ESP32 as counter-surveillance platform

ESP32 as counter-surveillance platform

Speakers: Cybertiger, Senior Staff Technologist, EFF; Colonel Panic, Malware Research Company; The Wrew

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=PcK-TDmzshc

Overview

This DEF CON talk, "ESP32 as counter-surveillance platform," is credited to Cybertiger, Colonel Panic, and The Wrew. Cybertiger from the Electronic Frontier Foundation (EFF) and Colonel Panic delivered the session on stage; The Wrew contributed to the work but was unable to attend because of a family emergency. The talk introduces a compelling and accessible approach to combating the pervasive expansion of surveillance technologies. Its core premise is to use the inexpensive yet powerful ESP32 microcontroller as a foundation for do-it-yourself (DIY) counter-surveillance tools, democratizing privacy and anti-surveillance efforts beyond the expensive, specialized equipment traditionally associated with Technical Surveillance Countermeasures (TSCM).

The talk highlights the alarming growth of the surveillance industry, with technologies like Automated License Plate Readers (ALPRs), police body cameras, drones, and cell site simulators (Stingrays) becoming commonplace. Cybertiger and Colonel Panic present their work as a form of "economic warfare," demonstrating how low-cost, open-source hardware and software can effectively challenge multi-million dollar surveillance systems. By enabling individuals and communities to detect and map these devices, the initiative aims to raise awareness, facilitate collective action, and ultimately impose significant costs on the surveillance state, forcing constant adaptation and innovation on their part.

This article delves into the technical specifics of their projects, including OUI Spy (or Wi Spy), Sky Spy, and FlockU, explaining how these tools utilize the ESP32 to passively detect various surveillance threats. It explores the broader implications for defenders, emphasizing the importance of community involvement, data sharing, and continuous innovation in this escalating cat-and-mouse game against an increasingly sophisticated surveillance apparatus.

Background

▶ Watch: Introduction to ESP32 and speakers (0:00)

The landscape of modern society is increasingly shaped by ubiquitous surveillance, a trend that the speakers argue is accelerating with bipartisan political and financial support. Companies like Palantir and Flock have seen significant investment, while agencies like the Department of Homeland Security (DHS) have tripled their budgets, leading to tens of millions of dollars spent on new surveillance equipment. This includes ALPRs (e.g., Flock, Axon), body cameras (Axon), surveillance drones, robot dogs equipped with cameras and potential weapons, and cell site simulators (IMSI catchers or MC catchers) that track phones and intercept communications. The advent of Artificial Intelligence (AI) further exacerbates these concerns, enabling the summary and analysis of vast datasets, predictive policing, and the potential for "thought crime," as Cybertiger puts it, drawing parallels to a dystopian "Torment Nexus."

Against this backdrop, the concept of Technical Surveillance Countermeasures (TSCM) typically involves high-end, expensive equipment like spectrum analyzers, nonlinear junction detectors, and advanced Software Defined Radios (SDRs). These tools, often costing thousands of dollars and requiring specialized training, are primarily used to find hidden surveillance devices. However, the speakers contend that privacy and anti-surveillance should not be a luxury reserved for the wealthy or technical elite. Their work is inspired by previous efforts to democratize counter-surveillance. Notably, Null Agent's Def Con 31 talk showcased the ability to track Axon devices (body cameras, smart holsters) by their static Bluetooth addresses, leading to the creation of the RF Party tool for mapping police presence. Similarly, the EFF's Ray Hunter project demonstrated the feasibility of detecting MC catchers using cheap, open-source software on hardware costing $20-40, achieving a staggering $50,000 to $1 economic ratio against million-dollar surveillance systems. Building on these precedents, Cybertiger and Colonel Panic aim to make counter-surveillance even more accessible and cost-effective using the ESP32.

Key Findings

▶ Watch: Counter-surveillance: cheap, accessible, economic warfare (8:10)

The central finding of this talk is the profound utility and accessibility of the ESP32 microcontroller as a platform for robust counter-surveillance. Priced at approximately $6, these devices offer a powerful, dual-core processor, built-in Wi-Fi (2.4 GHz or 5 GHz, depending on the model), and Bluetooth capabilities, all running on a free real-time operating system. This combination allows for programming close to the metal using languages like C, C++, MicroPython, Lua, or Rust, making it highly flexible for various applications.

The speakers frame their work as a form of "economic warfare," demonstrating how the low cost of an ESP32 can effectively counter multi-million dollar surveillance infrastructures. For instance, they cite Las Vegas Metro's $4.37 million investment in 211 Flock ALPR cameras, which could theoretically be detected by a single $6 ESP32, or a network of them for under $850. This dramatic cost differential—for example, a $50,000 to $1 ratio for detecting MC catchers with Ray Hunter, or the ability to counter a $4.37 million Flock deployment for under $850—is a cornerstone of their argument, highlighting the potential to overwhelm the economic model of the surveillance industry.

Key contributions and findings stemming from their research and development include:

• OUI Spy (Wi Spy): A fundamental tool built on the ESP32 that passively detects surveillance devices by monitoring their OUI (Organizationally Unique Identifier), the first six characters of a MAC address that identify the manufacturer. This allows for the detection of specific body cameras, police equipment, or other known surveillance hardware.
• Sky Spy: An ESP32-based application capable of decoding drone Remote ID broadcasts. This enables real-time mapping of drones and their pilots, identifying drone models (e.g., "Matrice 3 thermal" indicating police use), and alerting users to nearby drone activity. The inherent insecurity of Remote ID, which allows such tracking, is leveraged as a counter-surveillance advantage.
• FlockU: A popular project designed to detect Flock ALPR cameras. Initially relying on Bluetooth and Wi-Fi probes, it has evolved to use promiscuous mode to capture probe requests and wildcard probes from these cameras. It can provide simple beeping alerts or, when paired with GPS and an API, map the detected camera locations.
• Fox Hunting: A technique that extends OUI Spy's capabilities by integrating a cheap directional antenna. This allows users to physically locate target devices (drones, body cams, other surveillance hardware) by following the increasing frequency of detection beeps.
• Versatile Prototyping: The ESP32's ease of programming allows for rapid porting of existing firmware (e.g., Void Mantis OS, Sky Spy, Wi Spy) and the development of new applications for war driving, RF analysis, and more. Boards like the M5Stack provide user-friendly interfaces with Grove ports for easy sensor integration, making hardware hacking more accessible.

These findings collectively demonstrate that effective, accessible counter-surveillance is not only feasible but also a powerful strategy for community empowerment and resistance against an expanding surveillance state.

Technical Deep Dive

▶ Watch: FlockU mapping and open-source hardware design (20:00)

The technical foundation of the counter-surveillance efforts presented relies heavily on the capabilities of the ESP32 system-on-a-chip. This compact module integrates a dual-core processor, making it capable of handling multiple tasks concurrently, such as simultaneously monitoring Bluetooth and Wi-Fi signals. Its built-in radio supports 2.4 GHz Wi-Fi and Bluetooth, with specific models like the ESP32-C5 extending support to 5 GHz Wi-Fi. This range of wireless capabilities is crucial for detecting the diverse array of surveillance devices that communicate over these frequencies.

Programming the ESP32 is highly flexible, supporting various environments including the Arduino IDE, and languages such as C, C++, MicroPython, Lua, and Rust. This accessibility lowers the barrier to entry for hobbyists and researchers, enabling rapid prototyping and deployment of custom firmware. The operating system, FreeRTOS, allows for efficient, real-time operations, critical for responsive detection.

The core detection methodologies employed in projects like OUI Spy and FlockU involve passive listening to wireless traffic. For OUI Spy, this means monitoring Bluetooth Low Energy (BLE) and Wi-Fi signals to capture MAC addresses. The initial six characters of a MAC address, the Organizationally Unique Identifier (OUI), are used to identify the manufacturer of a device. By maintaining a database of OUIs associated with known surveillance equipment (e.g., specific police body camera models or ALPRs), the ESP32 can trigger alerts when these devices are detected nearby. Acknowledging the challenge of MAC randomization, which is becoming more prevalent, the speakers indicate that future work will involve "digging deeper into the Bluetooth stack" to find more persistent identifiers or characteristic fingerprints.

Sky Spy specifically targets drone Remote ID broadcasts. This relatively new regulation requires drones to broadcast their identification information. The talk reveals that this data is often transmitted in an insecure manner, allowing the ESP32 to passively decode it. This decoded information includes the drone's model (e.g., "Matrice 3 thermal," which could indicate police or official use), as well as the real-time location of both the drone and its pilot. This capability enables users to map drone activity and identify frequent flyers in their area.

For FlockU, the detection of Flock ALPR cameras has evolved. Early versions might have relied on static Bluetooth addresses, similar to the Axon device tracking. However, as surveillance technologies adapt, FlockU now utilizes the ESP32's ability to operate in promiscuous mode to capture Wi-Fi probe requests and wildcard probes. These are emitted by devices seeking to connect to Wi-Fi networks or broadcasting their presence. By analyzing these packets for patterns or specific identifiers unique to Flock cameras, the ESP32 can deduce their presence. The speakers note that newer Flock cameras may use 5 GHz Wi-Fi or cellular connections, posing ongoing challenges that require continuous adaptation and research, potentially leveraging the ESP32-C5 for 5 GHz detection.

Hardware choices extend beyond the bare ESP32. Small, cheap boards like the Xiao ESP32 are favored for their compact size. For easier prototyping, M5Stack devices are recommended due to their Grove ports, which allow for plug-and-play integration of various sensors without soldering. Detection alerts can be provided via simple passive buzzers (which can be optional if users find them annoying), haptic feedback, or even pushed to cloud APIs for mapping and data storage.

Further technical avenues explored include the ESP32's potential for cryptography. Cybertiger mentions a password generator app he wrote, leveraging the ESP32's reported ability to generate true random numbers based on the noise floor of its Bluetooth and Wi-Fi radios. While noting he is not a cryptographer and verification is needed, this suggests a broader utility for the ESP32 in security-focused applications.

For advanced deployments, ESP-NOW is highlighted as a mesh networking protocol that allows multiple ESP32s to communicate wirelessly without interfering with their Wi-Fi or Bluetooth stacks. This enables the creation of distributed sensor networks, potentially with multiple ESP32s each dedicated to monitoring a specific Wi-Fi channel, significantly enhancing war driving capabilities. Collected data is typically stored in JSON format and can be saved to the ESP32's internal SPIFFS (SPI Flash File System), or uploaded to APIs for broader community analysis and mapping efforts, aligning with community initiatives like Wiggle and Kismet.

Demo / Proof of Concept

▶ Watch: ESP32-C5 extends detection to 5 GHz (30:00)

While the talk did not feature a live, interactive demonstration in the traditional sense, the speakers extensively showcased and explained the functionality of several working proof-of-concept devices and their underlying code. Colonel Panic explicitly presented a physical OUI Spy device, describing it as "just an ESP32 with a buzzer," and pointed out the visible wiring, encouraging the audience to "rip it off" and build their own. He also mentioned a more artistic, wearable version—a clear PCB patch that functions identically to the OUI Spy but is designed to be sewn onto clothing, albeit with the caveat of being "really hard to solder."

The existence and operational success of these tools are central to the talk's message of accessible counter-surveillance. Colonel Panic detailed how Sky Spy has been running in his town for over six months, continuously collecting and saving drone Remote ID data via an API. This ongoing operation serves as a long-term demonstration of its effectiveness in mapping drone and pilot activity in near real-time. Similarly, FlockU is presented as a widely adopted and forked project on GitHub, with many users building their own versions. The speaker recounted having personally soldered over a thousand of these devices by hand during its initial popularity, underscoring its tangible impact and community engagement.

The talk emphasizes the DIY nature of these tools, stating that a basic FlockU or OUI Spy device is "literally just an ESP32 and a buzzer" costing "under 10 bucks." The open-source nature of the code means anyone can replicate, modify, and deploy these solutions. The speakers also discussed future iterations, such as a V2 for OUI Spy incorporating GPS, haptic feedback, and a dedicated app, further solidifying the active development and real-world application of these concepts. Although a direct, live "demo" wasn't the focus, the extensive explanation of these functional projects and their real-world impact served as a powerful testament to their viability as counter-surveillance tools.

Defensive Implications

▶ Watch: Signal Trace countermeasures and ESP-NOW clustering (42:00)

The work presented by Cybertiger and Colonel Panic carries profound defensive implications, offering actionable strategies for individuals and communities to push back against the ever-expanding surveillance state.

1. Democratization of Counter-Surveillance: By providing cheap ($6 ESP32s) and open-source tools, the project makes sophisticated Technical Surveillance Countermeasures (TSCM) accessible to everyone, not just government agencies or wealthy individuals. This empowers ordinary citizens to participate actively in protecting their privacy and monitoring their environment.

1. Community-Driven Data Collection and Mapping: Tools like OUI Spy, Sky Spy, and FlockU enable crowdsourced data collection. Users can detect and log the presence of ALPRs, body cameras, and surveillance drones. This aggregated data, potentially shared through platforms like Wiggle or community-developed APIs, can create public maps of surveillance infrastructure. Such maps are invaluable for raising public awareness, informing local activism, and challenging the deployment of these technologies in city council meetings or legal battles, as Colonel Panic recounted doing in his own city regarding Flock cameras.

1. Economic Warfare and Imposing Costs: The core strategy is to engage in "economic warfare" by using low-cost, rapidly deployable counter-surveillance tools against expensive, high-maintenance surveillance systems. If surveillance providers are forced to constantly update their hardware or change their communication protocols to evade detection, it significantly increases their operational costs and development cycles. This "cat-and-mouse game" makes surveillance more expensive and less efficient for the operators. Even if detection is temporary, the imposed cost is a victory for defenders.

1. Adaptation to Evolving Threats: The speakers acknowledge that surveillance technologies are constantly evolving (e.g., MAC randomization, 5 GHz Wi-Fi, cellular networks for Flock cameras, Signal Trace RF fingerprinting). Defenders must similarly adapt. The open-source nature of their projects encourages community contributions to find new detection methods, analyze deeper layers of communication stacks (e.g., Bluetooth characteristics, service UUIDs), and develop countermeasures for emerging threats like Signal Trace, which builds RF fingerprints of individuals.

1. Legal and Activist Leverage: The data collected through these devices can serve as critical evidence for legal challenges and advocacy efforts. Documenting the prevalence and locations of surveillance devices can expose over-policing, privacy violations, and the disproportionate impact on certain communities. The EFF's involvement underscores the importance of combining technological counter-measures with legal and policy advocacy.

1. "Poisoning the Well" (Speculative): A speculative defensive implication discussed is the idea of "poisoning the well" by broadcasting random or misleading RF signals. While legally ambiguous and technically challenging (AI could potentially filter noise), the intent would be to disrupt or degrade the quality of data collected by surveillance systems, further imposing costs and reducing their efficacy.

1. Inspiring Action and Reducing Paralysis: Beyond the technical aspects, the project aims to inspire individuals who feel "paralyzed by inaction" in the face of pervasive surveillance. By providing an easy, accessible entry point into hardware hacking and counter-surveillance, it encourages people to "get involved," think critically about their environment, and contribute to a collective defense of privacy.

In essence, the defensive implications revolve around empowerment, community, economic pressure, and continuous innovation, fostering a resilient and informed populace capable of challenging the surveillance state.

Key Takeaways

• ESP32 is a powerful, accessible counter-surveillance platform: The $6 ESP32 microcontroller offers dual-core processing, Wi-Fi, and Bluetooth, making it an ideal, cost-effective base for DIY anti-surveillance tools.
• Economic warfare is a viable strategy: By deploying cheap, open-source hardware and software, individuals can impose significant financial and developmental costs on multi-million dollar surveillance infrastructures (e.g., $50,000 to $1 ratio against MC catchers, countering $4.37M Flock deployments for under $850).
• Specific tools enable passive detection of various threats: Projects like OUI Spy (detects surveillance devices by MAC OUI), Sky Spy (decodes drone Remote ID for real-time mapping of drones and pilots), and FlockU (detects Flock ALPR cameras via Wi-Fi probes) provide tangible methods for monitoring surveillance.
• Community involvement and open-source development are crucial: The open-source nature encourages widespread adoption, adaptation, and collaborative development, allowing a "cat-and-mouse game" against evolving surveillance techniques (e.g., adapting to MAC randomization, 5 GHz Wi-Fi, Signal Trace).
• Privacy is a human right and should be universally accessible: The initiative democratizes counter-surveillance, ensuring that privacy protection is not limited to the wealthy or technically proficient, but available to everyone through easy-to-use, low-cost solutions.
• Constant adaptation and data sharing are essential for long-term success: As surveillance methods change, continuous research, community-driven data collection, and sharing of findings (e.g., new OUI indicators, detection techniques) are necessary to maintain effective counter-surveillance capabilities.

About the Speaker(s)

Cybertiger is a Senior Staff Technologist at the Electronic Frontier Foundation (EFF). He is known for creating or co-creating Ray Hunter, a tool designed to detect IMSI catchers (MC catchers or Stingrays). His work often involves reverse engineering malware, and he is a proponent of open-source solutions for digital rights. He is also recognized for distributing "terrible memes" and occasionally wearing a tiger suit.

Colonel Panic works at an undisclosed malware research company. He is the creator of several notable projects in the counter-surveillance and assistive technology space, including OUI Spy (also known as Wi Spy), Mesh Detect, and Dynamic Vision Assist (assistive technologies for visually impaired individuals). Colonel Panic emphasizes his commitment to making technology accessible and affordable for everyone, often favoring cheap, DIY hardware solutions like the ESP32 over expensive alternatives.

The Wrew was slated to speak but was unfortunately unable to attend the conference due to a family emergency. He is acknowledged for his contributions, including porting various firmware projects to different devices.