Building a War Spying Box
To demonstrate the dangers of unencrypted wireless cameras, Kevin Rose and Dan Huard reveal how to build and use the first ever handheld auto-switching warspying device. Designed from the ground up, they take a helpful step-by-step process to go from the basic circuit construction to the complete warspying box design.
Small wireless cameras have become increasingly popular in the past few years. They are used to monitor activity around homes and businesses in an effort to attain an extra hint of security. Most of these types of cameras, however, are unencrypted so their signals can be picked up by anyone with a compatible, off the shelf, receiver. This isn't necessarily a deal breaker for everyone, but if you use such cameras you should be aware of the potential danger of allowing someone to peek inside your home or place of business.
Searching for open video camera feeds is known as 'warspying.' Usually this is done with a handheld video camera, a wireless video receiver, and an inverter to power the whole rig from one's car. We weren't satisfied with that setup so we built a portable, autoswitching, warspying device to demonstrate that it can be very easy to find and possibly exploit these cameras.
In order to accomplish our goal we needed 5 things:
- a wireless video receiver
- a screen
- a portable power source
- a means of automatically switching between the various receiver channels
- an enclosure for the components
Wireless Receiver
We started with a standard X10 wireless receiver. The X10s are pretty popular due in part to their aggressive internet ad campaign. But these can't be used as-is and will require some modification that we'll get to later.
LCD Screen
As far as screens go the easiest choice are ones made for car entertainment systems. We used a non name brand widescreen headrest model. These are relatively inexpensive and can be stripped down to the bare LCD. They also have the added benefit of using a standard composite video connector for their input which can connect straight to the wireless receiver. Finally, it runs off of 12 volts which is relatively easy to power portably.
Power Supply
Both the LCD and X10 wireless receiver run off of 12 volts. But our switching circuit that we'll construct later runs off 5 volts. After some internet searching and trips to our local surplus electronics store we decided to go with a UPS (uninterruptable power supply). The UPS we found is not the kind typically used as backup power for your computer. Do not try to use that kind of UPS, they can be dangerous and aren't a good solution for this project anyway. Our UPS can connect to a standard 12V lead acid battery and provides 12, 5, and 3 volt outputs. This takes care of charging the battery for us and gives us nice clean power for all our components.
Some notes about power supplies:
- BE CAREFUL!!
- Usually you won't get clean voltage outputs until they are under load. That means that if you just plug it in and measure the voltage outputs then you're likely to see strange results. You need to connect one of the power outputs to something first. An LED and resistor in series is a good candidate for this.
- Many UPSs will not produce output when connected to the battery alone. They need to be jump-started with AC power first. Once they get going they can be disconnected from external power and will run until the battery dies or you turn off the devices that it is powering.
Automatic Switching
Now here is where we get into the nitty gritty electronics. We modified the X10 wireless receiver and added an automatic switching circuit to replace the 4 position manual switch that you'd normally find on the bottom of the unit.
First you'll need to take the receiver apart. This isn't as easy as it sounds. Once you take apart the plastic enclosure you'll notice that the channel switch is mostly inside a metal enclosure. A lot of solder is used to keep this enclosure closed and in place. Think of this as a great opportunity to better familiarize yourself with desoldering wicks and solder suckers.
Once you remove all the solder and completely disassemble the enclosure you'll see that the channels are switched with a 12-pin 4-position slider switch. This switch has small solder points that we found difficult to remove. Keep trying though, it'll come out eventually.
The switch works as follows:
Pins: ----- A B C D E F (the halves don't connect to each other) a b c d e f Positions: ---------- In position one, pin A connects to pin C and pin a connects to pin c and so on. 1. A-->C and a-->c 2. B-->D and b-->d 3. C-->E and c-->e 4. D-->F and d-->f
Once we knew how the switch worked we created a circuit that mimcs the functionality of the switch. In order to keep things cheap and simple we went with using common off the shelf integrated circuits. You can find the details of how to wire the circuit in this schematic. We used the wire-wrap method of wiring because we had the tools and mistakes are easier to correct.
An explanation of the circuit can be found in this episode's video. It basically works like this:
- the 555 timer chip produces a clock signal
- the 4017 Decade counter/divider counts the clock ticks from the 555 chip
- two 4066 quad bilateral switches are wired to replicate each half of the switch we're replacing. It takes a signal from the 4017 in order to know which pins to connect.
To accompany this circuit we added a button to switch between automatic and manual switching. The manual switch is constructed from a momentary switch connected to a 7400 quad NAND gate (wired as a switch debouncer). Finally we added a variable slider resister to control the auto-switching rate and an LED that is turned on and off by the switching circuit to have a better idea of when the switching is actually taking place.
The circuit is fairly straightforward, but if you're very new to electronics do yourself a favor and buy extras of each chip (they each go for under $1).
Enclosure
A standard lockbox for money turned out to be the best enclosure we could find. It will be modified quite a bit so get a sturdier double walled version. This is where you'll have to get creative. The modifications you'll need to make to the box will depend on the exact components you chose. A rotary tool and drill with many bits will be your best friends here. This will also require digging around various hardware and surplus stores to find the exact screws, brackets, standoffs, and connectors to make everything fit securely.
Finishing Touches
We added a few extra features to make life a little easier for us. The signal from the wireless receiver was split and wired to a component jack we mounted to the outside of the box. Also, the X10 antenna was replaced with a coax connector on the outside of the box so we could have more flexibility and range with the antennas we choose. Finally we added a cutoff switch that allows us to cut power to the switching circuit and the receiver to save battery life.
Final Notes
There is more than one way to construct such a device. Our design was largely a result of what was available to us in our local surplus electronics shop. Live there while building the device, you'll learn a lot and may come up with a better design than we did.
Take note of the wattage of the power supply you use. Our power supply turned out to be too weak to drive all our components so we had to wire our LCD directly to the battery.
Highlights
exact location
(
7:13, 7:13
)
increasingly popular
(
0:05, 0:05
)
power supply
(
2:30, 3:20, 2:30, 3:20
)
inch screen
(
6:19, 6:19
)
exact location
(
7:13, 7:13
)
increasingly popular
(
0:05, 0:05
)
power supply
(
2:30, 3:20, 2:30, 3:20
)
inch screen
(
6:19, 6:19
)
Automatically Generated Transcript(may not be 100% accurate) ( more )
" For the last few years small wireless cameras like this one it had become increasingly popular there for a moment this this is what most people don't realize that a lot of these cameras are on encryption which gets the potential wars --"
" inside your house and Montague if you went to turn the dangers of wireless cameras we're gonna build the first ever automated."
" I can't help war spying device on January I'm Kevin Rose welcomed the system. --"
" So what's the difference between a typical war spying senate president way to -- so with a typical set you have three main devices it. One is your wireless video receiver like we have here is that allow you to receive video content as you're driving around. This one actually has four different channels use those as a drag and you're want to look. Kind of serve to the different channels to try and find defeat of this year manually switching to these video things about the problem that I'm saying then. And that when -- you're gonna miss something yet if you're too fast goodness well you might -- the channel so it's -- really not the way we like to do okay the next thing we have here is an invert this is gonna plug into your cigarette lighter adapter is actually provide power for the wireless receiver and the last thing is a standard cam -- it's gonna allow you. -- Okay out in front of us is all the tools we need to complete a project let's start from the end when we -- so yes Benadryl for drilling holes and -- advocates. A rotary tool the budgeted for various bits from making case modifications. Standard screwdrivers soldering iron -- in a solder -- now this is really important -- is actually gonna be some chips. We're pulling off in removing sort of need that that little. And in on the theory and a couple really important things for building or circuit a power supply to power is circuit and also multi meter when we're doing some testing called though we got all the tools let's move on -- Arts and got pretty much -- harbor that we need for the project but before it started when you couple precautions. The first thing the second start modifying a lot of the stuff you're not gonna -- returned to the store and you're voiding your warranty. And the second being that we're doing with electricity today so if you haven't done in the past he really don't know what you're doing please consult the advice of an expert so you don't hurt yourself -- Now moving out of the heart of the person we're talking about is why does the receiver with the four channel selector right now also. To view the west -- being announced -- need in this case we have a seven point two adjusted the common in most car entertainment systems. It also has a video -- was going to allow you to connect to wireless receiver -- is -- video it's very -- connection is -- need -- conversion is nice that way the next thing we have is an instructive -- power supply -- is deals with 512 -- and also has a battery so don't have to be tethered to -- hardline -- walk -- into -- thing to remember though is that this is not your computer -- yeah that he over the computer not to -- actually really hurt -- don't bother with that we -- is an electronics specialty -- that's -- find -- also we have we have some -- is some -- passengers. Bracket screws -- which is we're gonna get did is that just a little bit later yes and -- the most important things we have is our project boxes where everything goes inside of this is the box we're gonna modify -- handle the -- this is actually a cash box of genres -- works perfectly and it'll actually how's everything that's in need. So that's all we need we're gonna class on this components in let's get Milton. But take apart the X ten wireless video receiver easily get access to that little manual switch had -- take -- apart and flip it over here you're gonna see there's a little metal housing fitting cases the switch that we're gonna need to get to act some take the soldering -- here we're here -- these different solder points and then you're gonna use the -- suckers going get that out there right essentially houses are cycle works just. Preston plunger get next to the -- point. Hit the button. Sex -- that lets others do it and then once you get to that point in this little dishonor let we have -- So Lieberman's switch and the twelve pin for positions ladders which writes to what we -- This circuit to replace this which could -- yet as total five -- on the circuit and this is how they work. First we have a 555 timer chip which is wired to produce available with clock signal. That's connected to a 57 decade -- adviser chip. That's wired account for positions like -- so which represents that the Ford video of him as Iraqis switching exactly now we -- 24066. Squad bilateral switches which are also wired to replicate the twelve pins on the slider switch. -- that's the buttons the switch between auto or manual switching so that it didn't hit a 7400 quad handy. Why is this which announcer for the manual switch -- about doing this -- chips that are readily available off the -- in the entire -- gonna -- about ten -- I know there's some additional resisters and capacity to make it all work and it -- humanity in general -- excellent you know the circuit want to move on to the extant wireless -- sorry twelve external wires here so they can interface with the circuit -- done here let's go -- bring -- the additional hardware and -- project box. -- this is just a hugely original box -- you can see we've made some major modifications -- it was certainly the worry to a -- window here for the LCD -- once you open -- the box here's a bunch of different -- that we don't hear this for -- the various components with -- that's where all components together. Fired -- let's do that yeah. Put together punching Ellison's take a look at the layout I was the seven point two inch screen on the front nonstick look at the components on the inside. So what we have -- X ten receiver the battery. That custom circuit that we made it here's ops and obviously the LC yup and for a nice now. What's that closes up on the very top here we have a couple more options this is for manually switching between the different channels and this is to turn on automatic switching. Now the automatic switching is controlled by this little slider here that adjusts the scan rate between the -- individual channels. Underneath that we have a coaxial connector that he's pro hooking up external antenna. And then below that we edit video out of you want to record anything that you might come across so -- to it let's take out the tunes you can find."
" I over the Carly get the war spying device that depth and we've also added an omni directional antenna as it -- the final all those open feet. So here's the directional antenna that we're gonna use candidate you can't. We will use this to pinpoint the exact location where the wireless cameras -- let's drug rezulin to fine."
" It's."
" Cool."
" Is little -- care irrelevant. There is it as there is -- I think we have and that is -- was the devil so that there actually found it looks like."
" It office complex. There is a wireless camera -- suddenly desk. -- Some this -- and then some kind of window or something we're heartless -- outside see what we in suing fine."
" I -- got a lot you know we've got pretty much it crystal clear view -- inside the business now. And it looks like that's actually inside the doors again. -- boasted that the -- actually see you inside the doors there there this -- again isn't there are hundreds and un encrypted. And there's DN DS that in general right -- In this about 3035 feet away but we're not having any problems. Whatsoever because we're using a directional cantenna to actually go right in the pick of the feed. So that's good about it it works perfect let's take this to residential area ensued I think it's. You don't get static who is the place. --"
" It's not. Oh socialism by going to -- make -- signal. Of -- there they're there because it does -- is July. Hold alone. If it's doing is -- is there anything. It's there there because how votes it looks like."
" And encrypting cam it's between two apartment complexes. In his back now we had quite --"
" With the two. Let's go and one closer and you know exactly what we can see that. -- it's completely encrypted. You can Smith. Sees this key has to. Do business."
" Names aren't from Irwin yeah the camera was completely gone."
" The device worked we were able captured two -- could be cameras from 670 feet away without a problem."
" So this goes to show if you really want it remains secure and private you have to use an encrypted camera."
" That's evidence that this has just about -- good. -- Kevin Rose until next time let him."
" For the last few years small wireless cameras like this one it had become increasingly popular there for a moment this this is what most people don't realize that a lot of these cameras are on encryption which gets the potential wars --"
" inside your house and Montague if you went to turn the dangers of wireless cameras we're gonna build the first ever automated."
" I can't help war spying device on January I'm Kevin Rose welcomed the system. --"
" So what's the difference between a typical war spying senate president way to -- so with a typical set you have three main devices it. One is your wireless video receiver like we have here is that allow you to receive video content as you're driving around. This one actually has four different channels use those as a drag and you're want to look. Kind of serve to the different channels to try and find defeat of this year manually switching to these video things about the problem that I'm saying then. And that when -- you're gonna miss something yet if you're too fast goodness well you might -- the channel so it's -- really not the way we like to do okay the next thing we have here is an invert this is gonna plug into your cigarette lighter adapter is actually provide power for the wireless receiver and the last thing is a standard cam -- it's gonna allow you. -- Okay out in front of us is all the tools we need to complete a project let's start from the end when we -- so yes Benadryl for drilling holes and -- advocates. A rotary tool the budgeted for various bits from making case modifications. Standard screwdrivers soldering iron -- in a solder -- now this is really important -- is actually gonna be some chips. We're pulling off in removing sort of need that that little. And in on the theory and a couple really important things for building or circuit a power supply to power is circuit and also multi meter when we're doing some testing called though we got all the tools let's move on -- Arts and got pretty much -- harbor that we need for the project but before it started when you couple precautions. The first thing the second start modifying a lot of the stuff you're not gonna -- returned to the store and you're voiding your warranty. And the second being that we're doing with electricity today so if you haven't done in the past he really don't know what you're doing please consult the advice of an expert so you don't hurt yourself -- Now moving out of the heart of the person we're talking about is why does the receiver with the four channel selector right now also. To view the west -- being announced -- need in this case we have a seven point two adjusted the common in most car entertainment systems. It also has a video -- was going to allow you to connect to wireless receiver -- is -- video it's very -- connection is -- need -- conversion is nice that way the next thing we have is an instructive -- power supply -- is deals with 512 -- and also has a battery so don't have to be tethered to -- hardline -- walk -- into -- thing to remember though is that this is not your computer -- yeah that he over the computer not to -- actually really hurt -- don't bother with that we -- is an electronics specialty -- that's -- find -- also we have we have some -- is some -- passengers. Bracket screws -- which is we're gonna get did is that just a little bit later yes and -- the most important things we have is our project boxes where everything goes inside of this is the box we're gonna modify -- handle the -- this is actually a cash box of genres -- works perfectly and it'll actually how's everything that's in need. So that's all we need we're gonna class on this components in let's get Milton. But take apart the X ten wireless video receiver easily get access to that little manual switch had -- take -- apart and flip it over here you're gonna see there's a little metal housing fitting cases the switch that we're gonna need to get to act some take the soldering -- here we're here -- these different solder points and then you're gonna use the -- suckers going get that out there right essentially houses are cycle works just. Preston plunger get next to the -- point. Hit the button. Sex -- that lets others do it and then once you get to that point in this little dishonor let we have -- So Lieberman's switch and the twelve pin for positions ladders which writes to what we -- This circuit to replace this which could -- yet as total five -- on the circuit and this is how they work. First we have a 555 timer chip which is wired to produce available with clock signal. That's connected to a 57 decade -- adviser chip. That's wired account for positions like -- so which represents that the Ford video of him as Iraqis switching exactly now we -- 24066. Squad bilateral switches which are also wired to replicate the twelve pins on the slider switch. -- that's the buttons the switch between auto or manual switching so that it didn't hit a 7400 quad handy. Why is this which announcer for the manual switch -- about doing this -- chips that are readily available off the -- in the entire -- gonna -- about ten -- I know there's some additional resisters and capacity to make it all work and it -- humanity in general -- excellent you know the circuit want to move on to the extant wireless -- sorry twelve external wires here so they can interface with the circuit -- done here let's go -- bring -- the additional hardware and -- project box. -- this is just a hugely original box -- you can see we've made some major modifications -- it was certainly the worry to a -- window here for the LCD -- once you open -- the box here's a bunch of different -- that we don't hear this for -- the various components with -- that's where all components together. Fired -- let's do that yeah. Put together punching Ellison's take a look at the layout I was the seven point two inch screen on the front nonstick look at the components on the inside. So what we have -- X ten receiver the battery. That custom circuit that we made it here's ops and obviously the LC yup and for a nice now. What's that closes up on the very top here we have a couple more options this is for manually switching between the different channels and this is to turn on automatic switching. Now the automatic switching is controlled by this little slider here that adjusts the scan rate between the -- individual channels. Underneath that we have a coaxial connector that he's pro hooking up external antenna. And then below that we edit video out of you want to record anything that you might come across so -- to it let's take out the tunes you can find."
" I over the Carly get the war spying device that depth and we've also added an omni directional antenna as it -- the final all those open feet. So here's the directional antenna that we're gonna use candidate you can't. We will use this to pinpoint the exact location where the wireless cameras -- let's drug rezulin to fine."
" It's."
" Cool."
" Is little -- care irrelevant. There is it as there is -- I think we have and that is -- was the devil so that there actually found it looks like."
" It office complex. There is a wireless camera -- suddenly desk. -- Some this -- and then some kind of window or something we're heartless -- outside see what we in suing fine."
" I -- got a lot you know we've got pretty much it crystal clear view -- inside the business now. And it looks like that's actually inside the doors again. -- boasted that the -- actually see you inside the doors there there this -- again isn't there are hundreds and un encrypted. And there's DN DS that in general right -- In this about 3035 feet away but we're not having any problems. Whatsoever because we're using a directional cantenna to actually go right in the pick of the feed. So that's good about it it works perfect let's take this to residential area ensued I think it's. You don't get static who is the place. --"
" It's not. Oh socialism by going to -- make -- signal. Of -- there they're there because it does -- is July. Hold alone. If it's doing is -- is there anything. It's there there because how votes it looks like."
" And encrypting cam it's between two apartment complexes. In his back now we had quite --"
" With the two. Let's go and one closer and you know exactly what we can see that. -- it's completely encrypted. You can Smith. Sees this key has to. Do business."
" Names aren't from Irwin yeah the camera was completely gone."
" The device worked we were able captured two -- could be cameras from 670 feet away without a problem."
" So this goes to show if you really want it remains secure and private you have to use an encrypted camera."
" That's evidence that this has just about -- good. -- Kevin Rose until next time let him."
Advertisement
