Eavesdropping and Bug Device Discovery with Bastille

Balint Seeber of Bastille demonstrates discovering covert surveillance bugs in sensitive spaces. An analog FM bug transmits room audio on an unusual frequency, while a compact, cheap GSM cellular bug calls a predefined number over a carrier network. Bastille sensors detect the FM emissions or unexpected GSM uplink activity, localize the device on the floor plan, and alert security.

Key Takeaways

• Analog FM bugs transmit room audio on uncommon frequencies to a nearby receiver
• GSM cellular bugs are tiny, cheap, and call a predefined number over a normal carrier network from anywhere
• Bastille detects FM emissions in a known band or unexpected GSM uplink activity in an area
• The bug is localized on the floor plan and an alert helps security find and remove it

Video Transcript

Hello, my name is Balint Seeber and I'm the Director of Vulnerability Research at Bastille. I'd like to show you how you can use the Bastille solution to monitor for surveillance devices that may be surreptitiously placed in boardrooms or C-suites, where an attacker wants to overhear sensitive conversations that are taking place. So two options are the use of either an analog FM bug or a GSM bug.

So in the first instance, an attacker might place an FM bug under a table, and when it detects voice activity within the room, it will begin transmitting using FM, but often on a much higher frequency than conventional FM radio, and such an attacker would then use an FM radio receiver to receive these conversations. The information is just communicated wirelessly, and the attacker can record these conversations for later review.

If an attacker wants to be a little bit further away, in fact, anywhere in the world, they can use a different sort of bug, a GSM cellular bug that can be similarly placed out of the way, out of sight. And they're very, very compact and quite cheap available online. They will actually communicate using a normal cell operator's tower. You could place a SIM chip in there. And these-- then upon hearing activity, will call a predefined number through the cellular network. And then the attacker's mobile phone will ring.

And they can listen to again, all the conversations taking place within that sensitive area. The Bastille solution can be used to protect and discover these attacks by having the sensors which are here deployed throughout this office floor, detect the emissions from these devices.

So when emissions from, say, an FM bug are detected in a known band, or if a GSM bug suddenly starts uplink activity in an area where you don't expect uplink activity to be occurring, they can be localized to this particular point on the floor plan within the user interface, and an alert is then thrown informing security personnel that a bug may be in use as they're actually localized with our back end analytics and shown on the floor plan, it greatly aids personnel in trying to discover where these bugs are actually placed.

And for more information, please refer to our website. [SUSPENSEFUL MUSIC] MUSIC]