time is on my side -...
TRANSCRIPT
![Page 1: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/1.jpg)
ForgingWirelessTimingSignalstoAttacktheNTPServer
Timeisonmyside
Timeisonmyside1
Yuwei Zheng @HITBHaoqi Shan @HITBFrom: Qihoo360 Unicorn Team
![Page 2: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/2.jpg)
Maincontents
Timeisonmyside
• AbouttheNTPserver• TheNTPstratummode• Thereferenceclock• Forge radio clock signals• Forge GPS clock signals• AttackNTPserver
2
![Page 3: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/3.jpg)
AboutNTPserver
Timeisonmyside
• Aserverforcomputertosynchronizetime.
3
![Page 4: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/4.jpg)
AboutNTPserver
Timeisonmyside
• CriticalIndustriesthatuseNTPservers
4
![Page 5: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/5.jpg)
TheNTPstratummode
Timeisonmyside
• Stratum0Referenceclocks• Stratum1Primarytimeservers• Stratum2• Stratum3…• Stratum16
5
![Page 6: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/6.jpg)
AbouttheNTPserver
Timeisonmyside
• NTPserversaredeployedwithopensourceNTPv4
6
![Page 7: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/7.jpg)
Thereferenceclock
Timeisonmyside
• ReferenceClockDriversintheopensourceNTPv4Type2Deprecated: wasTrak 8820GPSReceiverType3PSTI/Traconex 1020WWV/WWVHReceiver(WWV_PST)Type4Spectracom WWVB/GPSReceivers(WWVB_SPEC)Type5TrueTimeGPS/GOES/OMEGA Receivers(TRUETIME)Type6IRIGAudioDecoder(IRIG_AUDIO)Type7RadioCHUAudioDemodulator/Decoder(CHU)…Type39hopf GPS/DCF776039forPCI-Bus(HOPF_P)Type40JJYReceivers(JJY)Type41TrueTime 560IRIG-BDecoderType42ZyferGPStarplus ReceiverType43RIPENCCinterfaceforTrimblePalisadeType44NeoClock4X- DCF77/TDFseriallineType45Spectracom TSYNCPCIType46GPSDNGclientprotocol
7
![Page 8: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/8.jpg)
Thereferenceclock
Timeisonmyside
Whydoesthestratum-1NTPserveruseradioclockandGPS?• Atomicclock,accurate,butexpensive• GPS• radioclock
8
![Page 9: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/9.jpg)
Thereferenceclock
Timeisonmyside
• ReceivercardssupportedbyNTPV4
9
![Page 10: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/10.jpg)
Thereferenceclock
Timeisonmyside
• Stratum1NTPserverproductforindustrialusing
10
![Page 11: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/11.jpg)
Thereferenceclock
Timeisonmyside
• ItsupportsDCF77,MSF,WWVB,andGPS
11
![Page 12: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/12.jpg)
Forgelongwavetimingsignals
Timeisonmyside
• DIYacircuittotransmitradioclocksignalssupportWWVB,JJY,DCF77,andMSF
12
![Page 13: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/13.jpg)
WWVBencodingandmodulation
Timeisonmyside
• Different pulse width representdifferentdatabit
13
1 2 3 4t(s)
p
reduced
full
0.8s
marker 1 0 1
0.5s 0.5s0.2s
…
![Page 14: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/14.jpg)
WWVBencodingandmodulation
Timeisonmyside
• 60Khzcarrier
14
![Page 15: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/15.jpg)
WWVBencodingandmodulation
Timeisonmyside
• ASKmodulation
15
![Page 16: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/16.jpg)
WWVBencodingandmodulation
Timeisonmyside
• Theframestructure
16
![Page 17: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/17.jpg)
JJYencodingandmodulation
Timeisonmyside
Similar to the WWVB
17
1 2 3 4t(s)
p
reduced
full
0.8s
marker1 0 1
0.5s 0.5s0.2s
…
![Page 18: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/18.jpg)
DCF77encodingandmodulation
Timeisonmyside
• SimilartoWWVB,itusesa 77.5hzcarrier
18
![Page 19: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/19.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• Usead9850DDSmoduletogeneratethecarrier
19
![Page 20: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/20.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• AboutAD9850DDSmodulesupportstooutput0-40Mhzwavesendsallradioclocksignalswithonecircuit
• Usearduino tocontrolad9850Ad9850seriallibraryforarduinohttps://github.com/F4GOJ/AD9850
20
![Page 21: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/21.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• AsimpleJJYtransmittervoidsendMark(){//Sendhighfor0.2secDDS.setfreq(freq,phase);delay(200);//Sendlowfor0.8secDDS.down();delay(800);return;
}
21
![Page 22: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/22.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• AsimpleJJYtransmittervoidsendBit1(){//Sendhighfor0.5secDDS.setfreq(freq,phase);delay(500);//Sendlowfor0.5secDDS.down();delay(500);return;
}
22
![Page 23: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/23.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• AsimpleJJYtransmittervoidsendBitZero(){//Sendhighfor0.8secDDS.setfreq(freq,phase);delay(800);//Sendlowfor0.2secDDS.down();delay(200);return;
}
23
![Page 24: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/24.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside
• GettheantennafromanJJYreceiver
L=1890uH.𝑓 = $
%& '(,for60khzcarrierC=3.6nF
Forthe77.5khzcarrier,C=2.2nF
24
![Page 25: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/25.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside25
• Thewholecircuitoftheuniformtransmitter
![Page 26: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/26.jpg)
Longwavetimingsignaltransmitter
Timeisonmyside26
• LongdistancetransmitterDesignapoweramplifierwithMOSFETIR540.
![Page 27: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/27.jpg)
AttackGPSNTPreceiver
Timeisonmyside
• GPSreceiver• GPStechbriefing• GenerateGPSsignal• Haveatry• Upgradeattackalgorithm
27
![Page 28: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/28.jpg)
GPSreceiver
Timeisonmyside
• MultiplyConnection• PCI• USB• Serialport
28
![Page 29: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/29.jpg)
GPStechbriefing
Timeisonmyside
• Complicatedprinciple• Butdoesn’tmatter,it’sopen-sourced• Defcon23“GPSSpoofing- LinHuang”
29
![Page 30: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/30.jpg)
GPStechbriefing
Timeisonmyside30
Subframe 1 Subframe 2 Subframe 3 Subframe 4 Subframe 5
Time information Ephemeris
![Page 31: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/31.jpg)
GenerateGPSsignal
Timeisonmyside31
![Page 32: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/32.jpg)
Haveatry
Timeisonmyside32
![Page 33: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/33.jpg)
Panic
Timeisonmyside33
![Page 34: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/34.jpg)
Update attack algorithm
Timeisonmyside34
• Find GPSTime• Replace it• Re-ParityCheck
![Page 35: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/35.jpg)
Setup an NTP server
HackingFemtocell
• Setup an NTP server using JJY as clocksource
35
server127.127.40.0mode1preferfudge 127.127.40.0flag1stratum0
![Page 36: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/36.jpg)
Setup anNTPserver
Timeisonmyside
• ThisNTPserverwithJJYreferenceclock
36
![Page 37: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/37.jpg)
Setup an NTP server(JJY)
HackingFemtocell37
![Page 38: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/38.jpg)
AttacktheNTPserver
Timeisonmyside
• Canweinjectanytime?Thetimeoffsetmustbelessthan4hours.
• InjectatimethatisonehourslowthanrealtimeServercrashed!!!
38
![Page 39: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/39.jpg)
AttacktheNTPserver
Timeisonmyside
• Canweinjectanytime?Ifthetimeoffsetismorethan1000s,theserverwillshutdown.
39
![Page 40: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/40.jpg)
AttacktheNTPserver
Timeisonmyside
• Canweinjectanytime?theoffset>1000s,requiremanuallyadjust
40
![Page 41: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/41.jpg)
Root Dispersion
HackingFemtocell41
RFC5905
![Page 42: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/42.jpg)
Attack Demo
Timeisonmyside42
![Page 43: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/43.jpg)
Real Attack?
Time is on my side43
![Page 44: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/44.jpg)
Real Attack?
Time is on my side44
![Page 45: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/45.jpg)
Real Attack?
Time is on my side45
![Page 46: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/46.jpg)
Real Attack?
Time is on my side46
![Page 47: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/47.jpg)
Real Attack?
Time is on my side
• Sensitive & expensive
47
![Page 48: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/48.jpg)
References
Timeisonmyside
•“GPS Spoofing – Huang Lin”• https://www.eecis.udel.edu/~mills/ntp/html/refclock.html• http://www.sundgren.se/1-recreation/2-electronics/dcf77_simulator.htm
48
![Page 49: Time is on my side - conference.hitb.orgconference.hitb.org/hitbsecconf2016ams/wp-content/uploads/2015/11/... · 0.5s 0.2s 0.5s … WWVB encoding and ... Time is on my side • About](https://reader030.vdocuments.site/reader030/viewer/2022020305/5c15d16f09d3f2946a8b8159/html5/thumbnails/49.jpg)
Thanks
HackingFemtocell
• Any question?• Feel free to contact us!
49