- The video discusses a hacking technique used in the TV show Mr. Robot.
- The technique involves creating a mobile spy machine using a femtocell.
- A femtocell is a device used to improve cell service in areas with poor reception.
- The femtocell intercepts cell signals and sends them through the internet to the cellular network.
- The video explains how to access the femtocell and modify it for hacking purposes.
- The technique is similar to a Stingray device used by law enforcement.
- Femtocells are legal and can be purchased from carriers like Verizon.
- The video demonstrates how to create a cable to access the femtocell.

- The speaker explains how to connect an HDMI cable and an FTDI TTL 232R cable to gain access to a Femto cell's console.
- They mention that this hack was first presented at BlackHat in 2011.
- Once inside the Femto cell, there is a small Linux kernel called MontaLinux.
- The speaker emphasizes the importance of knowing Linux to navigate and exploit IoT devices.
- They discuss the process of escalating privileges to gain root access on the Femto cell.
- The speaker mentions using OpenWrt, an open-source Linux firmware, to flash the Femto cell and potentially install malware.
- The goal is to eavesdrop on mobile traffic, but decoding SMS and phone traffic requires additional steps.
- The range of the Femto cell is limited, but it can still capture traffic within a certain distance.
- The speaker highlights the OpenWrt project and its potential for customizing firmware for IoT devices.
- Flashing the Femto cell and capturing traffic are the most challenging parts of the hack.
- Enterprise-level Femto cells are easier to connect to and have a default root password.

- The root password for the femtocell is "femtocell" followed by the last 4 digits of the serial number
- Verizon claims to have closed the vulnerability that allowed easy access to the root password
- The process of hacking into a femtocell involves gaining console access, obtaining root privileges, and flashing it with a more complete Linux operating system
- Once inside the system, traffic can be monitored using tools like TCP dump or Wireshark
- Intercepting SMS and voice traffic requires finding the proper codecs used by the specific carrier
- The process shown in Mr. Robot is realistic, but the timeframes depicted are not
- The device being built is a Stingray-like device using Lime SDR, which is faster and more capable than HackRF
- The femtocell connects to the broadband gateway via Ethernet, which then connects to the internet and the mobile carrier's network
- Intercepting traffic between the femtocell and the gateway is not possible due to encryption
- Femtocells are typically used for 3G traffic, which is slower than 4G but still suitable for voice calls
- The femtocell can eavesdrop on unencrypted internet traffic, decrypt and intercept SMS messages, and decrypt voice traffic
- The vulnerability of femtocells has been demonstrated by researchers, and different femtocells may have different vulnerabilities
- Verizon's newer femtocells claim to have fixed the vulnerability, but there is always a way to gain root access

- The process of gaining root access on different devices varies depending on the manufacturer and carrier
- The speaker plans to create a tutorial on Hacker's Rise about hacking a legal device, but is still considering the legal implications
- The speaker has a vulnerable device that is relatively easy to hack, taking 2-3 days of work
- The speaker thanks Occupy the web for sharing knowledge and discusses the realism of Mr. Robot
- Viewers are encouraged to comment and suggest topics for future coverage.

- The video discusses a hacking technique used in the TV show Mr. Robot involving a femtocell.
- A femtocell is a device used to improve cell service in areas with poor reception.
- The technique involves accessing and modifying the femtocell to intercept and send cell signals through the internet.
- The video demonstrates how to create a cable to access the femtocell and gain console access.
- The process includes escalating privileges, flashing the femtocell with open-source Linux firmware, and potentially installing malware.
- The goal is to eavesdrop on mobile traffic, but decoding SMS and phone traffic requires additional steps.
- The range of the femtocell is limited, but it can capture traffic within a certain distance.
- The video emphasizes the importance of knowing Linux to navigate and exploit IoT devices.
- The process of hacking into a femtocell involves gaining console access, obtaining root privileges, and flashing it with a more complete Linux operating system.
- Intercepting traffic between the femtocell and the gateway is not possible due to encryption.
- The vulnerability of femtocells has been demonstrated by researchers, and different femtocells may have different vulnerabilities.
- The speaker plans to create a tutorial on hacking a legal device but is considering the legal implications.

Elliot hacks the FBI in Season 2, Episode 5 - in this video OTW (Occupy the Web) explains how realistic the hack is. Can this actually be done in the real world? OTW tells us the answers. 

OTW loves the Mr Robot TV Series as a lot of them are actually realistic - unlike a lot of other shows. This is our 4th video in the Mr Robot hacking series.

// OTW Discount //
Use the code BOMBAL to get a 20% discount off anything from OTW's website: https://davidbombal.wiki/otw

Direct links to courses:
Pro Subscriber: https://davidbombal.wiki/otwprosub
3 year deal: https://davidbombal.wiki/otw3year

// MENU //
00:00 - Coming up
00:33 - Intro
00:44 - Mr Robot episode summary
03:41 - Eavesdropping with Femtocells
04:44 - Femtocell diagram
05:13 - Femtocell vs Stingray
06:33 - Accessing the femtocell console
09:46 - Creating your own proprietary cable
11:17 - MonsaVista Linux in IoT deviecs
12:53 - Getting root access and flashing a Linux kernel
15:27 - Effective range of the femtocell
17:20 - Femtocell summary
22:39 - This hack can be done // reality vs movies
23:47 - OTW's Stingray-like device with LimeSDR
24:48 - Femtocell diagram pt. 2
26:07 - Why you can't run a sniffer
28:07 - Eavesdropping with femtocells
28:36 - Femtocells are vulnerable
29:54 - Femtocell hack guide on Hackers-Arise.com
30:52 - Conclusion // What should we cover next?

// Previous Videos in the Series //
Mr Robot Ep 1: https://youtu.be/3yiT_WMlosg
Mr Robot Ep 2: https://youtu.be/7V9_x97s4g8
Mr Robot Ep 3: https://youtu.be/5LvqU3-iINk

// David's SOCIAL //
Discord: https://discord.com/invite/usKSyzb
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal
YouTube: https://www.youtube.com/davidbombal 

// Occupy The Web social //
Twitter: https://twitter.com/three_cube

// Occupy The Web books //
Linux Basics for Hackers: https://amzn.to/3JlAQXe
Getting Started Becoming a Master Hacker: https://amzn.to/3qCQbvh

// Other books //
The Linux Command Line: https://amzn.to/3ihGP3j
How Linux Works: https://amzn.to/3qeCHoY
The Car Hacker’s Handbook by Craig Smith: https://amzn.to/3pBESSM
Hacking Connected Cars by Alissa Knight: https://amzn.to/3dDUZN8

// Occupy The Web Website / Hackers Arise Website //
Website: https://www.hackers-arise.com/?afmc=1d
OTW Mr Robot series: https://www.hackers-arise.com/mr-robot

fbi
fbi hacks
hacking fbi
hack fbi
apple
android
iphone
iphone 14
android 12
samsung
mr robot hacks
elliot
elliott hacks the fbi
mr robot
stingray
fbi stingray
femtocell
fbi hacking
cell phone
cell phone hacking
cell phone hack

Disclaimer: This video is for educational purposes only. 

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

#fbi #hack #mrrobot

Robot example and you actually doing it and showing, you know, is it real or is it just a movie scene?

And it's nice to see you, you know, actually showing us how to do it.

And today is going to be among the most advanced, the most complex hacks that we saw in Mr.

Robot, and maybe also, maybe the most valuable in that, in that we're going to be looking at essentially creating a mobile spy machine.

Hi, everyone, David Bombal back with Occupy the Web.

If you haven't seen our previous videos, he's the author of this book, Linux Basics for Hackers.

Fantastic book if you wanna learn Linux, but also from a hacker's perspective.

And he's also the author of this book, Getting Started Becoming a Master Hacker.

It's always great to be talking to you and talking about hacking.

I love this, this effort of trying to explain, you know, the Mr.

And today's going to be among the most advanced, the most complex hacks that we saw in Mr.

Robot, and maybe also maybe the most valuable in that, in that we're going to be looking at essentially creating a mobile spy machine.

mean, you've kind of mentioned it offline and I don't want to jump the gun.

This is season 2, I think it's episode 5.

They talk about it in episode 4, they do it in episode 5.

And this is, Well, you know, we know that Elliot has taken down Evil Corp, right?

Him and F Society have taken down Evil Corp and we have this kind of chaos in the global economy, right?

And we've now have lots of things going on, including the Chinese are now involved And we have the FBI's involved.

The FBI are on the trail of Elliott and his whole gang.

I mean, you know, they're kind of freaking out.

They realize that, you know, the FBI are not very far behind.

And so they've got to come up with a plan to be able to find out what the FBI know because everybody is getting paranoid thinking that they're gonna be arrested soon for the Five-Nine hack.

And so they come up with this plan to be able to spy on the FBI.

In the first part, we learned that the FBI has switched to Android phones.

And then in episode 5, we see Elliot is begins to develop some exploits, but he has to have a way to be able to deliver the exploits.

And so what he comes up with is to basically create a mini cell tower that he's going to place inside of Evil Corp.

And Angela, who's now working for Evil Corp, she can walk in apparently and place it in, apparently, that's kind of a big if, right?

But, and place it in the evil corp to be able to pick up the cell signals from the FBI.

And of course, then also implant some malware.

So what we're talking about here is what's called a femtocell.

These are a couple of femtocells and these are the ones that are actually used in the show.

This is the new, you can see this of course, right?

So what these are is that all of the cell companies, no matter where you're at around the world, they sell what are called network extenders.

These are for people who live in areas where there is not good cell service.

So you put 1 of these in your home, you put 1 of these in your office, if you don't have good cell service, maybe it's a dead zone.

And essentially what it does is it works as a cell tower within your home or office.

Now we know, maybe not, but we do, that your cell phone will connect to the closest and strongest cell signal.

And so essentially what these are, by putting 1 of these in somebody's home or office, they're going to connect to this femtocell and kind of give you a diagram of what it looks like in somebody's home.

It's like, so here's the femtocell in somebody's home.

And then the femtocell connects to broadband access into the internet, okay, then connects to the cell network.

So it is essentially intercepting the cell signal and putting it across the internet into the cellular network.

So it goes through the internet into the cellular network.

Can I ask you, is this similar to the Stingray type thing that the, cause that's the 1 you always hear about, like the police or whatever, FBI, whatever, using the Stingray ISMI catcher type things, right?

So essentially what this is, is that it's a mini Stingray, right?

Whereas a Stingray can capture signals for a large distance.

You can put 1 in a neighborhood and it'll pick up all the cell signals in that neighborhood.

And the FBI and others, law enforcement use them.

And it's only legal for law enforcement to actually have 1.

It's not legal for anybody else to have 1.

I will put out there that at Hackers Arise, we're working on building 1 with a software-defined radio.

You better come on the show when you've got that ready.

Okay, it's not something, we're not inventing it.

Okay, we're building it because it's already been invented, but you can go ahead and use a software-defined radio to make a Stingray.

Now, it's illegal to actually own 1, a Stingray.

We'll put it up on Hacker's Rise in the future.

So this is being sold from the largest carrier in the US, which is Verizon.

This is coming right off their website, very similar to the 1 that I have.

And people sell them on eBay because they bring them home and they don't want them or don't need them and they put them up on eBay.

And it's a legal device that the carriers and all the carriers sell them, but they're all slightly different.

So what I'm showing you here today is going to apply in general to all of them, but specifics are going to be very different.

Notice you can see here the Samsung logo right here.

I don't know if you can see that in the screen.

Verizon makes the Samsung, other carriers use other manufacturers to make these.

And what these are is just a mini cell tower.

The key in this mini cell tower is to be able to get inside of it.

Because if we can get inside of it, then in essence, we can eavesdrop and do a man in the middle on all the traffic that goes through it.

And that's essentially what Elliot's doing in the show.

So we see him, he's developing an exploit, but what he's doing is he's going to put that exploit into the femtocell.

So The first step to getting inside the femtocell is that I have 1 here and I've taken some pictures to show you.

The first step is you look down at the bottom right here.

Okay, so there's both enterprise level femtocells and there's consumer level femtocells.

It's actually a little bit easier to hack the enterprise level femtocells on the consumer level, which are cheap ones, right?

Here's, there's a connection down below in the bottom of these things right here.

Look at it, I'm gonna bring it a little closer.

I mean, this is what's really puzzling when you see this.

You go, what can I do with this HDMI connection here?

It turns out that the Samsung and Verizon have a specially made cable that is essentially USB on 1 end and HDMI on the other end.

Yeah, because I mean, HDMI, you think it's just a monitor.

Why would you want a screen connected to such a device?

But they've developed their own unique and proprietary cables to be able to get inside of these things.

And so that's what we're going to do next.

So this is basically, I'm looking at the bottom side under here on that last picture.

So what we need to do is that we can go out, okay, and get, this is actually, I bought this 1, I think off Amazon.

And what we can do is by using an HDMI cable and this cable.

So if you want to buy 1, they're about anywhere from about $7 or $8 to $15 in that area.

And so what we can do is we can splice these 2 cables together, HDMI cable and this cable, and this is the wiring for it.

You take the HDMI bare copper ground to the FTDI black.

There's the FTDI black right there, and the HDMI white to the FTDI yellow, and the HDMI orange to the FTDI orange, okay?

Was this just like trial and error, or did you find the specifications somewhere?

And so this actually comes from a hack that was developed and was first presented at Blackhead in like

And so, but the specifications, they didn't give the specifications for the cables at BlackHat.

So I had to go digging around some of the manuals for these Femto cells to find out what the cabling was like.

So anyways, once you have this cable, then you can access the console inside the Femto cell.

So the first step is we got to build the cable.

Got to build the cable that gives us a proprietary access to the Femto cell through that HDMI port.

And we're far from done, because when we get inside the Fentos cell, essentially we have a very small Linux kernel.

So it's a, It's a company out of California that makes these really small Linux kernels, put it in all kinds of devices.

And so that's what's inside the Fentos app.

But you'll find, you know, if you find Monta Linux in all kinds of IoT devices, no matter what you do, whether it be a router or baby monitor, what have you.

And so this is once again, I'm gonna plug learning Linux if you wanna be a hacker, right?

So- Let's see, which book should you read?

So, you know, that book, we're really looking at Linux as how to use it as an attack tool.

But the truth of the matter is, is that all these IoT devices also have Linux.

So you get inside 1 of these devices, and if you don't know Linux, you can't find your way around, right?

You don't know how to find anything, what to do with it.

You need to know Linux to be able to do this.

up with this- Linux is like speaking English, let's say in the US or the UK.

It's like a basic skill that you have to have these days in IT, I think.

So once you're inside, now you've got this MontaLynx, but it doesn't have a bash shell.

So it's not like what we're accustomed to, right?

And so it becomes pretty hard to work with.

Once again, this is a pretty complex hack, but it can be done.

So on the TV- It's just nice to see, you know, because you, sorry to interrupt again, it's just nice to see, you know, the Mr.

Robot example and you actually doing it and showing, is it real or is it just a movie scene?

And it's nice to see you actually showing us how to do

And that's once again, we've always talked about Mr.

And this 1, you know, if they were already familiar, 1 of the team was already familiar with it, yeah, it might be able to get done in a couple of few days that they had, but it's not easy.

So once we're inside, we've got the console, we've got to get root access.

And so here's the 2 models that Verizon uses.

And these are 2 methods to escalate privileges to get to root.

So the 1 I have is this 1 right here, which is the easier 1.

And Verizon now says that they've no longer, this no longer works, but it doesn't matter because we can just go buy the old ones that have never been updated off, you know, eBay or any place and get root access.

And so Once we got root access on these things, right?

So we now are in, you know, we've got root access on the Linux inside this device.

Unfortunately, even with root access, there's not, it's not really functional.

These are Linux images that can be used on IoT devices.

So if you've got some hardware, you can go ahead and download the Linux to install and flash into the IoT device.

Here's all the hardware that this has been going on for years and very few people are familiar with it.

It's open source software for a particular device, for any device.

And this is what they do, is that basically they take this femtocell and now they go ahead and flash it with a Linux operating system that they have developed themselves.

So they've basically taken the image from here and made some alterations to it.

The show, what happens is that Elliot actually puts some malware, he puts malware, you know, it's kind of a well-known browser, RCE exploit into the femtocell that would then put the shellcode onto the phones.

What I'm most interested in from this perspective is being able to eavesdrop on the traffic.

So we don't need to actually have an RCE.

We don't need to have any exploit at all to be able to listen in and watch the traffic.

So Elliot is trying to infect the phones, but to be able to listen in, it's, there's still a few things that we need to do.

You can see all of the data traffic, okay, it all goes unencrypted, but the SMS traffic and the phone traffic, you have to be able to decode that traffic because it's all encoded, but that's publicly available information that you can decode.

It's really kind of beyond the scope of what we're doing here today.

I'm just trying to give you the outlines of what can be done to be able to build essentially a small spy device, a mini stingray that gives you access to all of the mobile traffic in the area.

Now, these stingrays are kind of low power.

So the target has to be within 15 feet of the femtocell to be able to connect to it.

But they can then travel within 50 feet of the femtocell and they'll still be connected to that femtocell.

So the initial connection has to be within about 15 feet.

And then about 17, 16 meters in that range.

They travel throughout the room or the office, you can pick up all of their traffic.

So it's kind of giving you the kind of the bare outlines of what we have to do, but there's a lot of work involved here.

You know, probably, you know, the first step, of course, is getting that cable made so you can get access to the device, and then you have to go ahead and flash it, you've got root access, and then you gotta flash it with a new Linux kernel.

And then once you have new Linux kernel, then you have access to all of the traffic that's going over the device.

But I mean, if you put that in the ceiling, or like he did, like they hid it in a storeroom or something, didn't they?

In the show, there's a scene where Angela puts it on the floor and connects it into the Ethernet cable there.

But, you know, it's still, it's kind of a large device.

It's probably, you know, it's, well, not that large.

But it's, you know, if you, if it's set on the floor next to other electronic devices, people may not notice it.

But it's not so small like a raspberry pi that basically people are not going to see it.

But 1 of the things that I wanted to point out is this OpenWrt project, which, you know, I don't think many people are familiar with it, and that you can go ahead and get open source firmware for just about any IoT device, right?

And then if you have your own firmware, of course, then you can make your own edits to it and have it do just about anything that you want.

And that's what Elliot does in the show is that he goes and downloads firmware.

And much of this is mounted to Linux for various different devices.

said, it's quite a complex thing because you'd have to connect to that cell and then flash it basically, and then somehow capture the traffic going through it.

And so the hardest part, once you're, once you got the cable, then you got to go and flash it.

You got to get root access, then flash it.

And then you got to go ahead and figure out what the codecs are for the SMS and the voice traffic across it.

I'll also point out that on the enterprise, okay, on the enterprise level of these femto cells, they're actually a little bit easier because they have a standard connection to connect to the enterprise level.

It's simply a ethernet connection, right?

And then the root password on it is femtocell and then XXX, 4 X's, 4.

Femtocell, okay, a capital F, a capital C, and then the last 4 digits of the serial number on the device, right?

So those are the keys are being able to connect into the device, then get root access, okay?

And the enterprise level 1, the default password is publics, where the Xs represent the last 4 digits of the serial number of the device.

For these consumer level ones, it's a little more difficult.

And as I said earlier, is that Verizon has said they've now closed this vulnerability.

The vulnerability that they've closed is that the ease of getting the root password.

But like I said, there's always a way to get to escalate privileges, right?

So this is basically a privilege escalation issue, and it's going to differ from device to device.

So this applies to these Samsung devices that Verizon uses, that I have, and are used on the show.

But If you're in the UK, if you're in Germany, if you're in China, they're all going to be using, and different carriers are going to be using different femtocells.

But the process is still going to be the same.

In our case here, we had to build a special cable to get ourselves into the console.

Then once you're inside the console, then get root privileges, and then 3, you have to go ahead and flash it with a more complete Linux operating system.

Then once you have that inside the system, then you can go ahead and put in something like TCP dump or Wireshark and watch the traffic.

You can watch the data traffic from there without having to do anything further.

But as far as the SMS traffic and the voice traffic, it has to be, you have to find the proper codecs that that particular company is using to be able to decode the SMS traffic and the voice traffic.

You know, If you build 1, you've got yourself a really cool spy tool, okay, that you can use.

And like Elliot did, I mean, Elliot used it, remember, he listened in to the FBI conversations and he also hacked their phones with it because he used, as their traffic is going through the femto cells, he's sending an exploit to their phones and taking control of their phones.

But you don't have to take control of the phones.

You can just simply listen in on all the traffic, both the data traffic, the SMS traffic and the voice traffic.

Essentially you're taking control of the femtocell.

Robot is once again realistic, but like you always say, it's the timeframes, right?

There's a lot of research into these devices.

Some of that research has been published.

You can find the research and be able to do it yourself, but it's time consuming, but somebody has already done it.

The guys who originally did this at Black Hat were ISEC partners did it and they did it like 2011.

So this would have been available to Elliot when the show was made in

So he would have had this kind of research already available to him to be able to hack the femtocell.

And it was also was in the show that shows that he is actually using, he's building a browser exploit that was well known at that time.

It came out like in 2014 that he's building in the show in Ruby.

See all David Bombal transcripts on Youtube

Hacking cell phones like Mr Robot