Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/843 Thanks!
OK.
But some of them.
What can martini?
Shaken, not stirred.
Do I look like I give it them?
This was a game changer in James
Bond Casino Royale.
And so is modern technology
in modern microphone box.
Veronica and Sebastian
Garcia, both known from various
conferences like Black Hat or AK Party.
We'll tell you about the current
situation and about the current state
of microphone box.
Please welcome with the very, very
warm and applause
spy versus spy, a modern study
of microphone box.
Thanks.
Thank you.
Hi, everyone.
Out of people here.
So, first of all, thank you to
the CDC, to the Congress, to the
translation team for us is
super awesome to be here.
We're a little bit nervous, so
we are eager to show you what we did.
Yeah, I'm Sebastian Garcia.
I'm from Argentina, co-founder
of the Metzler Hackerspace.
And usually my day to day life
I work as a were
another security researcher using
machine learning in a university in
Prague.
And that's it
for I'm Veronica.
I'm also from Argentina and also a
co-founder of the Hacker Space Museum.
And my
daily job is nothing like this.
I'm a threat researcher doing
an indoor traffic analysis, so
we are here today to talk about
microphone bugs,
how to operate them and how to take them.
So we have a lot of material to
go through.
So we are really eager to
start.
So, so
spy was is by a mother
of study of milk box operation
and detection.
This is something that we start working
like. Two years ago, we were
trying to see. OK, we don't know much
about these. Probably few people know
much about these, and there is quite a
black hole in there for us to say, Hey,
we should get into that and see what the
reality for us in this topic.
Yeah, and everything started
when we have
the Chinese artist
AI Weiwei
phone microphones
hidden in electrical sockets in his
common studio back in 2015.
This was shocking for us.
I'm sure many of you heard this
story.
This was shocking because
it was believed that the microphones
were planted in his place
back in 2011 when
he was in jail.
So there were four
years of time
between the planned the devices until
he found the devices.
Four years is a lot of time for people
to hear all your life and conversations
and stories that go around your life.
So we were shocked.
Like how this?
We thought that this technology was all
and deprecated and this was not used
anymore, right?
And we were wrong.
So we start saying, well, why we
don't hear about this anymore.
So we started digging news and
there were a few other documented cases
like this in this was that had a little
political emphasis because
they found a bug in
the Ecuadorian Embassy
in London.
And of course, in these
type of cases, when you find a bug in
London, who can place a bug
in London, right?
So it was had like strong
political implications.
But these cases,
it's not the microphone bugs are not used
anymore, is that people just don't
speak about these freely.
So the documentation and
information available around these
type of things is not freely
available.
Another thing is that
it's it's very
it's very hard to actually know that you
are back, right?
So it's very
critical, you know, and even if you find
it, most people maybe not telling
others that they were bad.
So the information is the scars and
scars every time there are few cases
that are probably Kabelo.
Like this one?
Yeah. And we were we were thinking at
this point, OK, what do we know about
microphone bugs?
And we found that most of the things
that we know is from movies
and TV shows.
And when your information comes
from movies and TV show, that's not very
nice, right? So we started to dig more
and more. So we want to do this
like a formal research, like
a study was possible.
So we started as every
research staff with kind of
what it was done before.
What information is available from the
past? And we did like, OK,
take the last hundred years and say,
what was the injury kind
of highlight some of the cases that we
found interesting. Of course, there are
hundreds of them.
So these are some of
the ones that we like the most.
This one was invented
in Russia.
It was called the Great
Silver, or at the time, it
was known as the thing.
You know how much people knew about it is
that they call it the thing.
It was very interesting case because
it was planted in the US Embassy
in Moscow, and they took
seven years to find it
because it was planted in plain
sight, just in a room.
There was there was a gift for the
embassy, so they put it there on the
wall, right?
And it was found by accident
because some people was
some person that was listening to
the radio phone.
The actually he was hearing
conversations that were coming from the
embassy, but he was outside.
So he was like asking what is going
on? So they started investigating and
they found this.
So when they opened this thing
where they opened the thing, they found
that there was no battery in there, only
the microphone and some pieces
of electronics.
So how did it work if there
was no battery, if it was alone
in the embassy for seven years?
Does anyone here have any idea how this
mic work at the time?
Anyone want to shout?
So just just short.
What do you think, huh?
Why exactly, right?
Why do these energy? So thank you very
much. So the idea was that somebody
from the outside was a meeting
electromagnetic energy frequency
right into the embassy
in to the thing
powering up the thing.
And then the thing was there
capturing the sound, converting this into
electricity, modulating frequency
antenna and transmitting back.
They called these illuminating
the embassy row.
They were pointing electromagnetic
frequency. So
yeah, the people between these
inside this information, Adrianne didn't
feel so happy at the time.
So you can see that this is like NFC
near field communication technology, the
same that we are seeing now.
You transmit some energy wireless.
OK, maybe it was not near field.
Maybe it was very far away field
communication, but it's the same idea.
So the technology is not new.
It was the first time that we saw the
word using it like that.
Yeah. So after they found these
Americans, of course, took the idea and
they created something very similar to
those called Sahitya.
It was just a copy of these, and this was
after the Second World War.
Nineteen forty something.
So.
And this was kind of novel because it
didn't require energy, right?
But a few years later, the
transistor was invented, so
things started to shrink, and that was
a technological advance
on the field.
And one example of these is the
KGB bug.
It was these generic as we founded
it. You can see that it's really
small only seven centimeters long.
It has like two pins on the bottom
where it was a power supply, one pin in
the top for the antena.
The small screws
on the middle were for
tuning the frequency, so that was also
innovative and the small size make
it really portable.
You can see there the the number.
We thought it was the serial number,
which is pretty
large, but actually somebody told us that
the first two numbers was the year.
So that's supposed to be from 1964.
Yeah. So this was not
the only thing small that was amended
in on this
this date.
This was a Model Y
five seven four eight.
This was invented in Czech Republic
or the All Czechoslovakia.
It's a modular microphone, so it was
very novel by the time.
Every little cube have different
functionality, so you can assemble it
in with different combinations.
And it's my kids have like
functionalities like one of them
can be going home, whatever that means
at the time.
So it was it was kind of very
clever, and we found a magazine that
all magazine that explained how it was
used. And you can see here that they
made a fake wooden box where
there was a microphone and then the the
pile of batteries that
it needed to to borrow it up, and
it was placed under the table.
So how many of you would check under the
table like daily?
Yeah.
Oh, you're right around round.
So this can go undetected
for very long.
It was. It was very clever.
And you can imagine how many of these you
have to use to start making the modules
right, like object
oriented spying or something like that?
Yeah. So another
device that was very interesting
because all these different microphones
and we will see in the future
presentations that it's a problem
is how you power these
microphones to last very long time,
right? And this was a
very nice call topic
is because of the it was our
phone in the offices of the opaque
Organization for Petroleum, something
it was found in Austria in the 70s.
And if you pay attention to the image,
does it have been for power supply?
Right.
So it takes
a very interesting twist and this
is a microphone that you place
near electric wires.
So it's part of that by induction,
electrical induction.
So you it makes it really
interesting because you can't just put
it in the wall and
or near electric wires and you know
where they are.
And it will stay there as long as you
want it. So it's very clever ways.
Yeah. Again, NFC in another way, but
super, super interesting twist.
Yeah.
So this is from an old magazine from
the 80s, and the idea here is to give you
a hint of how many ways there they are to
spy people by using
the R in in a room
like these. So there are plenty of those.
The technology is these are super old.
You can see that they are, yes, using the
telephone, but also microwave
and also monitoring the typewriter
key. So this one now it's
called back monitoring typewriter
key sources call keystroke dynamic
in the area.
They were doing that, which sounds
a long time ago, and you can have also
from the windows, really dig team
frequencies in there.
You have also all the places to the
microphones that we are going to study
today.
So this is all, but there are plenty of
ways of doing this, including there the
laser pointing in the window
from the 80s right
now and on all of these or many
of these who are trying to solve the
power supply problem, right?
So the typical uses is in
our inside phones or
in the electrical sockets.
Why? Because you need like you have free
constant supply, also with
alarms and so on.
These are typical locations
using the bathroom still now, right?
But this is this is kind of all
technology.
Right now we see technology advanced,
right? And we went to
why put the microphone in
your in your home if you
can in fact, your phone with malware
and I know the phone will be with you
all the time and they can listen to all
your conversations.
So every feature is one of the
default fault. Let's say most use
malware for these.
It was very well documented different
cases, but also
there were right now other
clever solutions like lasers.
Yeah, and this is new technology that
they are ready. They are pointing
laser to mist in the air.
So water molecules in the air floating
on while you are talking and you are
close to dismiss, they're pointing a
laser to that and they can
then hear you bug.
So there are a lot of new things that
are going on, but we are going to focus
on,
yeah, we are familiar with malware are.
But the fact that a
person was for years had
the microphone in their home without
detecting it. That was something that we
thought that we needed to focus instead
of this right.
So we wanted to get our hands on the
technology. We wanted to try it on.
We we read some stuff.
We wanted to prove it for ourselves,
how it works, how it sounds, how, how
was the audio quality and so on.
So the spectrum of different microphones
is huge. So we wanted to focus on
something concrete is like a baby step on
the research.
So we focus on FM and GSM
commercially available microphone
banks. But the also they
are wireless and they are also
stationary. That means that they are
microphones designed for
two to be put in place and
be left there, right.
You put it on the electrical socket
and you just leave it.
So there are other type of
microphones that do not fill this
characteristic. So we focus try to
reduce this gap somehow in this
direction.
We started looking in typical ways
Amazon, eBay and other sites
for microphones.
This is one of the first one, the
f nine hundred and eight.
It's very small.
As you can see in the video,
it has a
plastic case.
It has the four four
power supply, a normal battery,
but it has a very long
antenna.
So all these movies that yeah, let's
let's have a microphone.
They just put it there.
Well, you still need to hide Antena
So.
So that was is
a very interesting model.
We we tried to buy.
We have a limited budget, so we tried to
buy like different models that
have some differences.
And this one was around $33
US dollars, and it
has an advertised range of 500 meters.
Another model was this micro.
It was. We wanted like the
smallest thing that we can find
these works in the same range of
frequency. Same power supply
is called for full price.
Those in how the case battery.
But you can see there
that there is a microphone,
the socket for the battery and also
the very long antenna.
And this is the microphone you can see
that is really small, but
you need to put the battery, which
is this big, right?
So it's not that big, that small anymore.
You just have to hide the whole thing.
Another example that we bought
is that one this
is very similar in this has
for adjusting the frequency as well.
The same range is.
US dollars.
The only thing different is that he has
like this cable for putting
the battery, which is
is a bit easier to kind of place
it on, Heidi, because you can stretch it
a bit more.
It has also a very long battery
antenna.
We wanted to also find things
OK, this trim. All those were models
of microphones designed to be like
spy microphones, right?
And we started the thing what kind
of devices could people normally
have in their homes that can use
for spy microphones?
So we found this.
This is the way to be.
Why throw for
these are baby monitors that work
on a FM frequency
for some reason.
This is where the thing is is more
expensive. The frequencies Kiger
800 800MHz and the
advertised range is 800 meters
because it seems that it's kind of
common just to leave your baby and to go
10 blocks away.
So I'm not sure what.
It's like that.
So we wanted to also
try somebody and we bought
this mini.
A eight is a
GSM microphone,
so it has a place for a SIM card,
has a battery in there,
has cost like $10
and is GSM.
So you can call from anywhere in the
world and you can listen to the
conversations where the
microphone is planted.
And also you can configure
it for to
automatically detect a conversation
when it hears noise.
It will automatically call you back
and you can
respond and you will hear what is going
on. So it's
very clever. It's a small,
but these are different technology, so
it's not FM and the diction
is different
and this is what is a huge advantage.
You so you can put it anywhere in
the war and call that it's quite
improvement in range.
And also you can actually
wait for somebody to make some noise.
So this is a totally different
way of listening to others.
Yeah.
So this
is kind of a summary of the comparison
of the different models, the
the three from ones who work in the same
kind of frequency.
The the baby monitor
works in a bit different frequency, but
it's kind of the same.
It has more range advertise
and you can see the difference in prices,
this kind of commercially accessible,
right? So
the next step was let's let's
try to hear them right?
Let's try to to see how
it actually works.
So we started doing experiments of
listening and we
knew we were doing this in
a normal neighborhood and we
found that there was actually several
blocks away. You could hear perfectly.
The microphones of these
are typical movie that there
is a van in front of of your home
hearing that's not needed.
Actually, you can hear from three hundred
meters away and it's perfectly
fine. So that was that
was very interesting.
The first experiment
on Yes, yes, I know the microphones were
having this feature I saw usually either
need to be less than 100
meters away like this is perfect hearing.
Unless you are inside some ion box.
There is, there is no need for that.
Yeah, of course.
The more buildings that are there, maybe
the audio quality differs, but is
actually perfectly fine.
So we wanted to do, as I say
in the in the in the beginning, as
photo as possible.
So we documented all these experiments.
Is everything all these tables are in
the paper you can read later.
This is one of the experiments where
the the the bag was
stationary in one place and the
receiver was 200 meters away
and getting closer.
So we were recording the audio quality
and most of the in most of the cases,
it was very good quality.
And also in the
I think the best case was where the
distance was 15 meters
and the person was five meters away.
But even with 200
meters away, it was not that
big of a difference.
So that was very interesting for us to
find out like a first
field experiments.
We forgot the beagley at the beginning
of the bigly to see this light.
No.
So, so super fast.
But we forgot. If you go to that link at
the beginning Bit.ly slash spy
34C three, you will see the slides
in your computer moving with
us so you can actually see click.
Copy the images and everything.
Better than your hero.
Sorry, forgot.
OK, so.
The so based
on these first experiments of only
listening, right, we
started on their sound more like these
are some geolocation remarks
rhetorically interesting because
an attacker needs to be close.
Right. And this is good for you, and
it's also really right for you for
several reasons.
First is good for you because it filters
your kind of attackers population
you. And it's not that anyone in the
world can attack to you, right?
Is the the attacker, and you have
to be sharing the same kind of physical
space or city or neighborhood.
So that's kind of good for you.
They they.
Is that for them that they need to be
close because you have more chances to
kind of spot them like suspicious
behavior.
But it's also bad for you that they are
close because they are physically
close to you, right?
They is.
It's a it's a different kind of
threat.
Yeah. So this is this
is not good.
And with other types of threats,
eavesdropping threats like malware,
infections, anyone in the internet can
help you, right?
But in this case,
you need to have people that people can
that kind of help.
You need to be kind of also close
geographically.
So that's not very good for you.
Another remarked, We
try to do a better
job of autonomy. Validation from
the different devices have types
of other iteration.
For example, the micro spy
has advertised about three hundred sixty
eight hours.
We tried it to leave it there
and is, in most of the cases, is it
was lower than advertised.
The only two cases are true was accurate
was that one was
around 100 hours and
the GSM one, which was
two hours.
That is really small
time. Even the hundred hours is really
small. Imagine that when the water is
out, you need to come back and just
changed the weather, so you need to have
physical access to a place.
And that gets things really complicated,
you
know, and this is related to how you are
targeting your operation if you want to
put the microphone.
You have to know where and what you want
to listen, to whom it which place because
your window of opportunity so small.
So this is giving you an idea of, OK,
what can you do with each microphone?
It's not that you can't just use any
microphone, right?
Yeah, exactly.
We want that because we work in our daily
sort of working analyzing malware.
We wanted to make some notes.
On the whole, this is different from
malware. Why would I choose malware
to infect your phone?
Or why would I choose to place a
microphone?
And when you try to infect someone
with malware, imagine that you don't have
physical access to a phone.
You have to
plan a phishing campaign, you send
a link to somebody, and
the successful infection
is not warranted.
The guy might click on the version of the
operating system might be wrong or
something happened, and the infection is
not successful.
And also, you cannot choose the time,
right? Like, yes, you are trying to
infect somebody, but you never know when
it's going to be infected can be today,
tomorrow or in a week.
And actually, there are a lot of
casualties around like they are not the
people you wanted to infect.
So it's not straightforward to do
this.
Yeah. And also, when you find the
malware, right?
Imagine that you are analyzing some
mobile devices and you find a malware.
You can you can analyze the
malware and you can reverse it.
You can find the malware leave traces
right? And then you can use that to
know who the attacker was
ideally or have some
idea.
Well, you know that something happened,
right?
Because the same thing happened in the
case of the microphones.
If the operation was successful,
you can go there, turn the microphone to
stick it out, and there is no trace at
all. You didn't know it happened.
So that was kind of
big differences.
And also, people
from the internet, as we say before, can
help you with malware.
We did that with the microphones.
It's not that easy.
So a big warning
here like we are trying to think about,
which is the difference between these
commercially available microphones and
the not commercially available
microphones.
We don't have access to these, not
commercial microphones, so we really
don't know how far away they are in the
technology of microphones bargain
right now.
What ideas are that?
First is the choice between electricity
or battery.
So if you want to listen to a specific
conversation, maybe with water, you're
OK. If you need to reset everything
that it's been said for a long time,
then you need to plug to electricity and
these constrained interruptions a lot.
And then we have a problem with the
transmission or storage.
A lot of microphones, if you look
at the OK, so we we don't know
what happened with the microphone, that
was fine, but
I way way. But if you look at it,
it looks are there are several modules,
there is antenna and the battery and the
microphone, and there is another box that
may be historic.
We don't know, of course.
So the idea that you can store
the audio in the car or
something like that?
So this is good because you are not
transmitting so you are less prone
to be detected.
However, you have to come back and
get the SD card. So depending of your
availability to get into
the premises, you can use the storage
or not. There were versions of
microphones that were having the
microphones inside the room and
then a cable to the module
that was transmitting like from 50 meters
away. So this is like a hybrid
option, right? You have the microphone
you are transmitting in real time, but
from the room there is no
detection of these transmission.
And then it's the thing of, OK,
there is a one time conversation,
we said, or versus, I want to listen at
all. And finally, how much access you
have to the room. So the opinion of this
body will cease your peak between
may be OK.
This is something I can do with the
commission available or
this is something that maybe some people
can do with the not commercially
available microphones out there.
Yeah. And one thing that is
important to keep in mind is that when we
think about microphones, at least
when I thought of microphones like two
years ago, I
the first thing that I thought it was
governments, right?
Governments putting microphones in your
home. But actually, all these
commercially available microphones are
not used by governments.
They are used for intellectual
espionage wives
or husbands trying to find if the other
partner is cheating on them and all
these type of things that there is like a
lot of variety of usages
that goes around these
these technology, and that's why all
these type of things come into place.
Hmm.
So right now, we are heading into
the part of the presentation that we will
talk about detection.
But please, if you really
are in a life threatening situation,
we we recommend to
just conduct like a professional company.
Where do they do professional swiping
soft devices and they do this for
a living, right? So just
be mindful.
So yes, there are a lot of companies
that are actually doing this for a
living, and they're very good.
The problem is that machine that you have
some suspicion that maybe somebody
is bugging you.
You may call one of these companies,
but then the other day you have the same
suspicion in your office or your room or
your car.
So it's not easy to call them.
They work can take up to 10 10 hours,
which is a lot, and it's super expensive.
So the problem we saw is that there was
no room in the middle for any
quick tool that you can use and
adjust. And how can you be to
modify to make the your
everyday detection in any place you will?
So this is why we created the salamander
salamander as a free software to
each SDR base,
software defined radio base.
And you can't go there, you can download
it. And the idea of salmonella
eat to make the detections
of hidden microphones around you easier,
something that you can go download
plug this year.
USB have some detection around
you and then you have some idea of what's
going on.
The other problem is that if you buy one
of the big hardware equipment for for
a spy microphone detections, it may
be suspicious.
If somebody is looking at you, they will
notice that you are buying this, which is
telling them that actually, you know
that you are B&O, which is bad for you
again. So the less they know
and the more you know, it's better.
In this case, it's just a software.
You don't know the USB and you
have an idea of what's going on.
So this is the type of device you are
using is very well known as
the basic device.
It's a TV tuner that you can buy from
$10 online,
and a lot of people has been using it
for years for SDR.
So we are using one of these devices.
Like this one, I mean, here is the same
on salamander isactually
in the background, using a tool that is
very well known tool called Ertel
Power. Each one of the tools that is
reading the information coming
from the USB device, and it's converting
these into power levels, and it's giving
you from a range
of frequencies, the power
levels detected by the
power tool.
So Salamander is reading these power
levels, and it's working with
these four detections.
So which is the basic idea
behind salamander for detection of hidden
microphones?
It's taking the power levels.
In this case, you have here normal FM
radio. This is the transmission, the
frequency where it's transmitting and
it's taking these
peaks and it's actually connecting
them. So when you
plug a microphone, you will see these.
So you can see that there is much more
noise in the frequencies.
And also you will see that there are a
lot of peaks around.
This is because you are usually close to
the microphone. So the closer you are
to the power source, the more spurious
frequencies you will find, the more
noise around and you
will see other frequencies
being also having this peak of
power. So if you move away
from the microphone, you will see that
these frequencies are going
down and there is only one frequency the
frequency which the microphone is using
for transmission.
So we are using this idea
and counting this noise
in a sense to know how close
or far away you are from the microphone.
So in here, this is an idea
of putting a threshold that hits
the blue line.
And then we are counting how many peaks
are over this threshold.
This is super basic.
Idea is not a new idea, probably,
but it's a very simple way
of reading very fast, a huge
range of frequencies.
And finally, if you are closer
or not to these sorts
of power frequencies,
this is helping us to split
and separate between the FM radio
station. That is super powerful, but it's
far away against the microphone
that is super small and less powerful,
but is close to you.
So we run several
experiments because US
research background that we have,
we wanted to know, OK, which is the best
threshold for these?
So this David is showing
the first two thresholds.
That means the high
off the power level that we want to
detect. That is the first column on the
second column is the amount of peaks that
we are counting.
OK? These two values are
the values that we are modifying
to know how good or bad
it's the detection.
So we run 85 experiments
with different microphones, different set
ups, different thresholds in different
situations and scenarios.
Rooms train in the street.
And then we count.
OK? There was a microphone.
Did you detected?
That is a true positive if there
is a detection from the tool, but there
is no microphone, that is a false
positive.
Right? And then if there is no microphone
and I'm not detecting it, I'm having a
true negative in there.
And if I'm
saying, Oh no, there is no microphone
and the race, in reality, there is
clearly false negatives.
So we count these errors and then
we compute some numbers.
We call the metrics to know which is the
best detection, right?
So the third column, we call it the f
measure ratio.
This is a balance between the accuracy
and the precision.
And then we have the false positive
rate. This a ratio of how many
times you said, Oh,
it's positive, very said detection.
And actually there was not a microphone.
And then the accuracy, the procession and
the ratio of true positives, the Times
said. You have a good detection.
So we count all of these and we
found the best solution for
us to compare.
We also bought this tool that
is called the ghost.
This is a hardware detector.
You can also buy online for very,
very small amount of money.
And this tool that you can press a button
and you can see that there are
microphones around you.
So it's one of the
easiest way to have some also some
hardware tool to help you.
So we were comparing salamander
with this tool.
This is the line you can see there the
ghost. This is the performance of the
ghost. And this is the performance of
Salamander.
So the best setup for us is the last
one where we have some 73
percent of measure.
This is pretty good and you have 11
percent of false positive ratio.
So this means that we lose some
microphones. So there were situations
where we say, Oh, there's a microphone,
and there was not, and there were some
situations where we say here,
if if measure OK, here,
right? There were some ways to say, Oh,
I think that there are no microphones
around me and actually there were.
So this is showing that no tool
is perfect.
And you should modify the values until
finally whatever is best for you, right?
So this is not perfect.
There are errors.
You will have situations where you are
not finding the Microsoft with any tool
and you will solicitations where you will
say, Oh, there are a lot of bugs around
me. And there are none.
Even with a hardware one.
So the good thing about salamander is
that you can keep on these parameters
and then you have a better detection.
And actually, you can find the pseudo
percentage false positive, which means
that there were no no errors
if you want, right?
So you sing Solomon.
This is an example.
Let me show you salamander
a running.
So one of the good things that
we thought about salamander was that in
the detectors cover detectors like these,
like the ghost, you need to be pressing
the button in order to be able to
have an addiction or not.
And you cannot just be pressing about
them all the time.
So the this
type of software is making that you can
leave it running and then you just
go to work and come back and try to see
if there is a difference or not.
Mm-Hmm.
So you hear this is a basic interface of
salamander, and now it's running, it's
running in some frequencies.
And now there are no detection.
And then this is the first one I was
showing you. I'm going to apply it to the
to the battery.
And now this is powering on.
It's taking my voice is converting into
the dam, the antenna frequency
in transmitting around.
And then here I have plug the
the
antenna off a USB device.
And there you can see that there is there
are some deductions already, so you can
see that there
is the time of detection, there is the
frequency 113 megahertz
and then those
sharp symbols.
He's telling me how many of the peaks
are in the frequency that I will
detect. So you can see there that there
are more and then there are less
right, which means that I'm closer
to the source or I'm farther away.
Right, you can see there, there are more
of them, more of them.
And I'm more in a way.
There is a time delay, of course, in
there until there is
no more detection because I am so far
away.
So, yeah, so this also
brings a problem that is not that you
just go into a blaze and put the
microphone right. You need to think of
all the interference of devices that are
there and it's like really
complicated.
So the good thing
about China, Mundra, is that you can walk
around and you can see what's going
on all the time continually and
you have recorded so you can go
and see, Oh, there is some frequency
here. I don't like because
you have devices at home, you have device
and you have radios and you have phones,
so you have a lot of things going on.
So it may happen that in some situations
you are picking another frequency, right?
So yesterday, for example, I was walking
around and trying to see what's going on
if I walk in there in the Congress.
And actually, I was surprised that there
were no detections or salamander was not
picking up any microphones, which
is good.
And then I started
having some detections in the
frequency of 400 something.
This is usually used by the
radio people that is speaking with these
radios. So say, Oh, somebody is speaking
actually, so I will try to see what's
going on with these. So I keep walking
around and actually start to try to
find them, right?
OK. Where are they?
So I was walking around until I was close
to the place that they were transmitting
because I can see the amount of
noise they were generating.
So in a sense, this can be used to
pinpoint any type of
a meter. But we are focusing,
of course, in there in them
hidden microphones.
So what's going on?
Why salamander is different to others.
First, you can walk around, you can find
different places.
You can do it for a long time.
You can leave it running during the
night, for example, which you cannot do
if you are pressing the bottom of the
hour. The doctors you, you don't
have to be there doing it, so
you can detect.
But more importantly, and this is super
new because we don't know any tool that
was doing this before.
You can locate microphones,
detection tools that are a lot like
Category one software.
I don't know anyone, any tool.
But more importantly, this is the first
time that we saw a tool that can help
you locate.
So of course, what we are doing here
is some kind of
translation from the amount
of peaks in the frequency to the
distance, which is not accurate.
Of course, these are not matters are
centimeters is just an estimation.
But these helping, you know if you are
far away or not.
And second, the idea is that you can
use earthly power to actually
store the audio
profiles in these power levels.
And this is a file so you can send
these to anyone in the
internet to help you.
We'd send a man or not to see if
you have a mic at home and this is
something very new.
You can't do this in any room
and then send the file to other people
that actually can help, you know, if
there was something, we are wrong.
And finally, you can provide
your environment.
You can take a measurement today that
you know there are no bugs and then take
it tomorrow or in the night or in a
special situation.
And then you will see the differences
because remember that you have the TV and
the telephone on your neighbor's
phone. So if you know
your environment, you will
notice the differences.
OK, so a
real Real-Life experiment?
Yeah.
So again, we wanted
to make this research
fun for us, not only like
all these experiments and
numbers.
So we wanted to try them out and
to to kind of
design experiments like, OK, let's
think that one of us is the
big team and one of us is evil.
So I will be the evil one planting
devices. I think you will have these
salamander, those trying to dig them.
And so the methodology of the experiments
were something like this the
the seeker that is in
this case of us.
He will go out of the room and
I will get in and I will hide a
microphone or not.
Right?
And then he gets seen.
He starts speaking some buzz words.
Not the real ones.
Or or yes,
key words, right?
And I will try to be listening
to these to try to make sure again,
like the accuracy of the words and the
listening quality.
And then we will measure two things.
The first thing I will measure the time
detection, which is do I
know if there is a microphone here
or not? And then we will measure
the time to actually find the microphone
that was hidden so
that that is two completely different
things, right? So we were we wanted
to know how hard it is to
actually find them.
And then we will measure what we call the
recall, which is he
mentioned a certain amount of passwords
are critical words.
So I will try to write
them down. And then the recall is the
amount of passwords that I heard
over the total passwords that he is
spoken. So we going this way we can.
We have some measure of how to compare
these experiments.
We did several like this.
And here is a small table comparing them
in the in this case.
In all the cases, we were hiding
microphones and we were
finding them, which is good, wouldn't
use the time to detect
was all in
almost all cases like really short,
like in a matter of minutes, you can save
with a certain level of
certainty that there was a microphone.
But you can see the difference between
the detection and the time to locate
them. It was like kind of
takes far more time to actually
find them, right?
And we also made sure
the recall, as we saw the
the amount of password spoken
over the passwords that I could listen.
And this was in only
one case it was 100 percent
in all the other cases it was some of the
passwords that I could listen properly
were very low compared to the
password spoken.
And you can see there that there is one
experiments. I took 25 minutes to look
to detect and then
we found at the end that actually the
microphone was running out of battery, so
it was not transmitting all the time.
It was super frustrating.
I know that they've shown like no
location. Even the Gos was not
detecting it.
And then at the end, there was support
among a
frequency energy going out of the
microphone signal and salmonella
detected. So there was a detection 20
minutes after that.
No location or I was not able to find
it because he was put off because,
yeah,
so
sorry. And you can see that there were no
bus or listen there.
So I was saying passwords.
But but there were no
password being listening, which is super
good for the for me in this case.
Yeah. And you can see how
this does make it difficult for the
passcode. The other thing or the great
seal, it was not emitting anything.
You can actually help fight it because
it's not admitting anything.
So this is
this was very nice to compare
and hit on some pictures of the
best locations that I found to
hide the microphones.
This was actually from
the example of the Czechoslovak bug, so I
hid it under the table.
It looks like really long to find
it was kind of the last stone
left in our place.
We were almost Sebastian
was almost starting to kick off the wall.
So it was very fun
and it was it was very interesting
to see the
two understand. Like the logic of the
people were the typical places where
you go to search on the other places that
you just give for granted that there is
not there
because the signal is bouncing around.
So the problem is that you may have
good detections in two places
in the room.
So it's super easy to say, Oh, it's here
and start breaking everything apart, but
maybe it's not there.
So it was so difficult to come down.
So, OK, this is the place I really think
it's here and then searching around you,
right? So detection, it's almost one
meter around you.
So it's actually a lot of places
if you think about it.
OK, five minutes, yes.
So another
place that was very, very hard to find
was this one.
OK, so so we're going to ask, do you know
what is the microphone in there?
It's a white board issue.
Yeah, it's a white bar.
And this was
this was very interesting because it had
like a little thing that you're you can
open.
There. So it was very fun because
it took forever to find and
it was it was very fun
to see people searching
for it and not finding it because it was
again just in front of people's eyes,
right? It was very clever.
Also, you were in front of a white, but
it's a very nice location because the
people is having dogs in there, right?
Yeah, maybe very interesting
dogs. So confusions
hiding microphone
in my experience was very hard because
it's not that you hide it in the bathroom
or in the kitchen, right?
You have to know your target.
You have to have physical access.
You need to know where the camera's
important conversations happen, right?
So and what what is what
you want to find out?
So you also need to solve the problem
of the power and you need to understand
the behavior of the people.
Yeah.
And even if you have some locations that
you want to hide, remember that yes, you
can put it underground and nobody
will find it, but you are not going to
listen. So the location
is super hard because you need
to listen and not to be found.
So this is something that it was
very, very hard.
I was moving around half of the
house and I was not able to find
for a long time.
Yeah. So the dog with
salamander is really fast.
You can see that it was a matter of
minutes and listening was hard.
I think we have some examples here.
Yes, we can quickly play.
So yeah, we
do have audio.
Yeah.
You should have.
No, we have that audio from the computer.
Thank you.
So this is where the music we are trying
some for music in the background
so
that they would be learning about what
we were going to find
out.
Yeah.
So so you can see how
it was kind of you can hear the voice
and you can see that someone is talking,
but you can hear the music as well.
But in and it's believed
that 50 years ago, putting radio
and then speaking was a
technique to kind of not making
people not able to listen to you.
But with current technologies, this
doesn't apply in any longer.
So we ask a firm in
Belarus to help us cleaning this
audio with the computer.
Because he's much more cleaner.
Right?
Both.
No music,
no.
The movies like
Away.
I think the fans,
OK, so
yeah, so basically the point is that you
can kind of really quickly
this was half hour work
and it's really easy to completely
remove the music, right?
So it's not that you should
not put music about this.
You should not believe that music will
cover up for you because it's that's not
long.
Imagine if you have resources and a
larger organization, this is very easy
to do, right? So don't trust any noise
around you to do this.
Yeah. So Harvey McAdoo,
sorry.
There you go.
Yeah.
So we believe like for
closing this up.
We believe that these are work.
I have like three key contributions.
First, we
did our systematic research on their
usage and performance of these bags, and
we haven't seen any other work doing
things like this. We hope that after
this talk, you just get your
idea and you try to do stuff like this
with other models. Maybe I don't
know your grandma has a microphone that
store somewhere so you can try it out.
We have the first year base
detection to youth
use is available on GitHub,
and we have the first
real life experiments documented
that can be used to compare with
other technologies and you can use
to actually learn and compare
with other things.
So before concluding,
Yeah, um,
I want to say that we are going to give
now to the people here.
We have one as the Eusebius
here that is for you.
So now at the end of the dog, we
are going to give it to somebody there.
So be prepared for that and
remind us this is for you
a second.
Can can you give us please the
microphone? So what are there?
So so yeah, they are spying
microphones, but we want them back.
So I remember to bring them on
to conclude, we can say that all the
eavesdropping is a real threat.
Don't be fooled here.
Yes, it's not straightforward.
Yes, malware is easier.
In some ways this is still happening in
us, happening as far as we know.
So be be aware
of the threat.
Now you know how at least commercially
available microphones work, so you have
any idea of what can be done and what
cannot be done. This is important for
your protection.
And then be sure
that you are taking the measurements to
protect yourself. So go there.
The notion of salamander helped modified
quite fine microphones.
Tell us about them, advance
the field and try to help
others. So every time we are talking
about these, there are a lot of people
concerned about this and say, Oh, I
can do with some sweeping off my hotel
room, for example, right?
This is something that can help you a
lot.
Yeah. So try it out.
Let us know how it works.
And yeah, thank you.
Do you want to do now or after?
So thank you.
I don't know how you can try to
just I don't know.
Do we have questions? Yes.
Yes, yes. Questions, no questions in the
room.
Please use the microphones.
We have microphones over there.
OK, so maybe before the questions
who you are going to give the USB
as? So we are going to throw
it. OK.
This is the best way we found to throw
away. We came up with several ideas,
but this is the easiest we got.
So
we would yeah, we would throw this small
thing in. You can pick up the DNA later.
OK.
Yeah.
So yeah, the danger is, you know.
Yeah. So I will call this and the one
that gets the USB, it's going to get the
antenna come here and it antenna.
OK. Are you ready for that?
They're one.
Be careful
what you.
I think he got
a round of applause.
Yeah.
If if you don't want it,
don't sell it, please just give it to the
people and pick
up the cable, please whoever holds,
we have questions.
OK, we would start with the Q&A,
starting with microphone number one,
please.
Test, test and the Snowden leaks.
There were a kind of internal catalog
where one department showed off to the
other departments what they can
technically do and what the
amount of money is they need for it.
And did you look at these catalogs
for equivalent techniques
technique in the of the NSA?
Or didn't you look at these as a source?
We didn't look at that, do you?
No, we have no idea.
So we don't know if there was some
idea there about microphones.
No, sorry.
Thank you.
Microphone number two, I think
yes, he's hidden behind the cameras.
Thank you.
One question you talked about
after microphones and you said that this
is the technology that is commercially
available. But do you
know which is the technology which
is professionally used by, I don't
know, government agencies
or um.
I mean, does everybody use a fast course?
No. Yeah, no.
I think that nowadays easier to go
digital. We saw like the gsm
that we have here, it's much more
safe to do.
There are some limitations of the it can
still be detected, but it's not
so noisy.
And remember that we didn't have access
to any of this equipment.
So it's just our ideas based
on the pictures on based on the
information we find about the real cases,
how they are doing it. However, if you
look at the microphone in the in the
Chinese case doesn't look like
to advance.
All right. Yeah.
Thank you.
And microphone.
Microphone number three, please.
Thank you. Thank you for the talk.
What I really like about your tool
is that it can be run 24-7,
so that will even work or
detect more advanced box
that store and
the audio and then forward, it compressed
only when the victim is supposedly
sleeping or out of the a home.
That's a really good idea.
OK, thank you very much.
Thanks for that comment.
Microphone number four, please.
Now that now that as
the hours are
available cheaply available
so you can monitor the RF spectrum
easily what you do.
Thank you for doing that great project.
Have you thought of extending
it to the light
spectrum because
of the LED lighting
works with switch
power supplies?
So that would it would be easy
to kind of P.W.
AMD signals out of that.
So no, we have thought
about it. I think it's a good idea.
I'm not sure if the same methodology will
apply of the noise around
you. Probably not.
So I think that it's
possible, but we should came up
with a new idea about how
it's working as far as I know with
lasers.
You have to be in the path of the laser,
so the detection is not being
broadcast in that sense.
So maybe it's quite more complicated
in that case.
But but but I think there are, like you
said, plenty of situations
that we still have to go and check
how we can do to protect
ourselves in these situations.
Yeah, yeah.
Are you? You can try it out then.
Yeah, you you can try these things.
Microphone No, I hope it's five.
Yes, it is.
So as an inspiration of how to take this
one step further, if you
could manage to attach
the antenna to your mobile phone and run
the application on your mobile phone,
then you could make use of technology
recently developed or released
by Apple or Google like a ARKit
for augmented reality
tracking, which would allow you to track
where you are in the room.
And then you could by fuzing
the different,
different signals you received over time.
You could show a heat map, which would
exactly show you the
the possibility or the possible places
where there could be something.
Yeah, sorry.
Yeah, that would be awesome, actually.
We thought about like, we need a heat
map here, like I'm walking around
and I was remembering the best
location points and
I was not able to plot that.
So I completely agree that a
small location, some trying to convert
into these would be awesome.
I'm not sure. Maybe we can even do with
Bluetooth devices or like like
the VR, like you say, other like they are
infrared cameras.
Maybe now it's OK.
If we do that, it's going to be so, so
cheap are easy, but I agree
that it's going to help a lot on that.
Yeah.
You would basically get the only one
question, please.
OK, thank you.
I do not see the signal angel, but do we
have?
We do OK, so please one question from
the headset.
The internet wanted to know
if.
If you have done research out
or research about fact that use
other communication technologies
such as wildlife.
Yeah. No, not so far.
We we focus specifically
on frameworks because it was like
the easy
first step on this election
and we needed to reduce the amount of the
spectrum to something that we could
manage to do like in one
year. So, yeah, no,
we didn't do that.
Yeah, so.
Hello, internet.
But no, we use
GSM that is also digital.
It's not dissimilar to us wi fi.
OK.
I think that Wi-Fi
can be more difficult because you have
a lot of white file around you all the
time. In the case of GSM, you may
see the hopping frequency if you're using
hopping frequency.
So we we managed to detect
the GSM that it's digital.
We never try with Wi-Fi so fast.
So maybe that it's better for the
listener. Yeah.
And I remember the we have a like a
14 pages long paper with all these
experiments documented, so you can go
check it out.
Let us know if you have questions or
ideas or you can experimented on
yourself and tried
things.
I think microphone number eight has a
question.
Yes. Hello. Yes.
Thank you for your talk.
Is there any reason why you went with
the strength of a single
signal versus trying to reproduce a
tone? So a suggestion for a salamander?
Perhaps you omit a particular tone
frequency and then you look
for any FM broadcast
on the spectrum that can also
match that tonal frequency, not unlike a
guitar tuner on your Android phone?
Yes, yes. Actually, that was the
second idea to put inside a mantra.
So that was superglue.
We say, Oh, we are going to actually
generate a pattern of tones,
and then I will search this pattern
matching the frequency.
And we were super excited to implement
these. And then we figured it out that,
well, we didn't need it because it was
working so well that it was like, OK,
maybe we don't.
So but I agree it's
a good idea and I want implemented
or somebody implemented at some point in
time because it's super nice to have this
button and then you can actually
filter out a lot of false positive
errors. A lot. So yeah, I agree.
Yeah, thanks. Thanks.
Yeah.
OK, ladies and gentlemen, a really
warm round of applause for Veronica
and Sebastian from much left Mason.
But.
The.