Wireless Hacking & Capture the Flag with Eric Escobar | CypherCon 2.0

### Overview At CypherCon 2.0, Eric Escobar of SecureWorks presents an introductory talk on software-defined radio (SDR) and wireless replay attacks, previewing challenges designed for the conference's Wireless Capture the Flag (CTF). Escobar explains that many cheap commercial electronic devices—particularly those operating around 433–434 MHz—lack encryption or rolling-code protections, making them inherently vulnerable to signal capture and replay attacks.

### Key Concepts & Hardware Escobar outlines fundamental concepts required for RF analysis: - **Duplexity**: Differentiating half-duplex systems (listen or talk one at a time, like walkie-talkies) from full-duplex systems (simultaneous transmit and receive, like telephones). - **Sampling Rates**: Measured in million samples per second (MSPS), balancing between sufficient sample resolution to capture signals accurately without overloading computer processors or draining battery. - **SDR Hardware Options**: Ranging from inexpensive $20 RTL-SDR TV tuners (receive-only with broad range), to intermediate transceivers like the Yard Stick One ($115, half-duplex), up to higher-end full-duplex transceivers such as the BladeRF ($650) with temperature-stabilized oscillators.

### Technical Details & Tooling To inspect unknown devices without manually decoding signals from raw waterfall plots, Escobar recommends looking up the device's FCC ID via `fcc.io` to retrieve public filings, internal photos, frequencies, and modulation specs. Many cheap devices rely on amplitude modulation (AM) via On-Off Keying (OOK), encoding binary ones and zeros as high/low signal pulses and repeatedly retransmitting packets to survive RF interference.

Signal analysis and exploitation tools highlighted include: - **Audacity**: Audio editor used to inspect `.wav` or raw signal captures visually and measure bit timings. - **GNU Radio & GQRX**: Popular open-source SDR toolkits for Unix systems. - **SDR# (SDRSharp)**: Windows-based platform capable of tasks such as tracking unencrypted aircraft beacons. - **RFcat**: Python-driven framework for RF manipulation. - **OOKtools**: Specialized software for scanning frequencies, identifying baud rates, and demodulating OOK signals (primarily with the Yard Stick One). - **HackRF Tools**: Demonstrating straightforward capture and replay using the `hackrf_transfer` command-line utility at specified frequencies (e.g., 434 MHz).

### Target Vulnerabilities & CTF Preview Escobar presents practical demonstrations of replay attacks against consumer hardware, including battery-deprived motion detectors, wireless doorbells, sequentially triggered Etekcity wireless power outlets, automated gated-community barriers, and an unencrypted dog shock collar. The presentation concludes with logistics for the CypherCon Wireless CTF (`CypherCon_WCTF`), which features fox hunts, ham radio number stations, SDR replay stations, and war driving verification against 7,500 mapped points in Milwaukee.