Detection of Tracking Devices, Motor Vehicle Bugs, and other interesting things

1. Horseless CarriageHorseless Carriage
Exploits and Eavesdropping DefensesExploits and Eavesdropping Defenses
Boston 2009Boston 2009
Copyright 2009, James M. Atkinson

2. Speaker Contact
James M. AtkinsonJames M. Atkinson
www.tscm.comwww.tscm.com
jmatk@tscm.comjmatk@tscm.com
(978) 546-3803(978) 546-3803
www.linkedin.com/in/jamesmatkinsonwww.linkedin.com/in/jamesmatkinson

3. What Are We Looking For?What Are We Looking For?
 Any Threat or Risk, PeriodAny Threat or Risk, Period
• Tracking DevicesTracking Devices
• Video DevicesVideo Devices
• Audio DevicesAudio Devices
• Telemetry DevicesTelemetry Devices
• Exploitable HardwareExploitable Hardware
• Other Hazards or RisksOther Hazards or Risks

4. Vehicle Sweep BasicsVehicle Sweep Basics
1.1. Make a PlanMake a Plan
2.2. Follow the PlanFollow the Plan
3.3. ““Show Your Work” - DocumentationShow Your Work” - Documentation
4.4. Work From Shop ManualsWork From Shop Manuals
5.5. Essential Tools and Test EquipmentEssential Tools and Test Equipment
6.6. Place to WorkPlace to Work
7.7. Knowledge of ThreatsKnowledge of Threats
 What is out there?What is out there?

5. Essential ResourcesEssential Resources
 Shop ManualsShop Manuals
• Original Hardcopy Shop ManualsOriginal Hardcopy Shop Manuals
 Avoid “Chilton Style”, or Multi-Year BooksAvoid “Chilton Style”, or Multi-Year Books
 Avoid CD’s, or Hardcopy ThemAvoid CD’s, or Hardcopy Them
• Make, Model, Year, Trim?Make, Model, Year, Trim?
 Trim and Powertrain VariationsTrim and Powertrain Variations
• Electrical Diagrams are CriticalElectrical Diagrams are Critical
• These are VERY ExpensiveThese are VERY Expensive
• NOTNOT the Owners Manualthe Owners Manual

6. Essential ResourcesEssential Resources
 FlashlightsFlashlights
• Plus, lots of extra batteriesPlus, lots of extra batteries
 Compact Mirror SystemCompact Mirror System
 Thin Nitrile GlovesThin Nitrile Gloves
• Keeps the grease out of the carKeeps the grease out of the car
 Protective Tarp or Covers for SeatsProtective Tarp or Covers for Seats
 Ground Tarp (if appropriate)Ground Tarp (if appropriate)
 Warm Weather is optionalWarm Weather is optional

7. Critical Test EquipmentCritical Test Equipment
 Broadband Signal DetectorBroadband Signal Detector
• One for each Mobile “Uplink”One for each Mobile “Uplink”
 Sharp Band Pass Filters AND Matching AntennaSharp Band Pass Filters AND Matching Antenna
 Most of the U.S. Requires 4 FiltersMost of the U.S. Requires 4 Filters
 Spectrum AnalyzersSpectrum Analyzers
 Amplifiers and AntennasAmplifiers and Antennas
• DC Adapter/HP FilterDC Adapter/HP Filter
 Digital VoltmeterDigital Voltmeter
 PCM ToolsPCM Tools (Power Train Control Module Interface)(Power Train Control Module Interface)
 Bluetooth DongleBluetooth Dongle
 Cell Phone Service MonitorCell Phone Service Monitor

8. ImportantImportant
 In a Perfect World:In a Perfect World:
• Performed in a 4500+ sq ft GaragePerformed in a 4500+ sq ft Garage
 Have a Hydraulic Lift, Four Mechanics, etc.Have a Hydraulic Lift, Four Mechanics, etc.
 Contain Every Known Mechanics ToolContain Every Known Mechanics Tool
 Sterile Clean Room, Epoxy Floors, Lab CoatsSterile Clean Room, Epoxy Floors, Lab Coats
 In Reality?In Reality?
• Work With What You HaveWork With What You Have
 In the Amount of Time Are GivenIn the Amount of Time Are Given
 Always bring cleaning suppliesAlways bring cleaning supplies
……and a first aid kitand a first aid kit

9. PCM ScannersPCM Scanners
 GenericGeneric
• BnB, AutoTapBnB, AutoTap
• ActronActron
• One-Size-Fits-All MentalityOne-Size-Fits-All Mentality
 ProprietaryProprietary
• DealershipsDealerships
• Snap On, MacTools, etcSnap On, MacTools, etc
Snap-On MODIS

10. Common Vehicle ExploitsCommon Vehicle Exploits
 Cell PhoneCell Phone (from anywhere in the world)(from anywhere in the world)
 Concierge ServicesConcierge Services (more to follow)(more to follow)
• On-Star/GM, Ford, ToyotaOn-Star/GM, Ford, Toyota
• Lethal To PrivacyLethal To Privacy
• ““Listen-In” FeatureListen-In” Feature
 Vulnerable >12-bit Security SystemsVulnerable >12-bit Security Systems (4096)(4096)
 Garage Door Openers >8 bitsGarage Door Openers >8 bits (256)(256)
 Similar “Conveniences”Similar “Conveniences”
 SpeedPass/RFIDSpeedPass/RFID

11. Vehicle Sweep BasicsVehicle Sweep Basics
 It takes the spy less then 30It takes the spy less then 30
seconds to install a bug or trackingseconds to install a bug or tracking
device in a car (install).device in a car (install). <30<30
sec.sec.
 But it only take 5 seconds or less toBut it only take 5 seconds or less to
exploit something that you alreadyexploit something that you already
have installed (exploit).have installed (exploit). <5 sec.<5 sec.

12. Detection ModalitiesDetection Modalities
 RF AnalysisRF Analysis
• Signals on the AirwaysSignals on the Airways
 Variety of EquipmentVariety of Equipment
• ““Tickle the Sleeping Dragon”Tickle the Sleeping Dragon”
• Make it wake up and make noiseMake it wake up and make noise
 Voltage/Current AnalysisVoltage/Current Analysis
• What Does the PCM and Radio Draw?What Does the PCM and Radio Draw?
• 3+ mA draw is fully detectable3+ mA draw is fully detectable

13. Detection ModalitiesDetection Modalities
 Physical InspectionPhysical Inspection
• Dismantle As NeededDismantle As Needed
 Always Limited by TimeAlways Limited by Time

14. Detection ModalitiesDetection Modalities
 NLJ Ping on GPS and Cell/PCS BandsNLJ Ping on GPS and Cell/PCS Bands
• Generic NLJD Good for 800/900 MHzGeneric NLJD Good for 800/900 MHz
• GPS/PCS Needs a Different UnitGPS/PCS Needs a Different Unit
• Sweep Generators with Off-Set NonSweep Generators with Off-Set Non
Contiguous Sweep is Very ProductiveContiguous Sweep is Very Productive

15. Manual Under Vehicle InspectionManual Under Vehicle Inspection
 Reality:Reality:
• A Lot Of Crawling Under CarsA Lot Of Crawling Under Cars
• Less Then Optimal SituationLess Then Optimal Situation
• Takes Hours, and it is MessyTakes Hours, and it is Messy

16. TrackingTracking
 Most Often a GPS Receiver, and CellMost Often a GPS Receiver, and Cell
Phone RepeaterPhone Repeater
 Could Be an On-Star SystemCould Be an On-Star System
• Sold Under Many Names/VariantsSold Under Many Names/Variants
 Lo-Jack, Remote ActivationLo-Jack, Remote Activation
 Security System ElementsSecurity System Elements
SiRF State of the ArtSiRF State of the Art
SmallerSmaller thanthan your thumb,your thumb, and shrinking…and shrinking…

17. On-Star Surveillance ModuleOn-Star Surveillance Module
 Almost All GM Vehicles, Lexus, etcAlmost All GM Vehicles, Lexus, etc
 Simple ModuleSimple Module
 GPS TrackingGPS Tracking
 TelemetryTelemetry
 Engine ControlEngine Control
 Audio SurveillanceAudio Surveillance

18. On-Star Surveillance ModuleOn-Star Surveillance Module
 Factory InstalledFactory Installed
 Highly ExploitableHighly Exploitable
 Hybrid DeviceHybrid Device
 NoteNote thethe Size…Size…

19. On-Star Surveillance ModuleOn-Star Surveillance Module
 Easy to Find with Spectrum AnalyzerEasy to Find with Spectrum Analyzer

20. On-Star Surveillance ModuleOn-Star Surveillance Module
 Easy to Find with ScrewdriverEasy to Find with Screwdriver

21. Similar European ModuleSimilar European Module
 Easy to Find with ScrewdriverEasy to Find with Screwdriver

22. Vehicle Video SurveillanceVehicle Video Surveillance
 Normally, it is Less Important to KnowNormally, it is Less Important to Know
What is Going on Inside a VehicleWhat is Going on Inside a Vehicle
 Important to Know What isImportant to Know What is Being SaidBeing Said
 Most Important to KnowMost Important to Know WhereWhere thethe
Vehicle is Going, or Has Been in the Past.Vehicle is Going, or Has Been in the Past.
 Thus, Video is of Less Value to Most SpiesThus, Video is of Less Value to Most Spies

23. Video CaseVideo Case
 Reverse Police Dash CamsReverse Police Dash Cams
• Officers Didn’t Know the Chief Did ItOfficers Didn’t Know the Chief Did It
• Officers Sleeping In CruisersOfficers Sleeping In Cruisers
• Chief Re-Aimed the Dash CamsChief Re-Aimed the Dash Cams
• Result: Three Suspended OfficersResult: Three Suspended Officers

24. Video CaseVideo Case
 Parental SupervisionParental Supervision
• Old Owners Never Removed ItOld Owners Never Removed It
• Video Cameras and Recording Sys.Video Cameras and Recording Sys.
• Old Owners Honestly Forgot to RemoveOld Owners Honestly Forgot to Remove
• Originally Installed to Supervise KidsOriginally Installed to Supervise Kids

25. Video CaseVideo Case
 Car Rental CompaniesCar Rental Companies
• ““Liability Recorders”Liability Recorders”
• High Risk RentersHigh Risk Renters
• Customers Not AmusedCustomers Not Amused
• Records a Video of the CrashRecords a Video of the Crash

26. Video CaseVideo Case
 Suspicious SpouseSuspicious Spouse
• ““That’s not my brand of lipstick…”That’s not my brand of lipstick…”
• Very Common SituationVery Common Situation
• Marital InfidelityMarital Infidelity
• Results: DivorceResults: Divorce (device found too late)(device found too late)
 Multi-Billion Dollar DivorceMulti-Billion Dollar Divorce

27. Typical GPS TrackerTypical GPS Tracker
 Passive Tracker/RecorderPassive Tracker/Recorder
 Computes LocationComputes Location
 Stores FixesStores Fixes
 Later RetrievedLater Retrieved
 Spy DownloadsSpy Downloads
 Very, Very CheapVery, Very Cheap
 Millions SoldMillions Sold

28. Typical GPS TrackerTypical GPS Tracker
 Drop In and RecordDrop In and Record
 Easy User InterfaceEasy User Interface

29. Typical GPS TrackerTypical GPS Tracker
 Active GPS TrackerActive GPS Tracker
 Cellular Data LinkCellular Data Link
• AT+CTK CommandsAT+CTK Commands
• Default PasswordDefault Password
 ““00000000”
• Default Unit ID
 “00000000”
• Spies Rarely Change
Unit ID or Password
from Factory Default

30. Typical GPS TrackerTypical GPS Tracker
• 98% Detected with:
 AT+CTKP=“00000000”,””,””,”00000000”
 AT+CTKC=10,10,10,3600,0,1,1,1,0,0,0
• ““Screams Itself to Sleep”Screams Itself to Sleep”
 Kills the Battery in MinutesKills the Battery in Minutes
• Max Out Spies AccountMax Out Spies Account
• Easy To FindEasy To Find – just DF– just DF
• Change PasswordChange Password
 Seize ControlSeize Control
• Smoke Out the SpySmoke Out the Spy
• Burn the SpyBurn the Spy

31. Active GPS TrackerActive GPS Tracker
 Typical FBI “Classified” TrackerTypical FBI “Classified” Tracker

32. Active GPS TrackerActive GPS Tracker
 Detection of FBI “Classified” TrackerDetection of FBI “Classified” Tracker

33. GPS Tracker Current DrawGPS Tracker Current Draw

34. Audio RisksAudio Risks
 Microphones,Microphones,
• Easy enough to visually find microphonesEasy enough to visually find microphones
 MirrorMirror
 A-PillarsA-Pillars
 Head LinersHead Liners
 CarpetCarpet

35. Audio RisksAudio Risks
 SpeakersSpeakers
• All Speakers are a IssueAll Speakers are a Issue
• Any Speaker Can Be Used as MicrophoneAny Speaker Can Be Used as Microphone
• Follow Those Speaker Wires CloselyFollow Those Speaker Wires Closely
• Be Suspicious of “Dead” SpeakersBe Suspicious of “Dead” Speakers

36. Audio RisksAudio Risks
 Audio RecordersAudio Recorders
• Often under seats or inside upholsteryOften under seats or inside upholstery
• May Be Wireless for Audio File RetrievalMay Be Wireless for Audio File Retrieval
• May Need to Be Manually Retrieved By SpyMay Need to Be Manually Retrieved By Spy
• Hunt For the 32.76 kHz Clock SignalHunt For the 32.76 kHz Clock Signal
• Usually A Quick Plant DeviceUsually A Quick Plant Device

37. Audio RisksAudio Risks
 TransmittersTransmitters
• Mind your Vehicle BeltlinesMind your Vehicle Beltlines
 Old School – Below the Belt Line (Bumper Beepers)Old School – Below the Belt Line (Bumper Beepers)
 New School – Above the Belt Line (GPS and Cell)New School – Above the Belt Line (GPS and Cell)
• A Transmitter Is Really Easy To DetectA Transmitter Is Really Easy To Detect
• Safest Option for the Lazy SpySafest Option for the Lazy Spy
 A Lazy Spy is Easy To CatchA Lazy Spy is Easy To Catch

38. Vehicle Audio BugVehicle Audio Bug

39. Vehicle Audio BugVehicle Audio Bug

40. Truck Telemetry SystemTruck Telemetry System
 1600 - 1645 MHz Sat Uplink

41. Truck GPS + Telemetry SystemTruck GPS + Telemetry System

42. TelemetryTelemetry
 Primarily for Trucks and Service VehiclesPrimarily for Trucks and Service Vehicles
• Little Black BoxesLittle Black Boxes
 PCM InterfacePCM Interface
 Airbag ControllersAirbag Controllers
 Accident Recorders, Remembers EverythingAccident Recorders, Remembers Everything
 Attorneys, Police, and DOT Love TheseAttorneys, Police, and DOT Love These
• Who Did What, When, and WhyWho Did What, When, and Why
• May Be Interfaced To:May Be Interfaced To:
 Tracking SystemTracking System
 Video, or ImagingVideo, or Imaging
 Voice RecordingVoice Recording

43. 70-80’s Era Bumper Beeper70-80’s Era Bumper Beeper
“Bumper Beeper” Transmitter
Direction towards Car
Direction Finder Receiver
Victims Car
Spies Car

44. Early 90’s Era Bumper BeeperEarly 90’s Era Bumper Beeper
 Note the Big MagnetsNote the Big Magnets

45. 2004 Era Bumper Beeper2004 Era Bumper Beeper
 Range is Blocks to MilesRange is Blocks to Miles
 Batteries Last Hours to WeeksBatteries Last Hours to Weeks
 Does Not Use GPS as AllDoes Not Use GPS as All
 Attached with MagnetsAttached with Magnets

46. 2005 Typical DHS Tracker2005 Typical DHS Tracker
 1.6"x1.1"x.85“ (with 9 days of battery life)

47. 2006 Era Bumper Beeper2006 Era Bumper Beeper
 Smaller Then a QuarterSmaller Then a Quarter

48. LoJack Tracking System
173.075 MHz
Effective radiated power (ERP) of approximately 200-300 mw.

49. LoJack Tracking System
 What It Looks Like InsideWhat It Looks Like Inside
 Nothing SpecialNothing Special

50. LoJack Schematic

51. LoJack Detected

52. LoJack Period “Covert Burst”
Every 16 or 360 Seconds
16 Second Hunt Mode
1 Hour Sleep Mode

53. Other Hazards or RisksOther Hazards or Risks
 Safety IssuesSafety Issues (Caused By the Spy)(Caused By the Spy)
• Damaged WiresDamaged Wires
• Battery Loading (No Start)Battery Loading (No Start)
• Bad BulbsBad Bulbs
• Vehicle FiresVehicle Fires

54. Other Hazards or RisksOther Hazards or Risks
 SecuritySecurity
• Bad LocksBad Locks
• Bypassed AlarmBypassed Alarm
• Missing Grease/GrimeMissing Grease/Grime
• Scraped Area under CarScraped Area under Car
• Velcro in Odd PlacesVelcro in Odd Places
 ObservationsObservations
• Leaking Fluids, Bad Things Under SeatsLeaking Fluids, Bad Things Under Seats
• Missing Jewelry = Found Bug, etcMissing Jewelry = Found Bug, etc

55. Use The TSCM ProfessionalsUse The TSCM Professionals
 Highly Specialized SkillsHighly Specialized Skills
 Laboratory Test GearLaboratory Test Gear
 Long, Tedious TestsLong, Tedious Tests
 Hundreds of Test FormsHundreds of Test Forms
 Takes HoursTakes Hours
• A Full ExamA Full Exam
 12-36 Hours Per Vehicle12-36 Hours Per Vehicle
• Cursory TestingCursory Testing
 Four HoursFour Hours

56. TSCMTSCM
Technical Surveillance Counter MeasuresTechnical Surveillance Counter Measures
 Inspection by a technician orInspection by a technician or
engineer of a physical item or placeengineer of a physical item or place
 Highly Technically TrainedHighly Technically Trained
 Vast Equipment RequiredVast Equipment Required
 Specialized ProtocolsSpecialized Protocols
Scientific Voice of ReasonScientific Voice of Reason

57. Illicit EavesdroppingIllicit Eavesdropping
In the United States overIn the United States over six millionsix million
dollarsdollars worth of surveillance devicesworth of surveillance devices
are soldare sold each dayeach day - This number is very conservative

58. Lay PersonLay Person
Defenses Against the Dark ArtsDefenses Against the Dark Arts

59. Defenses Against the Dark ArtsDefenses Against the Dark Arts
 Install Vehicle Security SystemInstall Vehicle Security System
 Consider Removal of On-Star, etcConsider Removal of On-Star, etc
 Minimize Cell Phone UsageMinimize Cell Phone Usage
 Minimize Bluetooth UsageMinimize Bluetooth Usage
 Buy Foil Bag for Speed-PassBuy Foil Bag for Speed-Pass

60. Parking CountermeasuresParking Countermeasures
 Always Lock Vehicles in AttachedAlways Lock Vehicles in Attached
Garage (with LOCKING doors)Garage (with LOCKING doors)
 Do Not Use Wireless Door OpenersDo Not Use Wireless Door Openers
 Always Park in Well Lit LotAlways Park in Well Lit Lot

61. Tampering CountermeasuresTampering Countermeasures
 Watch for “Scuffed” InteriorsWatch for “Scuffed” Interiors
 Watch for Missing Screws, and Wires.Watch for Missing Screws, and Wires.
 Be Wary of Panels being AjarBe Wary of Panels being Ajar
 Seats Moved?Seats Moved?
 Supervise Vehicle While In ShopSupervise Vehicle While In Shop

62. Bugged Vehicle Counter MeasuresBugged Vehicle Counter Measures
 Use a Flashlight and GlovesUse a Flashlight and Gloves
 Inspect Every Square cm outsideInspect Every Square cm outside
 Pay attention to lights and undersidePay attention to lights and underside

63. Bugged Vehicle Counter MeasuresBugged Vehicle Counter Measures
 Remove EVERYTHING from CarRemove EVERYTHING from Car
 Remove Boot/Trunk LinersRemove Boot/Trunk Liners
 Remove Rear SeatsRemove Rear Seats
 Remove Spare TireRemove Spare Tire
 Identify all wires and traceIdentify all wires and trace

64. Bugged Vehicle Counter MeasuresBugged Vehicle Counter Measures
 Inspect UpholsteryInspect Upholstery
 Inspect ConsolesInspect Consoles
 Inspect Glove BoxesInspect Glove Boxes
 Inspect DashInspect Dash
 Inspect Balance of Every Thing ElseInspect Balance of Every Thing Else

65. Essential Vehicle DataEssential Vehicle Data
Vehicle LocationVehicle Location
Plate and VIN #Plate and VIN #
Make and ModelMake and Model
Trim CodeTrim Code
Engine SizeEngine Size
ColorColor
ModificationsModifications
Date Manuf.Date Manuf.
Service Records, list of all prior workService Records, list of all prior work
Type of Audio Video Entertainment EquipmentType of Audio Video Entertainment Equipment
SIRIUS/XM?SIRIUS/XM?
On-Star, or Similar ServiceOn-Star, or Similar Service
Security System ModelSecurity System Model
Lo-Jack or SimilarLo-Jack or Similar

66. Vehicle Tasking ProtocolVehicle Tasking Protocol
Results = Average ofResults = Average of 324+324+ PagesPages
on Any Vehicle for a Full Inspectionon Any Vehicle for a Full Inspection
This Analysis is Usually Manually Intensive, but isThis Analysis is Usually Manually Intensive, but is
always based on what is found in the shop manualalways based on what is found in the shop manual
for your specific vehicle.for your specific vehicle.

67. Search MethodologySearch Methodology
1.1. Stand Off RFStand Off RF
2.2. Exterior SearchExterior Search
3.3. Trunk/LinerTrunk/Liner
4.4. Fast Access to InteriorFast Access to Interior
5.5. Engine CompartmentEngine Compartment
6.6. Electrical Tie InsElectrical Tie Ins
7.7. UpholsteryUpholstery
8.8. Dash and ConsolesDash and Consoles
9.9. Everything ElseEverything Else
10.10. Repeat, and ReverseRepeat, and Reverse
11.11. ““Shake and Tickle”Shake and Tickle”

68. CautionCaution
We have barely touched on:We have barely touched on:
1.1. How a vehicles can be buggedHow a vehicles can be bugged
2.2. How vehicle bugs are foundHow vehicle bugs are found
There are many other methodsThere are many other methods
You Must Pay Close Attention to DetailYou Must Pay Close Attention to Detail
Think about howThink about how YOUYOU can find bugscan find bugs

69. TSCM MantraTSCM Mantra
Always Assume that theAlways Assume that the
Vehicle is Bugged UntilVehicle is Bugged Until
You Can ScientificallyYou Can Scientifically
Prove Otherwise.Prove Otherwise.

70. Detection ToolsDetection Tools
Premium HandheldPremium Handheld
Digital Volt MeterDigital Volt Meter
Fluke 289Fluke 289

71. Detection ToolsDetection Tools
Premium HandheldPremium Handheld
OscilloscopeOscilloscope
Fluke 199CSFluke 199CS
FFT SpectrumFFT Spectrum
Analyzer ModeAnalyzer Mode

72. Detection ToolsDetection Tools
Spectrum AnalyzerSpectrum Analyzer

73. Detection ToolsDetection Tools
 Broadband RF DetectorBroadband RF Detector
 Use these in sets, with filtersUse these in sets, with filters

74. Vehicle Detection ToolsVehicle Detection Tools
 Audio Amp with DC Bias CircuitAudio Amp with DC Bias Circuit
 Look for Hidden MicrophonesLook for Hidden Microphones

75. Bug/Wiretap Detection ToolsBug/Wiretap Detection Tools
 Totally Avoid Spy Shop ToysTotally Avoid Spy Shop Toys
 Use Only Laboratory Grade TestUse Only Laboratory Grade Test
Equipment and ProceduresEquipment and Procedures
 Take All the Time You NeedTake All the Time You Need
 Never Miss the Details, EverNever Miss the Details, Ever

76. Cardinal RuleCardinal Rule
Convenience andConvenience and
Privacy arePrivacy are InverselyInversely
Proportional™Proportional™

77. www.tscm.comwww.tscm.com
Please Keep In TouchPlease Keep In Touch

78. Questions?Questions?
Thank YouThank You
????
????
??
??