DEFCON is one of the largest and longest running hacker conferences in the world. It’s been held every August in Las Vegas since 1993, and it’s a gathering of security researchers, hackers, tinkerers, journalists, curious weirdos (and quite a few feds) who all share an obsession with taking things apart and understanding how they really work. It’s part conference and part underground bazaar, with dozens of villages dedicated to things like lock picking, car hacking, IoT, and social engineering, plus talks, competitions, badge hacking, and a whole lot of soldering irons.
I go to DEFCON every year because I think the people there are doing really cool and awesome stuff. And this year was no different. The Ludlow Institute hosted a hackathon at IoT Village where we had people hack into IoT devices like electronic basketball hoops, electric cars, smart lights, and other everyday connected junk. And we gave out prizes when people found anything interesting.
The IoT Village peeps were awesome and set up an entire hacking station built around a tool called the Bus Pirate 5. It allows you to intercept communication happening on IoT devices. The chips in IoT devices constantly talk to each other over a few simple protocols, that travel along copper traces on the circuit board, sending information about sensor readings, stored settings, even firmware. The Bus Pirate clips onto the chips’ pins or exposed test points, lets you listen in on the information being sent, and displays it in real time on its screen or through a browser-based terminal. Really excited about some of the findings from the hackathon, which we’ll announce soon.
I also gave a presentation at DEFCON about the pervasive hidden surveillance that’s been quietly integrated into our lives, and how most people have no idea that it’s even there. And I met some super cool people building tools to fight back.
I recorded some interviews with a few of the people I met, just to give you a taste of the kinds of engagement going on right now to push back against the destruction of privacy in society. If you’ve ever felt like the surveillance state is too big and too invisible to do anything about, these people are quietly proving otherwise.
Colonel Panic and the OUI Spy
Colonel Panic makes hardware that detects surveillance technologies. Someone recently gave me one of his Flock detectors, called an “OUI Spy”, so I was super excited to meet him in person.
The device passively sniffs both Wi-Fi and Bluetooth, picking up the wireless emissions of Flock cameras so people can detect them without ever touching them.
“We have essentially two PCBs, a buzzer — so if you’re driving by one, you get a beep — and an ESP32-S3. It’s a tiny little computer, it’s got a little bit of memory, and it’s programmed with my firmware that tells it to beep when it detects a certain OUI.”
An OUI is the first six characters of a MAC address, and it can identify the company broadcasting the signal, because manufacturers reserve entire ranges of the MAC address space. But because of MAC address randomization, it’s getting harder to track certain devices by OUI alone. So now Colonel Panic has started to look at Bluetooth UUIDs and some of the deeper parts of the Bluetooth protocol that can still be passively detected.
Flock is rapidly responding to these kinds of detection tools, and it’s kind of a cat-and-mouse game to keep up, so Colonel Panic encourages everyone to get out there and do research.
“You could get WiGLE.net on your phone or even start to just look up wardriving.”
Wardriving is where you drive around and pick up signals like Wi-Fi signals and Bluetooth signals, to build a map. Every router is constantly broadcasting its BSSID — basically its MAC address, a unique hardware identifier. Apps like WiGLE log that identifier alongside the GPS coordinates where it was detected and upload it to WiGLE.net, a crowdsourced, publicly searchable database.
Anyone can wardrive to detect all the signals of the surveillance tech around them: things like Flock and Axon cameras. You can start to map where you’re seeing this spyware, so that people can avoid it or route around it.
“You’ll be really surprised at how much surveillance you see. I wasn’t aware of how much surveillance there was until I started wardriving. And then I noticed that it’s just everywhere. It was alarming to me. And I thought ‘It’d be interesting if we made something that detected all this easily for the average person.’”
Cyber Tiger and the Rayhunter
Cyber Tiger is a senior staff technologist at the Electronic Frontier Foundation, where he works on Rayhunter, an open-source tool for detecting cell-site simulators, better known as stingrays.
A stingray is a fake cell phone tower, most famously used by police. Your phone is designed to automatically connect to whatever nearby tower has the strongest signal, and a stingray exploits that trust.
“It tricks your phone into connecting to it so that it can find your identity — your IMSI, which is your unique identifier for your SIM card. Once it finds that, it can be used by law enforcement to locate you. It can be used by law enforcement or criminals or spies to listen to your phone calls and text messages. Or it can be used by scammers, spammers, or anyone else. It’s really easy for someone to set up a fake cell tower and say, ‘All cell phones in the area, please connect to this tower. It’s very important.’ And so all the phones will do that.”
Rayhunter is the EFF’s answer: open-source detection software that runs on a cheap mobile hotspot. You can buy these for $20 to $40 on eBay or Amazon. The hotspot’s modem is constantly chatting with nearby cell towers, and Rayhunter watches that conversation for the telltale signatures of a stingray at work.
Stingray use in the US has been shrouded in secrecy for years, with law enforcement agencies going to great lengths to avoid disclosing when and how they deploy them. Nobody really knows how widespread this surveillance is.
“We built Rayhunter to try to get a better idea of how often this tech was being used in the US, how prevalent it was, and how exactly it worked — because there’s been a lot of obfuscation of what exactly the attacks are that are taking place, and how we can better secure our phones against this technology. One of our big goals was to make a counter-surveillance device that was cheap, accessible, and easy to run for everyone.”
Simply buy a hotspot, plug it into your computer, and run the installer from eff.org/rayhunter. Then just carry the device around.
“It’ll have a little green line at the top. If that line turns red, that means that Rayhunter has found something it considers suspicious. Then you can connect to it and download the PCAPs.” (PCAPs are the packet captures of the suspicious network traffic, viewable in programs like Wireshark.)
“You can download the file, send it to us, and we’ll take a look at it and tell you what we think.”
Every person running a cheap hotspot can become a sensor in a crowdsourced effort to map how often fake cell towers are being used against the public.
John and the Biscuit Ultra
John is an attendee that I chatted with for a long time about all the stuff he’s playing with. He opened his backpack and it was FILLED with amazing tech that I wanted people to know about. First he showed me a pocket-sized device called the Biscuit Ultra, designed by a hacker who goes by Hedge. It’s a wardriving tool that also detects whether you’re being followed.
“First, it records all devices in the vicinity that it can find. And if it detects the same device within a certain interval, then it alerts you that you may have a tail — and saves it to an SD card for further analysis.”
Everything around you (phones, cars, earbuds, trackers) is constantly broadcasting wireless identifiers. If the same identifier keeps showing up as you move from place to place, that device is moving with you. The Biscuit Ultra will alert you if this happens.
It has several modes you can switch between:
Wi-Fi-only (scanning for APs)
Bluetooth and Flock
All (puts things like Axon security cameras in the area on a map where it locates them)
Anti-surveillance (detects if anyone is following you)
So in a single handheld: Wi-Fi access point scanning, full wardriving across Bluetooth and Wi-Fi, Flock and Axon camera detection with mapping, and tail detection.
Off-grid messaging with Meshtastic
John also pulled out a second device: a LilyGO T-Deck, a little handheld with a keyboard and screen. He’s flashed this with Meshtastic, which is a free, open-source firmware that turns cheap radios into an encrypted, off-grid mesh messaging network. His was loaded with a DEFCON-specific Meshtastic build, preconfigured for the channels attendees were using at the con.
“They have a web flasher that you use. Once you flash it, you can enable Bluetooth — there’s a Meshtastic app — and then you pair it with your device. Then you can use your phone to send and receive messages.”
He also had an Exploitee.rs pager flashed with the DEFCON Meshtastic build.
Meshtastic requires no cell towers, no internet, no accounts, and there’s no phone company in the middle.
“It’s a mesh network operating around 915 megahertz in the US.”
Every device on the network relays messages for every other device.
“It goes from node to node — meaning that this device goes to the nearest device it sees — even across different hotels and different areas.”
At a conference full of hackers, that meant messages hopping across the Las Vegas Strip from hotel to hotel with no cell connection required.
Em3ritus’ Simulacra
And finally there was a device called the Simulacra, a personal anti-surveillance system that protects you from wireless tracking by drowning your real devices in a sea of fake signals. It works like a small fleet: one central unit called a Vigil (an ESP32 with a touchscreen display, also known as a “Cheap Yellow Display”) acts as the commander, and it wirelessly controls a group of smaller nodes (ESP32-C5s and ESP32-C6s).
Together, this fleet constantly broadcasts a churning crowd of realistic-looking fake and randomly-generated Bluetooth and Wi-Fi signals all around you, so anyone trying to track your phone, earbuds, or car sees dozens of plausible devices instead of just yours, with no way to tell which is real. On top of that, Simulacra passively watches the wireless environment for devices that keep reappearing as you move, and alerts you when something might be following you. And it allows you to scan your own devices, to see what SSIDs you’re broadcasting
It’s Time To Build The Resistance
My main takeaway from this year’s DEFCON is that no one is coming to save us. If we want to understand what is going on in our tech, we have to break it open ourselves. The cell networks aren’t going to get more secure because a carrier decides to be nice. And Flock isn’t going to stop blanketing our neighborhoods with cameras because a community asked politely. The tools that protect us are being built by a small, scrappy community of hackers and hobbyists working on shoestring budgets often in their spare time. Tools like a $20 hotspot flashed with Rayhunter and a $10 ESP32 that beeps when you drive past a Flock camera and a pager sized gadget that warns you when the same car has been following you for too long.
I love seeing this stuff. And if you have anything that you’ve prototyped, come show me at a conference sometime.
The surveillance in our lives is pervasive, but it’s also detectable. And the more of us who are actually looking, the more empowered we can all be to protect ourselves in the digital age.
Yours In Privacy,
Naomi
Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.
NBTV. Because Privacy Matters.
If you can read this you are the Resistance
This is so cool! Thank you for sharing