Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/709 Thanks!
All right, so with that out of the
way, it is my pleasure to introduce
Phillip, who will be talking about Patra
systems. Now, many of you undoubtedly
are on call in one way or another,
but typically we take the easy way out
and we use apps like pager duty or
whatever other delivery mechanism.
But Phillip is actually going to talk
about these things like actual physical
pagers and the state of security
in this ecosystem.
So please give a warm round of applause
for Phillip.
Hi, thanks for having me here.
Well, it's
really fun to have secure
introducing me and
yeah, so tonight I'm going to
talk about a cold bra in the air.
So why cold ground so cold?
Brown is a medical lingo spoken
by EMS and emergency room personnel
to demand a patient
who is incontinent offices.
In simple words, someone should.
Yep.
So
why pagers?
It's such an old technique.
Why? Why we're talking about pagers
here because we want to make pagers great
again. Now
it's well, actually,
pagers are extensively used
in the United States and
Canada, to be sure, which is
on North America.
And it's used in Germany as well.
Um, it's mainly integrated with
like health care systems,
the workflow system.
And we have things like SMS
to pager gateway and email pager
Gateway that makes
a systemic and systematic
failure possible.
And in this talk, I would like to deliver
like less about the protocol, because
I think most of you know things
about the SDR and
this is C.C.C.
conference. So
I shouldn't be more technical than you
guys, but we can
look more on the data
and this legal disclaimer.
So it might be illegal
in some country to sniff and
store data, for example, in the
United States, it's OK to listen
to the radio and try to decode something,
but you cannot store it.
So NSA had thought of
a workaround which just work on
the metadata and things
are all right.
And the second thing is that
in some countries you cannot sniff
and you cannot store data,
which means I'm not sure what's the
situation in Germany right now.
If it if it's allowed to
kind of sniff the radio,
maybe. Maybe not.
Yep.
And in some countries, it's OK
to listen to unencrypted
data, but if you kind of
decrypt encoded data,
that's illegal.
OK, so in doubt, consult
your lawyer.
So some of you might say, oh, come on,
it's 2016, so who in
the hell is using this kind of old
technique?
Well, the thing is that
in some places you want to avoid
some interference, like being in
the hospitals in the United States.
They want to avoid interferences.
So if you have money to buy some
better equipment, I mean more modern
equipment, there are there are always
come with some magnetic shield
that is compatible with 3G or
LTE networks.
But for yeah,
but for some other equipment,
it might be there might be some
interference or
there might be some places like plants,
chemical plants
that signals are just
weak. You cannot use your cell phone
or there's some special places
like government
contractors defend defense
industry, military industry
where some
like devices
with with the recording
or transmission capacity is strictly
prohibited. So you need some alternations
and in Germany as well,
and you have something like, say, the
roof, it's still in use
and you can still buy this kind of pager.
So, um, yeah, actually,
that's one of the pages I
kind of, uh, listen
to.
And in Germany,
I don't I don't understand why the
message is in English anyhow.
And yeah, you can just read
it.
So this is the agenda
for today, I would first talk about a
little bit about the protocols and then
the how it is used in health centers,
hospitals used in industrial
sectors and then government,
and then we'll talk about how to spoof
it.
So Pager's
it's first invented in like
in 1950s.
It would just pay like 12 bucks a month
and you get a service of
20 miles of coverage.
That's quite neat, but the pay
isn't he wasn't hot
until nineteen ninety nine days,
but it's
it has been there for only like 10 years.
And after 10 years, everyone uses a
cell phone. So
Motorola stops making new pagers
in 2001.
But hey.
It was once a symbol of cool
people have invented so many numerical
expressions to say, hey, I love you, I
miss you. Goodbye, kiss, kiss
and go to hell.
Well, it's good our time, right?
So this is a exact protocol,
um, it's mostly used in
most countries all over the world,
including Germany, and it's like
five, 12 or twelve hundred
feet per second.
And the most important
things are the bandwidth is nine nine
kilohertz.
So we can practically recognize
this kind of signal in the waterfall
that we will see later.
And another protocol,
another main protocol is flaks
fluxes invented by Motorola.
So it's a little bit faster and
a little bit more efficient and
bandwidth.
And well, since
we don't want to really build things from
scratch and these protocols are kind of
complicated, you can always use a
utility like Ganu Radio
or Auto FM
or Multimode Nanji to decode
and modulate this kind of signals.
So we're using that as well.
So these are the frequencies,
but you don't you don't really
need to covid you can find it on
Wikipedia.
OK, so this is our
set up with only 20 bucks
or 20 euros.
You can buy such a
USB dongle, plug into your
computer, runs on the radio and
everything's done so easy.
And if you are rich enough,
you can buy some fancy stuff like
this Lekarev one,
and probably with a
B to Tan or
R.F., that's cool as well.
But well, the 20 bucks thing
is good enough,
and once it's all connected,
you can use Jukwa.
So I would like to
thank the authors of our
XM Radio and our small
town guys over over there.
I have met them in room 15
here in C.C.C., so
that's pretty cool. They have open source
everything so you can just grab them and
use it for free
and.
Does this signal here?
This one is Pakzad
and how do I know because it's
you can you can see the bandwidth.
It's a nine kilohertz and you
see that two, um,
two points there.
So, you know, it's like SK
is a frequent shipping
thing. So.
So in doubt.
Check this, a sick idea that,
um, it's pretty useful.
And for flash signals that we
just use, um,
this guy this ah Clayton Smith
has written a really cool piece of
software called a pager.
Our python
just run it and it it kind
of sniffs multiple band, multiple
bands at the same time.
And we have kind of conducted
our research for four months
from home from February to June,
and we collected and
collected sorry, we we
observed
18, 18
million of our numerical
messages yet.
So let's look at the data.
So how the data are used,
actually, it is integrated in mostly
on most hospitals in the United States,
like in nurse or workflow
management or between the communication
between the doctor and the pharmacy.
And sometimes you see personal messages
as well.
So let's just look in the data.
And so it's
every time when there's some event
happened, someone called nine one one
and a message is transferred to someplace
like you can read here.
And there is a type called E.M.S.
So it's an emergency thing and someone
has a chest pain at some time
or you can have some
advanced thing like someone.
Um, who is 19, one
year old female, and he has
a there is some IED
used, so she's
been transferred to
someplace being
treated by Doctor Who
and yet at
some hospital and
her date of birth
mom did y y y y
and there's some
some pre diagnosis
before she arrives.
So with this kind of information, they
can better coordinate with
the hospital and be prepared
for surgery or a
bed for the patient.
So that kind of.
Reduces the waiting time,
increases patient satisfaction.
Oh, sorry.
Sort of, yeah, yeah, if
you see the medical treatments as
a service, that can be a satisfaction,
OK, and it improves
efficiency in administering
discharge or you can
make an appointment with your doctor
for for a
in-house service in treatment
or things like that.
And we can see something like a
Navy care system and career span system
which just named these two, but it's
not limited to the brand,
for example, in Navy care.
You can see like is it's transporting
on some patient whose
medical reference number is such
and such from E.T.,
from emergency department
to some exam room.
And then
the patient is transferred to a CBC chest
pain center.
Then status is what admitted to
a doctor who diagnosis his
chest pain, things like that.
So you might think, oh,
yes, it is all about personal data,
my personal identifiable data.
It's quite scary, but
it's not limited to this kind of thing.
For example, we have a quicker
and quicker, as
is a little bit more cautious,
it uses abbreviations,
the first letters of the patient's
names, that's good.
But then it gives you a u r l
just visit this URL.
Yeah. Then you can see something.
But actually they ask for a
ID and the password, but you know,
they usually use one single idea and
password in a whole hospital.
So you might know something that
you are not authorized to now or
like this abysses.
And this is
from this ah red arrow.
You see the thing is a MRN
medical reference number.
And among all
the data we have seen,
it's about like
seven percent from NovaCare
and seven percent from Mackinson,
our records.
So you can kind of this you can
kind of guess the market and share.
Of all this workflow systems in the
hospitals, but
just be careful, because the data
might be biased, some
some message can be sent like in
a group car.
In the group car, it can be sent once to
a wild card number or it can be sent
like 13 times to 13 different
numbers.
So in that kind of duplicated numbers,
you get the bias, the data.
And we didn't claim that because that's
simply not necessary.
And
so with this
personal identifiable data,
we got like email, medical terms, English
names, syndrome's diagnosis,
medicine on FDA drug
list, phone numbers,
especially phone numbers, because
sometimes patients want to and
have an in-house care.
So they leave the number in the system.
We might know we might not
see that yet.
And we can make
an interesting, interesting statistics
on top of magical terms that we
have seen in the pages like
flat. They're quite interested in
your veins or EKG.
They're interested in the in the heart
of sepsis, x ray, things like that.
But
but.
We see other messages, like on how
doctors communicate with the pharmacy
and they have kind of place
to order, what kind of mad,
mad, mad cow medicine
should be delivered to which
room?
So with this kind of data, we see
a different picture.
It's not about a about your heart
or your vein, your
yeah, it's more about like
Albuterol Tylenol.
So it's about a painkiller.
And Mercanti,
sorry, bronchodilator.
And we see something on this are
from the United Kingdom, it's about organ
donors, so it's a donor number,
which number? And donors,
hospital name, donors, donors
name.
And like
this, this great honor as
a female forty nine years old,
is a donation after cardiac death
and the offer is to a patient
who actually this makes a
very serious
ethical issues
because usually we don't want to let
the that let the
the one who gets this
sorry, this human organ now, who
is who the donor is, because
that might be something,
um, might be something
like you're trading that an organ
or things like that.
So it can be very serious
and we see something like home
care, OK?
This is an example
of home care.
So it's like please call patient
at at home,
his or her home, the phone numbers like
this and for some
syndrome. And he wants to see what he
or she wants to take a steroids, but not
a not on this alone
or we see someone's dead.
And actually we have checked
the local newspaper and he said.
So and one
of the most serious
thing we see is the caller I.D.
system, the Colorado system
is that whenever you make a phone call,
it looks up in a internal
phonebook and shows up who's calling,
who's calling home and who
with a name and a number.
So if you kind of observe
this kind of this pages
for quite a long time, you can compose
your own Yellow Pages.
And that's made things worse,
and we will see that in a minute.
So Industria,
we see many industries using this
SMS to pager or Gateway, maybe
because they want to receive
some alerts from SMS.
But then that is they found that the SMS
might not be delivered to their cell
phones. So they use this kind of gateway
to transfer it to the pages
that might be used in the in the
plants and.
Hate, for example, you see this
from something that no,
it's a collie, no.
And you have the missed a call
from someone that's a caller number.
So here you can make a correlation
between caller and colleague.
And you can make a phone book, too,
and the the
example here, if we got the same number,
like number one, two, three, four, five,
six are exactly the same number.
And the message is so
brief, it's just coming.
And you see they have some type
relationship.
And.
Cox Press have this speech to
text summary, nada, just
like a Google service, it's transcribes
the voice message to a text
and send it to your SMS.
So in this case, it sent two of the
pages. So it's visible
if someone is saying is kind of listening
to the radio.
So.
And we have seen the examples
of using the email to Patrick Gateway,
like who's calling who was calling her,
will send email if there's some missed
call and we
have a Web control
building automation system from automatic
logic.
And this
is a building automation system for
Johnson Controls.
And here we see something interesting.
Like for what control?
It's not it's just, OK, we're
we don't really care if your trailer is
running or not, but a formatters
Matisses is they have something called
RFQ are, of course, a fully qualified
references, which means
and you say this is our
HQ and
this code.
Means aware in what
facility this thing's installed,
so.
It's, of course, the United States, you
can pin pinpoint on
which this code is denoted
to, you can find the proper place
and sometimes.
They have it written down in the email
address, so this are all redacted,
but you see some chemical manufacturers,
some defense contractors, some
university, some medical center,
you can name them.
They're all big brands.
So I don't want to be sued.
So I. Mastrov Yep.
OK, so an industry is
using this kind of techniques as well,
so you get a lot of code, you get
Nagios net bios name
CECO Quarry's
Preparer's.
Yeah.
Like and like I've
been doing Penthouse in for some time
and this kind of passive intelligence is
really valuable to me.
So thank you for the information.
And sometimes
the passcode is here.
Yeah, it's the password.
And that's that's not a real passcode.
But I made it.
But, yeah, the message is real.
And you have sometimes you have the
same Two-Factor authentication and the
code is here, like your passcode is
zero nine to three.
So what other Web app
is for?
And these messages are
from McAfee
interviewed.
Yeah, I'm not saying
I'm not saying against McAfee, but.
Actually, this is a list of the
that this next generation
intra intrusion prevention system
has found and
yet.
Well.
Well, they're doing a good
job, at least they're blocking
this kind of TV, but
what if this kind of TV is happening in
a national lab?
Conservers.
And we have things from power plants,
like
the things inside the turbine that
stops working is what's actually
in the nuclear plant.
So that's something serious, and
what if the nuclear plants lost the
power it uses, like
on batteries, our own generators?
Right. So this kind of incidents
are reported incidents.
So if you are a journalist, you might be
interested in crosscheck if they have
followed this incident and
nuclear control agency.
Nuclear agency.
So, yeah, what if they haven't
fired them?
Um, and we have mountains
and chemical plants, and
I have to say sorry that I don't know
anything about chemical industry, so
I cannot extract
useful information like I did in it.
But you see some stacks stacked
on top of some p.l.c..
Yeah. So if you are an expert
here, that might be useful to you.
And from
the messages we can find
on where exactly the
chemical plant is, you see this
river and this
Google satellite map.
Yeah, I cannot tell you where
it is, but you can try to find it.
Yep, or,
yeah, these are these are just not
very and
this is not meaningful to me, some jump
up and down,
but if you're working in the
chemical industry, maybe
you want to know some secret of your
competitor.
And it shows how their daily operation
is like.
And the last is
a hit in Malaysia and the air
conditioning system, but
now it's OK, it's just a boiler
and trailer and air conditioning
on and off.
It's not very a big
deal.
But what about a public
sector? So public sector, that's
government and its partners.
So we have seen this.
You guys go ahead. I'm eating here some
name.
Well, it's a personal message.
It's not a big deal if
it were not from a government
agency. Yeah, that
well, if that just between me and
my colleague, that's no big deal.
But, hey, I'm
living just in the mandate to meet
you somewhere.
If you think of Kevin Mitnick,
someone who's really good at doing social
engineering, and he got this kind
of useful information, hey, he can do
a lot of things.
Yeah.
And.
So here comes here, takes in the caller
I.D. system again, like
someone from some national
organization, he got a
call from some
people and you can do a passive
recognition like
like this one.
This one retcon is.
I should say she must be secretary
of some some very big guy,
she's saying, OK, J.W.
Marriott is only three hundred
bucks a night. You want to go for it.
So she's sending a lot of messages
out and we can see that.
And what if you want to impersonate her
and send a message?
Um, there's something
in design of this paging system
is that you cannot
authenticate who the sender is.
It is by design, so
if you kind of impersonate the secretary
and send a message to the big guy,
he would believe it's you.
And there's no way to make
a two way authentication like a like
SSL or OS.
OK, and this is a
voicemail summary.
The interesting thing,
so.
Actually, people are not aware that
what they have said has
been transcribed into a text and
then sent via pages.
So it's like, oh, he's just missed your
call. I want to tell me what's
what's up? Give me a call back
and you can see more intimate messages
if you really came to know
everything.
Yep, and
this is a recon.
We can't know who's calling
whom, who's whose mother,
whose sister or lover or girlfriend
whose husband is.
And their family
phone number.
So it's something something very,
very serious when it goes to
the government and
we can see a of.
Well, actually, these are
the tracking numbers of some parcels sent
by some national defense
contractors.
We see the parcels going out from
a given place and
we don't know who they are.
We don't want to know.
Yeah.
So what if you are a Russian spy,
no, if you're a Russian spy, you might
know many things, but if you are
lying spy, this
might help you.
Yeah,
OK.
Um, so it's about, um,
we have to prove we can actually send
a page
to this kind of tiny thing we
bought on eBay.
Yeah.
So we bought two devices
on eBay and we know the cap
code. We know the frequency they are
working on.
And again, thanks
to the new radio guys we used,
Jaara makes a lot.
And with a really, really
simple, uh, Tigran,
we can send the pages
like this.
So Hekla planet
Yae.
And we can think of the attack
scenarios like sending pages
to pharmacy to give you a wrong
medicine, and when I took it,
you got some problem,
we can try to move the patients
between the facilities, like move in
and out and in and out and in and out
until you're really bored.
Yeah.
And we can probably,
like, declare an emergency
in some facility so people
evacuate and then might cause some
damage or real damage.
Yeah.
Or we can impersonate
someone we can prepare prevent
to be a contractor because
I didn't show you.
But there are some real name, real
phone number and contact number.
So with country number you can pretend to
be meant to be someone.
Yeah.
So here's our conclusion.
Just stop using it.
Yeah, or if you really
want to use it, because you cannot avoid
this kind of system, encrypt everything
just like you do in HTP,
you do everything at ETPs
and that's better.
And if you really have to and
you cannot encrypt everything,
just don't leak personal information.
You can use like the first letter
of the names.
Just don't spell the whole name.
We have actually we have seen some really
good system trying to avoid everything
and we see very good examples
in Germany, like German
people are quite cautious about this kind
of thing. And during
these two days, at least at least two
days, I didn't see any real name.
Yeah, and with
small leaks, that doesn't.
Do you think that doesn't do any harm?
We can make a database and make it
a real home.
You can download
our white papers from this,
you are out or you can just search
looking beeves from Google.
You can get everything from us
and you can download the slides.
And if if you have something to tell
us, if you want to discuss
about how serious things could be,
just find us on SJ
Health and Maskey on Twitter.
So I think that's all.
Thank you.
Thank you very much.
We have some time for questions and
answers, if you would like to leave the
room. That's OK.
But please take some trash out with you.
And if you leave in the front, please
duck under the camera.
So if you have any questions, please line
up at the microphones, which we have
here.
In the meantime, are there any questions
from the Internet?
Seems like a no.
So come on, guys, don't be shy.
There's a question right here, yes, yes.
Is there any is there any commercially
available encrypted paging system?
Yes, there is.
Actually, sporks has this type of system
that you can buy.
It's I haven't used that,
so I cannot say it's good or
not. But yes, there is.
Just to make sure I understand, I
remember this page, the time and
the calls were receivable countrywide.
Yes, this still saw
this hospital staff send
it locally within the hospital, or
are they send it countrywide.
OK, um, thank you for
the question, because the actual
actually, they wanted to limit
the signal strength within
this buildings, but in
fact, they felt they failed
to do that.
So it's like you
can still get this kind of message just
like 10 or 20 miles away
from the hospital.
So, yeah.
All right, question in the back, yes.
Also, remember the time of the beaches
in the 90s and from one day to the
to the other, they were gone and call
centers were closed.
It was really, really credible.
I reckon that this was due
to ASMs.
We have this Chisum then coming up.
So I have the impression that
at that time, um, in
Europe, Assam's took over.
And as far as I know, Eskimo's is not
that widespread in the US.
So is there here in Europe
less patrinos usage
or is there still a lot of of of
peaches used here in
Europe, especially in Germany?
Um, that depends on the country because,
you know, Europe is quite complicated.
Yeah.
Well, um,
I can tell you is that, um,
the hospitals are not using Pageonce
systems in Germany, but
the emergency sectors, sometimes
the police and the fire fire department
are still using them.
So if you turn up to the right frequency,
you can get something.
But not like this.
Yeah, so it's not so scary
and someone told me that in Belgium
there's news and that's quite a lot.
But I, I, I haven't
been there, so I cannot tell you.
And the additional question would be,
you said Motorola was
stopping production to 2001
was to correct?
Yeah, um, but I
understand it's still, uh, these
speeches are produced and, um,
they're ruled out in new installations,
correct?
Yes.
OK, yes.
Uh, I'm not sure who made
this new pages.
Yeah.
All right. Any other questions
now is your chance.
Yes, please.
And on the encryption you spoke
about, there are encrypted systems, but
is there anything to retrofit?
I mean, nobody would buy another two
hundred new pagers
at once.
And you said encrypt the things.
But how could I encrypt if I have like a
hospital with my two thousand people and
I have to retrofit a solution?
I'm repeating for the stream.
Is there any encryption system that can
be retrofitted?
Um,
not us, I know.
Yeah, so the thing is,
you're telling us why there are not
replacing this kind of system for
a safer system.
Yeah, nobody wants to invest on
it for another two hundred
new pages with this inscription
systems, but.
Well, I'm not sure if there are
there are some some pressure from the
society maybe that would make a change.
All right, do we have any other
questions?
If not, we're going to close.
So thank you for attending, please, when
you leave, take out the trash and give
another warm round of applause for.