1
00:00:00,000 --> 00:00:07,000
It would be inappropriate of me to comment on this particular issue, but maybe...

2
00:00:10,740 --> 00:00:12,520
That kind of sums it up.

3
00:00:12,520 --> 00:00:14,100
Sorry for you guys over there.

4
00:00:18,780 --> 00:00:25,120
If you like this shirt, there is a template and the LBGFX guys will make it up for you.

5
00:00:25,540 --> 00:00:28,900
My idea was, I thought, well, this guy gave up his job.

6
00:00:28,900 --> 00:00:37,860
He put his head above the parapet and gave up his job, so maybe I should do something for him.

7
00:00:39,120 --> 00:00:43,640
Print up a shirt, maybe they sell it for an extra five bucks, and we give him the five bucks.

8
00:00:44,300 --> 00:00:52,760
But then I thought, well, actually, Cisco are doing a pretty good job of marketing him at the moment, so I don't think we really need to bother on that one, so I think we'll just leave that be.

9
00:00:55,660 --> 00:00:56,880
Okay, so who am I?

10
00:00:57,680 --> 00:00:59,220
My name is MajorMalfunction.

11
00:00:59,220 --> 00:01:00,080
Some of you will know me.

12
00:01:00,080 --> 00:01:03,240
I've been involved in DEF CON since DC5.

13
00:01:03,240 --> 00:01:11,720
I've been working in the security industry since the 70s, and I do have a proper day job where I do this kind of stuff.

14
00:01:15,280 --> 00:01:17,260
Now, why did I start looking at infrared?

15
00:01:17,260 --> 00:01:19,260
Well, basically, infrared's everywhere.

16
00:01:19,260 --> 00:01:28,360
This talk is called Old School Hacking, because when I first started talking about it, people said to me, but that's such old technology.

17
00:01:28,360 --> 00:01:30,280
Why would you bother looking at that?

18
00:01:30,280 --> 00:01:32,420
Nobody uses that shit anymore.

19
00:01:32,940 --> 00:01:35,420
I thought, well, I think a few people do.

20
00:01:35,420 --> 00:01:40,300
So , you know, I asked around, and when I talk at conferences, I check with those conferences.

21
00:01:40,300 --> 00:01:47,000
So , you know, put your hand up if you've used an infrared control this week of any kind.

22
00:01:47,280 --> 00:01:52,140
Okay, put your hand up if you haven't used an infrared control this week.

23
00:01:52,840 --> 00:01:55,400
Well, electricity will come to your village soon, I'm sure.

24
00:01:58,100 --> 00:01:59,920
They're really useful things, you know.

25
00:01:59,920 --> 00:02:00,960
Change the TV.

26
00:02:01,720 --> 00:02:03,120
So, it's everywhere.

27
00:02:03,120 --> 00:02:04,640
Everyone still uses it.

28
00:02:05,380 --> 00:02:17,920
And it gets used in the obvious things like TVs for tuning and master configuration, package selection, central control of billing systems in those devices, vending machines.

29
00:02:17,920 --> 00:02:27,980
I found some vending machines in Amsterdam where you actually had to go to the bar and ask the guy to switch the thing on before you could use it, so cigarette machines at the back of the bar.

30
00:02:28,380 --> 00:02:32,460
You would go up to the bar, say, I want to use the cigarette machine, and he would ping it on.

31
00:02:33,200 --> 00:02:35,280
I'm not sure exactly what that was all about.

32
00:02:35,280 --> 00:02:37,700
I guess there's some kind of fraud going on.

33
00:02:37,700 --> 00:02:41,840
People find out how to trick the machine, so they want to keep it under control.

34
00:02:42,880 --> 00:02:47,620
They also get used, at least in the UK, for setting up the pricing.

35
00:02:47,620 --> 00:02:51,360
So you get those multi-vending machines where you have different goods in there.

36
00:02:51,360 --> 00:02:58,420
They actually program which slot costs what, so potentially there's a nice little hack there.

37
00:02:59,160 --> 00:03:04,640
Public display signs, obviously you can set scrolling LEDs up to do kind of wacky things.

38
00:03:04,980 --> 00:03:07,380
And garage door openers, car alarms.

39
00:03:07,580 --> 00:03:21,480
So actually car alarms that I first started looking at, in the early days I had a car with an infrared control, and I found that I could record the door lock and unlock codes on my Palm Pilot and play them back.

40
00:03:21,480 --> 00:03:23,020
And I thought that was pretty neat.

41
00:03:23,640 --> 00:03:28,240
And then I got a new car, still had an infrared control, but this stopped working.

42
00:03:28,240 --> 00:03:30,220
I could do it once, and then it stopped.

43
00:03:30,760 --> 00:03:32,800
And I wanted to understand why.

44
00:03:32,800 --> 00:03:44,940
So I started looking at the tools to do it, and I started developing an application to try and analyze what was going on with the signal and why I was having that issue.

45
00:03:45,920 --> 00:03:51,100
So, which I called the Project Murder, which was the usual sort of hacker horrible pun.

46
00:03:51,100 --> 00:03:54,680
So I'm using IRDA and I put my initials on the front, I get murder.

47
00:03:55,680 --> 00:04:03,540
And I got to a point on FreeBSD where I was actually able to read the codes, but I hadn't yet started to write them back.

48
00:04:03,920 --> 00:04:05,580
And then I discovered Lurk.

49
00:04:05,580 --> 00:04:13,940
And because of Lurk, I overcame my BSD bigotry and installed Linux on my box, and I've been using that ever since.

50
00:04:15,620 --> 00:04:17,340
So why bother with IR?

51
00:04:18,080 --> 00:04:23,140
Well, IR is very unlikely to be replaced, at least in the foreseeable future.

52
00:04:23,480 --> 00:04:26,240
It's a very good technology, it's very fit for use.

53
00:04:26,620 --> 00:04:29,300
It's cheap, you know, the components exist.

54
00:04:29,800 --> 00:04:31,300
It's very simple.

55
00:04:32,160 --> 00:04:35,960
When I say it's fit for use, I mean things like TV, you know, it's absolutely perfect.

56
00:04:35,960 --> 00:04:40,160
You can point it in a completely random direction, it will still bounce off the walls and hit the TV.

57
00:04:40,220 --> 00:04:44,120
And it's not going to change the channel in the hotel room next door to you.

58
00:04:44,200 --> 00:04:50,900
You start looking at putting things like Bluetooth in controls, and you've then got issues of leakage into other environments.

59
00:04:50,900 --> 00:04:56,240
So, infrared is actually a very good tool for the job it does.

60
00:04:56,240 --> 00:05:01,560
From a technical point of view, why should I waste my time fiddling with this stuff?

61
00:05:01,560 --> 00:05:05,120
Well, as a security professional, I think it's good.

62
00:05:05,120 --> 00:05:11,340
You know, you have to develop a mindset that looks around you for security issues all the time.

63
00:05:11,680 --> 00:05:20,900
When I move into a house, a new house or an apartment or whatever, or I get a new car, for the next few weeks, I will try and break into it.

64
00:05:20,900 --> 00:05:27,760
I will see how many ways I can get back into my house without actually using the door key, or going up to the alarm and doing what I'm supposed to do on the alarm.

65
00:05:28,220 --> 00:05:36,440
And it's just habit, you know, it's using that mindset or developing that mindset where you're looking for security problems all the time.

66
00:05:38,960 --> 00:05:42,140
And infrared, you know, you're sitting in a hotel room, there's nothing to do.

67
00:05:42,480 --> 00:05:44,400
There's your infrared control, there's the TV.

68
00:05:44,820 --> 00:05:46,920
The hotel's quite an interesting place.

69
00:05:47,240 --> 00:05:51,920
They're trying to sell me stuff, but they don't actually want to have staff to do it, so they rely on technology.

70
00:05:52,620 --> 00:06:00,800
If you think about last time you checked into a hotel, you probably interacted with one person right at the beginning when you checked in.

71
00:06:01,500 --> 00:06:06,380
And for the rest of your stay in that hotel, you were using automated systems.

72
00:06:07,020 --> 00:06:12,060
And that's apart from the catering staff, but just, you know, you're in a big hotel, you're sleeping in the bedroom and so on.

73
00:06:12,520 --> 00:06:14,520
But meantime, they're still trying to sell you stuff.

74
00:06:14,520 --> 00:06:21,960
They've got pay TV, they've got mini bars, they've got all this stuff where they're delivering a service without actually having any staff to do it.

75
00:06:21,960 --> 00:06:24,100
They're relying on technology to do that.

76
00:06:24,440 --> 00:06:37,500
There will be security problems with technology, and those problems will have direct parallels in the internet networking world and, you know, within the systems themselves that some of you may be involved in actually deploying.

77
00:06:38,200 --> 00:06:39,180
And it's fun.

78
00:06:39,180 --> 00:06:42,080
At the end of the day, as you'll see, it's quite fun.

79
00:06:43,360 --> 00:06:49,780
So it turns out that infrared really is the ultimate in security by obscurity.

80
00:06:50,760 --> 00:06:53,540
You've got really simple codes.

81
00:06:53,540 --> 00:06:55,200
Because they're sent, you can't see them.

82
00:06:55,200 --> 00:06:57,380
No one can see what's actually going on.

83
00:06:57,760 --> 00:07:01,220
They don't bother engineering any kind of security into it.

84
00:07:02,060 --> 00:07:05,980
If you know the right code to send, you have total control of the box.

85
00:07:05,980 --> 00:07:07,740
That is it.

86
00:07:07,740 --> 00:07:08,720
You know, I am God.

87
00:07:08,720 --> 00:07:09,460
Bang.

88
00:07:09,760 --> 00:07:10,920
I now control the box.

89
00:07:10,920 --> 00:07:11,880
I can do anything I want.

90
00:07:11,880 --> 00:07:13,320
There's no two-way authentication.

91
00:07:13,320 --> 00:07:14,900
There's no further pin numbers.

92
00:07:14,900 --> 00:07:15,920
There's nothing.

93
00:07:16,920 --> 00:07:25,200
They also tend to use what I term an inversive security model, where the actual control of what you're allowed to do is at the wrong end.

94
00:07:25,200 --> 00:07:26,920
It's in the hostile environment.

95
00:07:26,980 --> 00:07:29,200
It's in the environment that I control.

96
00:07:29,780 --> 00:07:32,600
And we'll look at that in more detail.

97
00:07:35,510 --> 00:07:41,330
Okay, so the simplest attack is the one I described with my car, where I could just record the code and replay it.

98
00:07:42,290 --> 00:07:47,430
And that also applies to garage doors, so garage door openers.

99
00:07:47,430 --> 00:07:54,810
I think you mostly use RF over here, but in the UK and some parts of Europe, infrared controls are still very popular.

100
00:07:55,690 --> 00:08:02,970
There's also little robot toys, TVs, the TVs in bars and clubs and things.

101
00:08:03,830 --> 00:08:10,730
And if you can record a code or you know the code, then you can affect those publicly visible devices.

102
00:08:11,450 --> 00:08:17,950
And if you can get a hold of special controls that do extra things on those devices, you can simply clone them.

103
00:08:17,950 --> 00:08:22,450
And then you have the code, and you replay it, and you can do the special thing.

104
00:08:25,680 --> 00:08:34,120
And the kind of tools you can use to do it, Casio produced some nice little infrared watches back in the 80s, I think.

105
00:08:34,980 --> 00:08:41,640
Apple Newton was one of the first handheld manufacturers to actually have built-in IR that had this capability.

106
00:08:42,160 --> 00:08:50,260
And now you have tools like Omni Remote, which runs on any Palm-based operating system that has an infrared control.

107
00:08:51,180 --> 00:08:52,480
It's a very neat system.

108
00:08:52,480 --> 00:08:54,200
You can get it from Pacific Neotech.

109
00:08:54,200 --> 00:08:56,760
There's the URL, download that.

110
00:08:57,700 --> 00:09:01,680
Philips Pronto is used in a lot of those big home automation systems.

111
00:09:01,680 --> 00:09:07,900
So you have a control, and you completely program what the buttons look like, what command they send, and so on.

112
00:09:08,100 --> 00:09:11,300
And again, there's a lot of website resource behind that.

113
00:09:11,300 --> 00:09:15,320
You can download existing codes for different systems, and so on.

114
00:09:18,570 --> 00:09:21,930
So here's our first example, RoboSapien.

115
00:09:22,970 --> 00:09:25,870
Last year, there was a guy here at DEF CON walking around.

116
00:09:25,870 --> 00:09:29,390
He'd obviously bought one of these toys, and he was walking it around, up and down the queues.

117
00:09:29,390 --> 00:09:31,010
Anyone remember seeing him?

118
00:09:31,770 --> 00:09:32,370
Yeah.

119
00:09:32,530 --> 00:09:35,870
So he was walking up and down, trying to get someone to buy it.

120
00:09:38,340 --> 00:09:43,180
So I sat down behind him, and started recording the commands he was sending.

121
00:09:45,600 --> 00:09:50,620
So he would walk it up the aisle, and I would turn it around and walk it away from the aisle.

122
00:09:51,400 --> 00:09:58,380
And he would turn it back and walk it back up the aisle, and I would turn it away and make it shrug its shoulders, or make a rude farting noise, or something.

123
00:09:58,820 --> 00:10:02,060
So basically, I was able to then...

124
00:10:02,620 --> 00:10:03,580
tag it.

125
00:10:09,480 --> 00:10:11,000
So this is a guy at work.

126
00:10:11,000 --> 00:10:12,500
He owns the black car.

127
00:10:12,920 --> 00:10:14,700
A friend of mine owns the green car.

128
00:10:15,200 --> 00:10:24,540
So I put my system in the back of the green car, one day when he was leaving, and the next morning, when he arrived.

129
00:10:25,360 --> 00:10:30,520
And then that evening, when he went to go, he walked up to his car, and he unlocked it.

130
00:10:30,560 --> 00:10:31,920
And I locked it.

131
00:10:33,520 --> 00:10:34,840
He unlocked it.

132
00:10:35,120 --> 00:10:36,560
And I locked it.

133
00:10:37,640 --> 00:10:38,940
And he unlocked it.

134
00:10:38,940 --> 00:10:40,020
And I locked it.

135
00:10:40,400 --> 00:10:42,020
And that went on for a few minutes.

136
00:10:42,100 --> 00:10:47,860
And then he started walking back to the office to try and, you know, make a phone call, do whatever he had to do to sort his life out.

137
00:10:47,860 --> 00:10:49,440
And I unlocked it for him.

138
00:10:50,280 --> 00:10:51,840
Because I'm a nice guy, really.

139
00:10:53,200 --> 00:10:54,240
So that was...

140
00:10:54,240 --> 00:10:59,940
That's one of the older systems, that obviously didn't tackle this problem, that, you know, why can't I do that to my car?

141
00:10:59,940 --> 00:11:00,460
I don't know.

142
00:11:00,460 --> 00:11:02,900
But his, I could just replay as often as I like.

143
00:11:04,640 --> 00:11:09,440
I couldn't actually steal his car, because it turns out he has an RF as well, which disables the engine.

144
00:11:13,220 --> 00:11:14,900
Okay, so that's a replay attack.

145
00:11:14,900 --> 00:11:15,940
Very simple attack.

146
00:11:15,940 --> 00:11:21,540
You have to have access to the source to see the original signal and replay it.

147
00:11:22,360 --> 00:11:28,940
But what if you don't know what the original signal looks like, or what the exact code is for that device?

148
00:11:28,940 --> 00:11:33,840
You can go and buy a similar one, but you don't know the code for the man next door.

149
00:11:33,840 --> 00:11:36,200
So I've got the same garage door opener as he has.

150
00:11:38,440 --> 00:11:43,080
Well, as I say, I found this tool, Lurk, which you can download.

151
00:11:43,080 --> 00:11:46,940
It's the Linux Infrared Control project.

152
00:11:47,420 --> 00:11:50,420
It has some visualization tools, which I find very useful.

153
00:11:50,420 --> 00:11:54,840
You can send an infrared signal into it and actually visualize what's going on.

154
00:11:55,640 --> 00:12:01,100
It auto-learns, so you just point a remote at it and it will learn all the tricky stuff for you.

155
00:12:01,100 --> 00:12:02,780
You don't have to do any thinking.

156
00:12:03,740 --> 00:12:16,520
And it produces an ASCII human-readable config file, which is very important, because that means you can look at it, you can read it, you can understand it, and more importantly, you can change it, which is what we're going to do.

157
00:12:17,840 --> 00:12:18,840
It's software-only.

158
00:12:18,840 --> 00:12:21,120
It will work with my infrared on my laptop.

159
00:12:21,680 --> 00:12:23,060
It only runs on Linux.

160
00:12:24,660 --> 00:12:28,840
Alternatively, you can buy an external device, which is a USB dongle.

161
00:12:29,240 --> 00:12:31,900
It's available from irtrans.de.

162
00:12:33,220 --> 00:12:37,720
It's a much more powerful transmitter, so you can do stuff from further away.

163
00:12:38,360 --> 00:12:39,740
And it solves a bunch of issues.

164
00:12:39,740 --> 00:12:43,880
The way LERP works is it plays with serial protocols.

165
00:12:44,740 --> 00:12:51,360
What irtrans does is it actually runs in native mode, so it knows how to send native infrared commands.

166
00:12:51,860 --> 00:12:57,900
And that will run on Linux or that other funny virus operating system.

167
00:13:00,180 --> 00:13:01,420
This is what it looks like.

168
00:13:01,420 --> 00:13:03,180
It's just a little USB dongle.

169
00:13:04,500 --> 00:13:14,840
Okay, so for my first example, I took my garage door opener and popped it open and found there's this dip switch.

170
00:13:15,800 --> 00:13:22,120
And the dip switch has eight positions, so therefore there are 256 possible codes.

171
00:13:22,780 --> 00:13:29,500
So what I could do to get into my neighbor's garage is try every one of them, but that would be fairly dull.

172
00:13:31,260 --> 00:13:36,540
I had a look with a piece of software that comes with LERP called XMODE2.

173
00:13:37,900 --> 00:13:49,620
Now what XMODE2 does is you point the control at it, hit a command, and it will draw for you the signal that it sees.

174
00:13:49,620 --> 00:13:55,940
So there's a carrier signal, which it then modulates, and you get to see if it's a long pause or a short one.

175
00:13:56,700 --> 00:14:00,180
So if I switch all of the eight switches on, I get this.

176
00:14:00,180 --> 00:14:02,140
If I switch them off, I get that.

177
00:14:02,700 --> 00:14:06,320
If I switch number eight on, this one pops up.

178
00:14:06,540 --> 00:14:07,800
Number one, that one.

179
00:14:07,800 --> 00:14:09,880
So I can see where the pattern starts and ends.

180
00:14:09,880 --> 00:14:15,140
It's obviously just a very simple one-to-one relationship between the switch and the pulses.

181
00:14:15,740 --> 00:14:20,540
So I concluded that I have a start bit, eight data bits, and four stop bits.

182
00:14:24,730 --> 00:14:32,870
So now I train LERP how to just duplicate a code or a couple of codes.

183
00:14:32,870 --> 00:14:35,330
In this case, I would only need one.

184
00:14:35,770 --> 00:14:39,490
Because what I'm looking for is to see how that code is represented.

185
00:14:39,910 --> 00:14:44,230
So LERP, basically, this stuff is to do with timings and carrier frequencies.

186
00:14:44,930 --> 00:14:47,830
This is the actual code that's being sent.

187
00:14:48,210 --> 00:14:52,870
So for a particular switch position, it will give me a particular hex value.

188
00:14:53,930 --> 00:14:56,390
So I know the hex for one command.

189
00:14:57,370 --> 00:15:03,010
So it's not that hard, then, to write a little script that produces the hex for every possible command.

190
00:15:03,450 --> 00:15:04,790
Which I do.

191
00:15:06,050 --> 00:15:11,010
And then I write another little script that spits out each command.

192
00:15:11,010 --> 00:15:18,650
And it took 54 seconds to send all 256 possible codes to my garage door.

193
00:15:19,930 --> 00:15:22,290
So here I am, down in the garage.

194
00:15:22,290 --> 00:15:26,070
I'll stick the laptop down, fire it up.

195
00:15:26,790 --> 00:15:29,690
A few seconds later, bingo, door opens.

196
00:15:30,870 --> 00:15:36,950
Now what was surprising here was I knew the code was actually quite far up in the range.

197
00:15:36,950 --> 00:15:40,390
I thought it was going to take 45, 50 seconds to go.

198
00:15:40,750 --> 00:15:44,270
What actually happened is it went within about the first five seconds.

199
00:15:44,850 --> 00:15:48,690
So I thought, okay, well, maybe there's a factory backdoor in here.

200
00:15:48,690 --> 00:15:51,990
The manufacturers have actually got a code that just always works.

201
00:15:51,990 --> 00:15:54,110
And that's the only code I'm going to have to send.

202
00:15:55,030 --> 00:16:00,370
Actually, it turned out that what had happened is the building management had run out of controls.

203
00:16:00,370 --> 00:16:03,350
And they'd gone back to the company that sold the original system.

204
00:16:03,390 --> 00:16:06,350
And they'd said, we need more remotes.

205
00:16:06,370 --> 00:16:08,470
The company said, oh, that company's gone bust.

206
00:16:08,470 --> 00:16:09,530
We can't sell you any.

207
00:16:09,530 --> 00:16:11,150
You'll have to buy a new system.

208
00:16:11,230 --> 00:16:14,950
So they engineered into the system a second reader.

209
00:16:14,950 --> 00:16:16,670
So we have two readers here.

210
00:16:17,130 --> 00:16:27,450
So this reader, which is 100% compatible with that reader, has been engineered in so that another bunch of remotes can send 100% compatible codes and open my door.

211
00:16:28,090 --> 00:16:29,850
So, stupidity.

212
00:16:29,850 --> 00:16:31,530
They didn't bother to actually check.

213
00:16:31,530 --> 00:16:34,950
Or maybe they just set the switches wrong and they couldn't get the thing to work, but whatever.

214
00:16:34,950 --> 00:16:38,170
They wasted a lot of time and money putting that system in.

215
00:16:39,610 --> 00:16:42,210
You'll notice there's a security camera here.

216
00:16:43,270 --> 00:16:53,110
So while I was doing all this and fiddling around and opening garage doors without keys, presumably someone was recording that video and watching me.

217
00:16:53,110 --> 00:16:56,630
So I got a visit the next morning from security.

218
00:16:56,950 --> 00:16:58,750
No, of course not.

219
00:16:58,750 --> 00:17:02,930
If you have security, at least pay attention to it, guys.

220
00:17:05,700 --> 00:17:08,140
Okay, so hotel TVs.

221
00:17:09,640 --> 00:17:15,480
I thought, if I can do this to a garage door, maybe I can do it to a TV system.

222
00:17:15,480 --> 00:17:22,060
So I need a TV system that actually does more than simply changes channels.

223
00:17:22,440 --> 00:17:25,740
So I had a look at a hotel TV system.

224
00:17:26,720 --> 00:17:31,100
And this is one of the examples where I say we were running an inverted security model.

225
00:17:31,780 --> 00:17:35,940
The TV is controlling which content I get to see.

226
00:17:35,940 --> 00:17:43,100
The hotel in most cases is streaming content, basically all the content without any control.

227
00:17:43,100 --> 00:17:45,400
The TV itself filters the content.

228
00:17:47,460 --> 00:17:53,640
When you actually select a channel to look at that content, there's no further authentication required.

229
00:17:53,640 --> 00:17:58,640
If I can persuade the TV to go and look at a channel I'm not supposed to be looking at, that's it.

230
00:17:58,640 --> 00:18:00,760
I just send it the command and I can have it.

231
00:18:01,320 --> 00:18:12,680
The content itself isn't wrapped in any kind of encryption, unlike satellite TV, where they expect you to be able to receive it even though you're not a subscriber, because it's a closed system.

232
00:18:12,680 --> 00:18:13,840
They don't need to.

233
00:18:13,940 --> 00:18:15,800
It's entirely within their own building.

234
00:18:15,800 --> 00:18:17,240
It's their own backbone.

235
00:18:17,660 --> 00:18:24,000
They control who gets to see what on that system, or so they think.

236
00:18:26,680 --> 00:18:35,640
Okay, so if the system's broadcasting stuff, presumably you can just plug in another TV, tune yourself in, and watch whatever you want on any channel.

237
00:18:35,640 --> 00:18:38,900
But humping a TV around is a pain in the ass.

238
00:18:39,520 --> 00:18:43,280
Instead of that, we have these little USB dongle thingies.

239
00:18:45,920 --> 00:18:47,580
So I plug this one in.

240
00:18:47,580 --> 00:18:49,700
This is in line with the back end.

241
00:18:50,740 --> 00:18:56,100
And on the master TV, I'm getting the content they expect me to see, the master menu.

242
00:18:56,460 --> 00:19:01,000
On this one, I've got another channel, because I've tuned to another channel.

243
00:19:01,940 --> 00:19:07,380
And if I flick through the channels, I find there's various other bits of content.

244
00:19:07,380 --> 00:19:10,220
This is all just system messages.

245
00:19:14,840 --> 00:19:21,540
Occasionally, I came across these strange screens, where they were seemingly putting up an advert for something.

246
00:19:21,900 --> 00:19:26,300
Which is an advert no one's ever going to see, because none of the official channels actually look at this.

247
00:19:28,000 --> 00:19:31,000
But what was most interesting on there is there's a URL.

248
00:19:31,000 --> 00:19:32,920
This is the company that makes the thing.

249
00:19:33,460 --> 00:19:37,560
If I go to that URL, there's a load of technical documentation.

250
00:19:37,560 --> 00:19:39,720
So there's PDFs.

251
00:19:39,720 --> 00:19:41,700
It tells me how the systems work.

252
00:19:41,880 --> 00:19:45,380
What else I might be looking for when I start looking at these things.

253
00:19:45,560 --> 00:19:47,480
What new features they're putting in.

254
00:19:47,700 --> 00:19:49,680
Which hotels they've put them in.

255
00:19:50,000 --> 00:19:53,940
So you spot a feature you're interested in, you can just go and look at their client list.

256
00:19:53,940 --> 00:19:55,880
Say, oh yeah, they're testing that over here.

257
00:19:55,880 --> 00:19:57,680
Let's go and stay there for a night.

258
00:19:58,960 --> 00:20:03,380
Some of the things they're thinking of putting in are truly scary.

259
00:20:04,000 --> 00:20:05,800
Webcam in your bedroom.

260
00:20:05,800 --> 00:20:10,480
Now, why would anyone want... oh no, okay, don't answer that.

261
00:20:11,820 --> 00:20:13,140
I think I know.

262
00:20:18,220 --> 00:20:21,080
And of course, they're broadcasting premium content.

263
00:20:21,420 --> 00:20:24,680
So this is a pay movie that I'm supposed to have paid for to watch.

264
00:20:25,580 --> 00:20:28,540
Which I can watch on my tiddly little screen here.

265
00:20:29,700 --> 00:20:34,160
Or I can root it back out and into the SCART and watch it on the TV.

266
00:20:38,220 --> 00:20:42,000
Okay, that's fine, but that's just looking at the back-end content.

267
00:20:42,000 --> 00:20:44,040
We haven't actually got control of the system.

268
00:20:44,040 --> 00:20:48,780
But we've proved the concept that there is stuff on the back-end which we can get to.

269
00:20:49,680 --> 00:20:52,920
So I started looking at the actual remote controls.

270
00:20:52,920 --> 00:20:58,520
Can I do the same trick that I did brute-forcing my garage door to the TV remote?

271
00:20:59,400 --> 00:21:02,000
What I found is the codes are much more complex.

272
00:21:02,000 --> 00:21:02,840
They're much bigger.

273
00:21:02,840 --> 00:21:04,060
They have more bits.

274
00:21:04,520 --> 00:21:09,720
And the reason they do that is because they group them.

275
00:21:09,720 --> 00:21:12,240
You have manufacturer collision avoidance.

276
00:21:12,240 --> 00:21:15,500
So you have multiple remotes in the same environment.

277
00:21:15,500 --> 00:21:18,000
You don't want them interfering with each other's devices.

278
00:21:18,320 --> 00:21:22,300
So you have a preamble that says, I'm a Sony or I'm a JVC or whatever.

279
00:21:23,500 --> 00:21:27,800
You may have a remote that controls the TV and the video from the same manufacturer.

280
00:21:27,800 --> 00:21:29,580
So you have different groups for that.

281
00:21:30,560 --> 00:21:33,440
And you have standard groups versus extra groups.

282
00:21:33,440 --> 00:21:38,120
So Philips may make a TV that they sell to hotels and to home.

283
00:21:38,120 --> 00:21:41,840
And you have different sets of controls for the different environments.

284
00:21:43,160 --> 00:21:46,280
There's also this interesting group here.

285
00:21:46,480 --> 00:21:47,760
The hidden group.

286
00:21:48,320 --> 00:21:50,020
This is what we're looking for.

287
00:21:52,040 --> 00:21:54,220
So this is what they look like.

288
00:21:55,220 --> 00:21:58,060
As you can see, it's a much longer code.

289
00:21:58,420 --> 00:22:02,300
It's much harder to emulate or guess.

290
00:22:02,300 --> 00:22:09,040
In fact, when I looked at it, it turned out to be a 14-bit code in this particular case.

291
00:22:10,200 --> 00:22:17,340
Now unlike a garage door, when I test these codes, I need to watch.

292
00:22:17,340 --> 00:22:18,920
I need to actually pay attention.

293
00:22:18,920 --> 00:22:26,400
Because something will happen and then 10 seconds later, I could send another command that cancels that and does something else.

294
00:22:26,400 --> 00:22:31,260
So unless I'm actually watching each command as it plays out, I may miss the event.

295
00:22:31,260 --> 00:22:34,620
So garage door, I can just leave it running, wait for it to pop.

296
00:22:34,620 --> 00:22:36,800
This, I actually have to spend time on it.

297
00:22:38,040 --> 00:22:49,060
And it turns out I need to take about two seconds per code to have time to react and watch and let the code settle down, not be interfered by the next one.

298
00:22:49,860 --> 00:22:52,880
Which would be nine hours to test the whole system.

299
00:22:53,180 --> 00:23:00,680
And I found that out the hard way because one night in Amsterdam after a conference, back in my hotel room, and I'm playing with this stuff.

300
00:23:00,680 --> 00:23:03,020
This was in the early days when I was just figuring it out.

301
00:23:03,300 --> 00:23:05,560
Next thing I know, it's five hours later.

302
00:23:05,700 --> 00:23:07,160
It's one o'clock at night.

303
00:23:07,280 --> 00:23:12,160
I've just spent the only night in Amsterdam playing with hotel-dam TVs.

304
00:23:13,640 --> 00:23:15,380
Coffee shops are closed.

305
00:23:15,760 --> 00:23:18,080
And I really fancied a cup of coffee.

306
00:23:20,640 --> 00:23:23,020
So I thought, now I have to fix this.

307
00:23:23,020 --> 00:23:26,360
I need to reduce the time it takes to do this stuff.

308
00:23:27,080 --> 00:23:30,140
So I tried to find a way to reduce the search space.

309
00:23:31,760 --> 00:23:36,520
So basically that meant looking at what bits are being used in the codes.

310
00:23:36,640 --> 00:23:51,480
So if I take each of the codes in turn, 0 to 9, and I look at which bits have actually been either set to 1 or toggled from 0 to 1 or 1 to 0, I work my way through them all.

311
00:23:53,480 --> 00:23:58,960
Basically just try each one, organize them in such a way that I can see what's going on.

312
00:23:59,660 --> 00:24:02,480
Finally get to the end, and I'm down to...

313
00:24:08,020 --> 00:24:09,460
Yeah, sorry.

314
00:24:09,900 --> 00:24:11,620
First two bits are used.

315
00:24:11,660 --> 00:24:14,260
I've got four bits I've never seen change here.

316
00:24:14,940 --> 00:24:18,040
And the last eight bits is the actual code.

317
00:24:19,420 --> 00:24:21,420
So I want to reduce that further.

318
00:24:21,420 --> 00:24:23,140
That's not enough of a result.

319
00:24:23,140 --> 00:24:31,840
So what I do is I take a single command, doesn't matter what command it is, in this case I took the power command, and I start toggling bits.

320
00:24:32,500 --> 00:24:45,560
So if I toggle the first bit of the power command from 1 to 0, and I send the command again, and the command succeeds, then I can assume that bit is not actually used, it's ignored.

321
00:24:46,040 --> 00:24:49,620
In this case the command fails, so I know that bit's important.

322
00:24:50,600 --> 00:24:54,060
This one worked, so that bit's ignored.

323
00:24:54,440 --> 00:24:58,480
And in fact, all three, those three were ignored, that one failed.

324
00:24:58,520 --> 00:25:02,740
So I now know I've got a total of ten bits I have to care about.

325
00:25:03,260 --> 00:25:06,180
Which gives me a thousand codes, which is about half an hour.

326
00:25:06,200 --> 00:25:07,420
So I can live with that.

327
00:25:10,640 --> 00:25:14,340
So I spit out a bunch of configs which have all the possible codes.

328
00:25:14,600 --> 00:25:18,760
In this case I did them as four groups because I couldn't...

329
00:25:18,760 --> 00:25:22,600
I really couldn't figure out how to do 14-bit bitfields in Perl.

330
00:25:22,600 --> 00:25:26,380
So I did four sets of 8-bit bitfields with a lead in.

331
00:25:27,740 --> 00:25:31,660
And then I spit those out, and I run those, and I watch what happens.

332
00:25:33,520 --> 00:25:37,260
And sure enough, I find a load of really interesting stuff.

333
00:25:39,020 --> 00:25:40,640
This one in particular.

334
00:25:42,940 --> 00:25:44,440
This is the God code.

335
00:25:44,440 --> 00:25:46,260
Bingo, it's a game in England.

336
00:25:46,300 --> 00:25:47,760
Bingo, I've won.

337
00:25:56,530 --> 00:25:59,310
Okay, so the kind of things you do with hidden codes.

338
00:26:01,150 --> 00:26:07,950
The internal, the housekeeping staff use them for daily things like setting what they've done to the minibar.

339
00:26:08,210 --> 00:26:15,090
If they've cleaned the room, they'll set a status report so they don't have to fill in forms and report at the end of the day.

340
00:26:15,090 --> 00:26:19,150
The hotel actually has real-time information as to what room's in what state.

341
00:26:20,150 --> 00:26:25,930
You've then got some one-off tasks that the engineers use if they're having problems with the TV or they're first setting it up.

342
00:26:26,350 --> 00:26:28,450
And some debugging information.

343
00:26:31,200 --> 00:26:35,740
Okay, so one of the first things you can do is you can start to reconfigure the TV.

344
00:26:36,180 --> 00:26:38,020
You can change the messages.

345
00:26:38,900 --> 00:26:47,020
So when the TV gets switched on, comes up with a welcome message or a channel message, you can assign the TV to another room.

346
00:26:47,700 --> 00:26:52,420
You can assign channels that are now free that used to be paid channels.

347
00:26:52,580 --> 00:26:57,120
And you can find channels that just simply don't exist on a normal TV.

348
00:26:58,060 --> 00:26:59,840
So here's an example.

349
00:27:00,340 --> 00:27:05,380
First thing any good hacker does is tag his TV.

350
00:27:08,560 --> 00:27:12,420
So now when you switch the TV on this room, that's what comes up.

351
00:27:13,560 --> 00:27:17,080
And if you can find it, I'll give you some really cool prize.

352
00:27:17,080 --> 00:27:18,680
Some bit of Defcon swag.

353
00:27:21,140 --> 00:27:22,620
Same thing in Amsterdam.

354
00:27:26,040 --> 00:27:30,020
Or you can change a big banner that comes up when you turn the TV on.

355
00:27:34,740 --> 00:27:37,080
So this is not only owned, but it's really owned.

356
00:27:37,080 --> 00:27:39,360
I've locked it, no one else is going to use it.

357
00:27:41,220 --> 00:27:43,540
Actually, I unlocked it before I left, of course.

358
00:27:44,220 --> 00:27:45,260
Just testing.

359
00:27:45,260 --> 00:27:48,280
This is for security, you know, for research purposes only.

360
00:27:48,280 --> 00:27:50,260
Don't go home and abuse this stuff.

361
00:27:50,260 --> 00:27:51,460
Kids.

362
00:27:54,470 --> 00:27:59,150
And I try and, you know, tip the hat to conferences I go to.

363
00:28:07,060 --> 00:28:11,280
Okay, so one of the other things you can do is change the filtering on the TV.

364
00:28:11,680 --> 00:28:19,900
Most broadcasters these days, they actually send a signal to say what the certificate of the film is that they're sending.

365
00:28:20,980 --> 00:28:28,820
And so responsible hotels, if you check in with children, they'll put filtering on the TV so that you don't get inappropriate content.

366
00:28:29,300 --> 00:28:43,780
So if you're a sensitive character like me, and you walk into an environment like this, and everything's just coming through, they're not filtering anything, then you may want to take the matter into your own hands and deal with it.

367
00:28:55,410 --> 00:28:58,110
So now only the good stuff comes into my room.

368
00:28:59,090 --> 00:29:01,330
None of that sports news crap.

369
00:29:04,590 --> 00:29:11,730
You can also just start to look for these invisible channels, back-end systems that may be leaking information.

370
00:29:13,350 --> 00:29:16,210
So, fairly simple test signal.

371
00:29:16,210 --> 00:29:18,830
They obviously use that for just tuning the TV in.

372
00:29:19,290 --> 00:29:26,330
Actually, it's more interesting that these numbers, they usually are something other than zeros.

373
00:29:26,910 --> 00:29:33,850
And there seems to be some strange correlation with them becoming zeros and the minibar billing stopping to happen.

374
00:29:35,830 --> 00:29:38,050
I have no idea why that would be.

375
00:29:41,980 --> 00:29:44,220
You get some debugging information.

376
00:29:44,220 --> 00:29:49,680
Again, there's some weird numbers that I don't know what they are, but it says code, so that's got to be interesting, right?

377
00:29:51,020 --> 00:29:53,880
I think most of it's signal strength, things like that.

378
00:29:56,000 --> 00:29:59,060
Occasionally, I'll even interrupt a good movie to do this stuff.

379
00:29:59,060 --> 00:29:59,740
Sometimes

380
00:30:03,510 --> 00:30:08,670
you find stuff that really is quite interesting.

381
00:30:08,670 --> 00:30:09,570
It shouldn't be there.

382
00:30:09,570 --> 00:30:12,170
I shouldn't be able to find information like this.

383
00:30:12,470 --> 00:30:19,110
I know I'm running some kind of DOS environment, and I've even got an IP address.

384
00:30:21,850 --> 00:30:24,810
So, there's obviously some kind of computer back there.

385
00:30:25,070 --> 00:30:26,710
Maybe I can talk to it.

386
00:30:29,730 --> 00:30:31,850
Maybe I don't want to talk to it.

387
00:30:45,090 --> 00:30:46,050
Strange.

388
00:30:46,770 --> 00:30:48,910
We've got a web server back there, too.

389
00:30:50,170 --> 00:30:51,670
That looks fairly harmless.

390
00:30:51,670 --> 00:30:53,550
So, I've got an object not found page.

391
00:30:53,550 --> 00:30:54,410
Big deal.

392
00:30:55,950 --> 00:30:58,470
Actually, see how my mouse moves?

393
00:30:59,370 --> 00:31:02,930
Turns out the up, down, left, right buttons did the same thing to this one.

394
00:31:06,880 --> 00:31:08,500
So, I poke around a bit.

395
00:31:09,580 --> 00:31:12,740
I get another not found page, but it gives me a nice helpful message.

396
00:31:12,740 --> 00:31:15,320
Actually, this pops up a bit after that first page.

397
00:31:15,320 --> 00:31:16,840
So, it gives me a link.

398
00:31:16,840 --> 00:31:18,060
So, I click on it.

399
00:31:18,900 --> 00:31:20,340
Gives me another link.

400
00:31:21,660 --> 00:31:29,300
Microsoft helpfully suggests, if I'm not getting what I want from this system, perhaps I should go to the home page, the system that served it.

401
00:31:29,720 --> 00:31:32,020
There's my IP address, which is a link.

402
00:31:33,020 --> 00:31:34,440
And it sends me here.

403
00:31:49,220 --> 00:31:52,900
What is that doing on the back end system on a TV?

404
00:31:54,100 --> 00:31:55,220
No idea.

405
00:31:55,220 --> 00:31:59,400
And I resisted picking up the keyboard and playing with it, obviously.

406
00:31:59,780 --> 00:32:01,040
Nothing further to see here.

407
00:32:01,040 --> 00:32:01,800
Move along.

408
00:32:06,540 --> 00:32:07,260
Oops!

409
00:32:11,720 --> 00:32:13,500
Who left that lying around?

410
00:32:16,190 --> 00:32:17,670
So, yeah, I can move around.

411
00:32:17,670 --> 00:32:19,090
I can click on icons.

412
00:32:19,090 --> 00:32:21,250
And when I click on them, things pop up.

413
00:32:22,150 --> 00:32:24,310
And they kind of do things.

414
00:32:25,210 --> 00:32:26,550
And they launch.

415
00:32:29,150 --> 00:32:32,930
So, I thought I'd be, you know, I found this stuff, I'd be friendly and helpful.

416
00:32:32,930 --> 00:32:35,590
Do a bit of tidying up while I'm here.

417
00:32:40,130 --> 00:32:42,510
They hadn't defragged for ages.

418
00:32:46,250 --> 00:32:47,930
Didn't like the color scheme.

419
00:32:55,810 --> 00:32:58,330
This is a CD that was in the CD drive.

420
00:33:01,200 --> 00:33:03,640
And I just love this comment here.

421
00:33:10,330 --> 00:33:12,970
So, any copyright enforcement officers in the building?

422
00:33:17,820 --> 00:33:19,820
Okay, so what else could we do?

423
00:33:20,300 --> 00:33:23,400
We could change the status of things in our room.

424
00:33:25,020 --> 00:33:25,940
Minibar.

425
00:33:27,080 --> 00:33:29,020
Oh dear, we're all zeros.

426
00:33:32,730 --> 00:33:37,590
Now, you might not want the hotel staff coming in and finding all these empty bottles all over the floor.

427
00:33:37,590 --> 00:33:40,490
So, you can DOS your room by setting it to clean.

428
00:33:42,810 --> 00:33:44,490
They'll never bother you again.

429
00:33:48,420 --> 00:33:56,880
I've even found things which the vendor who built the system obviously put that in, but the hotel hadn't paid for the full package.

430
00:33:56,880 --> 00:34:08,080
So, for example, on this system we can watch movies, we can play with a PlayStation, we can look at some hotel information, whatever, and that's it.

431
00:34:09,340 --> 00:34:13,020
But in the background there, there's an internet connection.

432
00:34:13,860 --> 00:34:16,480
This screen was not available by any other means.

433
00:34:16,480 --> 00:34:20,720
There was no way to officially get to it, but it was a fully functional internet connection.

434
00:34:20,720 --> 00:34:22,520
So, it was hooked up to their backend.

435
00:34:22,520 --> 00:34:26,580
It was using their internet connection, which they probably used for the hotel.

436
00:34:26,900 --> 00:34:28,060
And this was real content.

437
00:34:28,060 --> 00:34:43,220
If I clicked on those links, I could start digging down further and actually using Squeak's technique to then tweak HTTP URLs and things and basically find a way to get to a search engine, whatever, and then get out to the outside world.

438
00:34:46,120 --> 00:34:48,820
Sometimes you can actually control physical devices.

439
00:34:50,300 --> 00:34:51,900
This is a minibar.

440
00:34:52,420 --> 00:34:54,800
This is a red light that says it's locked.

441
00:34:55,060 --> 00:34:58,140
That's the beer I was going to have before this happened.

442
00:35:02,530 --> 00:35:06,270
So that was motivation to find the unlock code, obviously.

443
00:35:10,090 --> 00:35:12,390
We can see what other people are doing.

444
00:35:13,350 --> 00:35:21,790
And we can do that because you often see this message, you choose something, premium content, whatever, and it will say, please wait, we're assigning another channel.

445
00:35:22,290 --> 00:35:33,530
And so what they're doing is they're going to broadcast the content and then they're going to retune your TV to that channel, which only you can watch, obviously, because they control the TV, right?

446
00:35:34,790 --> 00:35:36,090
So do I.

447
00:35:37,810 --> 00:35:44,750
So this guy is obviously, he's watching a film, he's interested in mountain-dwelling women or something.

448
00:35:47,480 --> 00:35:48,820
It's harmless enough.

449
00:35:48,820 --> 00:35:50,320
Okay, he's watching a movie.

450
00:35:50,860 --> 00:35:53,100
But what if he's browsing the Internet?

451
00:35:54,640 --> 00:36:00,860
Then he goes to his webmail account and he reads his mail.

452
00:36:05,350 --> 00:36:07,610
And he replies to his mail.

453
00:36:09,490 --> 00:36:12,090
Maybe I should help him with his spelling or something.

454
00:36:16,470 --> 00:36:20,570
Okay, so I can also assign the TV to another room.

455
00:36:22,170 --> 00:36:30,370
One of the interesting things you can do on your TV in your room is look at your bill.

456
00:36:30,770 --> 00:36:32,930
So we choose account status.

457
00:36:33,490 --> 00:36:35,170
It looks up my name.

458
00:36:36,750 --> 00:36:38,210
And there's my bill.

459
00:36:38,210 --> 00:36:41,590
There's that strange round number appears again.

460
00:36:43,270 --> 00:36:49,210
So the reason it can show me my bill is because it knows that this TV is in my room.

461
00:36:49,270 --> 00:36:52,270
And it knows that because it has an address.

462
00:36:52,270 --> 00:36:55,390
In this case, it's A161.

463
00:36:56,390 --> 00:37:06,550
So if I change it and it's now A162 I'm looking at the bill of the guy next door.

464
00:37:08,790 --> 00:37:10,990
Wow, look at all those room charges.

465
00:37:11,410 --> 00:37:13,170
What the hell has he been doing?

466
00:37:14,550 --> 00:37:16,290
His minibar is probably empty.

467
00:37:16,290 --> 00:37:19,690
He's watched every pay-peak TV movie in the place.

468
00:37:19,690 --> 00:37:21,550
He's been having a wild time.

469
00:37:23,230 --> 00:37:27,070
I'm guessing when he goes down to check out there may be some discussion.

470
00:37:38,780 --> 00:37:41,880
And I'm a busy professional, he's probably a busy professional.

471
00:37:42,580 --> 00:37:44,680
I have a big heart, you can probably tell that.

472
00:37:44,680 --> 00:37:46,840
So I figure I'll help him out.

473
00:37:54,140 --> 00:37:55,960
And send him on his way.

474
00:38:08,680 --> 00:38:12,380
If I can do that for one room, I can do it for all of the rooms.

475
00:38:14,280 --> 00:38:16,200
So I have a little shell script.

476
00:38:16,340 --> 00:38:19,080
And I have a little tripod and a digital camera.

477
00:38:19,200 --> 00:38:29,080
And when I turn up in a hotel and I go to bed and I get up the next morning I have a little page like this.

478
00:38:30,400 --> 00:38:31,620
Yes, it was me.

479
00:38:31,620 --> 00:38:34,060
I did spend the night in Paris Hilton.

480
00:38:36,120 --> 00:38:36,960
Grow.

481
00:38:38,460 --> 00:38:44,580
So that page gives me a little thumbnail of every room in the hotel.

482
00:38:45,040 --> 00:38:51,680
Who's staying where, who's staying with who, where they've been calling, all kinds of stuff.

483
00:38:51,820 --> 00:38:55,060
Which rooms are empty, which are full because you get different messages.

484
00:38:56,600 --> 00:39:00,280
So by the time I'm done, I know the percentage occupancy of the hotel.

485
00:39:00,280 --> 00:39:07,260
I know who's there, who they're with, what they've been eating, drinking and viewing, where they've called and how long they've been there.

486
00:39:08,640 --> 00:39:10,380
It's pretty bad.

487
00:39:13,200 --> 00:39:14,680
Okay, now the good stuff.

488
00:39:14,680 --> 00:39:16,900
This is what you all really came for, right?

489
00:39:19,120 --> 00:39:20,560
Pay-per-view.

490
00:39:21,520 --> 00:39:26,020
So there seem to be two different kinds of TV pay-per-view.

491
00:39:26,280 --> 00:39:31,060
There's the ones that you actually choose a film and it gets played for you.

492
00:39:31,360 --> 00:39:36,440
And there's ones that just play in a cycle and when you choose the film you get tuned in.

493
00:39:37,700 --> 00:39:40,540
There's various different ways they control this stuff.

494
00:39:41,260 --> 00:39:43,720
One of them is they send a blocking signal.

495
00:39:45,500 --> 00:39:56,100
So in this case, we've been scanning, we found a channel, we've got the sort of cheesy 70s music, we think we've hit pay dirt, but it's being blocked.

496
00:39:56,500 --> 00:39:58,980
So I found a command that unblocks it.

497
00:40:00,280 --> 00:40:03,540
Just a boring old documentary from the 70s.

498
00:40:05,880 --> 00:40:09,740
Alternatively, you could just retune all the channels.

499
00:40:10,400 --> 00:40:13,720
So you don't have to search for individual ones.

500
00:40:14,740 --> 00:40:16,600
So we also program.

501
00:40:17,300 --> 00:40:19,640
I'm sorry, it's a bit blurry, this picture.

502
00:40:19,720 --> 00:40:23,640
Seems to be one of the sort of fundamental issues with this kind of research.

503
00:40:24,060 --> 00:40:27,200
It's just not possible to get a good picture one-handed.

504
00:40:30,920 --> 00:40:34,140
And there's that educational channel you've been looking for.

505
00:40:37,730 --> 00:40:40,910
And like any good hacker, you tag it for them.

506
00:40:50,260 --> 00:40:54,840
Now if all that seems like way too much trouble, they have this great feature called a Barker channel.

507
00:40:55,500 --> 00:41:00,480
Barker channel is what comes up when you first turn the TV on.

508
00:41:01,300 --> 00:41:06,940
Oh, it's changed.

509
00:41:11,290 --> 00:41:13,570
So that's infrared.

510
00:41:14,450 --> 00:41:21,070
Other things I've been looking at recently, back to the old car alarms, those central locking systems.

511
00:41:21,490 --> 00:41:23,590
They've started using RF.

512
00:41:23,690 --> 00:41:26,250
Garage door openers over here use RF.

513
00:41:26,310 --> 00:41:29,070
I think it's going to be a carrier change only.

514
00:41:29,890 --> 00:41:31,850
The codes will be the same.

515
00:41:31,850 --> 00:41:34,390
They're just using RF instead of infrared.

516
00:41:35,370 --> 00:41:40,790
Some interesting things with hotel safes while I was looking at hotels.

517
00:41:41,510 --> 00:41:43,270
We'll come to that in a second.

518
00:41:43,470 --> 00:41:50,670
Car alarms, I've already found that existing RF systems often have very simple reset codes.

519
00:41:51,850 --> 00:41:58,010
The reason they do that is so their engineers can unscrew a car if you get locked out of it.

520
00:41:58,650 --> 00:42:00,810
And I found this out because my wife phoned me.

521
00:42:00,810 --> 00:42:02,950
It was actually after DEF CON a few years ago.

522
00:42:03,290 --> 00:42:06,010
A few of us were sitting around, decompressing, having a beer.

523
00:42:06,010 --> 00:42:09,730
I get a call from my wife saying, oh, you won't guess what happened to me.

524
00:42:09,870 --> 00:42:13,530
I got locked out of the car in this really bad part of town with loads of shopping.

525
00:42:13,530 --> 00:42:14,670
It was getting dark.

526
00:42:14,890 --> 00:42:18,030
I had like three kids, not all mine, three kids with me.

527
00:42:19,170 --> 00:42:20,370
And I couldn't get in.

528
00:42:20,370 --> 00:42:21,330
I phoned the garage.

529
00:42:21,330 --> 00:42:24,690
They said, well, it's going to be two hours before we can get someone out to you.

530
00:42:25,430 --> 00:42:27,190
So she explained the situation.

531
00:42:27,930 --> 00:42:30,350
Single female in a bad place.

532
00:42:30,350 --> 00:42:36,190
They said, okay, we're not supposed to tell you this stuff, but this is what you do.

533
00:42:37,010 --> 00:42:40,710
So you can imagine my first question is, are you all right?

534
00:42:40,770 --> 00:42:41,270
No.

535
00:42:41,270 --> 00:42:44,630
My first question was, you did write down the code, right?

536
00:42:46,590 --> 00:42:49,490
And being a good hacker's wife, she said yes.

537
00:42:50,830 --> 00:42:53,750
And got a round of applause from the goons around me.

538
00:42:53,750 --> 00:42:56,370
So she gave me this code.

539
00:42:57,190 --> 00:43:02,510
A few weeks later I was driving with a friend and he's in a rental and we have to drop it off on a garage forecourt.

540
00:43:02,890 --> 00:43:06,590
And I noticed that he had the same remote as my wife's car.

541
00:43:07,330 --> 00:43:08,930
So I'm like, well, hang on a second.

542
00:43:08,930 --> 00:43:10,230
Let me just try something.

543
00:43:11,170 --> 00:43:12,390
Do the code.

544
00:43:13,190 --> 00:43:18,330
You don't want to know what 50 cars opening their doors at the same time sounds like.

545
00:43:26,560 --> 00:43:28,740
Especially when you're not supposed to have done it.

546
00:43:29,320 --> 00:43:31,600
By this time we were running down the road.

547
00:43:34,270 --> 00:43:42,590
Turns out that hotels, when you forget your PIN number that you put in, they come with, guess what, an infrared dongle.

548
00:43:43,370 --> 00:43:46,410
Don't have a hack for you for this one, but I'm looking into it.

549
00:43:47,850 --> 00:43:49,430
This is a great device.

550
00:43:49,430 --> 00:43:50,250
TV be gone.

551
00:43:50,250 --> 00:43:51,610
Who's played with these?

552
00:43:52,590 --> 00:43:53,670
Yeah, a few people.

553
00:43:53,670 --> 00:43:55,030
Very cool device.

554
00:43:55,250 --> 00:43:58,770
Press a button and it sends every known off signal.

555
00:43:59,170 --> 00:44:01,010
So press the button once and just wait.

556
00:44:01,010 --> 00:44:07,910
And the TV in the bar that's irritating the crap out of you because they're playing sports is going to go off.

557
00:44:08,570 --> 00:44:11,050
So I cracked one open and had a look.

558
00:44:11,050 --> 00:44:13,230
And it's a simple development chip.

559
00:44:13,330 --> 00:44:19,970
The guys who sell it sell a system where you can very rapidly develop applications that use it.

560
00:44:20,050 --> 00:44:22,650
So I thought I should come up with one of my own.

561
00:44:28,670 --> 00:44:30,850
You'll notice the happy smiling face here.

562
00:44:30,850 --> 00:44:33,210
I'll just flick between the channels for you.

563
00:44:36,820 --> 00:44:38,880
One button and it's owned.

564
00:44:38,880 --> 00:44:41,660
So I might work on that.

565
00:44:42,840 --> 00:44:43,780
That's it.

566
00:44:43,780 --> 00:44:44,980
Any questions?

567
00:44:47,420 --> 00:44:48,680
Yes, sir.

568
00:45:00,080 --> 00:45:05,880
I've seen some of the new modern systems and I haven't seen any better controls.

569
00:45:05,880 --> 00:45:09,700
The question was will modern systems fix this problem?

570
00:45:09,700 --> 00:45:14,680
The newer systems I've seen still have the exact same problems but it's actually worse.

571
00:45:14,680 --> 00:45:20,580
They're starting to do things like allowing you to put credit card details in through your TV.

572
00:45:20,580 --> 00:45:22,620
And as I said, webcams, stuff like that.

573
00:45:22,620 --> 00:45:26,820
So the potential for abuse is actually getting worse.

574
00:45:28,120 --> 00:45:28,980
Yes, sir.

575
00:45:35,140 --> 00:45:37,700
The question is have I played with street signs?

576
00:45:38,320 --> 00:45:41,060
The big screens in Vegas?

577
00:45:41,820 --> 00:45:49,980
It's very likely the very systems I'm talking to, the desktops I'm talking to, are probably on the same network as the systems that are controlling those signs.

578
00:45:50,340 --> 00:45:51,760
Just a thought.

579
00:45:51,760 --> 00:45:51,820
Yes ,

580
00:45:56,260 --> 00:45:58,320
sir.

581
00:46:00,040 --> 00:46:01,600
Can I tell you what?

582
00:46:02,240 --> 00:46:04,360
Can I tell you what the codes are?

583
00:46:05,240 --> 00:46:07,200
I think you should work for that.

584
00:46:08,380 --> 00:46:10,800
I spent nine hours in a room in Amsterdam.

585
00:46:14,180 --> 00:46:16,660
Oh, for the car.

586
00:46:16,940 --> 00:46:18,280
It's actually very simple.

587
00:46:18,280 --> 00:46:27,120
All you did was take the battery out, press the unlock code ten times slowly, put the battery back in.

588
00:46:27,120 --> 00:46:30,720
I think that was just to discharge any capacitance that was in the system.

589
00:46:31,060 --> 00:46:35,740
And then again, press the unlock code ten times very slowly.

590
00:46:36,460 --> 00:46:42,380
And I think what's happening is it's saying to the car, I'm a brand new remote, you're a brand new car.

591
00:46:42,560 --> 00:46:43,780
Let's party.

592
00:46:48,380 --> 00:46:49,840
Any other questions?

593
00:46:54,220 --> 00:46:56,580
The question was are you able to get phone records?

594
00:46:56,580 --> 00:46:57,960
It depends on the hotel.

595
00:46:57,960 --> 00:47:00,180
Different folios show different detail.

596
00:47:02,400 --> 00:47:03,780
Okay, last question.

597
00:47:05,600 --> 00:47:06,600
There isn't one.

598
00:47:06,980 --> 00:47:08,100
Okay, I'll ask one.

599
00:47:13,620 --> 00:47:14,940
Do I have any literature?

600
00:47:14,940 --> 00:47:19,400
I don't have any with me, but I'll get the slides put up on the DEF CON site so you can view them.

601
00:47:19,400 --> 00:47:20,920
So that's it.

602
00:47:38,200 --> 00:47:39,620
Thank you, Major Malfunction.

603
00:47:39,620 --> 00:47:42,580
We need everyone out those doors, not the doors you came in.

604
00:47:43,080 --> 00:47:43,860
Those doors.

605
00:47:43,860 --> 00:47:47,260
We have a big line for the next presentation on war driving.