About the same time that the owner of the north mobbing house made his sly comments about his dislike of the blue light that radiated from his neighbors’ televisions, including my own (Your TV doesn’t have to be smart to be hacked (part 1), https://onbeingmobbed.com/2018/08/27/your-tv-doesnt-have-to-be-smart-to-be-hacked-part-1/#more-18739), he suggested we split the cost of a WiFi network. He, of course, would host it; he said he’d done it before. And not long after, he showed up at my door, wanting to have a look at “something” on my router. He turned the device over and over in his hands, replaced it on the floor and then left.

We never did “share” that WiFi network, at least not with my consent. Later I wrote a blog entry about this incident that I came to consider a real-world deployment of social engineering, perhaps more traditionally called a con or “confidence game” (The social engineering of mobbing, https://onbeingmobbed.com/2018/01/06/the-social-engineering-of-mobbing).

This trollish man, who informed me of his background in the military and took to shaking out his bedclothes and floor coverings from a veranda overlooking my front yard, was quick to tell me he bought a home in this neighborhood because there was “more room to build.” It seemed a curious statement from a man whose profession had nothing to do with construction. Not to mention the fact that the lots on either side of his own narrow piece of land were occupied. And in the same way that the mother of the south mobbing house owner so smoothly segued from small talk into insulting renters as “not very good people,” the north mobbing house owner wasted no time declaring his opinion to me, the holder of a history degree from U.C. Berkeley, that the liberal arts schools had failed in their mission.

These were the kind of people whose paths I’d been lucky enough not to cross before moving to this northeast Seattle neighborhood. They were the kind of people who do whatever they can to get under your skin.

These events took on another meaning after the start of the “mobbing”—the real estate mobbing or “property mobbing”—when the familiar voices of my neighbors and perhaps even some of those in the neighborhood watch could be heard within and without my legal rental home on the speakers of devices and appliances of technology old and new: Radios, cordless phone and computer, on smart phone and over terrestrial and digital TV.

Experimenting during the tumultuous first months of my being mobbed in my northeast Seattle neighborhood, I used a process of elimination to try to find the source of the harassment and escape the verbal abuse that seemed to follow me within my own home.

Since then I’ve theorized that it might not have been that I was followed per se, but that my habits were known and the neighbors on either side were close enough to have good knowledge of how I spent the time in my small house with its many windows. Alternately, I wondered whether the mobbers had deployed some kind of radio or speaker system to blanket my house in sound that would be audible in every corner. And more recently, given the motion-detecting flood light that the north mobbing house owner directed onto my front deck, I’ve considered whether they use sneaky forms of tracking based on common household technologies like the security cameras and motion-detecting lights that are installed on their own properties. [Note 031019: In my case, they could not break into and use my security cameras to spy on me. I installed a wired system and have kept it offline.]

Whatever the combination of methods, being forced to fend off a sound crime by shutting down connectivity and routers, and by shutting off devices, would further diminish my enjoyment of the amenities, and the liberties, that most Americans take for granted.

Ω

The mobbers made their first appearance on my bedside Proton clock radio one Saturday morning as I lay in bed with the cat, listening to Weekend Edition on NPR. That was the end of beginning my weekends with the cultured and intelligent reports of Scott Simon. A Microsoft friend and I broke my two Proton clock radios into pieces searching for the eavesdropping “bug” that the North Seattle Police said would have to be found before they would take a complaint. The power button of the TV met the same fate. A cordless phone was abandoned in favor of a cheap throwback whose analog design was likely from the 1970s. As the mobbing took hold—metaphorically or literally—all my devices were “bricked.”

But as the victim of a neighborhood bullying situation whose head was evident in the civil arena, the names of at least the key players who must be instrumental in deploying harassment into my home and onto my devices were known to me. And despite their insistence, the mobbers weren’t “getting [me] out.” But they definitely had me going. When I shut down the Comcast router in favor of internet access at the library, the mobbers showed up on WiFi devices around me. When I tried to make phone calls from a public phone in a parking lot, the mobbers had no trouble joining the call. At the gas pump, the same voices came on the speaker. And at Chase bank branches, they piped up over the speaker at the ATM.

The mobbers attempted to intensify my panic about using the household services that provide us with communications and entertainment by allowing me to overhear statements about the “back door” that had been left open on my machine, intimating that I should “log on” so they could close it, and then increasingly demanding that I do so. “Log on!” became code for “get with the program and get out,” and as the days and months of the first year passed, the mobbers’ incessant demands that I comply overtook their jeers and I heard the insult “Village Idiot” much less frequently. Over time, the most direct phrasing of their demand has been “Move on,” with the stress put on one or the other one-syllable word, or both, based on the impatience of the mobber: “Move on!” “Move on!” or “Move on.” Another time during the months for which my household Internet access remained shut down, the familiar voice of one of the female mobbers staged a scene that appeared to be intended to manipulate me into giving in out of pity, crying in anguish from the direction of the north mobbing house, “I put a bot on her machine!” It was an apparent attempt at creating a drama whose resolution would be my final curtain call.

But I stayed. And because I did, I was forced into the reluctant use of services I had to have to survive. I returned first to dial-up Internet, a mode of connection that was untenable in the age of web services and as the subscription model of software distribution got underway.  Wherever I could, I embraced minimalism and the analog, but I accepted the fact that I would not be able to escape the mobbing, at least not without capitulation to what I quickly understood was a criminal attempt at forced eviction and quite likely a shaming crime as well. To remain in my home, I would have to tolerate near-constant harassment.

Ω

It’s been three years since I’ve been able to watch television without an added “harassment track” of verbal abuse layered over the audio. That is, years since I have been able to watch television alone without hearing the abuse. How do the mobbers know where I am and if I’m alone? Hacking, following by private investigators, and neighbor watching all seem like good possibilities. And because most of us are creatures of habit, once they know your routine, they can tailor the mobbing to your environment and modulate the risk of exposure. But that probably isn’t supposed to be necessary, because when the neighborhood watch colludes with a vigilante group or with a pack of house flippers whose business model includes the amusement of some tenant-relocating every now and then, chances are they don’t expect to have to mob you for long. As one of my mobbers once said, “We mobbed you. Now get out!”

At its peak, which as of late is usually when the south mobbing house owner is in evidence, the verbal abuse is audible the moment I turn on the television or any device, the first word often clipped as though the “harassment track” is continuous and overlaid the programming before I turned up the volume. I can modulate the level of the verbal abuse by turning the tuner sound up and down. The abuse stops momentarily when I detune a station and returns when the next station tunes in.

To most effectively quiet the devices I’m not listening to, I avoid standby mode and turn devices off at the power strip or by unplugging the cord. Before I turn off devices, I try to remember to turn down the volume. Listening to programming at low volume tends to hide the harassment, which generally comes in at a lower level than does the programming. There is almost always a noticeable quieting that comes when I shut off the router, a Century Link device that supports both Ethernet and the 802.11 wireless network protocol.

At its most intense, it is as though the broadcast to my devices is constant, as though my house is bathed in sound. When the harassment is not on my devices, in other words, when they are off, the harassment is usually heard as acoustic leakage at my windows. To interrupt the acoustic leakage, I slightly open the windows. The sound at the windows is diminished in conditions of wind and rain. In my bedroom, and at the recommendation of a private investigator who explained acoustic leakage to me and how it can be used in eavesdropping or harassment, I cover the windows with varying amounts of construction-grade acoustic board so I can sleep as well as possible in this situation. Sound travels on a current; the sound board limits its travel. For more information about acoustic leakage and tips on using sound board, see my blog entry, “Sound is a pressure, and a tip on getting the most out of acoustic board (part 2).”

Along the way, I read about low-power and pirate TV stations, but I didn’t know of a reliable method for putting a continuous stream of verbal abuse on a neighbor’s television. That changed not long after getting laughed out of court when I tried to get anti-harassment orders against the owners of the mobbing houses. The trollish one from the north side stood up before the judge, told the judge how he made his living, and asked if it in fact was true that I had told police I heard “voices on my TV.”

That was all the judge needed to hear.

Ω

It was one of those days when you type the right combination of keywords into a web search engine and a whole new set of results pops up. I saw some chatter in some web forum on how you could put sound on your neighbors’ speakers by using Citizen’s Band (CB) radio and a directional antenna. An article on lifehacker was instructive.

“You need a Cheap CB radio, A linear amp, and a bottom loaded CB antenna (easier to build a ground plane for it). See if you can get a good guess where she has her [speaker] set up and get your antenna close as you can to it. You should be able to talk to her THROUGH her stereo system. The amplifier sections are not shielded in these plastic ready made toys and the resulting AM signal will impact it. In my case I ran a continuous 6khz tone from a signal generator which was more than enough to blow it up good. ENJOY!”

The writer summarized, “Essentially, with a few tools, you can transmit your voice, play an annoying tone, or even blast your own music through their speakers—even if their speakers are turned off (emphasis mine)” (“Silence Neighbours By Transmitting Your Music To Their Speakers,” https://www.lifehacker.com.au/2011/10/silence-neighbours-by-transmitting-your-music-to-their-speakers/).

Eventually I found RadioReference.com, where the forum on software-defined radio (SDR) caught my eye. Hackers were, according to one forum message, “very excited” about software-defined radio. Of course, they would be.

What is SDR? A soft radio, that is, a radio that is implemented in software instead of as a hardware device. SDR makes every band available, right on your computer. With a soft radio combined with a network stack and the application layer, you can receive radio frequency (RF) signals and use other applications to analyze, record, and store RF data. You can also transmit RF signals, using sound applications to create sound or mix sound captures, convert the signal to the proper band, and output the signal to physical media or speaker, or over the air. With the growing appreciation of how radio-based computer communications, and even an air-gapped computer can be disrupted by a rogue signal, hackers using SDR are returning to the source.

Ω

Disrupting devices using radio is nothing new. Kevin Mitnick claimed that his all-time favorite hack was accomplished with little more than a radio signal. Some forty years back, at the age of 16, Mitnick hijacked a local McDonald’s drive-through with a 5-watt transmitter.

At the time, Mitnick was interested in magic, and in amateur radio. He sat in his car, just across the street from the McDonald’s drive-through, broadcasting on the same frequency as the low-power headsets. The result was that he replaced the voices of the cashiers with his own. Bill Murphy, Jr. detailed the “prank” on Inc.:

He told some customers they had placed the 100th order of the day and should drive up to get their meal for free as a thank you. When police officers stopped to order food, he feigned panic, yelling so they could hear it, “Hide the cocaine!”

(“This Guy Hacked a McDonald’s Drive-Thru Using Only a Radio, but Later He Went to Prison, so…,” https://www.inc.com/bill-murphy-jr/this-guy-hacked-a-mcdonalds-drive-thru-using-on-a-radio-but-later-he-went-to-prison-so.html.) Murphy makes the point that it was the simplicity of the hack that made it most successful and that would fool people even now.

Ω

What’s most surprising to me, is that more than 40 years after Mitnick’s simple radio hack, psychologists continue to “diagnose” those who are victimized by hacks involving radio, speakers and microphones, as delusional, based on the unthinking application of the DSM (Diagnostic and Statistical Manual of Mental Disorders). And this occurs even when you try to warn those who refer subjects for mental health evaluations and those who do the mental health evaluations. For example, there are recent cases of women victimized by “smart” home abuse in Silicon Valley, at least one of whom was detained for a psychological evaluation. She was fortunate; someone realized that she was the victim of a crime (The New York Times on the digital tools of abuse, https://onbeingmobbed.com/2018/06/25/the-new-york-times-on-the-digital-tools-of-abuse/ ). And then there are many cases in which those who report crimes are discredited as mentally ill, often by perpetrators trying to cover up their crimes. Cases like these are sometimes related to “the Martha Mitchell effect” (Mobbing and the Martha Mitchell effect: When defamation in the neighborhood violates due process in the courtroom (part 1)).

This situation is the fault of professionals who fail to recognize the limitations of their field, attorneys who condemn their clients out of ignorance, and psychologists who do not withhold diagnosis when they should—when they are faced with the victims of unrecognized crimes who are forced into the therapist’s chair. This situation is the result of allowing those in the legal field to play at psychology, and giving psychology a primacy that is undeserved.

Such cases may be the result of professionals who pass the requirements to enter the field, but who lack the intelligence or depth of understanding to recognize when the application of psychology is inappropriate. In my own case, I gave those who had the power to stop what was happening every opportunity to recognize that a mistake was being made, but it did no good. What happened to me is another example of the unthinking application of the DSM by those who fail to see the person before them, hack psychologists who lack insight into the human condition and the context within which they practice. Psychology is no better than those who practice it.

And the thing is, this is exactly what criminals who hide their crimes by claiming that their victims are delusional intend. This is what happens when psychology, indiscriminately applied within a legal context, its use and meanings influenced by attorneys, becomes a tool of politics. The potential good of psychology is easily undermined by its political use. In the end, crimes like mobbing make fools of the police, the courts, and the psychiatrists. You can’t “diagnose” a crime.

Ω

Like any radio, television is vulnerable to signal manipulation. The North American television frequencies are separated into over-the-air (terrestrial) and cable television channels. Over-the-air channels include the VHF and UHF bands, both of which can be received (and directed) using antenna (“North American television frequencies,” in Wikipedia, https://en.wikipedia.org/wiki/North_American_television_frequencies). One technique used to transmit radio signals onto the devices of others is seen in the use of police radios and emergency frequencies, a topic I wrote about in my blog entry, “Radiohead: Cell phones are radios (part 3)“.

Even if you don’t manipulate it, your television is a radio. These days, FM radio stations are a standard feature on cable television services. When you think about it, it makes a lot of sense that a rogue television transmitter or some jerk with a directional  antenna could park out on the street and deploy rogue sound to your television. It would be even easier to deploy the equipment from a neighboring property. Security analysts Ken Westin and Craig Young demonstrated an updated technique for signal diversion from a computer using a Yagi WiFi antenna on Crime Watch Daily: Can These Cyber Security Experts Hack Into a ‘Smart House’? (https://www.youtube.com/watch?v=Cb23Gwhc9DU). The directional Yagi antenna is considered a “gateway” tool for hacking wireless networks.

In many ways, this technique, using a directional antenna, makes the most sense in my own situation. Think about it. And it makes sense when I think about what happened on a Saturday not long ago, when I was about to tune in to the NPR radio stream. I just published my recollection of this in another blog entry; this one was written closer to the actual event.

At just about the time when I was setting up the NPR stream to hear Wait, Wait… Don’t Tell Me,” an unfamiliar vehicle of the same make and model as my own pulled into the driveway of the south mobbing house, stopping on the bumper of another vehicle whose owner seemed to be on a trip. The south house had in fact been quieter the last days and as the driver adjusted the position of a personal device on the dashboard, I wondered if there was a purpose to her arrival just before one of the NPR shows that I’ve continued to listen to throughout the course of the mobbing.

I never heard the driver get out of her car. And when I emerged from the house more than an hour later, she hurriedly rolled the vehicle out of the driveway. But not in time to hide the license plate. She was a twenty- to thirty-something Asian woman, a vertical swath of blue cutting into her black hair.

I can’t be sure of what she was doing parked in a private driveway that happens to have great access to my front windows for more than an hour. But if she was using a directional antenna or an emergency radio station to broadcast into my house, this is a relatively safe technique that requires no malware and is therefore less likely to be forensically traced. If you neighbor the victim, you can hide the antennas on your premises and the victim will have little chance of escape.

Moreover, if your victim does not understand the technique, she might exhaust her funds paying for forensic services that cannot expose the exploit. Her forensic experts, whose expertise may be limited to using a forensic software package, may lack knowledge of techniques that thwart forensic detection. I suspect there may also be a difference between forensic specialists who understand how to find artifacts of intrusion on the hardware level versus those that exist on the software level and that might be found using a forensics application. At any rate, forensics is another area in which experts, or those who hire them, might wrongly conclude that the client is paranoid in their unwillingness to accept the limitations of their software.

The same is true of exploits that put sound on a television at a volume that is significantly lower than the digital signal. Digital sound editing software may discard the softer rogue signal as it focuses on the preservation of the sound with greater amplitude. Perhaps the softer sound is filtered out as noise. Or perhaps the reliance on visualization tools for the analysis of sound discourages us from careful listening and the crude visualizations do not accurately represent the range of sound in a sample.

At least, I suspect this is the technical reality of most audio software, as well as a vulnerability that mobbers exploit. It is a reality that has made me wonder whether the best way to apprehend mobbers is to analyze the signals crossing the hardware, or the data on the wire, at the packet level.

Ω

Not only can you listen to radio on your television, you can listen to television on your radio—at least, you can listen to analog TV on your TV band radio. This is the convergence not only of television and the computer, but of television and radio. A Lifewire article from June 2018 explains how TV band radios are AM/FM radios that can play the audio track of an analog TV signal. The TV band radio remains an analog device; to play a digital television signal you need a DTV converter box (“Making TV Band Radios Work With Digital TVs,” https://www.lifewire.com/tv-band-radios-digital-tv-3276380).

I haven’t come across an example, but I’ve wondered whether a rogue radio signal could overlay, and not wholly interrupt, the broadcast of a DTV signal. For example, could a transmission to the same frequency of an HD channel blend with the intended programming or would the transmission of a rogue signal onto, say, a cable TV radio station overlap and not displace programming that was underway. I’ve also wondered whether a rogue radio signal that targets a second HDMI interface would be heard on the speakers of a television over an ongoing DTV broadcast on the first. I guess it would depend on the hardware of the television, something that is outside my experience. Generally, however, when I turn up the volume on the television, the harassment usually begins, and often with a clipped word, as though the rogue signal was already in progress. The harassment on the television has the greatest volume on channels that are part of regular cable programming. Over the time of the mobbing, I have experimented with television over-the-air, through a digital converter box, on Comcast cable, with Century Link, and now with DirecTV, which is a streaming service receiving regular channels. I get the most relief from the harassment when I use services that I believe are purely streaming, where the programming is not alternately offered over a broadcast signal. Roku “channels” like Netflix and Amazon Prime have been the best for me when it comes to mitigating audible harassment when watching programming on television. This may indicate that in my case of probable neighbor mobbing with shortened attack vectors, the harassment is delivered over a rogue radio signal.

But it’s not just television hardware that is vulnerable. It’s the broadcast signal. A “proof-of-concept” exploit developed by Rafael Scheel of Oneconsult shows how you can use a cheap transmitter to embed malicious instructions in a rogue DVB-T signal that is received by devices in the same environment as a target smart TV. The malicious agents can then gain access to the smart TV and use it to spy on its owner or launch DDoS (distributed denial of service) attacks. Scheel estimated that 90 percent of smart televisions were vulnerable to such an attack (“Over 85% of Smart TVs Can Be Hacked Remotely Using Broadcasting Signals,” https://thehackernews.com/2017/03/hacking-smart-tvs.html).

Back in 2014, Rahul Sasi of Garage4Hackers gave a presentation on hacking video at the Hack in the Box (HITB) security conference in Amsterdam. Swati Khandelwal, who wrote of his friend Sasi’s exploits, comments that “television is a one-way medium” and that all that’s necessary is to use a man-in-the-middle (MITM) attack and then modify the channel frequencies to “hijack” cable TV (“Hacking Cable TV Networks to Broadcast Your Own Video Channel,” https://thehackernews.com/2014/05/hacking-cable-tv-networks-to-broadcast.html). This was apparently the kind of exploit that enabled a zombie apocalypse scare in Montana back in 2013. An emergency alert was used to “warn” residents that zombies were on the attack. Locals were cautioned not to approach the “extremely dangerous” zombies (“Hacker broadcasts zombie warning on TV,” https://thehackernews.com/2013/02/hacker-broadcasts-zombie-warning-on-tv.html).

Ω

The zombies showed up in Montana two years before my own mobbing began and I began to hear verbal abuse overlaying the sound tracks of my programs. It took a while for me to experiment and realize that the vulnerability was likely in the television signal, but I made some other fortuitous findings made along the way.

On a trip to Ada’s Bookstore on Seattle’s Capitol Hill, I ran across a book on cable hacks. Despite being outdated, it made clear that the information required to hack cable, at least traditional cable, was out there. And with the convergence between the Internet and television, data packets for both travel the same wireless transport protocols. It became clear that multiple attack vectors were applicable to television, and with the addition of streaming services and appliances like the Roku, the attack surface was significantly enlarged.

Early in 2018, Consumer Reports released their findings on easily exploited security vulnerabilities that affected not only Samsung Smart TVs, but other brands using the Roku TV smart-TV platform. Significantly, these vulnerabilities were not limited to televisions, but extended to Roku streaming devices like the Ultra. These vulnerabilities could give hackers access to Roku media services played on televisions that are not smart. Consumer Reports found that “a relatively unsophisticated hacker could change channels, play offensive content, or crank up the volume” from thousands of miles away. Vulnerabilities such as these make remote harassment all the more attractive to those who want to hurt you where you live. You can read more about the Consumer Reports study and Roku’s response in my blog entry of March 3, 2018, Consumer Reports finds vulnerabilities in Samsung TV and Roku streaming media player at https://onbeingmobbed.com/2018/01/06/the-social-engineering-of-mobbing.

And then you have malware that runs on adware platforms, rogue applications delivered by “app stores” that run on a not-so-secure distribution model, and increasing numbers of streaming applications retrieving streaming content from different servers. I began to wonder about the streaming applications that television providers make available or that come with devices like Roku, BlueRay and Amazon Firestick and the security holes of many Internet applications. What if the mobbers were writing their own malware applications to download and play streams of verbal harassment on any device that provided a platform?

But that doesn’t solve the problem of how to use others’ devices as a platform for harassment without getting caught. The verbal abuse is not only tuned and detuned like any television station and modulated by the sound controls on the television or cable box. To avoid detection, the mobbers must modulate the harassment based on what they know about the environment, or they must monitor. Ideally, they should have controls that allow them to modulate the harassment on any device. They may have to entirely stop the verbal abuse if the police come to the door, or they may have to change the quality of the harassment to ensure that for those who are not acculturated to the voices of the harassers and the secret code words of the mobbing, the verbal abuse blends in with the programming. Without monitoring, those who harass others from remote positions or by using technology that is remotely enabled may be easily detected (Remote harassment: Mobbing and the “I wasn’t there” syndrome).

The fact that monitoring allows the verbal abuse to be modulated in accord with the needs of the mobbers to escape detection and prosecution means that mobbing requires a very high level of attention on the part of the mobbers. If they had a malicious application that requested streams of verbal abuse, they would have to be able to interrupt the transmission or change the pattern of transmission at any time. Indeed, a Comcast technician I talked to up the street one day was doubtful that the mobbers could get into the set-top box and told me that if they were injecting abuse through the set-top box, they’d have to be close by, feeding it into the system the whole time. I’m not sure what the rationale for saying so was. At the time, I figured that while the technician might understand the physical media used to supply television, he might not have much knowledge of how it could be hacked from the network or application layers.

My assumptions, like most, were about hacking the television through the set-top box, the entertainment platform, or via the network. It wasn’t until I ran across the SamyGO project for modifying the firmware on Samsung televisions, that I was sure that the TV itself was vulnerable.

SamyGO (https://wiki.samygo.tv/index.php?title=Main_Page) is a community customization project that supports modifications to, and the reverse engineering of, the firmware used to operate Samsung televisions. The project is supported by the very active SamyGO forum (https://forum.samygo.tv/) that has sections devoted to Samsung models dating from 2008. The forum helps the aspiring firmware hacker to learn how to identify the version of the firmware that the target device runs, how to gain access to it, and the kinds of modifications that can be made. Depending on the model and firmware, you can use SamyGO to learn how to send custom IR codes, to modify the service menu, install custom SamyGO apps, and more. In addition to the SamyGO project, Samsung supports a collection of open source application programming interfaces (APIs), making the platform even more extensible. The key characteristic of the firmware running Samsung and numerous other television platforms, however, is the fact that it is based on the open source Linux operating system. This means that if you know Linux, you can hack Samy. In the end, a platform for development is a platform for hacking.

The question isn’t whether it’s possible for criminals to add rogue soundtracks over your television shows and over any programming on any wired or radioed device. The question isn’t even how many ways there are to victimize someone by using technology—even the victim’s own devices—to do so. This should be evident based on the recent spate of articles on crimes making use of audio speakers, from baby-camfecting to security camjacking. The real question is how long it will take before the City of Seattle and other municipalities stop accepting the story that those who claim to be victimized by such crimes are suffering from delusions, how long it will take before the City of Seattle begins to investigate reports of tech crimes instead of ignoring and ridiculing the reports of victims, and how long it will take the City of Seattle to do the right thing and to prosecute neighborhood watch groups gone rogue and other criminals who hide behind technology as they commit predatory crimes against their neighbors.