0 00:00:00,000 --> 00:00:30,000 Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/843 Thanks! 1 00:00:15,690 --> 00:00:16,769 OK. 2 00:00:16,770 --> 00:00:17,770 But some of them. 3 00:00:21,590 --> 00:00:22,590 What can martini? 4 00:00:23,620 --> 00:00:24,620 Shaken, not stirred. 5 00:00:25,960 --> 00:00:27,280 Do I look like I give it them? 6 00:00:28,690 --> 00:00:31,029 This was a game changer in James 7 00:00:31,030 --> 00:00:32,919 Bond Casino Royale. 8 00:00:32,920 --> 00:00:35,529 And so is modern technology 9 00:00:35,530 --> 00:00:38,349 in modern microphone box. 10 00:00:38,350 --> 00:00:40,509 Veronica and Sebastian 11 00:00:40,510 --> 00:00:43,719 Garcia, both known from various 12 00:00:43,720 --> 00:00:46,389 conferences like Black Hat or AK Party. 13 00:00:46,390 --> 00:00:48,069 We'll tell you about the current 14 00:00:48,070 --> 00:00:50,469 situation and about the current state 15 00:00:50,470 --> 00:00:51,579 of microphone box. 16 00:00:53,010 --> 00:00:55,319 Please welcome with the very, very 17 00:00:55,320 --> 00:00:57,629 warm and applause 18 00:00:57,630 --> 00:00:59,759 spy versus spy, a modern study 19 00:00:59,760 --> 00:01:01,319 of microphone box. 20 00:01:01,320 --> 00:01:02,320 Thanks. 21 00:01:03,780 --> 00:01:04,780 Thank you. 22 00:01:09,840 --> 00:01:11,879 Hi, everyone. 23 00:01:11,880 --> 00:01:12,880 Out of people here. 24 00:01:13,890 --> 00:01:16,049 So, first of all, thank you to 25 00:01:16,050 --> 00:01:18,119 the CDC, to the Congress, to the 26 00:01:18,120 --> 00:01:20,519 translation team for us is 27 00:01:20,520 --> 00:01:23,129 super awesome to be here. 28 00:01:23,130 --> 00:01:25,559 We're a little bit nervous, so 29 00:01:25,560 --> 00:01:28,019 we are eager to show you what we did. 30 00:01:28,020 --> 00:01:30,419 Yeah, I'm Sebastian Garcia. 31 00:01:30,420 --> 00:01:32,609 I'm from Argentina, co-founder 32 00:01:32,610 --> 00:01:34,499 of the Metzler Hackerspace. 33 00:01:34,500 --> 00:01:37,109 And usually my day to day life 34 00:01:37,110 --> 00:01:39,269 I work as a were 35 00:01:39,270 --> 00:01:41,549 another security researcher using 36 00:01:41,550 --> 00:01:43,169 machine learning in a university in 37 00:01:43,170 --> 00:01:44,170 Prague. 38 00:01:45,030 --> 00:01:46,030 And that's it 39 00:01:46,800 --> 00:01:48,599 for I'm Veronica. 40 00:01:48,600 --> 00:01:50,609 I'm also from Argentina and also a 41 00:01:50,610 --> 00:01:53,549 co-founder of the Hacker Space Museum. 42 00:01:53,550 --> 00:01:55,799 And my 43 00:01:55,800 --> 00:01:58,229 daily job is nothing like this. 44 00:01:58,230 --> 00:02:00,749 I'm a threat researcher doing 45 00:02:00,750 --> 00:02:03,449 an indoor traffic analysis, so 46 00:02:03,450 --> 00:02:06,029 we are here today to talk about 47 00:02:06,030 --> 00:02:07,110 microphone bugs, 48 00:02:08,130 --> 00:02:10,409 how to operate them and how to take them. 49 00:02:10,410 --> 00:02:12,479 So we have a lot of material to 50 00:02:12,480 --> 00:02:13,529 go through. 51 00:02:13,530 --> 00:02:15,959 So we are really eager to 52 00:02:15,960 --> 00:02:17,029 start. 53 00:02:17,030 --> 00:02:19,139 So, so 54 00:02:19,140 --> 00:02:21,279 spy was is by a mother 55 00:02:21,280 --> 00:02:23,339 of study of milk box operation 56 00:02:23,340 --> 00:02:24,340 and detection. 57 00:02:25,350 --> 00:02:27,509 This is something that we start working 58 00:02:27,510 --> 00:02:29,639 like. Two years ago, we were 59 00:02:29,640 --> 00:02:31,949 trying to see. OK, we don't know much 60 00:02:31,950 --> 00:02:34,139 about these. Probably few people know 61 00:02:34,140 --> 00:02:36,179 much about these, and there is quite a 62 00:02:36,180 --> 00:02:38,099 black hole in there for us to say, Hey, 63 00:02:38,100 --> 00:02:40,289 we should get into that and see what the 64 00:02:40,290 --> 00:02:42,779 reality for us in this topic. 65 00:02:42,780 --> 00:02:45,299 Yeah, and everything started 66 00:02:45,300 --> 00:02:47,619 when we have 67 00:02:47,620 --> 00:02:50,099 the Chinese artist 68 00:02:50,100 --> 00:02:51,100 AI Weiwei 69 00:02:52,170 --> 00:02:54,569 phone microphones 70 00:02:54,570 --> 00:02:56,709 hidden in electrical sockets in his 71 00:02:56,710 --> 00:02:59,639 common studio back in 2015. 72 00:02:59,640 --> 00:03:01,729 This was shocking for us. 73 00:03:01,730 --> 00:03:04,419 I'm sure many of you heard this 74 00:03:04,420 --> 00:03:05,519 story. 75 00:03:05,520 --> 00:03:07,769 This was shocking because 76 00:03:07,770 --> 00:03:10,139 it was believed that the microphones 77 00:03:10,140 --> 00:03:12,539 were planted in his place 78 00:03:12,540 --> 00:03:14,609 back in 2011 when 79 00:03:14,610 --> 00:03:16,619 he was in jail. 80 00:03:16,620 --> 00:03:19,019 So there were four 81 00:03:19,020 --> 00:03:21,119 years of time 82 00:03:21,120 --> 00:03:23,699 between the planned the devices until 83 00:03:23,700 --> 00:03:25,439 he found the devices. 84 00:03:25,440 --> 00:03:28,409 Four years is a lot of time for people 85 00:03:28,410 --> 00:03:30,839 to hear all your life and conversations 86 00:03:30,840 --> 00:03:32,849 and stories that go around your life. 87 00:03:32,850 --> 00:03:34,379 So we were shocked. 88 00:03:34,380 --> 00:03:36,329 Like how this? 89 00:03:36,330 --> 00:03:38,309 We thought that this technology was all 90 00:03:38,310 --> 00:03:40,199 and deprecated and this was not used 91 00:03:40,200 --> 00:03:41,199 anymore, right? 92 00:03:41,200 --> 00:03:42,659 And we were wrong. 93 00:03:42,660 --> 00:03:44,759 So we start saying, well, why we 94 00:03:44,760 --> 00:03:46,229 don't hear about this anymore. 95 00:03:46,230 --> 00:03:48,359 So we started digging news and 96 00:03:48,360 --> 00:03:50,729 there were a few other documented cases 97 00:03:50,730 --> 00:03:53,069 like this in this was that had a little 98 00:03:53,070 --> 00:03:55,199 political emphasis because 99 00:03:55,200 --> 00:03:57,269 they found a bug in 100 00:03:57,270 --> 00:03:59,699 the Ecuadorian Embassy 101 00:03:59,700 --> 00:04:00,779 in London. 102 00:04:00,780 --> 00:04:02,849 And of course, in these 103 00:04:02,850 --> 00:04:05,069 type of cases, when you find a bug in 104 00:04:05,070 --> 00:04:07,439 London, who can place a bug 105 00:04:07,440 --> 00:04:08,519 in London, right? 106 00:04:08,520 --> 00:04:10,979 So it was had like strong 107 00:04:10,980 --> 00:04:12,509 political implications. 108 00:04:12,510 --> 00:04:14,819 But these cases, 109 00:04:14,820 --> 00:04:16,708 it's not the microphone bugs are not used 110 00:04:16,709 --> 00:04:19,078 anymore, is that people just don't 111 00:04:19,079 --> 00:04:20,518 speak about these freely. 112 00:04:20,519 --> 00:04:22,500 So the documentation and 113 00:04:23,670 --> 00:04:25,859 information available around these 114 00:04:25,860 --> 00:04:28,739 type of things is not freely 115 00:04:28,740 --> 00:04:29,969 available. 116 00:04:29,970 --> 00:04:31,050 Another thing is that 117 00:04:32,910 --> 00:04:35,219 it's it's very 118 00:04:35,220 --> 00:04:37,019 it's very hard to actually know that you 119 00:04:37,020 --> 00:04:38,229 are back, right? 120 00:04:38,230 --> 00:04:40,079 So it's very 121 00:04:40,080 --> 00:04:41,729 critical, you know, and even if you find 122 00:04:41,730 --> 00:04:43,889 it, most people maybe not telling 123 00:04:43,890 --> 00:04:45,299 others that they were bad. 124 00:04:45,300 --> 00:04:47,519 So the information is the scars and 125 00:04:47,520 --> 00:04:49,889 scars every time there are few cases 126 00:04:49,890 --> 00:04:50,879 that are probably Kabelo. 127 00:04:50,880 --> 00:04:51,809 Like this one? 128 00:04:51,810 --> 00:04:53,849 Yeah. And we were we were thinking at 129 00:04:53,850 --> 00:04:55,769 this point, OK, what do we know about 130 00:04:55,770 --> 00:04:56,759 microphone bugs? 131 00:04:56,760 --> 00:04:58,919 And we found that most of the things 132 00:04:58,920 --> 00:05:01,259 that we know is from movies 133 00:05:01,260 --> 00:05:02,189 and TV shows. 134 00:05:02,190 --> 00:05:04,559 And when your information comes 135 00:05:04,560 --> 00:05:06,629 from movies and TV show, that's not very 136 00:05:06,630 --> 00:05:08,939 nice, right? So we started to dig more 137 00:05:08,940 --> 00:05:11,129 and more. So we want to do this 138 00:05:11,130 --> 00:05:13,709 like a formal research, like 139 00:05:13,710 --> 00:05:15,449 a study was possible. 140 00:05:15,450 --> 00:05:17,609 So we started as every 141 00:05:17,610 --> 00:05:20,279 research staff with kind of 142 00:05:20,280 --> 00:05:21,809 what it was done before. 143 00:05:21,810 --> 00:05:23,399 What information is available from the 144 00:05:23,400 --> 00:05:26,309 past? And we did like, OK, 145 00:05:26,310 --> 00:05:28,559 take the last hundred years and say, 146 00:05:28,560 --> 00:05:30,659 what was the injury kind 147 00:05:30,660 --> 00:05:32,759 of highlight some of the cases that we 148 00:05:32,760 --> 00:05:34,169 found interesting. Of course, there are 149 00:05:34,170 --> 00:05:35,170 hundreds of them. 150 00:05:36,040 --> 00:05:38,099 So these are some of 151 00:05:38,100 --> 00:05:39,510 the ones that we like the most. 152 00:05:40,800 --> 00:05:43,469 This one was invented 153 00:05:43,470 --> 00:05:44,470 in Russia. 154 00:05:45,090 --> 00:05:47,339 It was called the Great 155 00:05:47,340 --> 00:05:49,439 Silver, or at the time, it 156 00:05:49,440 --> 00:05:51,179 was known as the thing. 157 00:05:51,180 --> 00:05:53,009 You know how much people knew about it is 158 00:05:53,010 --> 00:05:54,120 that they call it the thing. 159 00:05:55,410 --> 00:05:57,509 It was very interesting case because 160 00:05:57,510 --> 00:05:59,939 it was planted in the US Embassy 161 00:05:59,940 --> 00:06:02,159 in Moscow, and they took 162 00:06:02,160 --> 00:06:04,379 seven years to find it 163 00:06:04,380 --> 00:06:06,689 because it was planted in plain 164 00:06:06,690 --> 00:06:08,319 sight, just in a room. 165 00:06:08,320 --> 00:06:10,179 There was there was a gift for the 166 00:06:10,180 --> 00:06:11,769 embassy, so they put it there on the 167 00:06:11,770 --> 00:06:13,179 wall, right? 168 00:06:13,180 --> 00:06:15,789 And it was found by accident 169 00:06:15,790 --> 00:06:17,320 because some people was 170 00:06:18,400 --> 00:06:20,589 some person that was listening to 171 00:06:20,590 --> 00:06:23,069 the radio phone. 172 00:06:23,070 --> 00:06:25,509 The actually he was hearing 173 00:06:25,510 --> 00:06:27,129 conversations that were coming from the 174 00:06:27,130 --> 00:06:28,599 embassy, but he was outside. 175 00:06:28,600 --> 00:06:30,729 So he was like asking what is going 176 00:06:30,730 --> 00:06:32,949 on? So they started investigating and 177 00:06:32,950 --> 00:06:34,029 they found this. 178 00:06:34,030 --> 00:06:36,969 So when they opened this thing 179 00:06:36,970 --> 00:06:38,229 where they opened the thing, they found 180 00:06:38,230 --> 00:06:40,539 that there was no battery in there, only 181 00:06:40,540 --> 00:06:42,669 the microphone and some pieces 182 00:06:42,670 --> 00:06:43,809 of electronics. 183 00:06:43,810 --> 00:06:45,969 So how did it work if there 184 00:06:45,970 --> 00:06:48,129 was no battery, if it was alone 185 00:06:48,130 --> 00:06:49,539 in the embassy for seven years? 186 00:06:49,540 --> 00:06:51,699 Does anyone here have any idea how this 187 00:06:51,700 --> 00:06:53,529 mic work at the time? 188 00:06:53,530 --> 00:06:54,910 Anyone want to shout? 189 00:06:56,900 --> 00:06:59,419 So just just short. 190 00:06:59,420 --> 00:07:01,329 What do you think, huh? 191 00:07:03,260 --> 00:07:04,579 Why exactly, right? 192 00:07:04,580 --> 00:07:05,929 Why do these energy? So thank you very 193 00:07:05,930 --> 00:07:08,179 much. So the idea was that somebody 194 00:07:08,180 --> 00:07:10,579 from the outside was a meeting 195 00:07:10,580 --> 00:07:12,769 electromagnetic energy frequency 196 00:07:12,770 --> 00:07:15,319 right into the embassy 197 00:07:15,320 --> 00:07:17,509 in to the thing 198 00:07:17,510 --> 00:07:18,919 powering up the thing. 199 00:07:18,920 --> 00:07:21,199 And then the thing was there 200 00:07:21,200 --> 00:07:23,959 capturing the sound, converting this into 201 00:07:23,960 --> 00:07:26,209 electricity, modulating frequency 202 00:07:26,210 --> 00:07:28,519 antenna and transmitting back. 203 00:07:28,520 --> 00:07:30,919 They called these illuminating 204 00:07:30,920 --> 00:07:31,879 the embassy row. 205 00:07:31,880 --> 00:07:33,919 They were pointing electromagnetic 206 00:07:33,920 --> 00:07:34,920 frequency. So 207 00:07:36,260 --> 00:07:38,809 yeah, the people between these 208 00:07:38,810 --> 00:07:40,669 inside this information, Adrianne didn't 209 00:07:40,670 --> 00:07:43,279 feel so happy at the time. 210 00:07:43,280 --> 00:07:45,379 So you can see that this is like NFC 211 00:07:45,380 --> 00:07:47,029 near field communication technology, the 212 00:07:47,030 --> 00:07:49,009 same that we are seeing now. 213 00:07:49,010 --> 00:07:51,019 You transmit some energy wireless. 214 00:07:51,020 --> 00:07:52,969 OK, maybe it was not near field. 215 00:07:52,970 --> 00:07:55,159 Maybe it was very far away field 216 00:07:55,160 --> 00:07:57,499 communication, but it's the same idea. 217 00:07:57,500 --> 00:07:59,539 So the technology is not new. 218 00:07:59,540 --> 00:08:01,159 It was the first time that we saw the 219 00:08:01,160 --> 00:08:02,479 word using it like that. 220 00:08:02,480 --> 00:08:04,309 Yeah. So after they found these 221 00:08:04,310 --> 00:08:06,319 Americans, of course, took the idea and 222 00:08:06,320 --> 00:08:07,939 they created something very similar to 223 00:08:07,940 --> 00:08:09,169 those called Sahitya. 224 00:08:09,170 --> 00:08:11,419 It was just a copy of these, and this was 225 00:08:11,420 --> 00:08:13,519 after the Second World War. 226 00:08:13,520 --> 00:08:15,049 Nineteen forty something. 227 00:08:15,050 --> 00:08:16,039 So. 228 00:08:16,040 --> 00:08:18,139 And this was kind of novel because it 229 00:08:18,140 --> 00:08:19,690 didn't require energy, right? 230 00:08:21,080 --> 00:08:23,509 But a few years later, the 231 00:08:23,510 --> 00:08:25,789 transistor was invented, so 232 00:08:25,790 --> 00:08:27,919 things started to shrink, and that was 233 00:08:27,920 --> 00:08:30,499 a technological advance 234 00:08:30,500 --> 00:08:31,429 on the field. 235 00:08:31,430 --> 00:08:33,499 And one example of these is the 236 00:08:33,500 --> 00:08:35,058 KGB bug. 237 00:08:35,059 --> 00:08:37,439 It was these generic as we founded 238 00:08:37,440 --> 00:08:39,529 it. You can see that it's really 239 00:08:39,530 --> 00:08:42,349 small only seven centimeters long. 240 00:08:42,350 --> 00:08:45,439 It has like two pins on the bottom 241 00:08:45,440 --> 00:08:47,509 where it was a power supply, one pin in 242 00:08:47,510 --> 00:08:48,620 the top for the antena. 243 00:08:49,700 --> 00:08:51,799 The small screws 244 00:08:51,800 --> 00:08:53,899 on the middle were for 245 00:08:53,900 --> 00:08:55,939 tuning the frequency, so that was also 246 00:08:55,940 --> 00:08:58,049 innovative and the small size make 247 00:08:58,050 --> 00:08:59,690 it really portable. 248 00:09:00,710 --> 00:09:02,329 You can see there the the number. 249 00:09:02,330 --> 00:09:04,429 We thought it was the serial number, 250 00:09:04,430 --> 00:09:06,529 which is pretty 251 00:09:06,530 --> 00:09:08,389 large, but actually somebody told us that 252 00:09:08,390 --> 00:09:10,369 the first two numbers was the year. 253 00:09:10,370 --> 00:09:13,969 So that's supposed to be from 1964. 254 00:09:13,970 --> 00:09:16,609 Yeah. So this was not 255 00:09:16,610 --> 00:09:19,009 the only thing small that was amended 256 00:09:19,010 --> 00:09:20,289 in on this 257 00:09:21,360 --> 00:09:22,369 this date. 258 00:09:22,370 --> 00:09:24,439 This was a Model Y 259 00:09:24,440 --> 00:09:26,719 five seven four eight. 260 00:09:26,720 --> 00:09:29,209 This was invented in Czech Republic 261 00:09:29,210 --> 00:09:31,039 or the All Czechoslovakia. 262 00:09:31,040 --> 00:09:33,139 It's a modular microphone, so it was 263 00:09:33,140 --> 00:09:35,479 very novel by the time. 264 00:09:35,480 --> 00:09:37,189 Every little cube have different 265 00:09:37,190 --> 00:09:39,589 functionality, so you can assemble it 266 00:09:39,590 --> 00:09:42,169 in with different combinations. 267 00:09:42,170 --> 00:09:44,659 And it's my kids have like 268 00:09:44,660 --> 00:09:46,999 functionalities like one of them 269 00:09:47,000 --> 00:09:49,139 can be going home, whatever that means 270 00:09:49,140 --> 00:09:50,299 at the time. 271 00:09:50,300 --> 00:09:52,429 So it was it was kind of very 272 00:09:52,430 --> 00:09:55,099 clever, and we found a magazine that 273 00:09:55,100 --> 00:09:57,139 all magazine that explained how it was 274 00:09:57,140 --> 00:09:59,209 used. And you can see here that they 275 00:09:59,210 --> 00:10:01,339 made a fake wooden box where 276 00:10:01,340 --> 00:10:03,439 there was a microphone and then the the 277 00:10:03,440 --> 00:10:05,779 pile of batteries that 278 00:10:05,780 --> 00:10:07,849 it needed to to borrow it up, and 279 00:10:07,850 --> 00:10:09,499 it was placed under the table. 280 00:10:09,500 --> 00:10:11,389 So how many of you would check under the 281 00:10:11,390 --> 00:10:12,740 table like daily? 282 00:10:14,060 --> 00:10:14,629 Yeah. 283 00:10:14,630 --> 00:10:16,669 Oh, you're right around round. 284 00:10:16,670 --> 00:10:19,039 So this can go undetected 285 00:10:19,040 --> 00:10:20,049 for very long. 286 00:10:20,050 --> 00:10:21,449 It was. It was very clever. 287 00:10:21,450 --> 00:10:23,299 And you can imagine how many of these you 288 00:10:23,300 --> 00:10:25,459 have to use to start making the modules 289 00:10:25,460 --> 00:10:27,709 right, like object 290 00:10:27,710 --> 00:10:29,629 oriented spying or something like that? 291 00:10:29,630 --> 00:10:32,449 Yeah. So another 292 00:10:32,450 --> 00:10:34,849 device that was very interesting 293 00:10:34,850 --> 00:10:37,699 because all these different microphones 294 00:10:37,700 --> 00:10:39,799 and we will see in the future 295 00:10:39,800 --> 00:10:42,259 presentations that it's a problem 296 00:10:42,260 --> 00:10:44,359 is how you power these 297 00:10:44,360 --> 00:10:46,549 microphones to last very long time, 298 00:10:46,550 --> 00:10:49,289 right? And this was a 299 00:10:49,290 --> 00:10:51,739 very nice call topic 300 00:10:51,740 --> 00:10:53,899 is because of the it was our 301 00:10:53,900 --> 00:10:56,389 phone in the offices of the opaque 302 00:10:56,390 --> 00:10:59,089 Organization for Petroleum, something 303 00:10:59,090 --> 00:11:01,329 it was found in Austria in the 70s. 304 00:11:01,330 --> 00:11:03,539 And if you pay attention to the image, 305 00:11:03,540 --> 00:11:05,869 does it have been for power supply? 306 00:11:05,870 --> 00:11:06,829 Right. 307 00:11:06,830 --> 00:11:07,970 So it takes 308 00:11:09,620 --> 00:11:11,869 a very interesting twist and this 309 00:11:11,870 --> 00:11:14,089 is a microphone that you place 310 00:11:14,090 --> 00:11:16,219 near electric wires. 311 00:11:16,220 --> 00:11:17,959 So it's part of that by induction, 312 00:11:17,960 --> 00:11:19,279 electrical induction. 313 00:11:19,280 --> 00:11:22,519 So you it makes it really 314 00:11:22,520 --> 00:11:24,649 interesting because you can't just put 315 00:11:24,650 --> 00:11:26,779 it in the wall and 316 00:11:26,780 --> 00:11:29,179 or near electric wires and you know 317 00:11:29,180 --> 00:11:30,139 where they are. 318 00:11:30,140 --> 00:11:32,059 And it will stay there as long as you 319 00:11:32,060 --> 00:11:34,449 want it. So it's very clever ways. 320 00:11:34,450 --> 00:11:36,679 Yeah. Again, NFC in another way, but 321 00:11:36,680 --> 00:11:38,839 super, super interesting twist. 322 00:11:38,840 --> 00:11:39,840 Yeah. 323 00:11:40,490 --> 00:11:42,679 So this is from an old magazine from 324 00:11:42,680 --> 00:11:44,809 the 80s, and the idea here is to give you 325 00:11:44,810 --> 00:11:46,909 a hint of how many ways there they are to 326 00:11:46,910 --> 00:11:49,189 spy people by using 327 00:11:49,190 --> 00:11:51,259 the R in in a room 328 00:11:51,260 --> 00:11:53,239 like these. So there are plenty of those. 329 00:11:53,240 --> 00:11:55,329 The technology is these are super old. 330 00:11:55,330 --> 00:11:57,399 You can see that they are, yes, using the 331 00:11:57,400 --> 00:11:59,949 telephone, but also microwave 332 00:11:59,950 --> 00:12:02,409 and also monitoring the typewriter 333 00:12:02,410 --> 00:12:04,719 key. So this one now it's 334 00:12:04,720 --> 00:12:07,149 called back monitoring typewriter 335 00:12:07,150 --> 00:12:09,669 key sources call keystroke dynamic 336 00:12:09,670 --> 00:12:10,929 in the area. 337 00:12:10,930 --> 00:12:13,089 They were doing that, which sounds 338 00:12:13,090 --> 00:12:15,669 a long time ago, and you can have also 339 00:12:15,670 --> 00:12:17,769 from the windows, really dig team 340 00:12:17,770 --> 00:12:19,629 frequencies in there. 341 00:12:19,630 --> 00:12:22,119 You have also all the places to the 342 00:12:22,120 --> 00:12:23,799 microphones that we are going to study 343 00:12:23,800 --> 00:12:24,999 today. 344 00:12:25,000 --> 00:12:27,129 So this is all, but there are plenty of 345 00:12:27,130 --> 00:12:29,079 ways of doing this, including there the 346 00:12:29,080 --> 00:12:31,599 laser pointing in the window 347 00:12:31,600 --> 00:12:33,249 from the 80s right 348 00:12:33,250 --> 00:12:35,409 now and on all of these or many 349 00:12:35,410 --> 00:12:37,749 of these who are trying to solve the 350 00:12:37,750 --> 00:12:39,349 power supply problem, right? 351 00:12:39,350 --> 00:12:41,619 So the typical uses is in 352 00:12:41,620 --> 00:12:43,929 our inside phones or 353 00:12:43,930 --> 00:12:45,579 in the electrical sockets. 354 00:12:45,580 --> 00:12:48,009 Why? Because you need like you have free 355 00:12:48,010 --> 00:12:50,139 constant supply, also with 356 00:12:50,140 --> 00:12:51,249 alarms and so on. 357 00:12:51,250 --> 00:12:54,639 These are typical locations 358 00:12:54,640 --> 00:12:56,889 using the bathroom still now, right? 359 00:12:56,890 --> 00:12:58,839 But this is this is kind of all 360 00:12:58,840 --> 00:13:00,069 technology. 361 00:13:00,070 --> 00:13:02,679 Right now we see technology advanced, 362 00:13:02,680 --> 00:13:05,109 right? And we went to 363 00:13:05,110 --> 00:13:07,329 why put the microphone in 364 00:13:07,330 --> 00:13:09,569 your in your home if you 365 00:13:09,570 --> 00:13:11,949 can in fact, your phone with malware 366 00:13:11,950 --> 00:13:14,169 and I know the phone will be with you 367 00:13:14,170 --> 00:13:16,159 all the time and they can listen to all 368 00:13:16,160 --> 00:13:17,169 your conversations. 369 00:13:17,170 --> 00:13:19,419 So every feature is one of the 370 00:13:19,420 --> 00:13:21,489 default fault. Let's say most use 371 00:13:21,490 --> 00:13:23,409 malware for these. 372 00:13:23,410 --> 00:13:25,689 It was very well documented different 373 00:13:25,690 --> 00:13:27,849 cases, but also 374 00:13:27,850 --> 00:13:30,039 there were right now other 375 00:13:30,040 --> 00:13:32,629 clever solutions like lasers. 376 00:13:32,630 --> 00:13:34,719 Yeah, and this is new technology that 377 00:13:34,720 --> 00:13:36,999 they are ready. They are pointing 378 00:13:37,000 --> 00:13:39,039 laser to mist in the air. 379 00:13:39,040 --> 00:13:41,919 So water molecules in the air floating 380 00:13:41,920 --> 00:13:43,599 on while you are talking and you are 381 00:13:43,600 --> 00:13:45,219 close to dismiss, they're pointing a 382 00:13:45,220 --> 00:13:47,349 laser to that and they can 383 00:13:47,350 --> 00:13:48,949 then hear you bug. 384 00:13:48,950 --> 00:13:51,039 So there are a lot of new things that 385 00:13:51,040 --> 00:13:53,469 are going on, but we are going to focus 386 00:13:53,470 --> 00:13:53,979 on, 387 00:13:53,980 --> 00:13:56,379 yeah, we are familiar with malware are. 388 00:13:56,380 --> 00:13:58,689 But the fact that a 389 00:13:58,690 --> 00:14:00,919 person was for years had 390 00:14:00,920 --> 00:14:03,099 the microphone in their home without 391 00:14:03,100 --> 00:14:05,709 detecting it. That was something that we 392 00:14:05,710 --> 00:14:07,209 thought that we needed to focus instead 393 00:14:07,210 --> 00:14:08,210 of this right. 394 00:14:09,580 --> 00:14:11,679 So we wanted to get our hands on the 395 00:14:11,680 --> 00:14:13,479 technology. We wanted to try it on. 396 00:14:13,480 --> 00:14:15,189 We we read some stuff. 397 00:14:15,190 --> 00:14:17,439 We wanted to prove it for ourselves, 398 00:14:17,440 --> 00:14:19,599 how it works, how it sounds, how, how 399 00:14:19,600 --> 00:14:21,189 was the audio quality and so on. 400 00:14:21,190 --> 00:14:23,859 So the spectrum of different microphones 401 00:14:23,860 --> 00:14:25,689 is huge. So we wanted to focus on 402 00:14:25,690 --> 00:14:27,699 something concrete is like a baby step on 403 00:14:27,700 --> 00:14:28,689 the research. 404 00:14:28,690 --> 00:14:31,329 So we focus on FM and GSM 405 00:14:31,330 --> 00:14:33,939 commercially available microphone 406 00:14:33,940 --> 00:14:36,039 banks. But the also they 407 00:14:36,040 --> 00:14:38,679 are wireless and they are also 408 00:14:38,680 --> 00:14:40,479 stationary. That means that they are 409 00:14:40,480 --> 00:14:42,579 microphones designed for 410 00:14:42,580 --> 00:14:44,769 two to be put in place and 411 00:14:44,770 --> 00:14:46,179 be left there, right. 412 00:14:46,180 --> 00:14:48,369 You put it on the electrical socket 413 00:14:48,370 --> 00:14:49,599 and you just leave it. 414 00:14:49,600 --> 00:14:51,669 So there are other type of 415 00:14:51,670 --> 00:14:53,829 microphones that do not fill this 416 00:14:53,830 --> 00:14:55,899 characteristic. So we focus try to 417 00:14:55,900 --> 00:14:57,549 reduce this gap somehow in this 418 00:14:57,550 --> 00:14:58,550 direction. 419 00:14:59,530 --> 00:15:01,779 We started looking in typical ways 420 00:15:01,780 --> 00:15:04,329 Amazon, eBay and other sites 421 00:15:04,330 --> 00:15:05,330 for microphones. 422 00:15:06,640 --> 00:15:09,009 This is one of the first one, the 423 00:15:09,010 --> 00:15:10,540 f nine hundred and eight. 424 00:15:11,800 --> 00:15:13,299 It's very small. 425 00:15:13,300 --> 00:15:15,399 As you can see in the video, 426 00:15:15,400 --> 00:15:16,400 it has a 427 00:15:17,560 --> 00:15:18,549 plastic case. 428 00:15:18,550 --> 00:15:20,769 It has the four four 429 00:15:20,770 --> 00:15:22,929 power supply, a normal battery, 430 00:15:22,930 --> 00:15:25,329 but it has a very long 431 00:15:25,330 --> 00:15:26,330 antenna. 432 00:15:28,030 --> 00:15:30,529 So all these movies that yeah, let's 433 00:15:30,530 --> 00:15:33,079 let's have a microphone. 434 00:15:33,080 --> 00:15:34,179 They just put it there. 435 00:15:34,180 --> 00:15:36,519 Well, you still need to hide Antena 436 00:15:36,520 --> 00:15:37,520 So. 437 00:15:39,130 --> 00:15:41,199 So that was is 438 00:15:41,200 --> 00:15:43,719 a very interesting model. 439 00:15:43,720 --> 00:15:45,199 We we tried to buy. 440 00:15:45,200 --> 00:15:47,229 We have a limited budget, so we tried to 441 00:15:47,230 --> 00:15:49,479 buy like different models that 442 00:15:49,480 --> 00:15:51,159 have some differences. 443 00:15:51,160 --> 00:15:54,249 And this one was around $33 444 00:15:54,250 --> 00:15:56,529 US dollars, and it 445 00:15:56,530 --> 00:15:58,799 has an advertised range of 500 meters. 446 00:16:00,990 --> 00:16:03,129 Another model was this micro. 447 00:16:03,130 --> 00:16:05,229 It was. We wanted like the 448 00:16:05,230 --> 00:16:07,689 smallest thing that we can find 449 00:16:07,690 --> 00:16:09,489 these works in the same range of 450 00:16:09,490 --> 00:16:12,369 frequency. Same power supply 451 00:16:12,370 --> 00:16:13,869 is called for full price. 452 00:16:13,870 --> 00:16:15,639 Those in how the case battery. 453 00:16:15,640 --> 00:16:17,829 But you can see there 454 00:16:17,830 --> 00:16:19,419 that there is a microphone, 455 00:16:20,800 --> 00:16:23,049 the socket for the battery and also 456 00:16:23,050 --> 00:16:24,519 the very long antenna. 457 00:16:26,950 --> 00:16:29,109 And this is the microphone you can see 458 00:16:29,110 --> 00:16:31,629 that is really small, but 459 00:16:31,630 --> 00:16:33,939 you need to put the battery, which 460 00:16:33,940 --> 00:16:36,369 is this big, right? 461 00:16:36,370 --> 00:16:38,649 So it's not that big, that small anymore. 462 00:16:38,650 --> 00:16:41,529 You just have to hide the whole thing. 463 00:16:41,530 --> 00:16:43,149 Another example that we bought 464 00:16:44,860 --> 00:16:47,349 is that one this 465 00:16:47,350 --> 00:16:49,599 is very similar in this has 466 00:16:49,600 --> 00:16:52,209 for adjusting the frequency as well. 467 00:16:52,210 --> 00:16:54,899 The same range is. 468 00:16:54,900 --> 00:16:55,900 US dollars. 469 00:16:57,480 --> 00:16:59,579 The only thing different is that he has 470 00:16:59,580 --> 00:17:01,709 like this cable for putting 471 00:17:01,710 --> 00:17:04,139 the battery, which is 472 00:17:04,140 --> 00:17:06,419 is a bit easier to kind of place 473 00:17:06,420 --> 00:17:08,039 it on, Heidi, because you can stretch it 474 00:17:08,040 --> 00:17:09,239 a bit more. 475 00:17:09,240 --> 00:17:11,909 It has also a very long battery 476 00:17:11,910 --> 00:17:12,910 antenna. 477 00:17:15,869 --> 00:17:18,249 We wanted to also find things 478 00:17:18,250 --> 00:17:20,449 OK, this trim. All those were models 479 00:17:21,750 --> 00:17:23,879 of microphones designed to be like 480 00:17:23,880 --> 00:17:25,769 spy microphones, right? 481 00:17:25,770 --> 00:17:28,049 And we started the thing what kind 482 00:17:28,050 --> 00:17:30,569 of devices could people normally 483 00:17:30,570 --> 00:17:32,699 have in their homes that can use 484 00:17:32,700 --> 00:17:34,139 for spy microphones? 485 00:17:34,140 --> 00:17:35,759 So we found this. 486 00:17:35,760 --> 00:17:37,729 This is the way to be. 487 00:17:37,730 --> 00:17:39,359 Why throw for 488 00:17:40,530 --> 00:17:42,689 these are baby monitors that work 489 00:17:42,690 --> 00:17:44,789 on a FM frequency 490 00:17:44,790 --> 00:17:45,790 for some reason. 491 00:17:47,130 --> 00:17:49,199 This is where the thing is is more 492 00:17:49,200 --> 00:17:51,449 expensive. The frequencies Kiger 493 00:17:51,450 --> 00:17:53,819 800 800MHz and the 494 00:17:53,820 --> 00:17:56,189 advertised range is 800 meters 495 00:17:56,190 --> 00:17:58,259 because it seems that it's kind of 496 00:17:58,260 --> 00:18:00,269 common just to leave your baby and to go 497 00:18:00,270 --> 00:18:01,559 10 blocks away. 498 00:18:01,560 --> 00:18:03,270 So I'm not sure what. 499 00:18:06,500 --> 00:18:08,429 It's like that. 500 00:18:08,430 --> 00:18:10,589 So we wanted to also 501 00:18:10,590 --> 00:18:13,079 try somebody and we bought 502 00:18:13,080 --> 00:18:14,129 this mini. 503 00:18:14,130 --> 00:18:16,859 A eight is a 504 00:18:16,860 --> 00:18:19,769 GSM microphone, 505 00:18:19,770 --> 00:18:22,019 so it has a place for a SIM card, 506 00:18:22,020 --> 00:18:24,209 has a battery in there, 507 00:18:24,210 --> 00:18:26,819 has cost like $10 508 00:18:26,820 --> 00:18:28,229 and is GSM. 509 00:18:28,230 --> 00:18:30,149 So you can call from anywhere in the 510 00:18:30,150 --> 00:18:32,249 world and you can listen to the 511 00:18:32,250 --> 00:18:34,349 conversations where the 512 00:18:34,350 --> 00:18:36,269 microphone is planted. 513 00:18:36,270 --> 00:18:38,759 And also you can configure 514 00:18:38,760 --> 00:18:40,949 it for to 515 00:18:40,950 --> 00:18:43,379 automatically detect a conversation 516 00:18:43,380 --> 00:18:44,639 when it hears noise. 517 00:18:44,640 --> 00:18:47,099 It will automatically call you back 518 00:18:47,100 --> 00:18:48,100 and you can 519 00:18:49,260 --> 00:18:50,999 respond and you will hear what is going 520 00:18:51,000 --> 00:18:53,099 on. So it's 521 00:18:53,100 --> 00:18:54,749 very clever. It's a small, 522 00:18:55,800 --> 00:18:57,359 but these are different technology, so 523 00:18:57,360 --> 00:18:59,609 it's not FM and the diction 524 00:18:59,610 --> 00:19:00,839 is different 525 00:19:00,840 --> 00:19:02,639 and this is what is a huge advantage. 526 00:19:02,640 --> 00:19:04,769 You so you can put it anywhere in 527 00:19:04,770 --> 00:19:07,109 the war and call that it's quite 528 00:19:07,110 --> 00:19:08,309 improvement in range. 529 00:19:08,310 --> 00:19:10,919 And also you can actually 530 00:19:10,920 --> 00:19:12,789 wait for somebody to make some noise. 531 00:19:12,790 --> 00:19:15,029 So this is a totally different 532 00:19:15,030 --> 00:19:17,189 way of listening to others. 533 00:19:17,190 --> 00:19:18,190 Yeah. 534 00:19:18,840 --> 00:19:21,029 So this 535 00:19:21,030 --> 00:19:23,159 is kind of a summary of the comparison 536 00:19:23,160 --> 00:19:25,799 of the different models, the 537 00:19:25,800 --> 00:19:28,079 the three from ones who work in the same 538 00:19:28,080 --> 00:19:29,249 kind of frequency. 539 00:19:29,250 --> 00:19:31,349 The the baby monitor 540 00:19:31,350 --> 00:19:33,389 works in a bit different frequency, but 541 00:19:33,390 --> 00:19:34,390 it's kind of the same. 542 00:19:35,310 --> 00:19:37,379 It has more range advertise 543 00:19:37,380 --> 00:19:39,659 and you can see the difference in prices, 544 00:19:39,660 --> 00:19:42,089 this kind of commercially accessible, 545 00:19:42,090 --> 00:19:43,230 right? So 546 00:19:44,280 --> 00:19:46,589 the next step was let's let's 547 00:19:46,590 --> 00:19:48,419 try to hear them right? 548 00:19:48,420 --> 00:19:50,519 Let's try to to see how 549 00:19:50,520 --> 00:19:52,739 it actually works. 550 00:19:52,740 --> 00:19:54,779 So we started doing experiments of 551 00:19:54,780 --> 00:19:57,359 listening and we 552 00:19:57,360 --> 00:19:59,429 knew we were doing this in 553 00:19:59,430 --> 00:20:01,619 a normal neighborhood and we 554 00:20:01,620 --> 00:20:03,839 found that there was actually several 555 00:20:03,840 --> 00:20:06,059 blocks away. You could hear perfectly. 556 00:20:06,060 --> 00:20:08,339 The microphones of these 557 00:20:08,340 --> 00:20:10,439 are typical movie that there 558 00:20:10,440 --> 00:20:13,019 is a van in front of of your home 559 00:20:13,020 --> 00:20:14,499 hearing that's not needed. 560 00:20:14,500 --> 00:20:16,739 Actually, you can hear from three hundred 561 00:20:16,740 --> 00:20:18,899 meters away and it's perfectly 562 00:20:18,900 --> 00:20:21,119 fine. So that was that 563 00:20:21,120 --> 00:20:22,619 was very interesting. 564 00:20:22,620 --> 00:20:24,339 The first experiment 565 00:20:24,340 --> 00:20:26,129 on Yes, yes, I know the microphones were 566 00:20:26,130 --> 00:20:28,649 having this feature I saw usually either 567 00:20:28,650 --> 00:20:30,869 need to be less than 100 568 00:20:30,870 --> 00:20:33,419 meters away like this is perfect hearing. 569 00:20:33,420 --> 00:20:35,939 Unless you are inside some ion box. 570 00:20:35,940 --> 00:20:37,859 There is, there is no need for that. 571 00:20:37,860 --> 00:20:39,179 Yeah, of course. 572 00:20:39,180 --> 00:20:40,979 The more buildings that are there, maybe 573 00:20:40,980 --> 00:20:42,839 the audio quality differs, but is 574 00:20:42,840 --> 00:20:44,789 actually perfectly fine. 575 00:20:44,790 --> 00:20:46,859 So we wanted to do, as I say 576 00:20:46,860 --> 00:20:48,929 in the in the in the beginning, as 577 00:20:48,930 --> 00:20:50,159 photo as possible. 578 00:20:50,160 --> 00:20:52,529 So we documented all these experiments. 579 00:20:53,880 --> 00:20:55,949 Is everything all these tables are in 580 00:20:55,950 --> 00:20:57,749 the paper you can read later. 581 00:20:57,750 --> 00:20:59,849 This is one of the experiments where 582 00:20:59,850 --> 00:21:02,250 the the the bag was 583 00:21:03,630 --> 00:21:05,699 stationary in one place and the 584 00:21:05,700 --> 00:21:07,769 receiver was 200 meters away 585 00:21:07,770 --> 00:21:08,909 and getting closer. 586 00:21:08,910 --> 00:21:11,699 So we were recording the audio quality 587 00:21:11,700 --> 00:21:14,109 and most of the in most of the cases, 588 00:21:14,110 --> 00:21:15,769 it was very good quality. 589 00:21:15,770 --> 00:21:18,179 And also in the 590 00:21:18,180 --> 00:21:20,939 I think the best case was where the 591 00:21:20,940 --> 00:21:23,129 distance was 15 meters 592 00:21:23,130 --> 00:21:25,019 and the person was five meters away. 593 00:21:25,020 --> 00:21:27,419 But even with 200 594 00:21:27,420 --> 00:21:29,489 meters away, it was not that 595 00:21:29,490 --> 00:21:30,629 big of a difference. 596 00:21:30,630 --> 00:21:32,279 So that was very interesting for us to 597 00:21:32,280 --> 00:21:34,439 find out like a first 598 00:21:34,440 --> 00:21:36,209 field experiments. 599 00:21:36,210 --> 00:21:38,399 We forgot the beagley at the beginning 600 00:21:38,400 --> 00:21:40,979 of the bigly to see this light. 601 00:21:40,980 --> 00:21:42,209 No. 602 00:21:42,210 --> 00:21:43,589 So, so super fast. 603 00:21:43,590 --> 00:21:45,539 But we forgot. If you go to that link at 604 00:21:45,540 --> 00:21:48,059 the beginning Bit.ly slash spy 605 00:21:48,060 --> 00:21:50,639 34C three, you will see the slides 606 00:21:50,640 --> 00:21:52,769 in your computer moving with 607 00:21:52,770 --> 00:21:55,019 us so you can actually see click. 608 00:21:55,020 --> 00:21:56,789 Copy the images and everything. 609 00:21:56,790 --> 00:21:58,199 Better than your hero. 610 00:21:58,200 --> 00:21:59,729 Sorry, forgot. 611 00:21:59,730 --> 00:22:01,589 OK, so. 612 00:22:02,680 --> 00:22:05,079 The so based 613 00:22:05,080 --> 00:22:07,209 on these first experiments of only 614 00:22:07,210 --> 00:22:09,549 listening, right, we 615 00:22:09,550 --> 00:22:11,709 started on their sound more like these 616 00:22:11,710 --> 00:22:13,959 are some geolocation remarks 617 00:22:13,960 --> 00:22:16,089 rhetorically interesting because 618 00:22:16,090 --> 00:22:18,099 an attacker needs to be close. 619 00:22:18,100 --> 00:22:20,259 Right. And this is good for you, and 620 00:22:20,260 --> 00:22:21,819 it's also really right for you for 621 00:22:21,820 --> 00:22:22,779 several reasons. 622 00:22:22,780 --> 00:22:25,809 First is good for you because it filters 623 00:22:25,810 --> 00:22:28,009 your kind of attackers population 624 00:22:28,010 --> 00:22:29,799 you. And it's not that anyone in the 625 00:22:29,800 --> 00:22:31,419 world can attack to you, right? 626 00:22:31,420 --> 00:22:33,489 Is the the attacker, and you have 627 00:22:33,490 --> 00:22:35,709 to be sharing the same kind of physical 628 00:22:35,710 --> 00:22:38,589 space or city or neighborhood. 629 00:22:38,590 --> 00:22:40,720 So that's kind of good for you. 630 00:22:42,340 --> 00:22:43,479 They they. 631 00:22:43,480 --> 00:22:45,069 Is that for them that they need to be 632 00:22:45,070 --> 00:22:47,079 close because you have more chances to 633 00:22:47,080 --> 00:22:48,969 kind of spot them like suspicious 634 00:22:48,970 --> 00:22:50,139 behavior. 635 00:22:50,140 --> 00:22:51,789 But it's also bad for you that they are 636 00:22:51,790 --> 00:22:54,309 close because they are physically 637 00:22:54,310 --> 00:22:55,489 close to you, right? 638 00:22:55,490 --> 00:22:56,459 They is. 639 00:22:56,460 --> 00:22:58,450 It's a it's a different kind of 640 00:23:00,120 --> 00:23:01,089 threat. 641 00:23:01,090 --> 00:23:03,399 Yeah. So this is this 642 00:23:03,400 --> 00:23:04,719 is not good. 643 00:23:04,720 --> 00:23:07,299 And with other types of threats, 644 00:23:07,300 --> 00:23:09,549 eavesdropping threats like malware, 645 00:23:09,550 --> 00:23:11,439 infections, anyone in the internet can 646 00:23:11,440 --> 00:23:12,459 help you, right? 647 00:23:12,460 --> 00:23:13,599 But in this case, 648 00:23:14,620 --> 00:23:16,769 you need to have people that people can 649 00:23:16,770 --> 00:23:18,129 that kind of help. 650 00:23:18,130 --> 00:23:20,499 You need to be kind of also close 651 00:23:20,500 --> 00:23:21,579 geographically. 652 00:23:21,580 --> 00:23:24,519 So that's not very good for you. 653 00:23:24,520 --> 00:23:26,889 Another remarked, We 654 00:23:26,890 --> 00:23:29,069 try to do a better 655 00:23:29,070 --> 00:23:31,989 job of autonomy. Validation from 656 00:23:31,990 --> 00:23:34,499 the different devices have types 657 00:23:34,500 --> 00:23:35,949 of other iteration. 658 00:23:35,950 --> 00:23:38,109 For example, the micro spy 659 00:23:38,110 --> 00:23:40,569 has advertised about three hundred sixty 660 00:23:40,570 --> 00:23:41,570 eight hours. 661 00:23:43,060 --> 00:23:45,489 We tried it to leave it there 662 00:23:45,490 --> 00:23:47,589 and is, in most of the cases, is it 663 00:23:47,590 --> 00:23:49,609 was lower than advertised. 664 00:23:49,610 --> 00:23:51,549 The only two cases are true was accurate 665 00:23:51,550 --> 00:23:53,619 was that one was 666 00:23:53,620 --> 00:23:55,759 around 100 hours and 667 00:23:55,760 --> 00:23:57,879 the GSM one, which was 668 00:23:57,880 --> 00:23:59,559 two hours. 669 00:23:59,560 --> 00:24:01,839 That is really small 670 00:24:01,840 --> 00:24:04,149 time. Even the hundred hours is really 671 00:24:04,150 --> 00:24:06,249 small. Imagine that when the water is 672 00:24:06,250 --> 00:24:08,169 out, you need to come back and just 673 00:24:08,170 --> 00:24:10,389 changed the weather, so you need to have 674 00:24:10,390 --> 00:24:12,159 physical access to a place. 675 00:24:12,160 --> 00:24:14,529 And that gets things really complicated, 676 00:24:14,530 --> 00:24:14,619 you 677 00:24:14,620 --> 00:24:16,569 know, and this is related to how you are 678 00:24:16,570 --> 00:24:18,339 targeting your operation if you want to 679 00:24:18,340 --> 00:24:19,539 put the microphone. 680 00:24:19,540 --> 00:24:21,519 You have to know where and what you want 681 00:24:21,520 --> 00:24:23,379 to listen, to whom it which place because 682 00:24:23,380 --> 00:24:25,719 your window of opportunity so small. 683 00:24:25,720 --> 00:24:27,609 So this is giving you an idea of, OK, 684 00:24:27,610 --> 00:24:29,439 what can you do with each microphone? 685 00:24:29,440 --> 00:24:31,089 It's not that you can't just use any 686 00:24:31,090 --> 00:24:31,799 microphone, right? 687 00:24:31,800 --> 00:24:32,800 Yeah, exactly. 688 00:24:35,890 --> 00:24:38,349 We want that because we work in our daily 689 00:24:38,350 --> 00:24:40,059 sort of working analyzing malware. 690 00:24:40,060 --> 00:24:42,219 We wanted to make some notes. 691 00:24:42,220 --> 00:24:43,839 On the whole, this is different from 692 00:24:43,840 --> 00:24:45,939 malware. Why would I choose malware 693 00:24:45,940 --> 00:24:47,019 to infect your phone? 694 00:24:47,020 --> 00:24:48,519 Or why would I choose to place a 695 00:24:48,520 --> 00:24:49,929 microphone? 696 00:24:49,930 --> 00:24:52,299 And when you try to infect someone 697 00:24:52,300 --> 00:24:54,129 with malware, imagine that you don't have 698 00:24:54,130 --> 00:24:55,329 physical access to a phone. 699 00:24:55,330 --> 00:24:56,330 You have to 700 00:24:57,730 --> 00:24:59,859 plan a phishing campaign, you send 701 00:24:59,860 --> 00:25:02,049 a link to somebody, and 702 00:25:02,050 --> 00:25:04,179 the successful infection 703 00:25:04,180 --> 00:25:05,379 is not warranted. 704 00:25:05,380 --> 00:25:07,449 The guy might click on the version of the 705 00:25:07,450 --> 00:25:09,069 operating system might be wrong or 706 00:25:09,070 --> 00:25:10,749 something happened, and the infection is 707 00:25:10,750 --> 00:25:11,750 not successful. 708 00:25:12,650 --> 00:25:14,379 And also, you cannot choose the time, 709 00:25:14,380 --> 00:25:15,969 right? Like, yes, you are trying to 710 00:25:15,970 --> 00:25:17,979 infect somebody, but you never know when 711 00:25:17,980 --> 00:25:19,419 it's going to be infected can be today, 712 00:25:19,420 --> 00:25:20,679 tomorrow or in a week. 713 00:25:20,680 --> 00:25:22,359 And actually, there are a lot of 714 00:25:22,360 --> 00:25:24,369 casualties around like they are not the 715 00:25:24,370 --> 00:25:25,329 people you wanted to infect. 716 00:25:25,330 --> 00:25:27,519 So it's not straightforward to do 717 00:25:27,520 --> 00:25:27,909 this. 718 00:25:27,910 --> 00:25:29,619 Yeah. And also, when you find the 719 00:25:29,620 --> 00:25:30,819 malware, right? 720 00:25:30,820 --> 00:25:32,359 Imagine that you are analyzing some 721 00:25:32,360 --> 00:25:33,999 mobile devices and you find a malware. 722 00:25:34,000 --> 00:25:36,099 You can you can analyze the 723 00:25:36,100 --> 00:25:37,689 malware and you can reverse it. 724 00:25:37,690 --> 00:25:40,209 You can find the malware leave traces 725 00:25:40,210 --> 00:25:42,729 right? And then you can use that to 726 00:25:42,730 --> 00:25:45,069 know who the attacker was 727 00:25:45,070 --> 00:25:47,199 ideally or have some 728 00:25:47,200 --> 00:25:48,109 idea. 729 00:25:48,110 --> 00:25:49,629 Well, you know that something happened, 730 00:25:49,630 --> 00:25:49,869 right? 731 00:25:49,870 --> 00:25:51,759 Because the same thing happened in the 732 00:25:51,760 --> 00:25:53,259 case of the microphones. 733 00:25:53,260 --> 00:25:55,569 If the operation was successful, 734 00:25:55,570 --> 00:25:57,619 you can go there, turn the microphone to 735 00:25:57,620 --> 00:25:59,289 stick it out, and there is no trace at 736 00:25:59,290 --> 00:26:01,629 all. You didn't know it happened. 737 00:26:01,630 --> 00:26:03,729 So that was kind of 738 00:26:03,730 --> 00:26:04,810 big differences. 739 00:26:06,070 --> 00:26:08,319 And also, people 740 00:26:08,320 --> 00:26:10,239 from the internet, as we say before, can 741 00:26:10,240 --> 00:26:11,389 help you with malware. 742 00:26:11,390 --> 00:26:13,629 We did that with the microphones. 743 00:26:13,630 --> 00:26:14,630 It's not that easy. 744 00:26:17,160 --> 00:26:19,529 So a big warning 745 00:26:19,530 --> 00:26:21,179 here like we are trying to think about, 746 00:26:21,180 --> 00:26:22,349 which is the difference between these 747 00:26:22,350 --> 00:26:24,419 commercially available microphones and 748 00:26:24,420 --> 00:26:26,189 the not commercially available 749 00:26:26,190 --> 00:26:27,239 microphones. 750 00:26:27,240 --> 00:26:29,669 We don't have access to these, not 751 00:26:29,670 --> 00:26:31,829 commercial microphones, so we really 752 00:26:31,830 --> 00:26:33,449 don't know how far away they are in the 753 00:26:33,450 --> 00:26:35,759 technology of microphones bargain 754 00:26:35,760 --> 00:26:36,749 right now. 755 00:26:36,750 --> 00:26:38,309 What ideas are that? 756 00:26:38,310 --> 00:26:41,099 First is the choice between electricity 757 00:26:41,100 --> 00:26:42,029 or battery. 758 00:26:42,030 --> 00:26:43,769 So if you want to listen to a specific 759 00:26:43,770 --> 00:26:45,719 conversation, maybe with water, you're 760 00:26:45,720 --> 00:26:47,969 OK. If you need to reset everything 761 00:26:47,970 --> 00:26:50,129 that it's been said for a long time, 762 00:26:50,130 --> 00:26:51,989 then you need to plug to electricity and 763 00:26:51,990 --> 00:26:54,300 these constrained interruptions a lot. 764 00:26:55,830 --> 00:26:57,419 And then we have a problem with the 765 00:26:57,420 --> 00:26:59,049 transmission or storage. 766 00:26:59,050 --> 00:27:01,139 A lot of microphones, if you look 767 00:27:01,140 --> 00:27:03,389 at the OK, so we we don't know 768 00:27:03,390 --> 00:27:04,949 what happened with the microphone, that 769 00:27:04,950 --> 00:27:07,019 was fine, but 770 00:27:07,020 --> 00:27:09,239 I way way. But if you look at it, 771 00:27:09,240 --> 00:27:12,359 it looks are there are several modules, 772 00:27:12,360 --> 00:27:14,129 there is antenna and the battery and the 773 00:27:14,130 --> 00:27:15,899 microphone, and there is another box that 774 00:27:15,900 --> 00:27:16,949 may be historic. 775 00:27:16,950 --> 00:27:19,259 We don't know, of course. 776 00:27:19,260 --> 00:27:21,539 So the idea that you can store 777 00:27:21,540 --> 00:27:23,699 the audio in the car or 778 00:27:23,700 --> 00:27:24,659 something like that? 779 00:27:24,660 --> 00:27:26,609 So this is good because you are not 780 00:27:26,610 --> 00:27:28,799 transmitting so you are less prone 781 00:27:28,800 --> 00:27:29,759 to be detected. 782 00:27:29,760 --> 00:27:31,919 However, you have to come back and 783 00:27:31,920 --> 00:27:34,289 get the SD card. So depending of your 784 00:27:34,290 --> 00:27:36,449 availability to get into 785 00:27:36,450 --> 00:27:38,969 the premises, you can use the storage 786 00:27:38,970 --> 00:27:40,949 or not. There were versions of 787 00:27:40,950 --> 00:27:42,719 microphones that were having the 788 00:27:42,720 --> 00:27:44,939 microphones inside the room and 789 00:27:44,940 --> 00:27:47,219 then a cable to the module 790 00:27:47,220 --> 00:27:49,589 that was transmitting like from 50 meters 791 00:27:49,590 --> 00:27:51,749 away. So this is like a hybrid 792 00:27:51,750 --> 00:27:53,189 option, right? You have the microphone 793 00:27:53,190 --> 00:27:55,139 you are transmitting in real time, but 794 00:27:55,140 --> 00:27:57,419 from the room there is no 795 00:27:57,420 --> 00:27:59,879 detection of these transmission. 796 00:27:59,880 --> 00:28:02,309 And then it's the thing of, OK, 797 00:28:02,310 --> 00:28:04,859 there is a one time conversation, 798 00:28:04,860 --> 00:28:06,689 we said, or versus, I want to listen at 799 00:28:06,690 --> 00:28:08,849 all. And finally, how much access you 800 00:28:08,850 --> 00:28:10,529 have to the room. So the opinion of this 801 00:28:10,530 --> 00:28:12,689 body will cease your peak between 802 00:28:12,690 --> 00:28:13,709 may be OK. 803 00:28:13,710 --> 00:28:15,059 This is something I can do with the 804 00:28:15,060 --> 00:28:17,159 commission available or 805 00:28:17,160 --> 00:28:19,199 this is something that maybe some people 806 00:28:19,200 --> 00:28:20,669 can do with the not commercially 807 00:28:20,670 --> 00:28:22,619 available microphones out there. 808 00:28:22,620 --> 00:28:24,749 Yeah. And one thing that is 809 00:28:24,750 --> 00:28:26,609 important to keep in mind is that when we 810 00:28:26,610 --> 00:28:28,769 think about microphones, at least 811 00:28:28,770 --> 00:28:30,809 when I thought of microphones like two 812 00:28:30,810 --> 00:28:33,299 years ago, I 813 00:28:33,300 --> 00:28:34,829 the first thing that I thought it was 814 00:28:34,830 --> 00:28:35,819 governments, right? 815 00:28:35,820 --> 00:28:37,439 Governments putting microphones in your 816 00:28:37,440 --> 00:28:38,669 home. But actually, all these 817 00:28:38,670 --> 00:28:40,469 commercially available microphones are 818 00:28:40,470 --> 00:28:41,519 not used by governments. 819 00:28:41,520 --> 00:28:43,679 They are used for intellectual 820 00:28:43,680 --> 00:28:45,929 espionage wives 821 00:28:45,930 --> 00:28:48,239 or husbands trying to find if the other 822 00:28:48,240 --> 00:28:50,489 partner is cheating on them and all 823 00:28:50,490 --> 00:28:52,289 these type of things that there is like a 824 00:28:52,290 --> 00:28:54,839 lot of variety of usages 825 00:28:54,840 --> 00:28:56,999 that goes around these 826 00:28:57,000 --> 00:28:58,979 these technology, and that's why all 827 00:28:58,980 --> 00:29:01,479 these type of things come into place. 828 00:29:01,480 --> 00:29:02,480 Hmm. 829 00:29:02,850 --> 00:29:05,009 So right now, we are heading into 830 00:29:05,010 --> 00:29:07,019 the part of the presentation that we will 831 00:29:07,020 --> 00:29:08,699 talk about detection. 832 00:29:08,700 --> 00:29:11,039 But please, if you really 833 00:29:11,040 --> 00:29:13,859 are in a life threatening situation, 834 00:29:13,860 --> 00:29:16,079 we we recommend to 835 00:29:16,080 --> 00:29:18,239 just conduct like a professional company. 836 00:29:18,240 --> 00:29:20,869 Where do they do professional swiping 837 00:29:20,870 --> 00:29:23,099 soft devices and they do this for 838 00:29:23,100 --> 00:29:25,109 a living, right? So just 839 00:29:26,280 --> 00:29:27,299 be mindful. 840 00:29:27,300 --> 00:29:29,519 So yes, there are a lot of companies 841 00:29:29,520 --> 00:29:31,139 that are actually doing this for a 842 00:29:31,140 --> 00:29:33,479 living, and they're very good. 843 00:29:33,480 --> 00:29:35,639 The problem is that machine that you have 844 00:29:35,640 --> 00:29:37,809 some suspicion that maybe somebody 845 00:29:37,810 --> 00:29:39,119 is bugging you. 846 00:29:39,120 --> 00:29:41,519 You may call one of these companies, 847 00:29:41,520 --> 00:29:43,709 but then the other day you have the same 848 00:29:43,710 --> 00:29:45,539 suspicion in your office or your room or 849 00:29:45,540 --> 00:29:46,499 your car. 850 00:29:46,500 --> 00:29:47,909 So it's not easy to call them. 851 00:29:47,910 --> 00:29:50,009 They work can take up to 10 10 hours, 852 00:29:50,010 --> 00:29:52,169 which is a lot, and it's super expensive. 853 00:29:52,170 --> 00:29:54,119 So the problem we saw is that there was 854 00:29:54,120 --> 00:29:56,579 no room in the middle for any 855 00:29:56,580 --> 00:29:58,739 quick tool that you can use and 856 00:29:58,740 --> 00:30:00,869 adjust. And how can you be to 857 00:30:00,870 --> 00:30:02,999 modify to make the your 858 00:30:03,000 --> 00:30:05,099 everyday detection in any place you will? 859 00:30:05,100 --> 00:30:07,559 So this is why we created the salamander 860 00:30:07,560 --> 00:30:09,869 salamander as a free software to 861 00:30:09,870 --> 00:30:12,029 each SDR base, 862 00:30:12,030 --> 00:30:13,919 software defined radio base. 863 00:30:13,920 --> 00:30:16,049 And you can't go there, you can download 864 00:30:16,050 --> 00:30:18,149 it. And the idea of salmonella 865 00:30:18,150 --> 00:30:20,399 eat to make the detections 866 00:30:20,400 --> 00:30:23,279 of hidden microphones around you easier, 867 00:30:23,280 --> 00:30:25,979 something that you can go download 868 00:30:25,980 --> 00:30:27,329 plug this year. 869 00:30:27,330 --> 00:30:29,399 USB have some detection around 870 00:30:29,400 --> 00:30:31,439 you and then you have some idea of what's 871 00:30:31,440 --> 00:30:32,440 going on. 872 00:30:33,870 --> 00:30:35,999 The other problem is that if you buy one 873 00:30:36,000 --> 00:30:38,399 of the big hardware equipment for for 874 00:30:38,400 --> 00:30:40,799 a spy microphone detections, it may 875 00:30:40,800 --> 00:30:41,759 be suspicious. 876 00:30:41,760 --> 00:30:43,439 If somebody is looking at you, they will 877 00:30:43,440 --> 00:30:45,359 notice that you are buying this, which is 878 00:30:45,360 --> 00:30:47,789 telling them that actually, you know 879 00:30:47,790 --> 00:30:49,979 that you are B&O, which is bad for you 880 00:30:49,980 --> 00:30:52,259 again. So the less they know 881 00:30:52,260 --> 00:30:53,969 and the more you know, it's better. 882 00:30:53,970 --> 00:30:55,559 In this case, it's just a software. 883 00:30:55,560 --> 00:30:57,689 You don't know the USB and you 884 00:30:57,690 --> 00:30:59,639 have an idea of what's going on. 885 00:30:59,640 --> 00:31:01,439 So this is the type of device you are 886 00:31:01,440 --> 00:31:03,569 using is very well known as 887 00:31:03,570 --> 00:31:05,109 the basic device. 888 00:31:05,110 --> 00:31:07,799 It's a TV tuner that you can buy from 889 00:31:07,800 --> 00:31:09,989 $10 online, 890 00:31:09,990 --> 00:31:12,089 and a lot of people has been using it 891 00:31:12,090 --> 00:31:13,769 for years for SDR. 892 00:31:13,770 --> 00:31:15,699 So we are using one of these devices. 893 00:31:15,700 --> 00:31:17,769 Like this one, I mean, here is the same 894 00:31:17,770 --> 00:31:20,439 on salamander isactually 895 00:31:20,440 --> 00:31:22,779 in the background, using a tool that is 896 00:31:22,780 --> 00:31:25,689 very well known tool called Ertel 897 00:31:25,690 --> 00:31:27,999 Power. Each one of the tools that is 898 00:31:28,000 --> 00:31:30,279 reading the information coming 899 00:31:30,280 --> 00:31:32,529 from the USB device, and it's converting 900 00:31:32,530 --> 00:31:34,449 these into power levels, and it's giving 901 00:31:34,450 --> 00:31:36,519 you from a range 902 00:31:36,520 --> 00:31:38,649 of frequencies, the power 903 00:31:38,650 --> 00:31:41,409 levels detected by the 904 00:31:41,410 --> 00:31:42,729 power tool. 905 00:31:42,730 --> 00:31:44,769 So Salamander is reading these power 906 00:31:44,770 --> 00:31:46,869 levels, and it's working with 907 00:31:46,870 --> 00:31:48,309 these four detections. 908 00:31:48,310 --> 00:31:50,499 So which is the basic idea 909 00:31:50,500 --> 00:31:52,629 behind salamander for detection of hidden 910 00:31:52,630 --> 00:31:53,589 microphones? 911 00:31:53,590 --> 00:31:55,989 It's taking the power levels. 912 00:31:55,990 --> 00:31:57,789 In this case, you have here normal FM 913 00:31:57,790 --> 00:31:59,769 radio. This is the transmission, the 914 00:31:59,770 --> 00:32:01,539 frequency where it's transmitting and 915 00:32:01,540 --> 00:32:03,639 it's taking these 916 00:32:03,640 --> 00:32:06,159 peaks and it's actually connecting 917 00:32:06,160 --> 00:32:08,229 them. So when you 918 00:32:08,230 --> 00:32:10,659 plug a microphone, you will see these. 919 00:32:10,660 --> 00:32:12,609 So you can see that there is much more 920 00:32:12,610 --> 00:32:14,529 noise in the frequencies. 921 00:32:14,530 --> 00:32:15,849 And also you will see that there are a 922 00:32:15,850 --> 00:32:17,169 lot of peaks around. 923 00:32:17,170 --> 00:32:18,639 This is because you are usually close to 924 00:32:18,640 --> 00:32:20,739 the microphone. So the closer you are 925 00:32:20,740 --> 00:32:23,289 to the power source, the more spurious 926 00:32:23,290 --> 00:32:25,419 frequencies you will find, the more 927 00:32:25,420 --> 00:32:27,579 noise around and you 928 00:32:27,580 --> 00:32:30,159 will see other frequencies 929 00:32:30,160 --> 00:32:32,289 being also having this peak of 930 00:32:32,290 --> 00:32:34,509 power. So if you move away 931 00:32:34,510 --> 00:32:36,309 from the microphone, you will see that 932 00:32:36,310 --> 00:32:38,499 these frequencies are going 933 00:32:38,500 --> 00:32:40,449 down and there is only one frequency the 934 00:32:40,450 --> 00:32:42,339 frequency which the microphone is using 935 00:32:42,340 --> 00:32:43,449 for transmission. 936 00:32:43,450 --> 00:32:45,639 So we are using this idea 937 00:32:45,640 --> 00:32:48,009 and counting this noise 938 00:32:48,010 --> 00:32:50,499 in a sense to know how close 939 00:32:50,500 --> 00:32:52,719 or far away you are from the microphone. 940 00:32:52,720 --> 00:32:54,909 So in here, this is an idea 941 00:32:54,910 --> 00:32:56,979 of putting a threshold that hits 942 00:32:56,980 --> 00:32:57,999 the blue line. 943 00:32:58,000 --> 00:33:00,489 And then we are counting how many peaks 944 00:33:00,490 --> 00:33:01,989 are over this threshold. 945 00:33:01,990 --> 00:33:02,949 This is super basic. 946 00:33:02,950 --> 00:33:05,139 Idea is not a new idea, probably, 947 00:33:05,140 --> 00:33:07,299 but it's a very simple way 948 00:33:07,300 --> 00:33:09,729 of reading very fast, a huge 949 00:33:09,730 --> 00:33:11,109 range of frequencies. 950 00:33:11,110 --> 00:33:13,359 And finally, if you are closer 951 00:33:13,360 --> 00:33:15,429 or not to these sorts 952 00:33:15,430 --> 00:33:18,549 of power frequencies, 953 00:33:18,550 --> 00:33:20,679 this is helping us to split 954 00:33:20,680 --> 00:33:22,929 and separate between the FM radio 955 00:33:22,930 --> 00:33:24,729 station. That is super powerful, but it's 956 00:33:24,730 --> 00:33:26,829 far away against the microphone 957 00:33:26,830 --> 00:33:29,109 that is super small and less powerful, 958 00:33:29,110 --> 00:33:31,239 but is close to you. 959 00:33:31,240 --> 00:33:33,309 So we run several 960 00:33:33,310 --> 00:33:35,739 experiments because US 961 00:33:35,740 --> 00:33:38,109 research background that we have, 962 00:33:38,110 --> 00:33:39,969 we wanted to know, OK, which is the best 963 00:33:39,970 --> 00:33:41,259 threshold for these? 964 00:33:41,260 --> 00:33:43,449 So this David is showing 965 00:33:43,450 --> 00:33:44,859 the first two thresholds. 966 00:33:44,860 --> 00:33:47,109 That means the high 967 00:33:47,110 --> 00:33:48,729 off the power level that we want to 968 00:33:48,730 --> 00:33:50,829 detect. That is the first column on the 969 00:33:50,830 --> 00:33:53,079 second column is the amount of peaks that 970 00:33:53,080 --> 00:33:54,009 we are counting. 971 00:33:54,010 --> 00:33:56,079 OK? These two values are 972 00:33:56,080 --> 00:33:58,179 the values that we are modifying 973 00:33:58,180 --> 00:34:00,279 to know how good or bad 974 00:34:00,280 --> 00:34:01,569 it's the detection. 975 00:34:01,570 --> 00:34:03,849 So we run 85 experiments 976 00:34:03,850 --> 00:34:05,589 with different microphones, different set 977 00:34:05,590 --> 00:34:07,059 ups, different thresholds in different 978 00:34:07,060 --> 00:34:08,259 situations and scenarios. 979 00:34:08,260 --> 00:34:10,658 Rooms train in the street. 980 00:34:10,659 --> 00:34:12,158 And then we count. 981 00:34:12,159 --> 00:34:13,959 OK? There was a microphone. 982 00:34:13,960 --> 00:34:15,069 Did you detected? 983 00:34:15,070 --> 00:34:17,229 That is a true positive if there 984 00:34:17,230 --> 00:34:18,879 is a detection from the tool, but there 985 00:34:18,880 --> 00:34:20,859 is no microphone, that is a false 986 00:34:20,860 --> 00:34:21,849 positive. 987 00:34:21,850 --> 00:34:24,638 Right? And then if there is no microphone 988 00:34:24,639 --> 00:34:26,769 and I'm not detecting it, I'm having a 989 00:34:26,770 --> 00:34:28,419 true negative in there. 990 00:34:28,420 --> 00:34:30,669 And if I'm 991 00:34:30,670 --> 00:34:33,039 saying, Oh no, there is no microphone 992 00:34:33,040 --> 00:34:34,908 and the race, in reality, there is 993 00:34:34,909 --> 00:34:36,129 clearly false negatives. 994 00:34:36,130 --> 00:34:38,259 So we count these errors and then 995 00:34:38,260 --> 00:34:40,388 we compute some numbers. 996 00:34:40,389 --> 00:34:42,519 We call the metrics to know which is the 997 00:34:42,520 --> 00:34:43,839 best detection, right? 998 00:34:43,840 --> 00:34:45,849 So the third column, we call it the f 999 00:34:45,850 --> 00:34:47,079 measure ratio. 1000 00:34:47,080 --> 00:34:48,908 This is a balance between the accuracy 1001 00:34:48,909 --> 00:34:50,079 and the precision. 1002 00:34:50,080 --> 00:34:52,238 And then we have the false positive 1003 00:34:52,239 --> 00:34:54,339 rate. This a ratio of how many 1004 00:34:54,340 --> 00:34:56,619 times you said, Oh, 1005 00:34:56,620 --> 00:34:58,539 it's positive, very said detection. 1006 00:34:58,540 --> 00:35:00,459 And actually there was not a microphone. 1007 00:35:00,460 --> 00:35:02,679 And then the accuracy, the procession and 1008 00:35:02,680 --> 00:35:04,629 the ratio of true positives, the Times 1009 00:35:04,630 --> 00:35:06,099 said. You have a good detection. 1010 00:35:06,100 --> 00:35:08,469 So we count all of these and we 1011 00:35:08,470 --> 00:35:10,569 found the best solution for 1012 00:35:10,570 --> 00:35:12,759 us to compare. 1013 00:35:12,760 --> 00:35:14,919 We also bought this tool that 1014 00:35:14,920 --> 00:35:15,939 is called the ghost. 1015 00:35:15,940 --> 00:35:17,619 This is a hardware detector. 1016 00:35:17,620 --> 00:35:19,929 You can also buy online for very, 1017 00:35:19,930 --> 00:35:22,479 very small amount of money. 1018 00:35:22,480 --> 00:35:24,459 And this tool that you can press a button 1019 00:35:24,460 --> 00:35:26,079 and you can see that there are 1020 00:35:26,080 --> 00:35:27,249 microphones around you. 1021 00:35:27,250 --> 00:35:29,409 So it's one of the 1022 00:35:29,410 --> 00:35:31,389 easiest way to have some also some 1023 00:35:31,390 --> 00:35:33,099 hardware tool to help you. 1024 00:35:33,100 --> 00:35:35,229 So we were comparing salamander 1025 00:35:35,230 --> 00:35:36,159 with this tool. 1026 00:35:36,160 --> 00:35:37,749 This is the line you can see there the 1027 00:35:37,750 --> 00:35:39,489 ghost. This is the performance of the 1028 00:35:39,490 --> 00:35:41,739 ghost. And this is the performance of 1029 00:35:41,740 --> 00:35:42,639 Salamander. 1030 00:35:42,640 --> 00:35:44,889 So the best setup for us is the last 1031 00:35:44,890 --> 00:35:47,379 one where we have some 73 1032 00:35:47,380 --> 00:35:49,089 percent of measure. 1033 00:35:49,090 --> 00:35:51,279 This is pretty good and you have 11 1034 00:35:51,280 --> 00:35:53,649 percent of false positive ratio. 1035 00:35:53,650 --> 00:35:55,779 So this means that we lose some 1036 00:35:55,780 --> 00:35:57,969 microphones. So there were situations 1037 00:35:57,970 --> 00:35:59,859 where we say, Oh, there's a microphone, 1038 00:35:59,860 --> 00:36:01,509 and there was not, and there were some 1039 00:36:01,510 --> 00:36:03,609 situations where we say here, 1040 00:36:03,610 --> 00:36:06,009 if if measure OK, here, 1041 00:36:06,010 --> 00:36:08,769 right? There were some ways to say, Oh, 1042 00:36:08,770 --> 00:36:10,539 I think that there are no microphones 1043 00:36:10,540 --> 00:36:12,609 around me and actually there were. 1044 00:36:12,610 --> 00:36:14,859 So this is showing that no tool 1045 00:36:14,860 --> 00:36:15,809 is perfect. 1046 00:36:15,810 --> 00:36:18,149 And you should modify the values until 1047 00:36:18,150 --> 00:36:20,369 finally whatever is best for you, right? 1048 00:36:20,370 --> 00:36:21,629 So this is not perfect. 1049 00:36:21,630 --> 00:36:23,099 There are errors. 1050 00:36:23,100 --> 00:36:24,989 You will have situations where you are 1051 00:36:24,990 --> 00:36:27,299 not finding the Microsoft with any tool 1052 00:36:27,300 --> 00:36:28,919 and you will solicitations where you will 1053 00:36:28,920 --> 00:36:30,929 say, Oh, there are a lot of bugs around 1054 00:36:30,930 --> 00:36:32,399 me. And there are none. 1055 00:36:32,400 --> 00:36:34,049 Even with a hardware one. 1056 00:36:34,050 --> 00:36:36,089 So the good thing about salamander is 1057 00:36:36,090 --> 00:36:38,249 that you can keep on these parameters 1058 00:36:38,250 --> 00:36:40,439 and then you have a better detection. 1059 00:36:40,440 --> 00:36:42,719 And actually, you can find the pseudo 1060 00:36:42,720 --> 00:36:44,549 percentage false positive, which means 1061 00:36:44,550 --> 00:36:46,739 that there were no no errors 1062 00:36:46,740 --> 00:36:48,689 if you want, right? 1063 00:36:48,690 --> 00:36:50,399 So you sing Solomon. 1064 00:36:50,400 --> 00:36:51,599 This is an example. 1065 00:36:51,600 --> 00:36:53,699 Let me show you salamander 1066 00:36:53,700 --> 00:36:55,229 a running. 1067 00:36:55,230 --> 00:36:57,299 So one of the good things that 1068 00:36:57,300 --> 00:36:59,499 we thought about salamander was that in 1069 00:36:59,500 --> 00:37:02,459 the detectors cover detectors like these, 1070 00:37:02,460 --> 00:37:04,379 like the ghost, you need to be pressing 1071 00:37:04,380 --> 00:37:06,479 the button in order to be able to 1072 00:37:06,480 --> 00:37:08,139 have an addiction or not. 1073 00:37:08,140 --> 00:37:10,319 And you cannot just be pressing about 1074 00:37:10,320 --> 00:37:11,969 them all the time. 1075 00:37:11,970 --> 00:37:14,159 So the this 1076 00:37:14,160 --> 00:37:15,749 type of software is making that you can 1077 00:37:15,750 --> 00:37:17,969 leave it running and then you just 1078 00:37:17,970 --> 00:37:20,219 go to work and come back and try to see 1079 00:37:20,220 --> 00:37:21,809 if there is a difference or not. 1080 00:37:21,810 --> 00:37:22,649 Mm-Hmm. 1081 00:37:22,650 --> 00:37:24,689 So you hear this is a basic interface of 1082 00:37:24,690 --> 00:37:26,699 salamander, and now it's running, it's 1083 00:37:26,700 --> 00:37:29,019 running in some frequencies. 1084 00:37:29,020 --> 00:37:30,989 And now there are no detection. 1085 00:37:30,990 --> 00:37:32,609 And then this is the first one I was 1086 00:37:32,610 --> 00:37:34,409 showing you. I'm going to apply it to the 1087 00:37:34,410 --> 00:37:35,309 to the battery. 1088 00:37:35,310 --> 00:37:37,139 And now this is powering on. 1089 00:37:37,140 --> 00:37:39,149 It's taking my voice is converting into 1090 00:37:39,150 --> 00:37:41,309 the dam, the antenna frequency 1091 00:37:41,310 --> 00:37:42,839 in transmitting around. 1092 00:37:42,840 --> 00:37:45,239 And then here I have plug the 1093 00:37:45,240 --> 00:37:46,240 the 1094 00:37:49,060 --> 00:37:50,060 the 1095 00:37:52,230 --> 00:37:54,179 antenna off a USB device. 1096 00:37:54,180 --> 00:37:55,979 And there you can see that there is there 1097 00:37:55,980 --> 00:37:58,019 are some deductions already, so you can 1098 00:37:58,020 --> 00:38:00,089 see that there 1099 00:38:00,090 --> 00:38:02,129 is the time of detection, there is the 1100 00:38:02,130 --> 00:38:04,889 frequency 113 megahertz 1101 00:38:04,890 --> 00:38:07,019 and then those 1102 00:38:07,020 --> 00:38:08,099 sharp symbols. 1103 00:38:08,100 --> 00:38:11,279 He's telling me how many of the peaks 1104 00:38:11,280 --> 00:38:13,469 are in the frequency that I will 1105 00:38:13,470 --> 00:38:14,999 detect. So you can see there that there 1106 00:38:15,000 --> 00:38:17,339 are more and then there are less 1107 00:38:17,340 --> 00:38:19,559 right, which means that I'm closer 1108 00:38:19,560 --> 00:38:21,589 to the source or I'm farther away. 1109 00:38:21,590 --> 00:38:23,519 Right, you can see there, there are more 1110 00:38:23,520 --> 00:38:24,479 of them, more of them. 1111 00:38:24,480 --> 00:38:26,429 And I'm more in a way. 1112 00:38:26,430 --> 00:38:28,409 There is a time delay, of course, in 1113 00:38:28,410 --> 00:38:30,569 there until there is 1114 00:38:30,570 --> 00:38:32,309 no more detection because I am so far 1115 00:38:32,310 --> 00:38:32,879 away. 1116 00:38:32,880 --> 00:38:35,189 So, yeah, so this also 1117 00:38:35,190 --> 00:38:37,079 brings a problem that is not that you 1118 00:38:37,080 --> 00:38:38,699 just go into a blaze and put the 1119 00:38:38,700 --> 00:38:40,769 microphone right. You need to think of 1120 00:38:40,770 --> 00:38:42,869 all the interference of devices that are 1121 00:38:42,870 --> 00:38:45,179 there and it's like really 1122 00:38:45,180 --> 00:38:46,559 complicated. 1123 00:38:46,560 --> 00:38:48,779 So the good thing 1124 00:38:48,780 --> 00:38:50,759 about China, Mundra, is that you can walk 1125 00:38:50,760 --> 00:38:52,859 around and you can see what's going 1126 00:38:52,860 --> 00:38:54,929 on all the time continually and 1127 00:38:54,930 --> 00:38:57,239 you have recorded so you can go 1128 00:38:57,240 --> 00:38:58,889 and see, Oh, there is some frequency 1129 00:38:58,890 --> 00:39:01,109 here. I don't like because 1130 00:39:01,110 --> 00:39:03,569 you have devices at home, you have device 1131 00:39:03,570 --> 00:39:05,839 and you have radios and you have phones, 1132 00:39:05,840 --> 00:39:07,739 so you have a lot of things going on. 1133 00:39:07,740 --> 00:39:10,259 So it may happen that in some situations 1134 00:39:10,260 --> 00:39:12,599 you are picking another frequency, right? 1135 00:39:12,600 --> 00:39:14,279 So yesterday, for example, I was walking 1136 00:39:14,280 --> 00:39:16,259 around and trying to see what's going on 1137 00:39:16,260 --> 00:39:18,329 if I walk in there in the Congress. 1138 00:39:19,560 --> 00:39:21,179 And actually, I was surprised that there 1139 00:39:21,180 --> 00:39:23,039 were no detections or salamander was not 1140 00:39:23,040 --> 00:39:25,199 picking up any microphones, which 1141 00:39:25,200 --> 00:39:26,499 is good. 1142 00:39:26,500 --> 00:39:28,559 And then I started 1143 00:39:28,560 --> 00:39:30,659 having some detections in the 1144 00:39:30,660 --> 00:39:32,579 frequency of 400 something. 1145 00:39:32,580 --> 00:39:35,189 This is usually used by the 1146 00:39:35,190 --> 00:39:37,109 radio people that is speaking with these 1147 00:39:37,110 --> 00:39:39,209 radios. So say, Oh, somebody is speaking 1148 00:39:39,210 --> 00:39:41,219 actually, so I will try to see what's 1149 00:39:41,220 --> 00:39:42,749 going on with these. So I keep walking 1150 00:39:42,750 --> 00:39:44,819 around and actually start to try to 1151 00:39:44,820 --> 00:39:45,899 find them, right? 1152 00:39:45,900 --> 00:39:47,039 OK. Where are they? 1153 00:39:47,040 --> 00:39:49,439 So I was walking around until I was close 1154 00:39:49,440 --> 00:39:50,999 to the place that they were transmitting 1155 00:39:51,000 --> 00:39:53,159 because I can see the amount of 1156 00:39:53,160 --> 00:39:54,989 noise they were generating. 1157 00:39:54,990 --> 00:39:57,239 So in a sense, this can be used to 1158 00:39:57,240 --> 00:39:59,819 pinpoint any type of 1159 00:39:59,820 --> 00:40:01,949 a meter. But we are focusing, 1160 00:40:01,950 --> 00:40:04,409 of course, in there in them 1161 00:40:04,410 --> 00:40:05,549 hidden microphones. 1162 00:40:05,550 --> 00:40:06,959 So what's going on? 1163 00:40:06,960 --> 00:40:08,529 Why salamander is different to others. 1164 00:40:08,530 --> 00:40:10,769 First, you can walk around, you can find 1165 00:40:10,770 --> 00:40:12,569 different places. 1166 00:40:12,570 --> 00:40:14,909 You can do it for a long time. 1167 00:40:14,910 --> 00:40:16,949 You can leave it running during the 1168 00:40:16,950 --> 00:40:19,139 night, for example, which you cannot do 1169 00:40:19,140 --> 00:40:20,519 if you are pressing the bottom of the 1170 00:40:20,520 --> 00:40:22,649 hour. The doctors you, you don't 1171 00:40:22,650 --> 00:40:24,839 have to be there doing it, so 1172 00:40:24,840 --> 00:40:25,979 you can detect. 1173 00:40:25,980 --> 00:40:28,109 But more importantly, and this is super 1174 00:40:28,110 --> 00:40:29,939 new because we don't know any tool that 1175 00:40:29,940 --> 00:40:30,959 was doing this before. 1176 00:40:30,960 --> 00:40:33,419 You can locate microphones, 1177 00:40:33,420 --> 00:40:35,399 detection tools that are a lot like 1178 00:40:35,400 --> 00:40:36,749 Category one software. 1179 00:40:36,750 --> 00:40:38,639 I don't know anyone, any tool. 1180 00:40:38,640 --> 00:40:40,619 But more importantly, this is the first 1181 00:40:40,620 --> 00:40:42,809 time that we saw a tool that can help 1182 00:40:42,810 --> 00:40:44,219 you locate. 1183 00:40:44,220 --> 00:40:46,319 So of course, what we are doing here 1184 00:40:46,320 --> 00:40:48,449 is some kind of 1185 00:40:48,450 --> 00:40:50,669 translation from the amount 1186 00:40:50,670 --> 00:40:52,139 of peaks in the frequency to the 1187 00:40:52,140 --> 00:40:53,759 distance, which is not accurate. 1188 00:40:53,760 --> 00:40:55,259 Of course, these are not matters are 1189 00:40:55,260 --> 00:40:57,239 centimeters is just an estimation. 1190 00:40:57,240 --> 00:40:58,859 But these helping, you know if you are 1191 00:40:58,860 --> 00:41:00,149 far away or not. 1192 00:41:00,150 --> 00:41:02,399 And second, the idea is that you can 1193 00:41:02,400 --> 00:41:04,709 use earthly power to actually 1194 00:41:04,710 --> 00:41:07,319 store the audio 1195 00:41:07,320 --> 00:41:09,149 profiles in these power levels. 1196 00:41:09,150 --> 00:41:11,549 And this is a file so you can send 1197 00:41:11,550 --> 00:41:13,649 these to anyone in the 1198 00:41:13,650 --> 00:41:15,089 internet to help you. 1199 00:41:15,090 --> 00:41:17,309 We'd send a man or not to see if 1200 00:41:17,310 --> 00:41:19,709 you have a mic at home and this is 1201 00:41:19,710 --> 00:41:20,909 something very new. 1202 00:41:20,910 --> 00:41:23,159 You can't do this in any room 1203 00:41:23,160 --> 00:41:25,049 and then send the file to other people 1204 00:41:25,050 --> 00:41:27,239 that actually can help, you know, if 1205 00:41:27,240 --> 00:41:29,369 there was something, we are wrong. 1206 00:41:29,370 --> 00:41:31,509 And finally, you can provide 1207 00:41:31,510 --> 00:41:32,549 your environment. 1208 00:41:32,550 --> 00:41:34,739 You can take a measurement today that 1209 00:41:34,740 --> 00:41:36,719 you know there are no bugs and then take 1210 00:41:36,720 --> 00:41:38,699 it tomorrow or in the night or in a 1211 00:41:38,700 --> 00:41:39,869 special situation. 1212 00:41:39,870 --> 00:41:41,669 And then you will see the differences 1213 00:41:41,670 --> 00:41:43,739 because remember that you have the TV and 1214 00:41:43,740 --> 00:41:45,899 the telephone on your neighbor's 1215 00:41:45,900 --> 00:41:48,209 phone. So if you know 1216 00:41:48,210 --> 00:41:50,339 your environment, you will 1217 00:41:50,340 --> 00:41:51,989 notice the differences. 1218 00:41:51,990 --> 00:41:54,389 OK, so a 1219 00:41:54,390 --> 00:41:55,589 real Real-Life experiment? 1220 00:41:55,590 --> 00:41:56,159 Yeah. 1221 00:41:56,160 --> 00:41:58,259 So again, we wanted 1222 00:41:58,260 --> 00:42:00,329 to make this research 1223 00:42:00,330 --> 00:42:02,459 fun for us, not only like 1224 00:42:02,460 --> 00:42:04,559 all these experiments and 1225 00:42:04,560 --> 00:42:05,459 numbers. 1226 00:42:05,460 --> 00:42:07,649 So we wanted to try them out and 1227 00:42:07,650 --> 00:42:09,179 to to kind of 1228 00:42:10,350 --> 00:42:12,969 design experiments like, OK, let's 1229 00:42:12,970 --> 00:42:15,059 think that one of us is the 1230 00:42:15,060 --> 00:42:16,859 big team and one of us is evil. 1231 00:42:16,860 --> 00:42:19,139 So I will be the evil one planting 1232 00:42:19,140 --> 00:42:20,699 devices. I think you will have these 1233 00:42:20,700 --> 00:42:22,320 salamander, those trying to dig them. 1234 00:42:24,080 --> 00:42:25,889 And so the methodology of the experiments 1235 00:42:25,890 --> 00:42:28,559 were something like this the 1236 00:42:28,560 --> 00:42:30,719 the seeker that is in 1237 00:42:30,720 --> 00:42:31,889 this case of us. 1238 00:42:31,890 --> 00:42:34,649 He will go out of the room and 1239 00:42:34,650 --> 00:42:36,479 I will get in and I will hide a 1240 00:42:36,480 --> 00:42:38,129 microphone or not. 1241 00:42:38,130 --> 00:42:39,130 Right? 1242 00:42:39,570 --> 00:42:41,669 And then he gets seen. 1243 00:42:41,670 --> 00:42:44,129 He starts speaking some buzz words. 1244 00:42:44,130 --> 00:42:45,599 Not the real ones. 1245 00:42:45,600 --> 00:42:47,699 Or or yes, 1246 00:42:47,700 --> 00:42:49,379 key words, right? 1247 00:42:49,380 --> 00:42:51,929 And I will try to be listening 1248 00:42:51,930 --> 00:42:54,029 to these to try to make sure again, 1249 00:42:54,030 --> 00:42:55,949 like the accuracy of the words and the 1250 00:42:55,950 --> 00:42:57,329 listening quality. 1251 00:42:57,330 --> 00:42:59,489 And then we will measure two things. 1252 00:42:59,490 --> 00:43:01,289 The first thing I will measure the time 1253 00:43:01,290 --> 00:43:03,389 detection, which is do I 1254 00:43:03,390 --> 00:43:05,579 know if there is a microphone here 1255 00:43:05,580 --> 00:43:07,649 or not? And then we will measure 1256 00:43:07,650 --> 00:43:10,979 the time to actually find the microphone 1257 00:43:10,980 --> 00:43:13,109 that was hidden so 1258 00:43:13,110 --> 00:43:15,449 that that is two completely different 1259 00:43:15,450 --> 00:43:17,639 things, right? So we were we wanted 1260 00:43:17,640 --> 00:43:19,889 to know how hard it is to 1261 00:43:19,890 --> 00:43:21,119 actually find them. 1262 00:43:21,120 --> 00:43:23,099 And then we will measure what we call the 1263 00:43:23,100 --> 00:43:25,319 recall, which is he 1264 00:43:25,320 --> 00:43:27,719 mentioned a certain amount of passwords 1265 00:43:27,720 --> 00:43:28,829 are critical words. 1266 00:43:28,830 --> 00:43:30,929 So I will try to write 1267 00:43:30,930 --> 00:43:33,029 them down. And then the recall is the 1268 00:43:33,030 --> 00:43:35,549 amount of passwords that I heard 1269 00:43:35,550 --> 00:43:37,449 over the total passwords that he is 1270 00:43:37,450 --> 00:43:39,959 spoken. So we going this way we can. 1271 00:43:39,960 --> 00:43:41,759 We have some measure of how to compare 1272 00:43:41,760 --> 00:43:43,829 these experiments. 1273 00:43:43,830 --> 00:43:46,059 We did several like this. 1274 00:43:46,060 --> 00:43:48,179 And here is a small table comparing them 1275 00:43:50,250 --> 00:43:52,739 in the in this case. 1276 00:43:52,740 --> 00:43:55,139 In all the cases, we were hiding 1277 00:43:55,140 --> 00:43:57,509 microphones and we were 1278 00:43:57,510 --> 00:43:59,609 finding them, which is good, wouldn't 1279 00:43:59,610 --> 00:44:01,559 use the time to detect 1280 00:44:02,670 --> 00:44:05,039 was all in 1281 00:44:05,040 --> 00:44:07,589 almost all cases like really short, 1282 00:44:07,590 --> 00:44:09,989 like in a matter of minutes, you can save 1283 00:44:09,990 --> 00:44:12,059 with a certain level of 1284 00:44:12,060 --> 00:44:14,249 certainty that there was a microphone. 1285 00:44:14,250 --> 00:44:16,499 But you can see the difference between 1286 00:44:16,500 --> 00:44:18,659 the detection and the time to locate 1287 00:44:18,660 --> 00:44:20,969 them. It was like kind of 1288 00:44:20,970 --> 00:44:23,249 takes far more time to actually 1289 00:44:23,250 --> 00:44:24,250 find them, right? 1290 00:44:25,350 --> 00:44:28,729 And we also made sure 1291 00:44:28,730 --> 00:44:30,989 the recall, as we saw the 1292 00:44:30,990 --> 00:44:33,269 the amount of password spoken 1293 00:44:33,270 --> 00:44:36,279 over the passwords that I could listen. 1294 00:44:36,280 --> 00:44:38,609 And this was in only 1295 00:44:38,610 --> 00:44:41,489 one case it was 100 percent 1296 00:44:41,490 --> 00:44:43,529 in all the other cases it was some of the 1297 00:44:43,530 --> 00:44:45,599 passwords that I could listen properly 1298 00:44:45,600 --> 00:44:47,759 were very low compared to the 1299 00:44:47,760 --> 00:44:48,899 password spoken. 1300 00:44:48,900 --> 00:44:50,369 And you can see there that there is one 1301 00:44:50,370 --> 00:44:52,649 experiments. I took 25 minutes to look 1302 00:44:52,650 --> 00:44:54,719 to detect and then 1303 00:44:54,720 --> 00:44:56,369 we found at the end that actually the 1304 00:44:56,370 --> 00:44:58,409 microphone was running out of battery, so 1305 00:44:58,410 --> 00:45:00,599 it was not transmitting all the time. 1306 00:45:00,600 --> 00:45:02,309 It was super frustrating. 1307 00:45:02,310 --> 00:45:03,839 I know that they've shown like no 1308 00:45:03,840 --> 00:45:06,059 location. Even the Gos was not 1309 00:45:06,060 --> 00:45:07,589 detecting it. 1310 00:45:07,590 --> 00:45:09,759 And then at the end, there was support 1311 00:45:09,760 --> 00:45:11,849 among a 1312 00:45:11,850 --> 00:45:13,739 frequency energy going out of the 1313 00:45:13,740 --> 00:45:16,079 microphone signal and salmonella 1314 00:45:16,080 --> 00:45:17,699 detected. So there was a detection 20 1315 00:45:17,700 --> 00:45:18,929 minutes after that. 1316 00:45:18,930 --> 00:45:21,209 No location or I was not able to find 1317 00:45:21,210 --> 00:45:23,339 it because he was put off because, 1318 00:45:23,340 --> 00:45:24,329 yeah, 1319 00:45:24,330 --> 00:45:25,139 so 1320 00:45:25,140 --> 00:45:26,579 sorry. And you can see that there were no 1321 00:45:26,580 --> 00:45:27,659 bus or listen there. 1322 00:45:27,660 --> 00:45:28,709 So I was saying passwords. 1323 00:45:28,710 --> 00:45:30,809 But but there were no 1324 00:45:30,810 --> 00:45:32,819 password being listening, which is super 1325 00:45:32,820 --> 00:45:34,769 good for the for me in this case. 1326 00:45:34,770 --> 00:45:36,839 Yeah. And you can see how 1327 00:45:36,840 --> 00:45:38,369 this does make it difficult for the 1328 00:45:38,370 --> 00:45:40,589 passcode. The other thing or the great 1329 00:45:40,590 --> 00:45:43,109 seal, it was not emitting anything. 1330 00:45:43,110 --> 00:45:45,089 You can actually help fight it because 1331 00:45:45,090 --> 00:45:46,169 it's not admitting anything. 1332 00:45:46,170 --> 00:45:48,839 So this is 1333 00:45:48,840 --> 00:45:51,469 this was very nice to compare 1334 00:45:51,470 --> 00:45:53,579 and hit on some pictures of the 1335 00:45:53,580 --> 00:45:55,709 best locations that I found to 1336 00:45:55,710 --> 00:45:56,849 hide the microphones. 1337 00:45:58,410 --> 00:46:00,779 This was actually from 1338 00:46:00,780 --> 00:46:03,119 the example of the Czechoslovak bug, so I 1339 00:46:03,120 --> 00:46:05,099 hid it under the table. 1340 00:46:05,100 --> 00:46:07,110 It looks like really long to find 1341 00:46:08,250 --> 00:46:10,409 it was kind of the last stone 1342 00:46:10,410 --> 00:46:11,789 left in our place. 1343 00:46:13,110 --> 00:46:15,179 We were almost Sebastian 1344 00:46:15,180 --> 00:46:17,559 was almost starting to kick off the wall. 1345 00:46:17,560 --> 00:46:19,739 So it was very fun 1346 00:46:19,740 --> 00:46:22,469 and it was it was very interesting 1347 00:46:22,470 --> 00:46:23,849 to see the 1348 00:46:25,140 --> 00:46:26,879 two understand. Like the logic of the 1349 00:46:26,880 --> 00:46:29,039 people were the typical places where 1350 00:46:29,040 --> 00:46:31,079 you go to search on the other places that 1351 00:46:31,080 --> 00:46:32,669 you just give for granted that there is 1352 00:46:32,670 --> 00:46:33,389 not there 1353 00:46:33,390 --> 00:46:35,309 because the signal is bouncing around. 1354 00:46:35,310 --> 00:46:37,439 So the problem is that you may have 1355 00:46:37,440 --> 00:46:39,669 good detections in two places 1356 00:46:39,670 --> 00:46:40,739 in the room. 1357 00:46:40,740 --> 00:46:42,779 So it's super easy to say, Oh, it's here 1358 00:46:42,780 --> 00:46:45,119 and start breaking everything apart, but 1359 00:46:45,120 --> 00:46:46,199 maybe it's not there. 1360 00:46:46,200 --> 00:46:48,239 So it was so difficult to come down. 1361 00:46:48,240 --> 00:46:50,069 So, OK, this is the place I really think 1362 00:46:50,070 --> 00:46:52,019 it's here and then searching around you, 1363 00:46:52,020 --> 00:46:54,269 right? So detection, it's almost one 1364 00:46:54,270 --> 00:46:55,389 meter around you. 1365 00:46:55,390 --> 00:46:57,449 So it's actually a lot of places 1366 00:46:57,450 --> 00:46:59,039 if you think about it. 1367 00:46:59,040 --> 00:47:00,869 OK, five minutes, yes. 1368 00:47:00,870 --> 00:47:02,999 So another 1369 00:47:03,000 --> 00:47:05,009 place that was very, very hard to find 1370 00:47:05,010 --> 00:47:05,939 was this one. 1371 00:47:05,940 --> 00:47:07,799 OK, so so we're going to ask, do you know 1372 00:47:07,800 --> 00:47:08,849 what is the microphone in there? 1373 00:47:12,930 --> 00:47:14,609 It's a white board issue. 1374 00:47:14,610 --> 00:47:16,089 Yeah, it's a white bar. 1375 00:47:16,090 --> 00:47:18,479 And this was 1376 00:47:18,480 --> 00:47:20,609 this was very interesting because it had 1377 00:47:20,610 --> 00:47:22,479 like a little thing that you're you can 1378 00:47:22,480 --> 00:47:23,419 open. 1379 00:47:23,420 --> 00:47:25,619 There. So it was very fun because 1380 00:47:25,620 --> 00:47:28,049 it took forever to find and 1381 00:47:28,050 --> 00:47:30,269 it was it was very fun 1382 00:47:30,270 --> 00:47:32,369 to see people searching 1383 00:47:32,370 --> 00:47:34,439 for it and not finding it because it was 1384 00:47:34,440 --> 00:47:36,419 again just in front of people's eyes, 1385 00:47:36,420 --> 00:47:38,519 right? It was very clever. 1386 00:47:38,520 --> 00:47:40,469 Also, you were in front of a white, but 1387 00:47:40,470 --> 00:47:41,769 it's a very nice location because the 1388 00:47:41,770 --> 00:47:43,159 people is having dogs in there, right? 1389 00:47:43,160 --> 00:47:45,269 Yeah, maybe very interesting 1390 00:47:45,270 --> 00:47:48,019 dogs. So confusions 1391 00:47:48,020 --> 00:47:50,339 hiding microphone 1392 00:47:50,340 --> 00:47:52,259 in my experience was very hard because 1393 00:47:52,260 --> 00:47:54,809 it's not that you hide it in the bathroom 1394 00:47:54,810 --> 00:47:56,729 or in the kitchen, right? 1395 00:47:56,730 --> 00:47:58,529 You have to know your target. 1396 00:47:58,530 --> 00:48:01,079 You have to have physical access. 1397 00:48:01,080 --> 00:48:03,029 You need to know where the camera's 1398 00:48:03,030 --> 00:48:05,489 important conversations happen, right? 1399 00:48:05,490 --> 00:48:07,709 So and what what is what 1400 00:48:07,710 --> 00:48:09,449 you want to find out? 1401 00:48:09,450 --> 00:48:11,729 So you also need to solve the problem 1402 00:48:11,730 --> 00:48:14,219 of the power and you need to understand 1403 00:48:14,220 --> 00:48:15,439 the behavior of the people. 1404 00:48:15,440 --> 00:48:15,819 Yeah. 1405 00:48:15,820 --> 00:48:17,639 And even if you have some locations that 1406 00:48:17,640 --> 00:48:19,499 you want to hide, remember that yes, you 1407 00:48:19,500 --> 00:48:21,569 can put it underground and nobody 1408 00:48:21,570 --> 00:48:23,039 will find it, but you are not going to 1409 00:48:23,040 --> 00:48:25,469 listen. So the location 1410 00:48:25,470 --> 00:48:27,569 is super hard because you need 1411 00:48:27,570 --> 00:48:29,309 to listen and not to be found. 1412 00:48:29,310 --> 00:48:31,379 So this is something that it was 1413 00:48:31,380 --> 00:48:32,309 very, very hard. 1414 00:48:32,310 --> 00:48:34,409 I was moving around half of the 1415 00:48:34,410 --> 00:48:36,869 house and I was not able to find 1416 00:48:36,870 --> 00:48:37,679 for a long time. 1417 00:48:37,680 --> 00:48:39,779 Yeah. So the dog with 1418 00:48:39,780 --> 00:48:40,979 salamander is really fast. 1419 00:48:40,980 --> 00:48:42,179 You can see that it was a matter of 1420 00:48:42,180 --> 00:48:43,889 minutes and listening was hard. 1421 00:48:43,890 --> 00:48:46,019 I think we have some examples here. 1422 00:48:46,020 --> 00:48:48,059 Yes, we can quickly play. 1423 00:48:48,060 --> 00:48:50,309 So yeah, we 1424 00:48:50,310 --> 00:48:51,479 do have audio. 1425 00:48:51,480 --> 00:48:52,499 Yeah. 1426 00:48:52,500 --> 00:48:53,879 You should have. 1427 00:48:53,880 --> 00:48:56,039 No, we have that audio from the computer. 1428 00:48:58,260 --> 00:48:59,249 Thank you. 1429 00:48:59,250 --> 00:49:01,169 So this is where the music we are trying 1430 00:49:01,170 --> 00:49:03,149 some for music in the background 1431 00:49:03,150 --> 00:49:04,150 so 1432 00:49:05,310 --> 00:49:08,039 that they would be learning about what 1433 00:49:08,040 --> 00:49:10,109 we were going to find 1434 00:49:10,110 --> 00:49:11,110 out. 1435 00:49:11,670 --> 00:49:12,479 Yeah. 1436 00:49:12,480 --> 00:49:14,729 So so you can see how 1437 00:49:14,730 --> 00:49:17,069 it was kind of you can hear the voice 1438 00:49:17,070 --> 00:49:19,050 and you can see that someone is talking, 1439 00:49:20,970 --> 00:49:23,219 but you can hear the music as well. 1440 00:49:23,220 --> 00:49:25,439 But in and it's believed 1441 00:49:25,440 --> 00:49:28,169 that 50 years ago, putting radio 1442 00:49:28,170 --> 00:49:30,329 and then speaking was a 1443 00:49:30,330 --> 00:49:32,639 technique to kind of not making 1444 00:49:32,640 --> 00:49:34,649 people not able to listen to you. 1445 00:49:34,650 --> 00:49:36,659 But with current technologies, this 1446 00:49:36,660 --> 00:49:38,609 doesn't apply in any longer. 1447 00:49:38,610 --> 00:49:40,739 So we ask a firm in 1448 00:49:40,740 --> 00:49:42,959 Belarus to help us cleaning this 1449 00:49:42,960 --> 00:49:44,610 audio with the computer. 1450 00:49:47,430 --> 00:49:49,079 Because he's much more cleaner. 1451 00:49:49,080 --> 00:49:50,409 Right? 1452 00:49:50,410 --> 00:49:51,410 Both. 1453 00:49:53,020 --> 00:49:54,020 No music, 1454 00:49:55,060 --> 00:49:56,060 no. 1455 00:49:58,530 --> 00:49:59,670 The movies like 1456 00:50:01,120 --> 00:50:02,159 Away. 1457 00:50:02,160 --> 00:50:03,510 I think the fans, 1458 00:50:04,950 --> 00:50:05,759 OK, so 1459 00:50:05,760 --> 00:50:07,439 yeah, so basically the point is that you 1460 00:50:07,440 --> 00:50:09,539 can kind of really quickly 1461 00:50:09,540 --> 00:50:11,010 this was half hour work 1462 00:50:12,390 --> 00:50:14,759 and it's really easy to completely 1463 00:50:14,760 --> 00:50:15,929 remove the music, right? 1464 00:50:15,930 --> 00:50:18,119 So it's not that you should 1465 00:50:18,120 --> 00:50:19,559 not put music about this. 1466 00:50:19,560 --> 00:50:21,389 You should not believe that music will 1467 00:50:21,390 --> 00:50:23,609 cover up for you because it's that's not 1468 00:50:23,610 --> 00:50:23,849 long. 1469 00:50:23,850 --> 00:50:25,799 Imagine if you have resources and a 1470 00:50:25,800 --> 00:50:28,109 larger organization, this is very easy 1471 00:50:28,110 --> 00:50:30,269 to do, right? So don't trust any noise 1472 00:50:30,270 --> 00:50:31,409 around you to do this. 1473 00:50:31,410 --> 00:50:33,779 Yeah. So Harvey McAdoo, 1474 00:50:33,780 --> 00:50:34,619 sorry. 1475 00:50:34,620 --> 00:50:35,639 There you go. 1476 00:50:35,640 --> 00:50:36,629 Yeah. 1477 00:50:36,630 --> 00:50:38,909 So we believe like for 1478 00:50:38,910 --> 00:50:40,649 closing this up. 1479 00:50:40,650 --> 00:50:43,109 We believe that these are work. 1480 00:50:43,110 --> 00:50:45,329 I have like three key contributions. 1481 00:50:45,330 --> 00:50:47,849 First, we 1482 00:50:47,850 --> 00:50:49,949 did our systematic research on their 1483 00:50:49,950 --> 00:50:52,289 usage and performance of these bags, and 1484 00:50:52,290 --> 00:50:54,299 we haven't seen any other work doing 1485 00:50:54,300 --> 00:50:56,549 things like this. We hope that after 1486 00:50:56,550 --> 00:50:58,989 this talk, you just get your 1487 00:50:58,990 --> 00:51:00,899 idea and you try to do stuff like this 1488 00:51:00,900 --> 00:51:02,969 with other models. Maybe I don't 1489 00:51:02,970 --> 00:51:05,399 know your grandma has a microphone that 1490 00:51:05,400 --> 00:51:07,230 store somewhere so you can try it out. 1491 00:51:08,670 --> 00:51:11,889 We have the first year base 1492 00:51:11,890 --> 00:51:14,039 detection to youth 1493 00:51:14,040 --> 00:51:16,709 use is available on GitHub, 1494 00:51:16,710 --> 00:51:18,779 and we have the first 1495 00:51:18,780 --> 00:51:21,749 real life experiments documented 1496 00:51:21,750 --> 00:51:23,849 that can be used to compare with 1497 00:51:23,850 --> 00:51:26,159 other technologies and you can use 1498 00:51:26,160 --> 00:51:28,559 to actually learn and compare 1499 00:51:28,560 --> 00:51:30,119 with other things. 1500 00:51:30,120 --> 00:51:32,339 So before concluding, 1501 00:51:32,340 --> 00:51:34,619 Yeah, um, 1502 00:51:34,620 --> 00:51:36,989 I want to say that we are going to give 1503 00:51:36,990 --> 00:51:38,939 now to the people here. 1504 00:51:38,940 --> 00:51:41,279 We have one as the Eusebius 1505 00:51:41,280 --> 00:51:42,869 here that is for you. 1506 00:51:42,870 --> 00:51:44,969 So now at the end of the dog, we 1507 00:51:44,970 --> 00:51:47,069 are going to give it to somebody there. 1508 00:51:47,070 --> 00:51:49,289 So be prepared for that and 1509 00:51:49,290 --> 00:51:51,089 remind us this is for you 1510 00:51:52,860 --> 00:51:53,759 a second. 1511 00:51:53,760 --> 00:51:55,049 Can can you give us please the 1512 00:51:55,050 --> 00:51:56,579 microphone? So what are there? 1513 00:51:56,580 --> 00:51:58,859 So so yeah, they are spying 1514 00:51:58,860 --> 00:52:00,509 microphones, but we want them back. 1515 00:52:00,510 --> 00:52:03,509 So I remember to bring them on 1516 00:52:03,510 --> 00:52:05,489 to conclude, we can say that all the 1517 00:52:05,490 --> 00:52:07,109 eavesdropping is a real threat. 1518 00:52:07,110 --> 00:52:08,489 Don't be fooled here. 1519 00:52:08,490 --> 00:52:10,859 Yes, it's not straightforward. 1520 00:52:10,860 --> 00:52:12,539 Yes, malware is easier. 1521 00:52:12,540 --> 00:52:14,579 In some ways this is still happening in 1522 00:52:14,580 --> 00:52:16,679 us, happening as far as we know. 1523 00:52:16,680 --> 00:52:18,959 So be be aware 1524 00:52:18,960 --> 00:52:20,579 of the threat. 1525 00:52:20,580 --> 00:52:22,889 Now you know how at least commercially 1526 00:52:22,890 --> 00:52:24,569 available microphones work, so you have 1527 00:52:24,570 --> 00:52:26,219 any idea of what can be done and what 1528 00:52:26,220 --> 00:52:28,109 cannot be done. This is important for 1529 00:52:28,110 --> 00:52:29,159 your protection. 1530 00:52:29,160 --> 00:52:31,289 And then be sure 1531 00:52:31,290 --> 00:52:32,969 that you are taking the measurements to 1532 00:52:32,970 --> 00:52:34,319 protect yourself. So go there. 1533 00:52:34,320 --> 00:52:36,899 The notion of salamander helped modified 1534 00:52:36,900 --> 00:52:38,189 quite fine microphones. 1535 00:52:38,190 --> 00:52:40,289 Tell us about them, advance 1536 00:52:40,290 --> 00:52:42,389 the field and try to help 1537 00:52:42,390 --> 00:52:43,799 others. So every time we are talking 1538 00:52:43,800 --> 00:52:45,419 about these, there are a lot of people 1539 00:52:45,420 --> 00:52:47,519 concerned about this and say, Oh, I 1540 00:52:47,520 --> 00:52:49,949 can do with some sweeping off my hotel 1541 00:52:49,950 --> 00:52:51,569 room, for example, right? 1542 00:52:51,570 --> 00:52:53,309 This is something that can help you a 1543 00:52:53,310 --> 00:52:53,899 lot. 1544 00:52:53,900 --> 00:52:56,579 Yeah. So try it out. 1545 00:52:56,580 --> 00:52:58,829 Let us know how it works. 1546 00:52:58,830 --> 00:53:00,929 And yeah, thank you. 1547 00:53:08,360 --> 00:53:09,929 Do you want to do now or after? 1548 00:53:10,950 --> 00:53:12,509 So thank you. 1549 00:53:12,510 --> 00:53:14,779 I don't know how you can try to 1550 00:53:14,780 --> 00:53:15,929 just I don't know. 1551 00:53:15,930 --> 00:53:16,919 Do we have questions? Yes. 1552 00:53:16,920 --> 00:53:18,689 Yes, yes. Questions, no questions in the 1553 00:53:18,690 --> 00:53:19,349 room. 1554 00:53:19,350 --> 00:53:21,299 Please use the microphones. 1555 00:53:21,300 --> 00:53:22,189 We have microphones over there. 1556 00:53:22,190 --> 00:53:24,419 OK, so maybe before the questions 1557 00:53:24,420 --> 00:53:26,669 who you are going to give the USB 1558 00:53:26,670 --> 00:53:29,129 as? So we are going to throw 1559 00:53:29,130 --> 00:53:30,089 it. OK. 1560 00:53:30,090 --> 00:53:32,319 This is the best way we found to throw 1561 00:53:32,320 --> 00:53:34,679 away. We came up with several ideas, 1562 00:53:34,680 --> 00:53:36,419 but this is the easiest we got. 1563 00:53:36,420 --> 00:53:37,420 So 1564 00:53:38,700 --> 00:53:40,679 we would yeah, we would throw this small 1565 00:53:40,680 --> 00:53:43,099 thing in. You can pick up the DNA later. 1566 00:53:43,100 --> 00:53:43,409 OK. 1567 00:53:43,410 --> 00:53:44,039 Yeah. 1568 00:53:44,040 --> 00:53:46,289 So yeah, the danger is, you know. 1569 00:53:46,290 --> 00:53:48,539 Yeah. So I will call this and the one 1570 00:53:48,540 --> 00:53:50,339 that gets the USB, it's going to get the 1571 00:53:50,340 --> 00:53:51,629 antenna come here and it antenna. 1572 00:53:51,630 --> 00:53:53,339 OK. Are you ready for that? 1573 00:53:54,510 --> 00:53:55,829 They're one. 1574 00:53:55,830 --> 00:53:56,909 Be careful 1575 00:53:56,910 --> 00:53:57,910 what you. 1576 00:53:59,570 --> 00:54:00,570 I think he got 1577 00:54:01,870 --> 00:54:02,870 a round of applause. 1578 00:54:03,860 --> 00:54:04,860 Yeah. 1579 00:54:07,930 --> 00:54:10,059 If if you don't want it, 1580 00:54:10,060 --> 00:54:11,619 don't sell it, please just give it to the 1581 00:54:11,620 --> 00:54:13,689 people and pick 1582 00:54:13,690 --> 00:54:15,909 up the cable, please whoever holds, 1583 00:54:15,910 --> 00:54:17,549 we have questions. 1584 00:54:17,550 --> 00:54:20,139 OK, we would start with the Q&A, 1585 00:54:20,140 --> 00:54:21,219 starting with microphone number one, 1586 00:54:21,220 --> 00:54:22,220 please. 1587 00:54:22,960 --> 00:54:25,209 Test, test and the Snowden leaks. 1588 00:54:25,210 --> 00:54:27,549 There were a kind of internal catalog 1589 00:54:27,550 --> 00:54:29,199 where one department showed off to the 1590 00:54:29,200 --> 00:54:30,699 other departments what they can 1591 00:54:30,700 --> 00:54:33,339 technically do and what the 1592 00:54:33,340 --> 00:54:35,789 amount of money is they need for it. 1593 00:54:35,790 --> 00:54:38,589 And did you look at these catalogs 1594 00:54:38,590 --> 00:54:40,719 for equivalent techniques 1595 00:54:40,720 --> 00:54:42,789 technique in the of the NSA? 1596 00:54:42,790 --> 00:54:45,119 Or didn't you look at these as a source? 1597 00:54:45,120 --> 00:54:46,899 We didn't look at that, do you? 1598 00:54:46,900 --> 00:54:48,199 No, we have no idea. 1599 00:54:48,200 --> 00:54:50,389 So we don't know if there was some 1600 00:54:50,390 --> 00:54:52,119 idea there about microphones. 1601 00:54:52,120 --> 00:54:53,499 No, sorry. 1602 00:54:53,500 --> 00:54:54,500 Thank you. 1603 00:54:55,180 --> 00:54:56,349 Thank you. 1604 00:54:56,350 --> 00:54:58,989 Microphone number two, I think 1605 00:54:58,990 --> 00:55:01,119 yes, he's hidden behind the cameras. 1606 00:55:01,120 --> 00:55:02,139 Thank you. 1607 00:55:02,140 --> 00:55:04,239 One question you talked about 1608 00:55:04,240 --> 00:55:06,129 after microphones and you said that this 1609 00:55:06,130 --> 00:55:08,289 is the technology that is commercially 1610 00:55:08,290 --> 00:55:10,419 available. But do you 1611 00:55:10,420 --> 00:55:12,489 know which is the technology which 1612 00:55:12,490 --> 00:55:14,589 is professionally used by, I don't 1613 00:55:14,590 --> 00:55:16,779 know, government agencies 1614 00:55:16,780 --> 00:55:18,800 or um. 1615 00:55:19,840 --> 00:55:23,019 I mean, does everybody use a fast course? 1616 00:55:23,020 --> 00:55:24,609 No. Yeah, no. 1617 00:55:24,610 --> 00:55:26,409 I think that nowadays easier to go 1618 00:55:26,410 --> 00:55:28,719 digital. We saw like the gsm 1619 00:55:28,720 --> 00:55:31,089 that we have here, it's much more 1620 00:55:31,090 --> 00:55:32,090 safe to do. 1621 00:55:33,100 --> 00:55:35,169 There are some limitations of the it can 1622 00:55:35,170 --> 00:55:37,449 still be detected, but it's not 1623 00:55:37,450 --> 00:55:39,729 so noisy. 1624 00:55:39,730 --> 00:55:41,829 And remember that we didn't have access 1625 00:55:41,830 --> 00:55:44,049 to any of this equipment. 1626 00:55:44,050 --> 00:55:46,329 So it's just our ideas based 1627 00:55:46,330 --> 00:55:47,529 on the pictures on based on the 1628 00:55:47,530 --> 00:55:50,289 information we find about the real cases, 1629 00:55:50,290 --> 00:55:52,059 how they are doing it. However, if you 1630 00:55:52,060 --> 00:55:53,979 look at the microphone in the in the 1631 00:55:53,980 --> 00:55:56,529 Chinese case doesn't look like 1632 00:55:56,530 --> 00:55:57,899 to advance. 1633 00:55:57,900 --> 00:55:59,109 All right. Yeah. 1634 00:55:59,110 --> 00:56:00,110 Thank you. 1635 00:56:00,580 --> 00:56:01,599 And microphone. 1636 00:56:01,600 --> 00:56:03,819 Microphone number three, please. 1637 00:56:03,820 --> 00:56:05,859 Thank you. Thank you for the talk. 1638 00:56:05,860 --> 00:56:07,989 What I really like about your tool 1639 00:56:07,990 --> 00:56:11,199 is that it can be run 24-7, 1640 00:56:11,200 --> 00:56:13,329 so that will even work or 1641 00:56:13,330 --> 00:56:15,819 detect more advanced box 1642 00:56:15,820 --> 00:56:18,639 that store and 1643 00:56:18,640 --> 00:56:21,399 the audio and then forward, it compressed 1644 00:56:21,400 --> 00:56:24,039 only when the victim is supposedly 1645 00:56:24,040 --> 00:56:27,129 sleeping or out of the a home. 1646 00:56:27,130 --> 00:56:28,239 That's a really good idea. 1647 00:56:29,260 --> 00:56:31,269 OK, thank you very much. 1648 00:56:31,270 --> 00:56:32,270 Thanks for that comment. 1649 00:56:33,340 --> 00:56:35,619 Microphone number four, please. 1650 00:56:35,620 --> 00:56:37,709 Now that now that as 1651 00:56:37,710 --> 00:56:39,789 the hours are 1652 00:56:39,790 --> 00:56:41,889 available cheaply available 1653 00:56:41,890 --> 00:56:44,049 so you can monitor the RF spectrum 1654 00:56:44,050 --> 00:56:45,699 easily what you do. 1655 00:56:45,700 --> 00:56:47,979 Thank you for doing that great project. 1656 00:56:47,980 --> 00:56:51,579 Have you thought of extending 1657 00:56:51,580 --> 00:56:53,649 it to the light 1658 00:56:53,650 --> 00:56:56,019 spectrum because 1659 00:56:56,020 --> 00:56:58,119 of the LED lighting 1660 00:56:58,120 --> 00:57:00,399 works with switch 1661 00:57:00,400 --> 00:57:01,719 power supplies? 1662 00:57:01,720 --> 00:57:03,999 So that would it would be easy 1663 00:57:04,000 --> 00:57:06,159 to kind of P.W. 1664 00:57:06,160 --> 00:57:07,539 AMD signals out of that. 1665 00:57:09,940 --> 00:57:12,069 So no, we have thought 1666 00:57:12,070 --> 00:57:14,409 about it. I think it's a good idea. 1667 00:57:15,970 --> 00:57:17,919 I'm not sure if the same methodology will 1668 00:57:17,920 --> 00:57:20,229 apply of the noise around 1669 00:57:20,230 --> 00:57:21,369 you. Probably not. 1670 00:57:21,370 --> 00:57:23,439 So I think that it's 1671 00:57:23,440 --> 00:57:25,599 possible, but we should came up 1672 00:57:25,600 --> 00:57:27,789 with a new idea about how 1673 00:57:27,790 --> 00:57:29,979 it's working as far as I know with 1674 00:57:29,980 --> 00:57:31,029 lasers. 1675 00:57:31,030 --> 00:57:33,039 You have to be in the path of the laser, 1676 00:57:33,040 --> 00:57:35,379 so the detection is not being 1677 00:57:35,380 --> 00:57:37,749 broadcast in that sense. 1678 00:57:37,750 --> 00:57:40,119 So maybe it's quite more complicated 1679 00:57:40,120 --> 00:57:41,120 in that case. 1680 00:57:42,370 --> 00:57:44,349 But but but I think there are, like you 1681 00:57:44,350 --> 00:57:46,599 said, plenty of situations 1682 00:57:46,600 --> 00:57:48,819 that we still have to go and check 1683 00:57:48,820 --> 00:57:50,919 how we can do to protect 1684 00:57:50,920 --> 00:57:52,359 ourselves in these situations. 1685 00:57:52,360 --> 00:57:53,649 Yeah, yeah. 1686 00:57:53,650 --> 00:57:55,329 Are you? You can try it out then. 1687 00:57:55,330 --> 00:57:58,419 Yeah, you you can try these things. 1688 00:57:58,420 --> 00:58:00,579 Microphone No, I hope it's five. 1689 00:58:00,580 --> 00:58:01,899 Yes, it is. 1690 00:58:01,900 --> 00:58:03,939 So as an inspiration of how to take this 1691 00:58:03,940 --> 00:58:06,249 one step further, if you 1692 00:58:06,250 --> 00:58:08,559 could manage to attach 1693 00:58:08,560 --> 00:58:10,599 the antenna to your mobile phone and run 1694 00:58:10,600 --> 00:58:13,039 the application on your mobile phone, 1695 00:58:13,040 --> 00:58:15,219 then you could make use of technology 1696 00:58:15,220 --> 00:58:17,349 recently developed or released 1697 00:58:17,350 --> 00:58:20,049 by Apple or Google like a ARKit 1698 00:58:20,050 --> 00:58:22,149 for augmented reality 1699 00:58:22,150 --> 00:58:24,579 tracking, which would allow you to track 1700 00:58:24,580 --> 00:58:26,319 where you are in the room. 1701 00:58:26,320 --> 00:58:28,689 And then you could by fuzing 1702 00:58:28,690 --> 00:58:29,690 the different, 1703 00:58:31,480 --> 00:58:33,549 different signals you received over time. 1704 00:58:33,550 --> 00:58:35,349 You could show a heat map, which would 1705 00:58:35,350 --> 00:58:38,299 exactly show you the 1706 00:58:38,300 --> 00:58:40,539 the possibility or the possible places 1707 00:58:40,540 --> 00:58:41,379 where there could be something. 1708 00:58:41,380 --> 00:58:42,849 Yeah, sorry. 1709 00:58:42,850 --> 00:58:44,769 Yeah, that would be awesome, actually. 1710 00:58:44,770 --> 00:58:46,929 We thought about like, we need a heat 1711 00:58:46,930 --> 00:58:49,029 map here, like I'm walking around 1712 00:58:49,030 --> 00:58:51,219 and I was remembering the best 1713 00:58:51,220 --> 00:58:53,499 location points and 1714 00:58:53,500 --> 00:58:54,789 I was not able to plot that. 1715 00:58:54,790 --> 00:58:56,919 So I completely agree that a 1716 00:58:56,920 --> 00:58:59,229 small location, some trying to convert 1717 00:58:59,230 --> 00:59:02,289 into these would be awesome. 1718 00:59:02,290 --> 00:59:04,299 I'm not sure. Maybe we can even do with 1719 00:59:04,300 --> 00:59:06,489 Bluetooth devices or like like 1720 00:59:06,490 --> 00:59:08,289 the VR, like you say, other like they are 1721 00:59:08,290 --> 00:59:10,329 infrared cameras. 1722 00:59:10,330 --> 00:59:12,399 Maybe now it's OK. 1723 00:59:12,400 --> 00:59:13,989 If we do that, it's going to be so, so 1724 00:59:13,990 --> 00:59:16,089 cheap are easy, but I agree 1725 00:59:16,090 --> 00:59:17,899 that it's going to help a lot on that. 1726 00:59:17,900 --> 00:59:18,489 Yeah. 1727 00:59:18,490 --> 00:59:20,469 You would basically get the only one 1728 00:59:20,470 --> 00:59:21,470 question, please. 1729 00:59:22,540 --> 00:59:24,849 OK, thank you. 1730 00:59:24,850 --> 00:59:26,859 I do not see the signal angel, but do we 1731 00:59:26,860 --> 00:59:27,909 have? 1732 00:59:27,910 --> 00:59:30,189 We do OK, so please one question from 1733 00:59:30,190 --> 00:59:31,190 the headset. 1734 00:59:32,470 --> 00:59:35,439 The internet wanted to know 1735 00:59:35,440 --> 00:59:36,440 if. 1736 00:59:37,340 --> 00:59:40,159 If you have done research out 1737 00:59:40,160 --> 00:59:42,649 or research about fact that use 1738 00:59:42,650 --> 00:59:44,719 other communication technologies 1739 00:59:44,720 --> 00:59:45,720 such as wildlife. 1740 00:59:46,910 --> 00:59:48,559 Yeah. No, not so far. 1741 00:59:48,560 --> 00:59:50,779 We we focus specifically 1742 00:59:50,780 --> 00:59:53,179 on frameworks because it was like 1743 00:59:53,180 --> 00:59:55,279 the easy 1744 00:59:55,280 --> 00:59:57,529 first step on this election 1745 00:59:57,530 --> 00:59:59,269 and we needed to reduce the amount of the 1746 00:59:59,270 --> 01:00:01,819 spectrum to something that we could 1747 01:00:01,820 --> 01:00:04,039 manage to do like in one 1748 01:00:04,040 --> 01:00:06,199 year. So, yeah, no, 1749 01:00:06,200 --> 01:00:07,919 we didn't do that. 1750 01:00:07,920 --> 01:00:08,839 Yeah, so. 1751 01:00:08,840 --> 01:00:09,769 Hello, internet. 1752 01:00:09,770 --> 01:00:11,959 But no, we use 1753 01:00:11,960 --> 01:00:13,459 GSM that is also digital. 1754 01:00:13,460 --> 01:00:15,469 It's not dissimilar to us wi fi. 1755 01:00:15,470 --> 01:00:16,519 OK. 1756 01:00:16,520 --> 01:00:18,649 I think that Wi-Fi 1757 01:00:18,650 --> 01:00:20,839 can be more difficult because you have 1758 01:00:20,840 --> 01:00:22,069 a lot of white file around you all the 1759 01:00:22,070 --> 01:00:24,349 time. In the case of GSM, you may 1760 01:00:24,350 --> 01:00:26,509 see the hopping frequency if you're using 1761 01:00:26,510 --> 01:00:27,499 hopping frequency. 1762 01:00:27,500 --> 01:00:29,809 So we we managed to detect 1763 01:00:29,810 --> 01:00:31,579 the GSM that it's digital. 1764 01:00:31,580 --> 01:00:33,949 We never try with Wi-Fi so fast. 1765 01:00:33,950 --> 01:00:36,529 So maybe that it's better for the 1766 01:00:36,530 --> 01:00:37,549 listener. Yeah. 1767 01:00:37,550 --> 01:00:39,709 And I remember the we have a like a 1768 01:00:39,710 --> 01:00:41,569 14 pages long paper with all these 1769 01:00:41,570 --> 01:00:43,639 experiments documented, so you can go 1770 01:00:43,640 --> 01:00:44,629 check it out. 1771 01:00:44,630 --> 01:00:46,129 Let us know if you have questions or 1772 01:00:46,130 --> 01:00:48,229 ideas or you can experimented on 1773 01:00:48,230 --> 01:00:50,479 yourself and tried 1774 01:00:50,480 --> 01:00:51,769 things. 1775 01:00:51,770 --> 01:00:53,779 I think microphone number eight has a 1776 01:00:53,780 --> 01:00:55,059 question. 1777 01:00:55,060 --> 01:00:56,989 Yes. Hello. Yes. 1778 01:00:56,990 --> 01:00:57,990 Thank you for your talk. 1779 01:00:59,630 --> 01:01:01,519 Is there any reason why you went with 1780 01:01:02,600 --> 01:01:04,729 the strength of a single 1781 01:01:04,730 --> 01:01:07,459 signal versus trying to reproduce a 1782 01:01:07,460 --> 01:01:09,769 tone? So a suggestion for a salamander? 1783 01:01:09,770 --> 01:01:11,569 Perhaps you omit a particular tone 1784 01:01:11,570 --> 01:01:13,789 frequency and then you look 1785 01:01:13,790 --> 01:01:16,159 for any FM broadcast 1786 01:01:16,160 --> 01:01:18,619 on the spectrum that can also 1787 01:01:18,620 --> 01:01:20,809 match that tonal frequency, not unlike a 1788 01:01:20,810 --> 01:01:22,729 guitar tuner on your Android phone? 1789 01:01:22,730 --> 01:01:24,829 Yes, yes. Actually, that was the 1790 01:01:24,830 --> 01:01:26,269 second idea to put inside a mantra. 1791 01:01:26,270 --> 01:01:28,189 So that was superglue. 1792 01:01:28,190 --> 01:01:29,629 We say, Oh, we are going to actually 1793 01:01:29,630 --> 01:01:31,819 generate a pattern of tones, 1794 01:01:31,820 --> 01:01:33,349 and then I will search this pattern 1795 01:01:33,350 --> 01:01:35,149 matching the frequency. 1796 01:01:35,150 --> 01:01:37,069 And we were super excited to implement 1797 01:01:37,070 --> 01:01:39,169 these. And then we figured it out that, 1798 01:01:39,170 --> 01:01:40,759 well, we didn't need it because it was 1799 01:01:40,760 --> 01:01:42,979 working so well that it was like, OK, 1800 01:01:42,980 --> 01:01:44,059 maybe we don't. 1801 01:01:44,060 --> 01:01:46,359 So but I agree it's 1802 01:01:46,360 --> 01:01:48,559 a good idea and I want implemented 1803 01:01:48,560 --> 01:01:50,429 or somebody implemented at some point in 1804 01:01:50,430 --> 01:01:52,579 time because it's super nice to have this 1805 01:01:52,580 --> 01:01:55,099 button and then you can actually 1806 01:01:55,100 --> 01:01:56,809 filter out a lot of false positive 1807 01:01:56,810 --> 01:01:58,729 errors. A lot. So yeah, I agree. 1808 01:01:58,730 --> 01:01:59,899 Yeah, thanks. Thanks. 1809 01:01:59,900 --> 01:02:00,969 Yeah. 1810 01:02:00,970 --> 01:02:03,049 OK, ladies and gentlemen, a really 1811 01:02:03,050 --> 01:02:05,389 warm round of applause for Veronica 1812 01:02:05,390 --> 01:02:07,579 and Sebastian from much left Mason. 1813 01:02:07,580 --> 01:02:08,580 But. 1814 01:02:26,520 --> 01:02:27,520 The.