Situation
In June 2014 the startup had a device called the WRAT and an agreement to present and sell it at Black Hat and DefCon 2014. The WRAT was a couple of tiny-form-factor PCs, mini and micro-ITX boards plus a PSU in a small fractional-1U chassis, booting a Linux image that did minimal things: scan 2.4 GHz Wi-Fi, run an automated WEP attack, and stand up a fake AP with a crude captive portal. Customers also had a legitimate concern about putting a prototype on their own network.
Objective
Deliver a working product for Black Hat and DefCon 2014, and support the business plan and the raise.
Approach
I rethought the device as a drop-in, self-contained, multi-radio sensor with cellular backhaul. It needed nothing but power and could sit passively listening, which removed the “not on my network” objection. I designed and built it mostly alone, worked on the business plan, and sat in VC meetings and sessions with strategic advisers.
- Radios. Two PC-card Wi-Fi adapters, a high-power SR71 and an Intel card for 5 GHz and expanded scanning. A USB software-defined radio for sub-1 GHz RF scanning. A USB cell-radio sled with GPS and a SIM slot for the cellular link. The chassis was drilled for cell, GPS, SDR and four Wi-Fi antennas.
- OS. A custom-tuned Linux distro with exactly the features and drivers needed.
- Wi-Fi engine. Node.js over Python and driver integration, with two parallel threads: one hopped channels and, on command from the cloud, sent deauth and disassociation frames; the other captured APs, clients, associations and signal strength and streamed them to the cloud.
- Cellular. Backhaul so the sensor could be dropped in place and left running. I also instrumented it: cell towers and per-tower signal strength, IMSI-catcher detection including new-tower detection, and per-device GPS logging.
- RF. A signal model built from Wireshark to detect the 900 to 905 MHz portable POS devices used in casinos. More generally, it detected an RF signal, measured channel width and encoding, matched it against a library of known protocols, and classified it once identified.
- Cloud C2. ASP.NET / WCF and MS SQL. Each device enrolled with a client certificate. Authenticated users saw every device, its detections and its GPS location. When several devices saw the same target, the cloud used their fixed positions and measured signal strengths to trilaterate the target, whether a laptop, AP or phone.
- Over-the-air modules. Every capability shipped to the device as a package. The main Linux service authenticated to the cloud, pushed data up, pulled commands down, and pulled new packages to add or update functionality.
I also proposed the company name, “802 Secure”, as in IEEE 802.11. The Triverium intern hand-assembled the boxes.
Deployment at Black Hat and DefCon 2014. I delivered six functional sensors, the cloud C2, the patent work written and ready to file, and an updated business plan. With access from the casino group’s CISO, we placed three sensors in the Mandalay Bay plenum and three around the Rio: near the entrance, bar and restaurant area where the POS devices were used, above the exhibitor floor, and where they formed a good triangle for trilateration. I worked from the command post above the DefCon floor alongside other wireless security vendors.
Fixing scale live. At north of ten thousand people, the sensors captured faster than the cell backhaul could ship. During the event I rewrote the data path and pushed OTA packages to each device: comb filters so a device sent only new observations plus lightweight “still-there” heartbeats, payload compression with data going up via MTOM over HTTPS, and tuned POS detection.
Net results
- Detections fired, the devices ran, and the cloud held up at a ten-thousand-person event.
- We detected and roughly located a rogue IMSI-catcher, a fake cell tower that visiting hackers had stood up to skim taxi credit-card swipes outside a casino entrance. Exactly what the product was for.
- All six devices sold, with investor and adviser interest.
- The company later raised from angels and VCs and built the device out from the architecture and plans I designed.
- The work resulted in a granted U.S. patent, below.
Takeaway: build architecture you can change live; OTA packages let me re-engineer the data path mid-event.
Sources: USPTO and Justia records for US 10,257,226 B2.
Scope and technologies
Tiny-form-factor x86 micro and mini-ITX sensor; custom Linux distro; multi-radio, with 2.4 and 5 GHz Wi-Fi via SR71 and Intel, USB SDR for sub-1 GHz RF, and a USB cellular card with GPS and SIM; Node.js plus Python and driver integration; parallel channel-hop and capture threads; deauth and disassociation on command; IMSI-catcher and rogue-tower detection; RF protocol fingerprinting, including 900 MHz POS; client-cert device enrollment; ASP.NET/WCF and MS SQL cloud C2; multi-sensor signal-strength trilateration; OTA capability packages.
Patents
- US 10,257,226 B2, “Deceptive network emulation to trap wireless attackers.” Granted April 9, 2019. Inventors: Garry Drummond and Paul Vilevac. The earlier US 2017/0279852 A1 was the application publication; 10,257,226 B2 is the grant, confirmed on USPTO and Justia, Oct 2026.