Staying Connected during a Revolution or Disaster
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Wilhelm, Thomas
-19/dc-19-presentations/Wilhelm/DEFCON-19-Wilhelm-Staying-Connected%20.pdf During the recent revolutions in Africa and the Middle East, governments have shut down both Internet and Phone services in an attempt to quell communication among demonstrators. In addition, during natural disasters, people have been left without a means of finding out the latest news regarding emergency services. We will discuss methods that can circumvent severed telecommunication infrastructures, including the use of mobile devices to act as ad hoc network access points. At the end of this talk, a new open source project will be announced, with the goal of developing the capabilities to generate spontaneous networks in times of crisis using current cellular phone technology. Thomas Wilhelm is a Senior Security Consultant within the Penetration Test practice at Trustwave's SpiderLabs. SpiderLabs is the advanced security team responsible for application security, incident response, penetration testing, physical security and security research for Trustwave's clients. Thomas has been involved in Information Security since 1990, where he served in the Army for eight years as a Signals Intelligence Analyst / Russian Linguist / Cryptanalyst. Thomas is also a Doctoral student who holds Masters degrees in both Computer Science and Management, and has written numerous articles and books; the latest being "Ninja Hacking," published by Syngress. Twitter: thomas_wilhelm
 So today's talk is going to be a little bit different than some of the other ones I've had in the past. This is a little bit, I guess, a little bit more focused on trying to help out other people before it's been about, you know, cool little things or just having fun. So what we're going to talk about today is how do we stay connected during a disaster or a natural disaster or a revolution, sorry. I'm going to put up a slide here. There's a link to it for those who are actually interested in participating in the demo. It's only Android users. Unfortunately, the guy who is working with me doing the programming for this app, which is still in the process of being developed, it's just mostly for demonstration purposes. He didn't, doesn't really like iPhones, so he pretty much has screwed it. I don't know if I'm going to be able to be friends with them after this, but anyway. So if you want to see what the demo is, there's going to be some screenshots for those that don't have an Android phone. What you'll need to do is actually download an application. You'll need to make sure that your phone is able to handle that. And one of the things I want to tell you about is there is a button on there for emergency. If you push it, don't send it. If you do send it, then you will actually broadcast to anybody else that's got the app, your phone number and your actual location. All right, so just so you know. All right, so let me go ahead and talk about what the idea behind this is just a little bit. As I said, what do we do during a revolution? What do we do during a natural disaster? There's been a lot of proposals out there and I'm going to propose again another idea that we can add to the list. This is more of a brainstorming idea as opposed to this is how we should do it. And so I'm actually hoping that at the end of this talk, there's going to be some people who show up for QA and discuss some things. Because there are some issues that need to be worked out and as a community, as a hacker community, I think that we can do an outstanding job of this. All right, so like I said, this isn't me telling you what to do. This isn't me saying this is how we need to do it. This is an idea that I'm proposing and hopefully it will gain some traction. The reason why I'm even talking about this, I figured that by now this kind of stuff would have already been hammered out since Katrina's been for a few years and Egypt was not too long ago. But it hasn't evolved fast enough or hasn't even evolved properly. So people are still, I mean, there's still the phrase that I heard today as people are dying in silence. So it's something that we can do as a community to change that. Okay, so let me tell you a little bit about myself. I've got a couple master's degrees. I'm working as a PhD student. I've been in the U.S. Army doing signals intelligence and I've got a bunch of certifications that stand by my name. I'm also an employee at Trustwave. You can probably tell by the slides. All right, so current events. One of the things that have hit home recently in the news is the Egypt and Middle East specifically. And then what's happened is a lot of these revolutions were created by social networking. And that's actually one of the reasons why the telecommunications systems have been shut down. The revolutions themselves are typically decentralized. And the natural disasters, there's been earthquakes, tsunamis, hurricanes, you name it. There's communities that are hit every year that are basically devoid or lose their telecommunication capabilities. And there has to be a way around that to get information to individuals. All right, so I'm just going to go over some of the details. I mean, this has been pushed in the news a lot, but this is the reason why we need to develop a better way of communicating in these kind of situations. The biggest one obviously is the loss of life. There's really no reason why we can't do something to try to alleviate that. And the emergency services themselves are desperate to try to figure out a way to get help to those individuals that need it. And so because of the telecommunication loss, there's obviously lots of life. There's limited response by emergency services, like I said. They don't know where to go because they have no information. And then there's disruption of organized events. If you go back to Katrina and trying to get people medical treatment or at least get them to the dome, it just didn't happen like it would need it to. And there's the economic loss. That's the actual impact of the telecommunication. That's not what I'm going to focus on here. But we need to be able to create a different method for communicating besides just relying on the current infrastructure of the telecommunication system. The representative of Louisiana said, and I'm going to read this quote because it's really pretty important. It said that during the Katrina people could not communicate. It got to the point that people were literally writing messages on paper, putting them in bottles and dropping them from helicopters to other people on the ground. That's how bad it got. So what actually happens during the communication breakdown? We'll talk about both natural disasters and then if the government intervenes. So natural disasters naturally wipe out the telecommunication infrastructure. And it does actually require, in some cases, days to be able to get mobile devices on site in order to reestablish some of the telecommunications. But in essence, it really takes months to be able to reconstruct that. So a lot of people are out for a very long time. Under government suppression, it's different, obviously. The infrastructure remains intact. Basically what happens is somebody just turns off a switch like they did in Egypt and shut down most of the telecommunications, internet, and things like that. And based on our history or limited history with this, it's down for only a few days. Usually it comes back up because of the economic pressure more than anything else. So what actually happened in the instance with the Japanese earthquake and the tsunami, it was impacting the cell phone, landline phones. It interrupted the power. All transportation was pretty much shut down and it actually impacted the undersea communication as well. So we're looking at shut off of internet services in the region. We're also looking at the inability to get emergency services to the location. Under the government and the corporate response to this was to use loudspeakers. You may have seen it happen, but governments have vehicles that drive around the broadcast this information over loudspeakers. The television news broadcast, they were trying to provide information to the individuals that were affected, but you also have to remember is that because of power issues, they were unable to receive a lot of that information. Mobile cellular bases were actually brought into the area in order to try to reconnect. And then there was an increased use of Wi-Fi hotspots. This wasn't necessarily in the area affected. This was in areas outside of it. So basically as people were able to get out of the impacted area, they were able to communicate with family friends and things like that at different hotspots that were not impacted. So let's talk about Hurricane Katrina. The impacts were cellular, landline phones, same thing as before. The local television stations, they were decimated. The broadcast information was broadcast outside of the area. So basically surrounding communities ended up picking up information that they needed to provide to the people that were in the affected area. Again, it doesn't necessarily help anybody in that area simply because power is down, things like that. Power obviously was lost in transportation again. So the response was relocation of the new services. Like I said, they moved them out of that area entirely in the hopes that somebody would be able to at least press on the information, but at least it would get out there. Again, mobile cellular base stations were pretty much on site within 72 hours. And then there was actual increase of use of amateur radio operators, which is one of the things I'm going to briefly mention and more from a perspective of a multi-tier approach. And I think this is an outstanding method of communicating, but it's not pervasive enough in our community to be able to positively affect situations. All right. So let's talk about the human impact of Katrina. The communication breakdown actually did cause deaths. I mentioned the loss of life before. Well, here's an actual quote from an individual who was writing a thesis, a master's thesis, Lieutenant Colonel Heather Kay Meads, Army National Guard. He wrote this when he was at War College, I believe. And the quote is, I'll read the quote straight out, with communication breakdown, critical information could not be transmitted. The levies broke and no one other than local residents knew about the massive flooding for several hours. Victims could not communicate with possible responders, which increased the lack of response and devastation. Lack of communications at all levels increased the chaos, death and destruction in the aftermath of Hurricane Katrina. Right there, that's pretty damning of the infrastructure and the response. So basically what we're going to talk about later on is how we can try to improve that. That's really the gist of it. All right. So let's talk about what happened during the Egyptian Revolution. Impact of the social networks, mobile phones, television network coverage, Internet, which started on January 27th and then extended for a few days till January 31st. Because the mobile phone system was down, that eliminated the ability to do SMS messaging. I mean, that's part and parcel and then landlines were disconnected as well. So anybody that wanted to communicate with anybody else basically had that removed. The primary focus of the Egyptian Revolution was to undermine the movement of people and also to prevent information from that movement going outside of the area. So what was the response by the individuals in that area that still had power, they just didn't have the telecommunication capabilities. So they started using smartphones as modems. They also used landlines with dial-up modems, the ones that they could actually find working. They used fax machines, which is good too, but again, you need a line in order to be able to do that. And then amateur radio. So now another proposed alternative that came out of that, and I'm not sure if it actually did occur during the Revolution or not, but it got a lot of press afterwards, is the idea of using a wireless mesh network using laptops. And we'll talk about that and I think it's a good idea, but that's not necessarily something we're going to focus on today. Okay. So my focus is on handheld technology. I'm specifically talking about cell phones. I mean, that's ubiquitous enough where, and they're intelligent enough from a computational perspective that we have a device that can set up infrastructures at ad hoc. And so that's why this talk, because it has that, we're at that capability now. All right. So the way that we can create ad hoc networks, and that's really what we're talking about, as opposed to the established telecommunication networks, there's a couple of ways we can do that. We can do it through a flooding relay or a routing relay. And what ends up happening is just like what they were talking about with the laptops, the ad hoc wireless connections using the laptops, we can also apply that to our cell phones as well. The idea behind a mesh network, besides the flooding and the routing, is that the data dissemination goes to each of these nodes. Each node itself then becomes a relay. So what ends up happening is you capture and then disseminate the information. This isn't new. This isn't something I'm proposing. This is something that already exists. And it's basically what has been proposed using the laptops. There's two types, flooding and routing. I already alluded to that. Flooding and I'll actually have a demonstration or an image of that later. Flooding basically hits every single network, or every single node, I'm sorry. And then the routing one has predetermined directions of where it's going to go. Some of the interesting examples of ad hoc networks that are out there, there's a mobile ad hoc network and a vehicular ad hoc network. I'm going to let you guys look more of that up. Again, we're not going to talk about it, but it is some interesting proposals. Nothing really has been pushed out as a standard or, you know, it's more in the learning stages, it's more in the demonstration stages. But it's clever. And it could actually be applied into emergency situations like this. All right. So the purpose of an ad hoc technology, as I mentioned before, there was some traction in the news after the revolution in Egypt. But the idea behind it is to disseminate information. The idea is we're going to push out revolutionary activities, any evacuation notices, some weather alerts, and then also to decrease information, the misinformation, and also eliminate some of the fears, because that's pretty rampant in any of these circumstances. Especially during a national disaster where people don't know how to communicate. Emergency services, they need to be communicated with obviously as well. Fire, police, ambulance, hospital locations, and closures. There was a ton of closures in Louisiana, and a lot of people ended up going to hospitals that were shut down and people who were in desperate need of support. There's also something that kind of gets pushed by the wayside is communication with relatives. That doesn't seem to be as important to a lot of people, but as far as government, and honestly the first thing you care about when a disaster happens is where are your loved ones and what are they doing? And you want to make sure that you can communicate with them. And if the telecommunication system is down, it makes it very difficult. All right. So I mentioned ad hoc nodes using laptops. Let's talk about some of the advantages of that. So the laptops already have TCP IP stacks integrated. The advantage to that obviously is then it's easy to talk straight to the Internet. Just a straight leap into it. If you can find an access point that connects out, you're good to go. Laptops actually meet or exceed the capabilities of routers depending on what you have. And they're also extremely flexible. You can load up apps. You can use data storage. There's a lot of accessories that you can add into it. So there's definitely a good reason to use laptops as an ad hoc node. And I'm not going to dissuade that from people from using that at all. I think that's going to be a critical, especially communicating into the Internet. Some of the disadvantages that it's expensive, it's also not very portable, extremely power hungry, and does require preexisting software to be installed in order to be part of that node. If you're talking about a revolution or telecommunication disaster where you cannot connect to the Internet, you can't just selectively decide that you want to be part of that node simply because you don't have any way of downloading the software that's needed for that. Amateur radios. Like I said, I was going to talk about this a little bit. I think that the more traction we have in amateur radio enthusiasm across the world, the better. Honestly, it only makes sense. They've been a big proponent of being able to exist in emergency situations. That's why a lot of people get into it, to be able to provide a relay across the world. The advantage of amateur radio, it can be both huge, massive towers. It can be very small down to handheld. Amateur radio will actually be able to send information over TCP IP. It's very portable, like I said, if you're dealing with smaller handsets. It does have a very long signal range since it's just using radio waves. The disadvantage is specialized knowledge. No, I'm not saying that it's complicated. I'm just saying that the average person has no idea what to do with it other than pretend it's a walkie-talkie. It's also not ubiquitous. It's not in everybody's hand. I would say that 90, 95% of the people here have a cell phone, but I would say we push in it even in this environment where 10% have amateur phones on them, or amateur radios on them. That's the problem that I see with amateur radios, is that it's not everywhere it needs to be at the moment. There are some corporate and government ad hoc nodes as well. I mentioned some of them already. Specifically, some of the loudspeakers, mobile cellular base stations, and then the television. Now, whether you really can call that a node or not is questionable, but it is one way of providing information to individuals in the affected area may not be the most effective. The advantage to this one, though, is that it's authoritative. You know that it's coming from an official source, and when you're dealing with natural disasters, that's a really big thing. You don't want to go by word of mouth. You want to know what the real official word is. The disadvantage is slow to respond, extremely slow to respond. We saw that in Katrina. It was really bad. And it does require infrastructures. Base stations have to show up. Television stations have to assume. You can't just pick up and move them easily. And it does consume resources, helicopters, mobile police force, et cetera. And the other thing that ends up happening too is, and we saw that in Katrina, not in Japan, but people got very hostile with any authority organizations, whether it was police forces on the scene or helicopters. They were getting shot at all the time. So that's something else that needs to be taken into consideration. Okay, so now let me talk a little bit about the advantages of using cellular smartphones in an ad hoc node. This is also assuming that there is no telecommunication infrastructure that's available. Again, like I said, it's everywhere. And it's accepted technology. Everybody, including my mom, has a cell phone. And for my mom to have any technology is amazing. It has lower power consumption than a lot of the other devices that we talked about. It's very portable and extremely flexible, just like the laptops as well, where we're dealing with apps, data storage, and accessories. Some of the disadvantages, it does have some limited range, and it does require preexisting software to be installed. Now, I'm going to talk about later on the application that you guys downloaded. I'm just going to give you... I'm going to get up on a cell box later on, but at this point, there's no reason why the operating system developers don't have something like what we're going to talk about, where you can create ad hoc networks using cell phones without a telecommunication infrastructure. There should be no reason why that doesn't already exist in their operating system. And so we need to actually push that to be spread out into the OSes as they're distributed to the telecommunication companies. As I mentioned before, the use of laptops is important. The use of amateur radios is extremely important as well. I don't think that there's any reason to take one of those solutions over another. When you're talking about natural disasters, you're definitely talking about redundancy, and you need to have that. So cell phone services are very vulnerable to disruption, so that's one of the reasons why we need to have this. Powder outages impact most responses, both from the emergency services and also from citizens trying to get information to the emergency services as well. Portability is extremely critical because circumstances will change. Whether or not a new storm front comes in or new waves of a disaster, you never know what's going to happen. And then there needs to be some interoperability, and this is actually, I don't have a quote for this, but this is a serious problem that has been identified by the government as well during the Katrina's that a lot of organizations had no way of actually communicating with each other, which is sad, but it's just the state of being. So the next thing I'm going to actually talk about is the smartphone technology, and I'm going to do a proposal for the future ad hoc communication methods. And that's what we're going to get into. Okay, so smartphones, that's what we're going to get into. So the communication protocols that exist now, you guys know this. IEEE 802.11, ABNG, and then there's Bluetooth. And we're focusing on this, so we have an idea, like I said, this is more of a brainstorming effort, and this is what we have to deal with when we're talking about smartphones. So as far as messaging and data, we have the ability to use Pop3, I-Map4, and SMS, which obviously gets impacted. And then we also have within the device as well a GPS antenna. And most smartphones, it's pretty much standard now. So a mobile ad hoc network, this actually uses the internet technology, TCP IP stacks, and it has a longer range basically because that's power. Did we lose power? I lost power up here as well. Yep. It's not just this outlet. Yeah, what I needed is a smartphone that can actually push this information to everybody else's smartphone. That would be fantastic. We lost power. Three times, right? It's doing it on its own. Bear with us here folks as we deal with some minor technical difficulties. You guys are really bored, we can do the Jeopardy theme. So while we're waiting for this, I actually wanted to bring up another topic while I'm up here. I'm actually running the Be the Match bone marrow donor registry. And what ended up happening is last year I ran it and we got some people to sign up. But this year, Barcode, which is part of the vision network, he ended up being negatively impacted and he will need a... Excellent. Anyway, so he actually will eventually need a bone marrow transplant himself. There's also other individuals in the community that has the need for bone marrow as well from leukemia. And there's a lot of other diseases too. It's not surprising that a group this large that people are going to have a need for this type of medical assistance, the bone marrow donation. But to me the way I look at it, it's actually one of the coolest human hacks that you can do. I actually was a donor myself and I'm telling you it's no big deal to go through, but it's extremely life changing when you do it. So for me it's been an extremely positive influence. It's unfortunate that we have individuals in our community that are in desperate need now, but we have the ability to help. And if you have the time later today, if you can swing by the contest area in the center, there will be the match. We're doing a drive trying to get people up on the registry. Not everybody gets picked, but the ones that do are extremely helpful, happy to help out. And there's also a blood drive going on in Barcode's name as well. So definitely check out that if you're not willing to do the marrow as well. Okay, so I think we're back up. Thank you. I think we're back up on the slides. Let me go ahead and continue. So we were talking about smartphones and we were talking about potential ad hoc networks. And like I said, the proposal for mobile ad hoc networks is users' current technology has longer ranges, but it does require a phone be capable of relaying data, which isn't really programmed right now. And then it also consumes power rapidly. Another alternative is the Bluetooth ad hoc network with lower power requirements and short ranges. Now, I actually am going to propose today the Bluetooth ad hoc network doing it that way as opposed to the mobile ad hoc network where we use the TCP IP stack. I'm assuming that later on that somebody will be able to figure out a way to bridge the information from Bluetooth that gets onto a system and then it passes over to TCP IP stack. That should be pretty straightforward. But the reason why I'm pushing the Bluetooth is pretty much because of the power requirements, much less intense than the Wi-Fi. And when you're talking about natural disaster specifically, that becomes a really critical component to being able to communicate externally. And some of the solutions that people have been using is cars are broken down, there's flooding in the streets, whatnot, but they're still able to power their devices because they usually carry around some sort of way of connecting into a vehicle, a battery through the cigarette lighter, whatnot. So power is there, it's just not as easy to get to, and the less power consumption that you use, the better. That's my personal viewpoint, and that's why I'm going to push the Bluetooth ad hoc network. So pretty much from here on out, that's what we're going to do. And I actually have a slide on which one's better under the different circumstances. The real ultimate goal is to be able to have the TCP IP connection, especially during revolution, but honestly just being able to get the information out is critical enough. And the other advantage to the Bluetooth as opposed to the TCP IP Internet is that data stays local. It's easier to disseminate the information to a very specific region if you're just using Bluetooth because it won't hop onto the Internet and then get to somebody in India when the services are needed in Louisiana. Okay, so what data are we actually talking about that we need to send out? So emergency service information is probably the forefront of this discussion, but I do want to mention that there are other things that we need to talk about like the revolutionary activities, and then of course like I said evacuation notices, weather alerts, things like that. Now I will also say that there will be a need for encryption during this. It's not the application that I had you guys download for those that were willing to do it. There is no encryption at this point, but we'll talk about that here shortly. Okay, so the application that was written, I'm not a good enough programmer to be able to do it myself, so I've got a buddy to help out, and like I said, right now we're dealing with the droid, and I'm going to actually solicit people after this to start helping me out on some of the other platforms, or at least start talking about them. But I'm calling it the autobahn, and the reason why is the autobahn is actually, I thought it, yeah, it's right here, top automated broadcast ad hoc network that made perfect sense. And the idea behind the autobahn open source project is to develop applications for cell phones. And actually, the end result is to get the applications installed as default on these smart phone devices. I mean, you already got your email, you got your Safari on iPhone, why don't you have something that can communicate with other phones in emergency circumstances. So use existing smart phone technology to create ad hoc networks. Also find the shortest path possible to and from the emergency services. And when we talk about the broadcast routing, then we'll get into that. And then also allow people to join or drop conferences, or part of the channels as needed, and then provide confidentiality integrity. When you're thinking about revolutionary activity, you want that, the revolutionary individuals will want that confidentiality and that integrity to be able to push out the information to those individuals that need it. We're doing this here at this location, we're still going. You want some way of knowing that it's from that individual. And then also they will want to talk to some of the other people that are in charge of it, or at least leading the cause and being able to do that in a confidential manner. It also needs to have an extremely easy user interface. Like I said, my mom's got smart phones, so now it has to be extremely simple to use. Because if it's not, she's never going to use it. And then also integrated, like I said, into the current phone kernels so that it will get pushed out for everybody that buys it. And the other thing too is that by now you guys pretty much figured out this is not going to be difficult to implement. This should be very simple. As I was thinking about it and trying to figure out why we haven't already done it, it was one of those dumb moments where it's so simplistic that it should have already been discussed and online. All right, so when we're dealing with, let me go back. So when we're talking about existing smart phone technology, this does limit some phone technology, obviously. It limits it just to, you know, we're dealing with the Android phone and the BlackBerrys and iPhones and things like that. Some of the older or less advanced cell phones aren't going to be able to be a part of this, but it's becoming a lot more popular. All right, so let's talk about the shortest path. I mentioned that it's going to have a graphic here. The reason why I'm proposing the flooding relay is because you don't have any routing information to worry about. That's part of the advantages of having EdHawk. So phones will be able to pass information and you see the red line basically going from the center to the receiver as quickly as possible. But there are some problems. You'll see that there's going to be some spamming problems and there's also going to be infinite loop problems for anybody that is interested in the networking stuff. All right, and I'll talk a little bit about that as well. All right, so again, during the shortest path, all messages get sent to all available phones in the area, but we should have the ability to filter out the ones that we want to view. In other words, we're going to create channels, so that people can look to things that they're interested in and ignore everything else. But going back to that first bullet is that all messages get sent out to all cell phones. So you'll have emergency information in there as well as detailed information from your mom, just a matter of picking and choosing which ones you want to see. And then I mentioned infinite loop problems. So to deal with that is going back to some of the ways that we deal with the network layer three stuff is just use timestamps and dropped after a set time instead of time to life or just using timestamps. And then the spamming problem, phones can actually recognize who they connect to to push the information to, so they won't replicate messages. They will continue to connect to them if they can with any additional messages that they have, just not repeat anything that they've already sent. All right, so let's talk about some of the chat channels. So the user should be able to subscribe to the chat channels, like I mentioned. Think of them as chat rooms. That again prevents users from seeing all the messages that go across the network. That way you don't get a flood of information, you get just the information that you want. But you also need to have in the app some pre-existing chat threads so that you can receive information from emergency services as well. That way you know that they come from authoritative individuals as opposed to somebody who just want to mess with your head. And then users should be able to create and view local chat channels as they need to. And the ability to create them is actually critically important because when you're talking about like revolutionary type of activity, you need to be able to create stuff on the fly. And so if users want to be able to relay some information, they just saw an event that occurred. They need to pass that information on to somebody. They can create a chat channel. People will see it on their phone and be able to subscribe to it. And their phones will continue to push that information on regardless. Let's talk about security confidentiality and integrity. So security, this is obviously a big issue here. One of the things that I approached this project with is that under certain circumstances, specifically emergency medical services where you're in need, you don't care about security. You care about getting that message out. So there has to be a little bit of balance between security and availability. And that's always the case. But the applications and smartphones can use public private keys. Not necessarily PKI. We're not talking about infrastructure. We're talking about the ability for people to create their own public and private keys and be able to push that information on to phones or actually people being able to pull that information, the public keys, as they needed to. So scenario is during revolutionary situation. If people want to stay connected with this individual's communication, they should be able to download a certificate for that particular chat channel. It will have that information in there. And they will be able to know that it came from that person because it was signed by their private key. So that provides the confidentiality. Also, if the person who is the revolutionary leader wants to restrict access to his messages, he can just also limit who has access to that public key. And then, like I said, integrity broadcasts the public key to the world if you want to. So everybody knows it comes from you. One problem in Egypt a lot is that they weren't sure if it was some of the messages were coming out from the individual who was considered the leader for that event. Under natural disaster, the confidentiality integrity are both pretty much the same. We need to have pre-installed, my view is, we need to have pre-installed public keys for emergency services on that phone in that application. That way, the emergency services can get that information out using a private key that has been distributed to them in a controlled manner. And it also, by using that, it allows you to encrypt the information that you're sending to the emergency services so that they're the only ones that can read it. As I gave a warning at the very beginning of this, for anybody that downloaded the app, if you push the emergency button and you go through the system and you send that message, it's going to send off a couple bits of information. One is your latitude, which if you're talking about, I have a heart attack and I need somebody here now, you'll want that information given out. That's fine. My personal view is I don't care if anybody sees that. But the next thing that does go out also is your phone number. That will also reduce the opportunity of abuse and that will also increase the opportunity should telecommunication systems come back online, that people who are in dire need can get connected to or the emergency services can push the telecommunication services, the mobile networks to allow access to that individual. Okay. And then integrity is, again, if you want reliable information from a government entity, you can use public keys having that pre-installed and then making sure that the emergency services, the government, whomever is using that private key, then you're good to go. Okay. As I mentioned, we need to integrate this into the kernel. Here's a little bit of a soapbox. We need to persuade the operating system manufacturers to include this type of application in all of their distributions. And it actually needs to be interconnectivity. So I don't care if it's iPhone, I don't care if it's BlackBerry, they should all talk to each other. And then there is some current roadblocks. The Droid phone is changing pretty rapidly. The latest version has reduced a lot of these problems. And I'll show you one of them that they will eliminate in the latest version. And then this can actually save lives, but it's not profitable. And so that's where our challenge really comes into play, that telecommunication companies don't have a reason to implement something like this. They want people to use their telecommunication system. They don't want thinking. I'm talking for them, which is probably not appropriate. But my personal view is that they would be reluctant to have something like this that would circumvent and could circumvent effectively and for long periods of time their telecommunication infrastructure. I mean, there's no reason why this kind of application couldn't be used on a broader scale. A lot of people are already using Bluetooth, and so it's not a big surprise that it would be considered a problem if it was used consistently and daily. And then... But the problem shouldn't be about control of the information. It really should be about getting the information to and from the individuals that need it the most during these kind of situations. Okay, so now for those who have actually downloaded the Android phone, hopefully you've been playing with it, but I'll show you some screenshots for those that don't. This is the demo part. After the demo, there's a few more slides, and I'll discuss also some of the... very briefly, some of the problems that we're facing and some of the things that need to be worked out. And I'm actually going to invite everybody who's interested in talking about this to the QA room so we can even start hashing some of this out or we can get some people to start participating in development. Right. So this is a very stripped-down version. It's very simplistic. Basically, you need to turn it on or turn it off. I would actually think that in one of the design requests that I have is that Autobahn automatically turns on when there is a period of time where it is not connected to a telecommunication system. That way people can start automatically pushing this information back and forth between each other without even knowing about it. It can also allow them to know that a disaster is going on when they open up their phone. They can't figure out what's going on, and it's right there for them. Their emergency service information is right there. But in the meantime, people should be able to start and stop the service as they see fit. The second half on the right-hand side, this is one of the hurdles that is currently a problem but is actually being eliminated in future deployments of the Android operating system, is that it is a limited amount of time for other Bluetooth devices to be able to actually connect and discover and connect to the system. We need this to be more pervasive. We need it to be turned on and left on as needed. Yes, it drains power, but when we are talking about life's limbs, eyesight, it's an easy call to say, let's burn the power. So, if you click on the button at the very top, it will say emergency, you get this next screen right now. It's got the medical, police, and fire, but the Homeland Defense has been talking about zombie infestation, so I think that was probably appropriate as well. So, we've got an emergency for any of these, and if you click on one, it actually takes you onto the right-hand slide which shows you, basically it breaks down into what is your emergency circumstance. So, if you're dealing with a heart attack, first thing you would click on is the medical, and then it would say, basically if it's personal, and it would break down, whether or not it's life-threatening or not, and then be able to provide that information. As, like I said, this is simplistic for my mom to be able to handle. She'd be able to click the right button, and then it would be, at the last thing that would end up happening is a message would be created. This is actually available on the application that you can download now, where it produces a message that says your latitude, your longitude, your phone number, and any sort of emergency information that you can additionally provide as well. In this case, the individual is under attack from robots from the future. So, okay, a little bit of humor in there, but it is actually extremely, I think, a very important discussion. I'm not saying that the autobahn is the end-all-be-all way to go with it. I am proposing that this is the kind of thing that we need to see pushed onto all smartphone devices. Okay, so we're going to talk about conclusion real quick. A couple more slides. We've got plenty of time before you guys have to bail out. It's only 12.45, so just hold on for a second. All right, so I need your help. I need programmers. I need Android, iPhone, BlackBerry. I also need people who are interested in becoming leads for any of this. The individual who is helping me out, he's got a full-time job, but he was able to do a lot, and from his guidance, I don't see this as a long, complicated, drawn-out process. I can see this with a concerted effort, a matter of months, to be able to get something like this up and going, especially with the new versions of operating system coming out that allow more flexibility in this. So this is an opportunity to actually do something that can benefit humanity, saves life, and extremely simple to be able to implement. If you want to hook up with me and get this going, or if you want to debate this, or you're telling me that this is a crap idea and you have a better one, I'm all ears, you can contact me at autobahn at hackardemia.com. Hackardemia.com also has a link to download the app again, and I'll just leave that up, and as it progresses, we'll add that as well. So this is my thank you to everybody. We're going to go to the breakout room after this. Some of the problems that we need to discuss still, as a community, or between me and the programmers, it doesn't really matter, we need to deal with power resupply, application interoperability, prepopulated certificate, message size, and anything else you guys can think about. All right, that's going to be it, gentlemen and ladies. I appreciate your attendance. I know you've got a lot of things to do, but I definitely appreciate you being here. Thank you.
 So today's talk is going to be a little bit different than some of the other ones I've had in the past.  This is a little bit, I guess, a little bit more focused on trying to help out other people before it's been about, you know, cool little things or just having fun.  So what we're going to talk about today is how do we stay connected during a disaster or a natural disaster or a revolution, sorry.  I'm going to put up a slide here. There's a link to it for those who are actually interested in participating in the demo.  It's only Android users. Unfortunately, the guy who is working with me doing the programming for this app, which is still in the process of being developed,  it's just mostly for demonstration purposes. He didn't, doesn't really like iPhones, so he pretty much has screwed it.  I don't know if I'm going to be able to be friends with them after this, but anyway.  So if you want to see what the demo is, there's going to be some screenshots for those that don't have an Android phone.  What you'll need to do is actually download an application. You'll need to make sure that your phone is able to handle that.  And one of the things I want to tell you about is there is a button on there for emergency. If you push it, don't send it.  If you do send it, then you will actually broadcast to anybody else that's got the app, your phone number and your actual location.  All right, so just so you know. All right, so let me go ahead and talk about what the idea behind this is just a little bit.  As I said, what do we do during a revolution? What do we do during a natural disaster?  There's been a lot of proposals out there and I'm going to propose again another idea that we can add to the list.  This is more of a brainstorming idea as opposed to this is how we should do it.  And so I'm actually hoping that at the end of this talk, there's going to be some people who show up for QA and discuss some things.  Because there are some issues that need to be worked out and as a community, as a hacker community, I think that we can do an outstanding job of this.  All right, so like I said, this isn't me telling you what to do. This isn't me saying this is how we need to do it.  This is an idea that I'm proposing and hopefully it will gain some traction.  The reason why I'm even talking about this, I figured that by now this kind of stuff would have already been hammered out since Katrina's been for a few years and Egypt was not too long ago.  But it hasn't evolved fast enough or hasn't even evolved properly.  So people are still, I mean, there's still the phrase that I heard today as people are dying in silence.  So it's something that we can do as a community to change that.  Okay, so let me tell you a little bit about myself.  I've got a couple master's degrees. I'm working as a PhD student.  I've been in the U.S. Army doing signals intelligence and I've got a bunch of certifications that stand by my name.  I'm also an employee at Trustwave. You can probably tell by the slides.  All right, so current events. One of the things that have hit home recently in the news is the Egypt and Middle East specifically.  And then what's happened is a lot of these revolutions were created by social networking.  And that's actually one of the reasons why the telecommunications systems have been shut down.  The revolutions themselves are typically decentralized.  And the natural disasters, there's been earthquakes, tsunamis, hurricanes, you name it.  There's communities that are hit every year that are basically devoid or lose their telecommunication capabilities.  And there has to be a way around that to get information to individuals.  All right, so I'm just going to go over some of the details.  I mean, this has been pushed in the news a lot, but this is the reason why we need to develop a better way of communicating in these kind of situations.  The biggest one obviously is the loss of life.  There's really no reason why we can't do something to try to alleviate that.  And the emergency services themselves are desperate to try to figure out a way to get help to those individuals that need it.  And so because of the telecommunication loss, there's obviously lots of life.  There's limited response by emergency services, like I said.  They don't know where to go because they have no information.  And then there's disruption of organized events.  If you go back to Katrina and trying to get people medical treatment or at least get them to the dome, it just didn't happen like it would need it to.  And there's the economic loss. That's the actual impact of the telecommunication.  That's not what I'm going to focus on here.  But we need to be able to create a different method for communicating besides just relying on the current infrastructure of the telecommunication system.  The representative of Louisiana said, and I'm going to read this quote because it's really pretty important.  It said that during the Katrina people could not communicate.  It got to the point that people were literally writing messages on paper, putting them in bottles and dropping them from helicopters to other people on the ground.  That's how bad it got.  So what actually happens during the communication breakdown?  We'll talk about both natural disasters and then if the government intervenes.  So natural disasters naturally wipe out the telecommunication infrastructure.  And it does actually require, in some cases, days to be able to get mobile devices on site in order to reestablish some of the telecommunications.  But in essence, it really takes months to be able to reconstruct that.  So a lot of people are out for a very long time.  Under government suppression, it's different, obviously.  The infrastructure remains intact.  Basically what happens is somebody just turns off a switch like they did in Egypt and shut down most of the telecommunications, internet, and things like that.  And based on our history or limited history with this, it's down for only a few days.  Usually it comes back up because of the economic pressure more than anything else.  So what actually happened in the instance with the Japanese earthquake and the tsunami, it was impacting the cell phone, landline phones.  It interrupted the power.  All transportation was pretty much shut down and it actually impacted the undersea communication as well.  So we're looking at shut off of internet services in the region.  We're also looking at the inability to get emergency services to the location.  Under the government and the corporate response to this was to use loudspeakers.  You may have seen it happen, but governments have vehicles that drive around the broadcast this information over loudspeakers.  The television news broadcast, they were trying to provide information to the individuals that were affected,  but you also have to remember is that because of power issues, they were unable to receive a lot of that information.  Mobile cellular bases were actually brought into the area in order to try to reconnect.  And then there was an increased use of Wi-Fi hotspots.  This wasn't necessarily in the area affected.  This was in areas outside of it. So basically as people were able to get out of the impacted area,  they were able to communicate with family friends and things like that at different hotspots that were not impacted.  So let's talk about Hurricane Katrina.  The impacts were cellular, landline phones, same thing as before.  The local television stations, they were decimated.  The broadcast information was broadcast outside of the area.  So basically surrounding communities ended up picking up information that they needed to provide to the people that were in the affected area.  Again, it doesn't necessarily help anybody in that area simply because power is down, things like that.  Power obviously was lost in transportation again.  So the response was relocation of the new services.  Like I said, they moved them out of that area entirely in the hopes that somebody would be able to at least press on the information,  but at least it would get out there.  Again, mobile cellular base stations were pretty much on site within 72 hours.  And then there was actual increase of use of amateur radio operators,  which is one of the things I'm going to briefly mention and more from a perspective of a multi-tier approach.  And I think this is an outstanding method of communicating, but it's not pervasive enough in our community to be able to positively affect situations.  All right. So let's talk about the human impact of Katrina.  The communication breakdown actually did cause deaths.  I mentioned the loss of life before.  Well, here's an actual quote from an individual who was writing a thesis, a master's thesis,  Lieutenant Colonel Heather Kay Meads, Army National Guard.  He wrote this when he was at War College, I believe.  And the quote is, I'll read the quote straight out,  with communication breakdown, critical information could not be transmitted.  The levies broke and no one other than local residents knew about the massive flooding for several hours.  Victims could not communicate with possible responders, which increased the lack of response and devastation.  Lack of communications at all levels increased the chaos, death and destruction in the aftermath of Hurricane Katrina.  Right there, that's pretty damning of the infrastructure and the response.  So basically what we're going to talk about later on is how we can try to improve that.  That's really the gist of it.  All right. So let's talk about what happened during the Egyptian Revolution.  Impact of the social networks, mobile phones, television network coverage, Internet,  which started on January 27th and then extended for a few days till January 31st.  Because the mobile phone system was down, that eliminated the ability to do SMS messaging.  I mean, that's part and parcel and then landlines were disconnected as well.  So anybody that wanted to communicate with anybody else basically had that removed.  The primary focus of the Egyptian Revolution was to undermine the movement of people  and also to prevent information from that movement going outside of the area.  So what was the response by the individuals in that area that still had power,  they just didn't have the telecommunication capabilities.  So they started using smartphones as modems.  They also used landlines with dial-up modems, the ones that they could actually find working.  They used fax machines, which is good too, but again, you need a line in order to be able to do that.  And then amateur radio.  So now another proposed alternative that came out of that,  and I'm not sure if it actually did occur during the Revolution or not,  but it got a lot of press afterwards,  is the idea of using a wireless mesh network using laptops.  And we'll talk about that and I think it's a good idea,  but that's not necessarily something we're going to focus on today.  Okay.  So my focus is on handheld technology.  I'm specifically talking about cell phones.  I mean, that's ubiquitous enough where,  and they're intelligent enough from a computational perspective that  we have a device that can set up infrastructures at ad hoc.  And so that's why this talk, because it has that, we're at that capability now.  All right.  So the way that we can create ad hoc networks,  and that's really what we're talking about,  as opposed to the established telecommunication networks,  there's a couple of ways we can do that.  We can do it through a flooding relay or a routing relay.  And what ends up happening is just like what they were talking about  with the laptops, the ad hoc wireless connections using the laptops,  we can also apply that to our cell phones as well.  The idea behind a mesh network, besides the flooding and the routing,  is that the data dissemination goes to each of these nodes.  Each node itself then becomes a relay.  So what ends up happening is you capture and then disseminate the information.  This isn't new. This isn't something I'm proposing.  This is something that already exists.  And it's basically what has been proposed using the laptops.  There's two types, flooding and routing.  I already alluded to that.  Flooding and I'll actually have a demonstration or an image of that later.  Flooding basically hits every single network, or every single node, I'm sorry.  And then the routing one has predetermined directions of where it's going to go.  Some of the interesting examples of ad hoc networks that are out there,  there's a mobile ad hoc network and a vehicular ad hoc network.  I'm going to let you guys look more of that up.  Again, we're not going to talk about it, but it is some interesting proposals.  Nothing really has been pushed out as a standard or, you know,  it's more in the learning stages, it's more in the demonstration stages.  But it's clever.  And it could actually be applied into emergency situations like this.  All right.  So the purpose of an ad hoc technology, as I mentioned before,  there was some traction in the news after the revolution in Egypt.  But the idea behind it is to disseminate information.  The idea is we're going to push out revolutionary activities,  any evacuation notices, some weather alerts,  and then also to decrease information, the misinformation,  and also eliminate some of the fears,  because that's pretty rampant in any of these circumstances.  Especially during a national disaster where people don't know how to communicate.  Emergency services, they need to be communicated with obviously as well.  Fire, police, ambulance, hospital locations, and closures.  There was a ton of closures in Louisiana,  and a lot of people ended up going to hospitals that were shut down  and people who were in desperate need of support.  There's also something that kind of gets pushed by the wayside  is communication with relatives.  That doesn't seem to be as important to a lot of people,  but as far as government,  and honestly the first thing you care about when a disaster happens  is where are your loved ones and what are they doing?  And you want to make sure that you can communicate with them.  And if the telecommunication system is down, it makes it very difficult.  All right.  So I mentioned ad hoc nodes using laptops.  Let's talk about some of the advantages of that.  So the laptops already have TCP IP stacks integrated.  The advantage to that obviously is then it's easy to talk straight to the Internet.  Just a straight leap into it.  If you can find an access point that connects out, you're good to go.  Laptops actually meet or exceed the capabilities of routers depending on what you have.  And they're also extremely flexible.  You can load up apps.  You can use data storage.  There's a lot of accessories that you can add into it.  So there's definitely a good reason to use laptops as an ad hoc node.  And I'm not going to dissuade that from people from using that at all.  I think that's going to be a critical,  especially communicating into the Internet.  Some of the disadvantages that it's expensive,  it's also not very portable, extremely power hungry,  and does require preexisting software to be installed  in order to be part of that node.  If you're talking about a revolution or telecommunication disaster  where you cannot connect to the Internet,  you can't just selectively decide that you want to be part of that node  simply because you don't have any way of downloading the software that's needed for that.  Amateur radios.  Like I said, I was going to talk about this a little bit.  I think that the more traction we have in amateur radio enthusiasm across the world, the better.  Honestly, it only makes sense.  They've been a big proponent of being able to exist in emergency situations.  That's why a lot of people get into it,  to be able to provide a relay across the world.  The advantage of amateur radio, it can be both huge, massive towers.  It can be very small down to handheld.  Amateur radio will actually be able to send information over TCP IP.  It's very portable, like I said, if you're dealing with smaller handsets.  It does have a very long signal range since it's just using radio waves.  The disadvantage is specialized knowledge.  No, I'm not saying that it's complicated.  I'm just saying that the average person has no idea what to do with it  other than pretend it's a walkie-talkie.  It's also not ubiquitous.  It's not in everybody's hand.  I would say that 90, 95% of the people here have a cell phone,  but I would say we push in it even in this environment where 10% have amateur phones on them,  or amateur radios on them.  That's the problem that I see with amateur radios,  is that it's not everywhere it needs to be at the moment.  There are some corporate and government ad hoc nodes as well.  I mentioned some of them already.  Specifically, some of the loudspeakers, mobile cellular base stations,  and then the television.  Now, whether you really can call that a node or not is questionable,  but it is one way of providing information to individuals in the affected area  may not be the most effective.  The advantage to this one, though, is that it's authoritative.  You know that it's coming from an official source,  and when you're dealing with natural disasters, that's a really big thing.  You don't want to go by word of mouth.  You want to know what the real official word is.  The disadvantage is slow to respond, extremely slow to respond.  We saw that in Katrina. It was really bad.  And it does require infrastructures.  Base stations have to show up.  Television stations have to assume.  You can't just pick up and move them easily.  And it does consume resources, helicopters, mobile police force, et cetera.  And the other thing that ends up happening too is,  and we saw that in Katrina, not in Japan,  but people got very hostile with any authority organizations,  whether it was police forces on the scene or helicopters.  They were getting shot at all the time.  So that's something else that needs to be taken into consideration.  Okay, so now let me talk a little bit about the advantages of using cellular smartphones  in an ad hoc node.  This is also assuming that there is no telecommunication infrastructure that's available.  Again, like I said, it's everywhere.  And it's accepted technology.  Everybody, including my mom, has a cell phone.  And for my mom to have any technology is amazing.  It has lower power consumption than a lot of the other devices that we talked about.  It's very portable and extremely flexible, just like the laptops as well,  where we're dealing with apps, data storage, and accessories.  Some of the disadvantages, it does have some limited range,  and it does require preexisting software to be installed.  Now, I'm going to talk about later on the application that you guys downloaded.  I'm just going to give you...  I'm going to get up on a cell box later on,  but at this point, there's no reason why the operating system developers  don't have something like what we're going to talk about,  where you can create ad hoc networks using cell phones without a telecommunication infrastructure.  There should be no reason why that doesn't already exist in their operating system.  And so we need to actually push that to be spread out into the OSes  as they're distributed to the telecommunication companies.  As I mentioned before, the use of laptops is important.  The use of amateur radios is extremely important as well.  I don't think that there's any reason to take one of those solutions over another.  When you're talking about natural disasters, you're definitely talking about redundancy,  and you need to have that.  So cell phone services are very vulnerable to disruption,  so that's one of the reasons why we need to have this.  Powder outages impact most responses, both from the emergency services  and also from citizens trying to get information to the emergency services as well.  Portability is extremely critical because circumstances will change.  Whether or not a new storm front comes in or new waves of a disaster,  you never know what's going to happen.  And then there needs to be some interoperability,  and this is actually, I don't have a quote for this,  but this is a serious problem that has been identified by the government as well  during the Katrina's that a lot of organizations had no way of actually communicating with each other,  which is sad, but it's just the state of being.  So the next thing I'm going to actually talk about is the smartphone technology,  and I'm going to do a proposal for the future ad hoc communication methods.  And that's what we're going to get into.  Okay, so smartphones, that's what we're going to get into.  So the communication protocols that exist now, you guys know this.  IEEE 802.11, ABNG, and then there's Bluetooth.  And we're focusing on this, so we have an idea, like I said,  this is more of a brainstorming effort,  and this is what we have to deal with when we're talking about smartphones.  So as far as messaging and data, we have the ability to use Pop3, I-Map4, and SMS,  which obviously gets impacted.  And then we also have within the device as well a GPS antenna.  And most smartphones, it's pretty much standard now.  So a mobile ad hoc network,  this actually uses the internet technology, TCP IP stacks,  and it has a longer range basically because that's power.  Did we lose power?  I lost power up here as well.  Yep.  It's not just this outlet.  Yeah, what I needed is a smartphone that can actually push this information  to everybody else's smartphone. That would be fantastic.  We lost power.  Three times, right?  It's doing it on its own.  Bear with us here folks as we deal with some minor technical difficulties.  You guys are really bored, we can do the Jeopardy theme.  So while we're waiting for this, I actually wanted to bring up another topic while I'm up here.  I'm actually running the Be the Match bone marrow donor registry.  And what ended up happening is last year I ran it and we got some people to sign up.  But this year, Barcode, which is part of the vision network,  he ended up being negatively impacted and he will need a...  Excellent.  Anyway, so he actually will eventually need a bone marrow transplant himself.  There's also other individuals in the community that has the need for bone marrow as well from leukemia.  And there's a lot of other diseases too.  It's not surprising that a group this large that people are going to have a need for this type of medical assistance,  the bone marrow donation.  But to me the way I look at it, it's actually one of the coolest human hacks that you can do.  I actually was a donor myself and I'm telling you it's no big deal to go through,  but it's extremely life changing when you do it.  So for me it's been an extremely positive influence.  It's unfortunate that we have individuals in our community that are in desperate need now,  but we have the ability to help.  And if you have the time later today, if you can swing by the contest area in the center, there will be the match.  We're doing a drive trying to get people up on the registry.  Not everybody gets picked, but the ones that do are extremely helpful, happy to help out.  And there's also a blood drive going on in Barcode's name as well.  So definitely check out that if you're not willing to do the marrow as well.  Okay, so I think we're back up.  Thank you.  I think we're back up on the slides.  Let me go ahead and continue.  So we were talking about smartphones and we were talking about potential ad hoc networks.  And like I said, the proposal for mobile ad hoc networks is users' current technology has longer ranges,  but it does require a phone be capable of relaying data, which isn't really programmed right now.  And then it also consumes power rapidly.  Another alternative is the Bluetooth ad hoc network with lower power requirements and short ranges.  Now, I actually am going to propose today the Bluetooth ad hoc network doing it that way as opposed to the mobile ad hoc network  where we use the TCP IP stack.  I'm assuming that later on that somebody will be able to figure out a way to bridge the information from Bluetooth  that gets onto a system and then it passes over to TCP IP stack.  That should be pretty straightforward.  But the reason why I'm pushing the Bluetooth is pretty much because of the power requirements,  much less intense than the Wi-Fi.  And when you're talking about natural disaster specifically,  that becomes a really critical component to being able to communicate externally.  And some of the solutions that people have been using is cars are broken down,  there's flooding in the streets, whatnot, but they're still able to power their devices  because they usually carry around some sort of way of connecting into a vehicle,  a battery through the cigarette lighter, whatnot.  So power is there, it's just not as easy to get to,  and the less power consumption that you use, the better.  That's my personal viewpoint, and that's why I'm going to push the Bluetooth ad hoc network.  So pretty much from here on out, that's what we're going to do.  And I actually have a slide on which one's better under the different circumstances.  The real ultimate goal is to be able to have the TCP IP connection,  especially during revolution,  but honestly just being able to get the information out is critical enough.  And the other advantage to the Bluetooth as opposed to the TCP IP Internet  is that data stays local.  It's easier to disseminate the information to a very specific region  if you're just using Bluetooth because it won't hop onto the Internet  and then get to somebody in India when the services are needed in Louisiana.  Okay, so what data are we actually talking about that we need to send out?  So emergency service information is probably the forefront of this discussion,  but I do want to mention that there are other things that we need to talk about  like the revolutionary activities,  and then of course like I said evacuation notices, weather alerts, things like that.  Now I will also say that there will be a need for encryption during this.  It's not the application that I had you guys download  for those that were willing to do it.  There is no encryption at this point, but we'll talk about that here shortly.  Okay, so the application that was written,  I'm not a good enough programmer to be able to do it myself,  so I've got a buddy to help out,  and like I said, right now we're dealing with the droid,  and I'm going to actually solicit people after this to start helping me out  on some of the other platforms, or at least start talking about them.  But I'm calling it the autobahn, and the reason why is the autobahn is actually,  I thought it, yeah, it's right here,  top automated broadcast ad hoc network that made perfect sense.  And the idea behind the autobahn open source project is to develop applications for cell phones.  And actually, the end result is to get the applications installed as default  on these smart phone devices.  I mean, you already got your email, you got your Safari on iPhone,  why don't you have something that can communicate with other phones in emergency circumstances.  So use existing smart phone technology to create ad hoc networks.  Also find the shortest path possible to and from the emergency services.  And when we talk about the broadcast routing, then we'll get into that.  And then also allow people to join or drop conferences,  or part of the channels as needed, and then provide confidentiality integrity.  When you're thinking about revolutionary activity,  you want that, the revolutionary individuals will want that confidentiality  and that integrity to be able to push out the information to those individuals that need it.  We're doing this here at this location, we're still going.  You want some way of knowing that it's from that individual.  And then also they will want to talk to some of the other people that are in charge of it,  or at least leading the cause and being able to do that in a confidential manner.  It also needs to have an extremely easy user interface.  Like I said, my mom's got smart phones, so now it has to be extremely simple to use.  Because if it's not, she's never going to use it.  And then also integrated, like I said, into the current phone kernels  so that it will get pushed out for everybody that buys it.  And the other thing too is that by now you guys pretty much figured out  this is not going to be difficult to implement.  This should be very simple.  As I was thinking about it and trying to figure out why we haven't already done it,  it was one of those dumb moments where it's so simplistic  that it should have already been discussed and online.  All right, so when we're dealing with, let me go back.  So when we're talking about existing smart phone technology,  this does limit some phone technology, obviously.  It limits it just to, you know, we're dealing with the Android phone  and the BlackBerrys and iPhones and things like that.  Some of the older or less advanced cell phones aren't going to be able to be a part of this,  but it's becoming a lot more popular.  All right, so let's talk about the shortest path.  I mentioned that it's going to have a graphic here.  The reason why I'm proposing the flooding relay is because you don't have any  routing information to worry about.  That's part of the advantages of having EdHawk.  So phones will be able to pass information and you see the red line  basically going from the center to the receiver as quickly as possible.  But there are some problems. You'll see that there's going to be some  spamming problems and there's also going to be infinite loop problems  for anybody that is interested in the networking stuff.  All right, and I'll talk a little bit about that as well.  All right, so again, during the shortest path,  all messages get sent to all available phones in the area,  but we should have the ability to filter out the ones that we want to view.  In other words, we're going to create channels,  so that people can look to things that they're interested in  and ignore everything else.  But going back to that first bullet is that all messages get sent out  to all cell phones.  So you'll have emergency information in there as well as detailed information  from your mom, just a matter of picking and choosing which ones you want to see.  And then I mentioned infinite loop problems.  So to deal with that is going back to some of the ways that we deal with  the network layer three stuff is just use timestamps and dropped after a set time  instead of time to life or just using timestamps.  And then the spamming problem, phones can actually recognize who they connect to  to push the information to, so they won't replicate messages.  They will continue to connect to them if they can with any additional messages  that they have, just not repeat anything that they've already sent.  All right, so let's talk about some of the chat channels.  So the user should be able to subscribe to the chat channels, like I mentioned.  Think of them as chat rooms.  That again prevents users from seeing all the messages that go across the network.  That way you don't get a flood of information, you get just the information that you want.  But you also need to have in the app some pre-existing chat threads  so that you can receive information from emergency services as well.  That way you know that they come from authoritative individuals as opposed to somebody  who just want to mess with your head.  And then users should be able to create and view local chat channels as they need to.  And the ability to create them is actually critically important because  when you're talking about like revolutionary type of activity,  you need to be able to create stuff on the fly.  And so if users want to be able to relay some information,  they just saw an event that occurred.  They need to pass that information on to somebody.  They can create a chat channel.  People will see it on their phone and be able to subscribe to it.  And their phones will continue to push that information on regardless.  Let's talk about security confidentiality and integrity.  So security, this is obviously a big issue here.  One of the things that I approached this project with is that under certain circumstances,  specifically emergency medical services where you're in need,  you don't care about security.  You care about getting that message out.  So there has to be a little bit of balance between security and availability.  And that's always the case.  But the applications and smartphones can use public private keys.  Not necessarily PKI.  We're not talking about infrastructure.  We're talking about the ability for people to create their own public and private keys  and be able to push that information on to phones or actually people being able to pull that information,  the public keys, as they needed to.  So scenario is during revolutionary situation.  If people want to stay connected with this individual's communication,  they should be able to download a certificate for that particular chat channel.  It will have that information in there.  And they will be able to know that it came from that person because it was signed by their private key.  So that provides the confidentiality.  Also, if the person who is the revolutionary leader wants to restrict access to his messages,  he can just also limit who has access to that public key.  And then, like I said, integrity broadcasts the public key to the world if you want to.  So everybody knows it comes from you.  One problem in Egypt a lot is that they weren't sure if it was some of the messages were coming out  from the individual who was considered the leader for that event.  Under natural disaster, the confidentiality integrity are both pretty much the same.  We need to have pre-installed, my view is, we need to have pre-installed public keys  for emergency services on that phone in that application.  That way, the emergency services can get that information out using a private key  that has been distributed to them in a controlled manner.  And it also, by using that, it allows you to encrypt the information that you're sending to the emergency services  so that they're the only ones that can read it.  As I gave a warning at the very beginning of this, for anybody that downloaded the app,  if you push the emergency button and you go through the system and you send that message,  it's going to send off a couple bits of information.  One is your latitude, which if you're talking about, I have a heart attack  and I need somebody here now, you'll want that information given out.  That's fine.  My personal view is I don't care if anybody sees that.  But the next thing that does go out also is your phone number.  That will also reduce the opportunity of abuse and that will also increase the opportunity  should telecommunication systems come back online,  that people who are in dire need can get connected to  or the emergency services can push the telecommunication services,  the mobile networks to allow access to that individual.  Okay.  And then integrity is, again, if you want reliable information from a government entity,  you can use public keys having that pre-installed and then making sure that the emergency services,  the government, whomever is using that private key, then you're good to go.  Okay.  As I mentioned, we need to integrate this into the kernel.  Here's a little bit of a soapbox.  We need to persuade the operating system manufacturers to include this type of application  in all of their distributions.  And it actually needs to be interconnectivity.  So I don't care if it's iPhone, I don't care if it's BlackBerry,  they should all talk to each other.  And then there is some current roadblocks.  The Droid phone is changing pretty rapidly.  The latest version has reduced a lot of these problems.  And I'll show you one of them that they will eliminate in the latest version.  And then this can actually save lives, but it's not profitable.  And so that's where our challenge really comes into play,  that telecommunication companies don't have a reason to implement something like this.  They want people to use their telecommunication system.  They don't want thinking.  I'm talking for them, which is probably not appropriate.  But my personal view is that they would be reluctant to have something like this  that would circumvent and could circumvent effectively and for long periods of time  their telecommunication infrastructure.  I mean, there's no reason why this kind of application couldn't be used on a broader scale.  A lot of people are already using Bluetooth,  and so it's not a big surprise that it would be considered a problem  if it was used consistently and daily.  And then...  But the problem shouldn't be about control of the information.  It really should be about getting the information to and from the individuals  that need it the most during these kind of situations.  Okay, so now for those who have actually downloaded the Android phone,  hopefully you've been playing with it, but I'll show you some screenshots for those that don't.  This is the demo part.  After the demo, there's a few more slides,  and I'll discuss also some of the...  very briefly, some of the problems that we're facing  and some of the things that need to be worked out.  And I'm actually going to invite everybody who's interested in talking about this to the QA room  so we can even start hashing some of this out  or we can get some people to start participating in development.  Right.  So this is a very stripped-down version.  It's very simplistic.  Basically, you need to turn it on or turn it off.  I would actually think that in one of the design requests that I have  is that Autobahn automatically turns on when there is a period of time  where it is not connected to a telecommunication system.  That way people can start automatically pushing this information back and forth between each other  without even knowing about it.  It can also allow them to know that a disaster is going on when they open up their phone.  They can't figure out what's going on, and it's right there for them.  Their emergency service information is right there.  But in the meantime, people should be able to start and stop the service as they see fit.  The second half on the right-hand side, this is one of the hurdles that is currently a problem  but is actually being eliminated in future deployments of the Android operating system,  is that it is a limited amount of time for other Bluetooth devices to be able to actually connect  and discover and connect to the system.  We need this to be more pervasive.  We need it to be turned on and left on as needed.  Yes, it drains power, but when we are talking about life's limbs, eyesight,  it's an easy call to say, let's burn the power.  So, if you click on the button at the very top, it will say emergency,  you get this next screen right now.  It's got the medical, police, and fire, but the Homeland Defense has been talking about zombie infestation,  so I think that was probably appropriate as well.  So, we've got an emergency for any of these, and if you click on one,  it actually takes you onto the right-hand slide which shows you,  basically it breaks down into what is your emergency circumstance.  So, if you're dealing with a heart attack, first thing you would click on is the medical,  and then it would say, basically if it's personal, and it would break down,  whether or not it's life-threatening or not, and then be able to provide that information.  As, like I said, this is simplistic for my mom to be able to handle.  She'd be able to click the right button, and then it would be,  at the last thing that would end up happening is a message would be created.  This is actually available on the application that you can download now,  where it produces a message that says your latitude, your longitude,  your phone number, and any sort of emergency information that you can additionally provide as well.  In this case, the individual is under attack from robots from the future.  So, okay, a little bit of humor in there, but it is actually extremely,  I think, a very important discussion.  I'm not saying that the autobahn is the end-all-be-all way to go with it.  I am proposing that this is the kind of thing that we need to see pushed onto all smartphone devices.  Okay, so we're going to talk about conclusion real quick.  A couple more slides.  We've got plenty of time before you guys have to bail out.  It's only 12.45, so just hold on for a second.  All right, so I need your help.  I need programmers.  I need Android, iPhone, BlackBerry.  I also need people who are interested in becoming leads for any of this.  The individual who is helping me out, he's got a full-time job,  but he was able to do a lot, and from his guidance,  I don't see this as a long, complicated, drawn-out process.  I can see this with a concerted effort, a matter of months,  to be able to get something like this up and going,  especially with the new versions of operating system coming out that allow more flexibility in this.  So this is an opportunity to actually do something that can benefit humanity,  saves life, and extremely simple to be able to implement.  If you want to hook up with me and get this going,  or if you want to debate this,  or you're telling me that this is a crap idea and you have a better one, I'm all ears,  you can contact me at autobahn at hackardemia.com.  Hackardemia.com also has a link to download the app again, and I'll just leave that up,  and as it progresses, we'll add that as well.  So this is my thank you to everybody.  We're going to go to the breakout room after this.  Some of the problems that we need to discuss still, as a community,  or between me and the programmers, it doesn't really matter,  we need to deal with power resupply, application interoperability,  prepopulated certificate, message size, and anything else you guys can think about.  All right, that's going to be it, gentlemen and ladies.  I appreciate your attendance.  I know you've got a lot of things to do, but I definitely appreciate you being here.  Thank you.
DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_0_755.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_756_4079.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_4080_4139.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_4140_4475.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_4476_5543.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_5544_7919.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_7920_8063.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_8064_9227.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_9228_11447.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_11448_13295.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_13296_14879.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_14880_16067.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_16068_17399.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_17400_18047.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_18048_20915.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_20916_23003.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_23004_25019.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_25020_27047.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_27048_29051.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_29052_31223.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_31224_32999.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_33000_33323.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_33324_34451.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_34452_34763.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_34764_34811.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_34812_35339.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_35340_35387.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_35388_35447.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_35448_35891.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_35892_36203.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36204_36347.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36348_36419.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36420_36503.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36504_36551.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36552_36611.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36612_36659.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36660_36719.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36720_36803.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36804_36887.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36888_36959.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_36960_37079.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_37080_37163.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_37164_37211.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_37212_37259.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_37260_37487.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_37488_42659.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_42660_43631.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_43632_44663.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_44664_45287.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_45288_48467.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_48468_48527.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_48528_49235.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_49236_50159.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_50160_51923.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_51924_53555.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_53556_58823.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_58824_61715.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_61716_64523.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_64524_64595.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_64596_64835.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_64836_66047.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_66048_66911.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_66912_67151.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_67152_68915.png DEF_CON_19_-_Thomas_Wilhelm_-_Staying_Connected_during_a_Revolution_or_Disaster_Ns4yJH1kbn0_1_68916_69704.png