170 --> 48:17.050]  Wireless smart cards.
[48:17.110 --> 48:17.290]  Yes.
[48:17.370 --> 48:18.470]  I've seen combinations.
[48:19.250 --> 48:20.830]  Smart card and wireless in one.
[48:20.970 --> 48:26.730]  But every smart card I've seen that has a little chip on it, you have to actually put this into a reader that makes physical contact.
[48:28.930 --> 48:31.130]  So it's proximity challenge response is what you're saying?
[48:31.790 --> 48:33.370]  And do you know if there's any kind of...
[48:33.370 --> 48:33.490]  Oh, you see?
[48:34.230 --> 48:40.330]  Usually the challenge is enough bits that doing this kind of brute force attack on it would take a very long time.
[48:40.370 --> 48:44.250]  Do you know if there's any kind of rate limiting inherent in the card?
[48:45.490 --> 48:45.690]  Mm-hmm.
[48:45.690 --> 48:45.990]  You see?
[48:46.170 --> 48:47.610]  It just shows...
[48:48.310 --> 48:50.440]  Mm-hmm.
[48:52.520 --> 48:56.600]  Well, I'll be the first person to admit, I have not heard of contactless smart cards.
[48:56.720 --> 48:57.460]  I have not seen that.
[48:57.680 --> 49:00.480]  And I'm definitely going to look into that because that's something worth looking into.
[49:10.610 --> 49:11.090]  Okay.
[49:11.090 --> 49:12.610]  But these are smart cards.
[49:14.270 --> 49:14.750]  Hmm.
[49:16.390 --> 49:19.770]  And it's not the same coil-based system.
[49:22.530 --> 49:23.010]  Okay.
[49:32.830 --> 49:33.310]  Hmm.
[49:33.910 --> 49:34.530]  Not by me.
[49:36.990 --> 49:37.770]  Oh, that's good.
[49:37.970 --> 49:39.190]  That's something else to look into.
[49:39.370 --> 49:40.910]  I haven't had my hands on that system.
[49:41.810 --> 49:42.270]  There you go.
[49:42.270 --> 49:43.590]  I just want to ask one other thing.
[49:43.590 --> 49:50.470]  Does anybody know if these proximity challenge response cards, if the challenge is authenticated in any way?
[49:50.650 --> 49:54.430]  Or can anybody effectively issue a challenge by being in proximity?
[49:57.070 --> 49:57.790]  Nobody knows.
[49:58.070 --> 49:58.210]  Nope.
[49:58.430 --> 49:58.690]  Not me.
[49:58.870 --> 49:59.550]  You were doing it.
[50:02.250 --> 50:03.670]  Mm-hmm.
[50:04.210 --> 50:04.450]  Thank you.
[50:04.610 --> 50:04.710]  Okay.
[50:06.450 --> 50:07.290]  Anything else?
[50:14.820 --> 50:15.600]  Use the mic.
[50:16.260 --> 50:16.540]  All right.
[50:16.580 --> 50:18.740]  I have a friend of mine who took apart the transmitter in there.
[50:18.740 --> 50:19.840]  And it is, in fact, a transmitter.
[50:19.940 --> 50:21.720]  He took it with a frequency counter and it does transmit.
[50:21.760 --> 50:22.660]  He won't read that one.
[50:22.760 --> 50:23.620]  I'm pretty sure it won't.
[50:24.980 --> 50:25.260]  Yeah.
[50:25.360 --> 50:26.320]  It's not a passive device at all.
[50:27.020 --> 50:27.300]  Sorry?
[50:27.540 --> 50:28.440]  We were talking about these devices.
[50:28.540 --> 50:29.300]  It's not a passive device at all.
[50:29.380 --> 50:29.880]  It does transmit.
[50:30.020 --> 50:30.200]  Okay.
[50:30.260 --> 50:32.840]  Well, I do believe I said I don't know about it.
[50:32.900 --> 50:34.380]  And all I know is that I've heard it secondhand.
[50:34.600 --> 50:35.600]  So, there you go.
[50:41.380 --> 50:41.900]  That's fine.
[50:42.220 --> 50:42.600]  I...
[50:42.600 --> 50:44.660]  That's a whole other area of research.
[50:45.000 --> 50:46.080]  And I will look into that.
[50:46.160 --> 50:46.740]  That's not what I...
[50:46.740 --> 50:47.760]  That's not what this was about.
[50:48.240 --> 50:49.300]  But, there it is.
[50:50.180 --> 50:51.980]  And if there's nothing else...
[50:52.420 --> 50:53.020]  Have a day.
[50:53.020 --> 50:53.060]  Thank you.