From War Driving to Counter-Surveillance with Colonel Panic and Cooper

0:00you know, along similar lines, right? We wanted to really democratize counter surveillance and create ways for people to find out what surveillance is around them easily and cheaply, right? And get more information about how these systems are working. Hello and welcome to another episode of the Philip Wiley Show. I'm excited to be joined by Colonel Panic and Cooper. I found out about these gentlemen through their DevCon talk recently on privacy and devices to detect things that could impede on your privacy and they've discussed like flock cameras and some of the really cool things they were doing was watching that over a weekend. I thought, man, it would be awesome to get these guys on. So I was able to make a connection with Colonel Panic and then with Cooper.

1:03So it's really great that you guys are taking time out to join today. Welcome to the show. Thank you so much for having us. And I hope you're happy to be here. Yeah, that's great to have you guys on. So this is a really interesting topic that haven't had anyone on to discuss this before. So to be super cool, it's always good to see some things about the hardware side of things because I've had Matt Brown on before he pen tests hardware and stuff. So we're very interested in having someone that's kind of experts on the privacy side of things. And so let's start out. I usually ask my guests to share their hacker origin stories. So Colonel Panic, why don't we start with you? All right. I kind of started at a young age, lived in a very rural area in the south and I began to take things apart. Not always under the no good graces of my parents, but took a lot of things apart. We got ended up getting a computer that had, I believe, AOL dial up. And soon after that, I became

2:09interested in someone told me about 2600 magazine. So a couple of buddies and I would drive a couple of towns over to the only college town around and grab 2600 magazines. And so from there, I started, you know, honestly, I used key loggers to get my AOL password and then figured out how to how to disable the speaker on the modem. I actually have that 2600 magazines still here framed. And it's still got the commands written old passwords from the early days. But yeah, once I kind of, you know, I became interested in malware, young age, and Trojans, and things like that. And then kind of just kept doing projects, ended up getting in the restaurant business, ended up getting burned out on that, got into just working in a grocery store for a while, no pressure. And then COVID happened and I essentially had no, I have children had to stay home and I was like, I'll just go

3:11to, I'll just go to university for a while and I ended up, you know, I was interested in cybersecurity always. And I'm like, let's, let's, you know, older, more mature, not just the Wild West days of the internet playing with malware in the wild or whatever, like a kid. And so we started, we started, you know, I started college and then ended up getting a bunch of certs and they got, got hired on as a malware researcher. So, and now like my, my real passion is, is truly doing hardware and privacy stuff and building things. I like making things and rapid prototyping. So it's been a, it's been an interesting ride so far. Very cool. So Cooper, how about your, your story? Yeah, I got started. So when I was in fifth grade, my teacher was getting, they were upgrading the class computers and he took my side and said, hey, I noticed that you're on the computer in class more than anyone. This was back. They were, and he was like, do you want to take one of

4:12these computers home and I was like, oh, hell yeah, I definitely want to take one of these computers home. So I took one home. It was a 286 monochrome, right, running DOS. It could, you know, you could play Oregon Trail on it, right? And, and programming basic. And that was what I was really interested in. So I started doing that and then, you know, spent one summer in high school, the, or in, you know, late middle school or late high school, the year that the movie hackers came out, I guess, in 1993 or no, in 1998. Anyway, the year the movie hackers came out, I went and rented it every, every week that summer. And I go return it and then check it out again and keep watching it just on a loop while I, while I browse text files.com and hackers.com and pop myself from skills and, and, you know, messed around basically being home alone all summer. And so, you know, after that, I got really into into that side of computers and then I got too cool. I got into punk rock and

5:17music and stuff and kind of like forgot about that for a while. Went off to college around 2003, started protesting the second Iraq war in 2003. And after, you know, marching around on the streets a lot and protesting a lot, I realized, hey, you know, I know all this stuff about computers. I bet I could do a lot more good by, by being on the computer than by being out in the streets. You know, a lot of people can be out in the streets. So I started teaching people, privacy and security back then, trying to help out anti-war organizations, you know, set up websites and do all that and kept doing privacy and security trainings and talks and trying to, you know, help people learn OTR chat and PGP and just kind of kept on that path, started doing professionally building websites for non-profit organizations. And then eventually got a job at the Electronic Frontier Foundation almost 13 years ago where I'm still at

6:18that's very cool. Really cool the way you've embraced the kind of the privacy kind of things. So that's really cool. Yeah, great things that y'all are doing there. I get to hear, I guess it's your CEO at B-Sides or Lando. I think she was one of the keynotes back in 2022. Oh Cindy Cohn, yeah, our former executive director. Okay, Cindy Cohn. She has actually retired as of this year and we have a new executive director Nikki Ozer who's also a great former head of ACLU North Carolina, the head of their Public Interest Technology Program there. So we're really excited to have her, but yeah, Cindy's awesome. And she's off to a new thing now, but she just put out a book called Privacy's Defender that's about her 30 year fight for privacy. That's a really good sort of backstory of the movement for privacy and internet freedom. That's very cool. So it was kind of interesting really like I said, I found out you guys from your talk and just to share with the listeners because I will share

7:21a link to that YouTube recording in the show notes, but the title was ESP32 as a counter surveillance platform. So if you guys wouldn't mind kind of sharing about your presentation. Yeah, I guess it start with saying that kind of one of the things also that got me into all this was war driving and and just trying to detect a bunch of devices in the wild. Always with the started with Wi-Fi, you know, and then you realize how much a microcontroller can do and how far microcontrollers are coming. So using that is a way to also, you know, study using it for war driving or a way to study what kind of surveillance is around, you know. So the evidence for this talk was really uh uh kernel panics, oh, you iSpy device, which is which is a really cool device and then I was working on a similar project and so we we linked up because we were working on such similar projects and realized that we're we're you know we both care a lot about privacy, we both care a lot about making cheap ways to detect uh you know surveillance and we're both punk as fuck.

8:25So it was it was a you know kind of an instant friendship and then um you know we realized that uh we can make a really good talk about all this stuff so we got together but yeah the the ou ispi is really an awesome project. I can actually show that off I have a couple of sure. This is the original ou ispi here. Cool. And all it is it has two PCBs you have a ESB 32s3 and a three volt passive buzzer. So the idea is to use this for bluetooth or wifi um and you can set ou isen it where you can detect drones but basically you get an alert when uh when your device of choice is nearby and this kind of took off a lot because at one time it was very easy to detect uh flock cameras with these and so that that's right around the time that we did our defcon talk they completely changed up the hardware or the firmware so it's not. So essentially you know people

9:27are still looking for different ways but uh the the traditional methods for detecting flock cams is pretty much over. You could probably do it with infrared that might might be a new one. I've heard people talking about that but essentially I wanted to make something really cheap uh you know that people could use easily and become more aware of surveillance and uh I did other things like the badge and earrings. I was selling earring sets for a while. I like the art aspect of it quite a bit. There's the patch it's the same thing it's the ou isobye what I use clear PCB and initially I thought these things were going to be thicker so I was like wow I could use this to make a patch and so I designed this so you can sew it onto your hopefully the back of your punk vest or your metal battle jacket and then the mesh detected it's essentially the same concept but it sends it over mesh-tastic networks so you can have a sensor net for instance like if you have you want to keep track of drones uh you can set multiple of these out in different locations and

10:30have them report back to you and map or get to get alerts and things like that. The idea is cheap detection for everybody you know that's that's it and uh it's all open source so it could be you can build these things yourself really easily even put the there's there's some of uh stuff on my GitHub that shows the schematic of this so you can easily make it use the firmware you don't have to buy this this is art so so you're saying this is a kind of low low cost what does it cost to build something like that you could build that thing for 10 to 12 bucks the at least the the ou isobye now the mesh detects are going to be a little more expensive it's probably 40-ish the mesh board is a little more expensive so but uh yeah you can you can build them pretty cheap you don't even need the buzzer if you if you got a shall ESP32 s3 and plugged it into the for instance the mesh mapper API that I've built and you can just detect as wrong with it for you know seven to ten

11:32bucks cheap cheap cheap yeah that's that's what I've done is I've just I've just bought a bunch of ESP 32's flashed his software onto them and and not even hooked up the buzzer is just kind of like scattered them you know in my cars and then and elsewhere and then I just check on them with with my phone to see where they sound from time to time and then the the project that I've been working on is this one it's called ray hunter so this is a this is a commercial off the shelf um uh mobile hotspot the cot you can it's called the orbic you you can buy them for uh well when I start a project you buy them for like 20 bucks online now I think they're a little more expensive because people have been buying them all um so you can find them for like 40 or 60 bucks now but what we've done is we've written some open source firmware for this to detect cell size simulators or fake cell towers um that police use to um trick phones into connecting to them so that they can find a location um and and you know along similar lines right we wanted to to really democratize counter surveillance and

12:36create ways for for people to find out what surveillance is around them easily and cheaply right and get more information about how these systems are working so both of us you know we're really working on the same lines right and both really concerned about the amount of surveillance going on like flock cameras, eye-cell cameras, license plate, we need to go up in every city right drones, every police department getting drones and flying those over you know people's backyards you know using facial recognition, surveyor protests, cell size simulators, all these things um and so we wanted to make you know we really wanted to make it and and the point of the talk was we wanted to encourage people you know to to get out there and start you know looking at the first surveillance in their town and start thinking about ways they can get engaged in ways things that they can build that can help people get engaged in this fight against surveillance in a really accessible way right in a cheap way you shouldn't have to spend thousands of dollars on counter surveillance equipment

13:36to get involved in you know in this and start looking for surveillance in your town. Yeah it's interesting that you you mentioned that with the like the stingray type stuff there's uh I was seeing an article recently because I live in the Dallas-Fort Worth area that they'd bought like a couple the police bought like a couple two or three SUVs and they have like stingray type equipment set up in those vehicles so yeah you know that surveillance is getting crazy and crazy or by the minute and I know back when uh as some of the Dallas hackers association meetings that I go to there were some months that people were able to detect stingrays when we're having our meetings and stuff so it's it's kind of interesting so uh just for some of the folks that may not be aware what you know a lot of people say I'm not doing anything wrong what I have to worry about surveillance in my privacy you guys can kind of give your comments on that. There's so many examples of this is essentially drug net surveillance there's so many examples of people getting uh kind of misidentified

14:38for someone else and then having getting caught up in legal trouble or other examples of uh you know police using and abusing these systems to stalk x's or to surveil specific people and harass people so you know I don't think anybody should have this kind of umniscient access to the to the movement in open society it's too much it's just too much yeah there was there was a really crazy story that came up and so there was recently some uh testimony about flock in the senate um and there was a woman there who had been uh uh pulled out of her bed in the middle of the night and thrown in jail for weeks because they said that she had been involved in a fatal hit and run that night in a different town miles away from her well she was still in bed right and like it was it was a different car with a different life and split her car was new you know not a scratch on it right

15:40in her driveway right and they still pulled her out of bed because the license plate reader the flock camera had said that it was her license plate there well it was a mystery it wasn't her license plate she was completely innocent but she was still in jail for weeks uh over nothing right and this is this is you know the thing about flock cameras when they when they get it wrong they can ruin people's lives right and even when they are actually reactivately reading your license plate this is a surveillance system that is recording everyone all the time right when you're going to school when you're going to church right parents dropping their kids off at school people going to the grocery store right people going to gun shops people doing going to protests right these have been used to surveil people uh at protest there's a whole training module that flock put up to instruct cops on how to uh surveil protesters after protests right this is this is dragnets surveillance of everyone in the US whether or not you're a huge

16:40of a crime and that is not the country that we are supposed to be that i don't think that's the country any of us want to live in right that's certainly not the country i want to live in um and and and you know i don't think we should tolerate it right we shouldn't tolerate any dragnets surveillance in the US it's kind of like when the patriot act come about it open up a can of worms and just keep getting worse from there i think another point too i agree with the patriot acts stuff that's it's it's continues on uh but you know it's uh when uh a company like clock we you know people are trying to to say hey you have security vulnerabilities and and of course they don't want that kind of press so that for a time it was it was pretty heavily denied on on their side from my understanding and then you know to have i didn't consent to them having my face or license plate in their systems and how do i trust this company that some threat actor isn't going to get a hold of that information as well because we know that they don't have the best security practices off the jump so

17:42that you know you only trust the technology so much anyways and in in the day of uh you know AI and exploits and things like that the zero day is becoming more common and uh your data is less and less safe every day especially if they're getting everything somebody could exploit that very easily i'm sure yeah yeah i mean i think that's a part we don't talk about as much right but it's equally important and this is flock is all or an alpran general are a because i don't just want to hit on flock there are so many other companies axon is is waiting in the wings you know hoping that people will just stop at flock and and when flock goes out of business they can just take over that entire market and everybody will forget that the problem is not flock the problem is lifeless pay readers right but um this is sorry uh as an aside um we don't talk about as much as the national security implications of these things like journal panic was saying there have been so many vulnerabilities discovered in these cameras in in these networks right and imagine if

18:44you know i ran Iranian hackers they're Chinese hackers right take over these networks imagine if um you know shiny hunters takes over these networks right and now suddenly shiny hunters did the american criminal hacker game gang has has access to everybody's location information going back you know years potentially right like imagine what they could do with that that's a terrifying thought and it's it's absolutely like it's not just undemocratic it's not just unethical it is dangerous for these companies and these police departments to be keeping people's location data going back so far again it's kind of back to re-talking about you know threat actors getting this data you could take organized crime uh organizations could be getting this data and say who's a good target for us to do a home invasion or whatever you know yeah exactly that's someone's family member yeah

19:45yeah exactly like imagine shiny hunters having this data imagine the calm having this data right like they they we know that they go out and do kinetic actions they go out and kidnap people right like that's it's it's it's bad it's it's really bad it's bad to have this it's bad for everyone and i don't i don't see any value in it at all so one thing that was seen recently was seeing like the growth of the flock cameras have really uh ramped up a lot since the the current administration took office i would not i'm not surprised um the current administration had invested in some tasers for max on for ice which is interesting that uh members of the administration would invest in that kind of technology but yeah yeah i mean we're there's definitely a big surveillance boom going on right now right ice ice's budget has gone up uh uh to you know sixty billion dollars a year right and this is triple what it was let you know the

20:48previous years and um they're buying all sorts of surveillance equipment for sure the the administration is investing in companies like Palantir like flock like axon right um and and yeah it's becoming you know it's it's it's becoming quite where it's red for sure and up yours though license paid reader what when you know when we talk about flock this is the underlying technology license paid readers have been around for uh you know over a decade right but we the ff has been warning people about this for over a decade um and we've been telling people you know this is bad this is going to get really bad and i don't know i don't know what it is about flock that has really captured the uh zeitgeist right and and activated so many people but i'm bad right it's good to see i mean i mean maybe it's because they've grown so quickly right and there's so the cameras have such a unique silhouette so it's really easy for people to like it's really people for it's easy for people to conceptualize and say oh look there's surveillance right there i can see the surveillance camera right i actually i play this game with my son we go spot the surveillance camera and just

21:51you know it's it's like punch buggy right anytime we you know you see us surveillance camera we shot our own surveillance camera right and and we see so many right we see so many flock cameras in particular um just every town we're in right so i think it's really easy for people to conceptualize and think about and get mad about and that's good um you know it's good to see so many people getting mad about privacy and caring about this stuff right um there's never been a moment like this before in my in my you know uh 20 years of of trying to educate people about privacy right so it's really it's really exciting yeah and if you went mine for the folks who don't know of EFF if you could wouldn't mind explaining what EFF does and who they are yeah sure electronic frontier foundation or EFF we are a non-profit defense still i can y'all hear that pounding above me there's it there's the noise canceling you're working well i can hear it but it's not bad

22:51yeah okay good uh sorry i'm having a new roof footed in and they started today um EFF is a civil liberties organization we've been around for over 35 years now our mission is to defend your rights both online and off so we do a lot of uh work in in privacy and in free speech online um we have lawyers who uh take on cases and and and do impact litigation and take case to the Supreme Court they also sometimes defend hackers when they get in trouble for things they shouldn't because using a computer is not a crime um we have activists who do grassroots activism uh a lot of writing a lot of when we even do a little bit of lobbying um in in Washington we have two lobbyists who punch way above their weight um in Washington and then uh we have a team of technologists public interest technologists which is what i'm on and we do

23:54software projects to help people like privacy badger which is a browser add-on um to block the trackers that follow you around online uh we do projects like rate hunter um we also run one of the largest certificate authorities in the world uh uh uh uh or we we we help fund one of our significant authorities in the world uh which is uh less encrypts and then we run the client for that which is certbot and through certbot we issue millions of free certificates every year and we we basically started the movement um to make hdbs certificates free a lot of kids don't remember these days apparently that uh ssl certificate to encrypt your website used to cost like 60 bucks a year right and that was the cheap for the cheap ones um and so they're they're free now and that's because of the ff right and so yeah we we threw that product you know encrypted you know 90 95 percent of the web um is on hdbs now whereas you know that didn't used to be the default so

24:56uh yeah so we're a nonprofit we're member supported um we we we remain independent because we mostly rely on on individual donations to keep us afloat so uh go check us out and if you like our work uh think about becoming a member at efs.org yeah you guys always have some really cool swag it conferences too so yeah the greatest are yeah we have we have this is when this is our last year's member shirt it's a it's a really cool one i don't the the current year's member shirt is dirty unfortunately but uh it's uh cat taking a swipe at a at a non-specific license plate reader camera very cool so we're getting down towards the end of the episode is there anything you guys like to share before we close it out uh you can check out my website or get hub website kernelpanic.tech that's collo any opa and ic.tech or just check kernel panic hacks get hub or instagram always something going on there um but yeah take out the efs r through they're doing great stuff i just want to say you know get out there and and go hack something right go go

25:59go you don't but you don't just have to hack right you can also go to your city council meetings right and and you know it city council members tell them to get this surveillance out of your town right or or you know start you know build something on the efs p32 right make things that are cheap and accessible make things that look cool and people will be very excited to use them right everybody is really hungry for ways to get involved ways to find out about surveillance right and ways to fight back and you can you can give the ways to fight back and that is super powerful so it's good that you guys are out there speaking on it and it's good what all you're doing your project wise and as well as what all you guys are doing efs and it's 100% legal and okay to wardrobe and detect things yep go have fun going on soon yep yeah it's kind of funny because some of my i used to want some earlier consulting jobs we used to do war driving very nice yeah and it's always interesting to see how far that signal would reach when you're out there because some of

27:01the antennas I had weren't anything ridiculous just like maybe 12 or 14 inch antenna on my network adapter and then drive out i remember driving out like a half a mile from from the location and be able to still okay i bet that's got some reach well thanks again guys i appreciate you taking the time at your busy schedule to do this and i'm sure the the the viewers and listeners will enjoy it thank you so much thanks for having us on the thanks for having us on the show oh you're welcome it's an honor thanks everyone for listening and we'll see you in the next episode make sure to like and share and if you're watching this on youtube add some comments that way the algorithms help skip this content out to other people that could use it and until next time take care