start	end	text
0	7000	It would be inappropriate of me to comment on this particular issue, but maybe...
10740	14100	That kind of sums it up. Sorry for you guys over there.
18780	25120	If you like this shirt, there is a template and the LBGFX guys will make it up for you.
25540	28900	My idea was, I thought, well, this guy gave up his job.
28900	37860	He put his head above the parapet and gave up his job, so maybe I should do something for him.
39120	43640	Print up a shirt, maybe they sell it for an extra five bucks, and we give him the five bucks.
44300	48740	But then I thought, well, actually, Cisco are doing a pretty good job of marketing him at the moment,
48740	52760	so I don't think we really need to bother on that one, so I think we'll just leave that be.
55660	59220	Okay, so who am I? My name is MajorMalfunction.
59220	63240	Some of you will know me. I've been involved in DEF CON since DC5.
63240	71720	I've been working in the security industry since the 70s, and I do have a proper day job where I do this kind of stuff.
75280	79260	Now, why did I start looking at infrared? Well, basically, infrared's everywhere.
79260	84780	This talk is called Old School Hacking, because when I first started talking about it,
85260	90280	people said to me, but that's such old technology. Why would you bother looking at that?
90280	95420	Nobody uses that shit anymore. I thought, well, I think a few people do.
95420	100300	So, you know, I asked around, and when I talk at conferences, I check with those conferences.
100300	107000	So, you know, put your hand up if you've used an infrared control this week of any kind.
107280	112140	Okay, put your hand up if you haven't used an infrared control this week.
112840	115400	Well, electricity will come to your village soon, I'm sure.
118100	120960	They're really useful things, you know. Change the TV.
121720	124640	So, it's everywhere. Everyone still uses it.
125380	137920	And it gets used in the obvious things like TVs for tuning and master configuration, package selection, central control of billing systems in those devices, vending machines.
137920	145060	I found some vending machines in Amsterdam where you actually had to go to the bar and ask the guy to switch the thing on
145060	147980	before you could use it, so cigarette machines at the back of the bar.
148380	152460	You would go up to the bar, say, I want to use the cigarette machine, and he would ping it on.
153200	157700	I'm not sure exactly what that was all about. I guess there's some kind of fraud going on.
157700	161840	People find out how to trick the machine, so they want to keep it under control.
162880	167620	They also get used, at least in the UK, for setting up the pricing.
167620	171360	So you get those multi-vending machines where you have different goods in there.
171360	178420	They actually program which slot costs what, so potentially there's a nice little hack there.
179160	184640	Public display signs, obviously you can set scrolling LEDs up to do kind of wacky things.
184980	187380	And garage door openers, car alarms.
187580	194360	So actually car alarms that I first started looking at, in the early days I had a car with an infrared control,
194900	201480	and I found that I could record the door lock and unlock codes on my Palm Pilot and play them back.
201480	203020	And I thought that was pretty neat.
203640	208240	And then I got a new car, still had an infrared control, but this stopped working.
208240	210220	I could do it once, and then it stopped.
210760	212800	And I wanted to understand why.
212800	219640	So I started looking at the tools to do it, and I started developing an application
219640	224940	to try and analyze what was going on with the signal and why I was having that issue.
225920	231100	So, which I called the Project Murder, which was the usual sort of hacker horrible pun.
231100	234680	So I'm using IRDA and I put my initials on the front, I get murder.
235680	243540	And I got to a point on FreeBSD where I was actually able to read the codes, but I hadn't yet started to write them back.
243920	245580	And then I discovered Lurk.
245580	253940	And because of Lurk, I overcame my BSD bigotry and installed Linux on my box, and I've been using that ever since.
255620	257340	So why bother with IR?
258080	263140	Well, IR is very unlikely to be replaced, at least in the foreseeable future.
263480	266240	It's a very good technology, it's very fit for use.
266620	269300	It's cheap, you know, the components exist.
269800	271300	It's very simple.
272160	275960	When I say it's fit for use, I mean things like TV, you know, it's absolutely perfect.
275960	280160	You can point it in a completely random direction, it will still bounce off the walls and hit the TV.
280220	284120	And it's not going to change the channel in the hotel room next door to you.
284200	290900	You start looking at putting things like Bluetooth in controls, and you've then got issues of leakage into other environments.
290900	296240	So, infrared is actually a very good tool for the job it does.
296240	301560	From a technical point of view, why should I waste my time fiddling with this stuff?
301560	305120	Well, as a security professional, I think it's good.
305120	311340	You know, you have to develop a mindset that looks around you for security issues all the time.
311680	317400	When I move into a house, a new house or an apartment or whatever, or I get a new car,
317400	320900	for the next few weeks, I will try and break into it.
320900	324900	I will see how many ways I can get back into my house without actually using the door key,
324900	327760	or going up to the alarm and doing what I'm supposed to do on the alarm.
328220	333600	And it's just habit, you know, it's using that mindset or developing that mindset
333600	336440	where you're looking for security problems all the time.
338960	342140	And infrared, you know, you're sitting in a hotel room, there's nothing to do.
342480	344400	There's your infrared control, there's the TV.
344820	346920	The hotel's quite an interesting place.
347240	350440	They're trying to sell me stuff, but they don't actually want to have staff to do it,
350440	351920	so they rely on technology.
352620	355440	If you think about last time you checked into a hotel,
356040	360800	you probably interacted with one person right at the beginning when you checked in.
361500	366380	And for the rest of your stay in that hotel, you were using automated systems.
367020	370440	And that's apart from the catering staff, but just, you know, you're in a big hotel,
370440	372060	you're sleeping in the bedroom and so on.
372520	374520	But meantime, they're still trying to sell you stuff.
374520	377160	They've got pay TV, they've got mini bars,
377160	379900	they've got all this stuff where they're delivering a service
379900	381960	without actually having any staff to do it.
381960	384100	They're relying on technology to do that.
384440	387380	There will be security problems with technology,
387380	392220	and those problems will have direct parallels in the internet networking world
392220	394940	and, you know, within the systems themselves
394940	397500	that some of you may be involved in actually deploying.
398200	402080	And it's fun. At the end of the day, as you'll see, it's quite fun.
403360	409780	So it turns out that infrared really is the ultimate in security by obscurity.
410760	413540	You've got really simple codes.
413540	415200	Because they're sent, you can't see them.
415200	417380	No one can see what's actually going on.
417760	421220	They don't bother engineering any kind of security into it.
422060	425980	If you know the right code to send, you have total control of the box.
425980	429460	That is it. You know, I am God. Bang.
429760	431880	I now control the box. I can do anything I want.
431880	434900	There's no two-way authentication. There's no further pin numbers.
434900	435920	There's nothing.
436920	440700	They also tend to use what I term an inversive security model,
440700	445200	where the actual control of what you're allowed to do is at the wrong end.
445200	446920	It's in the hostile environment.
446980	449200	It's in the environment that I control.
449780	452600	And we'll look at that in more detail.
455510	458810	Okay, so the simplest attack is the one I described with my car,
458810	461330	where I could just record the code and replay it.
462290	467430	And that also applies to garage doors, so garage door openers.
467430	472170	I think you mostly use RF over here, but in the UK and some parts of Europe,
472170	474810	infrared controls are still very popular.
475690	482970	There's also little robot toys, TVs, the TVs in bars and clubs and things.
483830	486950	And if you can record a code or you know the code,
486950	490730	then you can affect those publicly visible devices.
491450	493930	And if you can get a hold of special controls
493930	497950	that do extra things on those devices, you can simply clone them.
497950	500470	And then you have the code, and you replay it,
500470	502450	and you can do the special thing.
505680	508020	And the kind of tools you can use to do it,
508020	514120	Casio produced some nice little infrared watches back in the 80s, I think.
514980	518640	Apple Newton was one of the first handheld manufacturers
518640	521640	to actually have built-in IR that had this capability.
522160	525540	And now you have tools like Omni Remote,
525540	530260	which runs on any Palm-based operating system that has an infrared control.
531180	534200	It's a very neat system. You can get it from Pacific Neotech.
534200	536760	There's the URL, download that.
537700	541680	Philips Pronto is used in a lot of those big home automation systems.
541680	545220	So you have a control, and you completely program what the buttons look like,
545220	547900	what command they send, and so on.
548100	551300	And again, there's a lot of website resource behind that.
551300	555320	You can download existing codes for different systems, and so on.
558570	561930	So here's our first example, RoboSapien.
562970	565870	Last year, there was a guy here at DEF CON walking around.
565870	567410	He'd obviously bought one of these toys,
567410	569390	and he was walking it around, up and down the queues.
569390	571010	Anyone remember seeing him?
571770	572370	Yeah.
572530	575870	So he was walking up and down, trying to get someone to buy it.
578340	580140	So I sat down behind him,
580140	583180	and started recording the commands he was sending.
585600	587360	So he would walk it up the aisle,
587820	590620	and I would turn it around and walk it away from the aisle.
591400	593880	And he would turn it back and walk it back up the aisle,
593880	595940	and I would turn it away and make it shrug its shoulders,
595940	598380	or make a rude farting noise, or something.
598820	602060	So basically, I was able to then...
602620	603580	tag it.
609480	612500	So this is a guy at work. He owns the black car.
612920	614700	A friend of mine owns the green car.
615200	618240	So I put my system in the back of the green car,
618240	620320	one day when he was leaving,
620320	624540	and the next morning, when he arrived.
625360	627820	And then that evening, when he went to go,
627820	630520	he walked up to his car, and he unlocked it.
630560	631920	And I locked it.
633520	634840	He unlocked it.
635120	636560	And I locked it.
637640	638940	And he unlocked it.
638940	640020	And I locked it.
640400	642020	And that went on for a few minutes.
642100	643760	And then he started walking back to the office
643760	645460	to try and, you know, make a phone call,
645460	647860	do whatever he had to do to sort his life out.
647860	649440	And I unlocked it for him.
650280	651840	Because I'm a nice guy, really.
653200	654240	So that was...
654240	655680	That's one of the older systems,
655680	657840	that obviously didn't tackle this problem,
657840	659940	that, you know, why can't I do that to my car?
659940	660460	I don't know.
660460	662900	But his, I could just replay as often as I like.
664640	665980	I couldn't actually steal his car,
665980	667780	because it turns out he has an RF as well,
667780	669440	which disables the engine.
673220	674900	Okay, so that's a replay attack.
674900	675940	Very simple attack.
675940	677800	You have to have access to the source
678380	681540	to see the original signal and replay it.
682360	684200	But what if you don't know
684200	685980	what the original signal looks like,
685980	688940	or what the exact code is for that device?
688940	690780	You can go and buy a similar one,
690780	693840	but you don't know the code for the man next door.
693840	696200	So I've got the same garage door opener as he has.
698440	700980	Well, as I say, I found this tool, Lurk,
700980	703080	which you can download.
703080	706940	It's the Linux Infrared Control project.
707420	709040	It has some visualization tools,
709040	710420	which I find very useful.
710420	712700	You can send an infrared signal into it
712700	714840	and actually visualize what's going on.
715640	718600	It auto-learns, so you just point a remote at it
718600	721100	and it will learn all the tricky stuff for you.
721100	722780	You don't have to do any thinking.
723740	727760	And it produces an ASCII human-readable config file,
727760	729500	which is very important, because that means
729500	731820	you can look at it, you can read it,
731820	733460	you can understand it, and more importantly,
733460	736520	you can change it, which is what we're going to do.
737840	738840	It's software-only.
738840	741120	It will work with my infrared on my laptop.
741680	743060	It only runs on Linux.
744660	747300	Alternatively, you can buy an external device,
747300	748840	which is a USB dongle.
749240	751900	It's available from irtrans.de.
753220	755340	It's a much more powerful transmitter,
755340	757720	so you can do stuff from further away.
758360	759740	And it solves a bunch of issues.
759740	763880	The way LERP works is it plays with serial protocols.
764740	768040	What irtrans does is it actually runs in native mode,
768040	771360	so it knows how to send native infrared commands.
771860	773320	And that will run on Linux
773320	777900	or that other funny virus operating system.
780180	781420	This is what it looks like.
781420	783180	It's just a little USB dongle.
784500	786420	Okay, so for my first example,
786420	788980	I took my garage door opener
788980	794840	and popped it open and found there's this dip switch.
795800	798280	And the dip switch has eight positions,
798840	802120	so therefore there are 256 possible codes.
802780	805180	So what I could do to get into my neighbor's garage
805180	807500	is try every one of them,
807500	809500	but that would be fairly dull.
811260	813760	I had a look with a piece of software
813760	816540	that comes with LERP called XMODE2.
817900	822700	Now what XMODE2 does is you point the control at it,
822700	824660	hit a command,
825420	829620	and it will draw for you the signal that it sees.
829620	832020	So there's a carrier signal, which it then modulates,
832020	835940	and you get to see if it's a long pause or a short one.
836700	839180	So if I switch all of the eight switches on,
839180	840180	I get this.
840180	842140	If I switch them off, I get that.
842700	846320	If I switch number eight on, this one pops up.
846540	847800	Number one, that one.
847800	849880	So I can see where the pattern starts and ends.
849880	852900	It's obviously just a very simple one-to-one relationship
852900	855140	between the switch and the pulses.
855740	858140	So I concluded that I have a start bit,
858140	860540	eight data bits, and four stop bits.
864730	871050	So now I train LERP how to just duplicate a code
871050	872870	or a couple of codes.
872870	875330	In this case, I would only need one.
875770	879490	Because what I'm looking for is to see how that code is represented.
879910	884230	So LERP, basically, this stuff is to do with timings and carrier frequencies.
884930	887830	This is the actual code that's being sent.
888210	892870	So for a particular switch position, it will give me a particular hex value.
893930	896390	So I know the hex for one command.
897370	899830	So it's not that hard, then, to write a little script
899830	903010	that produces the hex for every possible command.
903450	904790	Which I do.
906050	911010	And then I write another little script that spits out each command.
911010	918650	And it took 54 seconds to send all 256 possible codes to my garage door.
919930	922290	So here I am, down in the garage.
922290	926070	I'll stick the laptop down, fire it up.
926790	929690	A few seconds later, bingo, door opens.
930870	936950	Now what was surprising here was I knew the code was actually quite far up in the range.
936950	940390	I thought it was going to take 45, 50 seconds to go.
940750	944270	What actually happened is it went within about the first five seconds.
944850	948690	So I thought, okay, well, maybe there's a factory backdoor in here.
948690	951990	The manufacturers have actually got a code that just always works.
951990	954110	And that's the only code I'm going to have to send.
955030	960370	Actually, it turned out that what had happened is the building management had run out of controls.
960370	963350	And they'd gone back to the company that sold the original system.
963390	966350	And they'd said, we need more remotes.
966370	968470	The company said, oh, that company's gone bust.
968470	971150	We can't sell you any. You'll have to buy a new system.
971230	974950	So they engineered into the system a second reader.
974950	976670	So we have two readers here.
977130	981030	So this reader, which is 100% compatible with that reader,
981030	987450	has been engineered in so that another bunch of remotes can send 100% compatible codes and open my door.
988090	991530	So, stupidity. They didn't bother to actually check.
991530	994950	Or maybe they just set the switches wrong and they couldn't get the thing to work, but whatever.
994950	998170	They wasted a lot of time and money putting that system in.
999610	1002210	You'll notice there's a security camera here.
1003270	1009270	So while I was doing all this and fiddling around and opening garage doors without keys,
1009270	1013110	presumably someone was recording that video and watching me.
1013110	1016630	So I got a visit the next morning from security.
1016950	1018750	No, of course not.
1018750	1022930	If you have security, at least pay attention to it, guys.
1025700	1028140	Okay, so hotel TVs.
1029640	1035480	I thought, if I can do this to a garage door, maybe I can do it to a TV system.
1035480	1042060	So I need a TV system that actually does more than simply changes channels.
1042440	1045740	So I had a look at a hotel TV system.
1046720	1051100	And this is one of the examples where I say we were running an inverted security model.
1051780	1055940	The TV is controlling which content I get to see.
1055940	1063100	The hotel in most cases is streaming content, basically all the content without any control.
1063100	1065400	The TV itself filters the content.
1067460	1073640	When you actually select a channel to look at that content, there's no further authentication required.
1073640	1078640	If I can persuade the TV to go and look at a channel I'm not supposed to be looking at, that's it.
1078640	1080760	I just send it the command and I can have it.
1081320	1086800	The content itself isn't wrapped in any kind of encryption, unlike satellite TV,
1086800	1091260	where they expect you to be able to receive it even though you're not a subscriber,
1091260	1093840	because it's a closed system. They don't need to.
1093940	1097240	It's entirely within their own building. It's their own backbone.
1097660	1104000	They control who gets to see what on that system, or so they think.
1106680	1111780	Okay, so if the system's broadcasting stuff, presumably you can just plug in another TV,
1111780	1115640	tune yourself in, and watch whatever you want on any channel.
1115640	1118900	But humping a TV around is a pain in the ass.
1119520	1123280	Instead of that, we have these little USB dongle thingies.
1125920	1129700	So I plug this one in. This is in line with the back end.
1130740	1136100	And on the master TV, I'm getting the content they expect me to see, the master menu.
1136460	1141000	On this one, I've got another channel, because I've tuned to another channel.
1141940	1147380	And if I flick through the channels, I find there's various other bits of content.
1147380	1150220	This is all just system messages.
1154840	1158200	Occasionally, I came across these strange screens,
1158200	1161540	where they were seemingly putting up an advert for something.
1161900	1163640	Which is an advert no one's ever going to see,
1163640	1166300	because none of the official channels actually look at this.
1168000	1171000	But what was most interesting on there is there's a URL.
1171000	1172920	This is the company that makes the thing.
1173460	1177560	If I go to that URL, there's a load of technical documentation.
1177560	1181700	So there's PDFs. It tells me how the systems work.
1181880	1185380	What else I might be looking for when I start looking at these things.
1185560	1189680	What new features they're putting in. Which hotels they've put them in.
1190000	1193940	So you spot a feature you're interested in, you can just go and look at their client list.
1193940	1197680	Say, oh yeah, they're testing that over here. Let's go and stay there for a night.
1198960	1203380	Some of the things they're thinking of putting in are truly scary.
1204000	1205800	Webcam in your bedroom.
1205800	1210480	Now, why would anyone want... oh no, okay, don't answer that.
1211820	1213140	I think I know.
1218220	1221080	And of course, they're broadcasting premium content.
1221420	1224680	So this is a pay movie that I'm supposed to have paid for to watch.
1225580	1228540	Which I can watch on my tiddly little screen here.
1229700	1234160	Or I can root it back out and into the SCART and watch it on the TV.
1238220	1242000	Okay, that's fine, but that's just looking at the back-end content.
1242000	1244040	We haven't actually got control of the system.
1244040	1248780	But we've proved the concept that there is stuff on the back-end which we can get to.
1249680	1252920	So I started looking at the actual remote controls.
1252920	1258520	Can I do the same trick that I did brute-forcing my garage door to the TV remote?
1259400	1262000	What I found is the codes are much more complex.
1262000	1264060	They're much bigger. They have more bits.
1264520	1269720	And the reason they do that is because they group them.
1269720	1272240	You have manufacturer collision avoidance.
1272240	1275500	So you have multiple remotes in the same environment.
1275500	1278000	You don't want them interfering with each other's devices.
1278320	1282300	So you have a preamble that says, I'm a Sony or I'm a JVC or whatever.
1283500	1287800	You may have a remote that controls the TV and the video from the same manufacturer.
1287800	1289580	So you have different groups for that.
1290560	1293440	And you have standard groups versus extra groups.
1293440	1298120	So Philips may make a TV that they sell to hotels and to home.
1298120	1301840	And you have different sets of controls for the different environments.
1303160	1306280	There's also this interesting group here.
1306480	1307760	The hidden group.
1308320	1310020	This is what we're looking for.
1312040	1314220	So this is what they look like.
1315220	1318060	As you can see, it's a much longer code.
1318420	1322300	It's much harder to emulate or guess.
1322300	1329040	In fact, when I looked at it, it turned out to be a 14-bit code in this particular case.
1330200	1337340	Now unlike a garage door, when I test these codes, I need to watch.
1337340	1338920	I need to actually pay attention.
1338920	1342340	Because something will happen and then 10 seconds later,
1343000	1346400	I could send another command that cancels that and does something else.
1346400	1351260	So unless I'm actually watching each command as it plays out, I may miss the event.
1351260	1354620	So garage door, I can just leave it running, wait for it to pop.
1354620	1356800	This, I actually have to spend time on it.
1358040	1364240	And it turns out I need to take about two seconds per code to have time to react and watch
1364240	1369060	and let the code settle down, not be interfered by the next one.
1369860	1372880	Which would be nine hours to test the whole system.
1373180	1378340	And I found that out the hard way because one night in Amsterdam after a conference,
1378340	1380680	back in my hotel room, and I'm playing with this stuff.
1380680	1383020	This was in the early days when I was just figuring it out.
1383300	1385560	Next thing I know, it's five hours later.
1385700	1387160	It's one o'clock at night.
1387280	1392160	I've just spent the only night in Amsterdam playing with hotel-dam TVs.
1393640	1395380	Coffee shops are closed.
1395760	1398080	And I really fancied a cup of coffee.
1400640	1403020	So I thought, now I have to fix this.
1403020	1406360	I need to reduce the time it takes to do this stuff.
1407080	1410140	So I tried to find a way to reduce the search space.
1411760	1416520	So basically that meant looking at what bits are being used in the codes.
1416640	1420540	So if I take each of the codes in turn, 0 to 9,
1420540	1429140	and I look at which bits have actually been either set to 1 or toggled from 0 to 1 or 1 to 0,
1429140	1431480	I work my way through them all.
1433480	1438960	Basically just try each one, organize them in such a way that I can see what's going on.
1439660	1442480	Finally get to the end, and I'm down to...
1448020	1449460	Yeah, sorry.
1449900	1451620	First two bits are used.
1451660	1454260	I've got four bits I've never seen change here.
1454940	1458040	And the last eight bits is the actual code.
1459420	1461420	So I want to reduce that further.
1461420	1463140	That's not enough of a result.
1463140	1467380	So what I do is I take a single command, doesn't matter what command it is,
1467380	1469740	in this case I took the power command,
1469740	1471840	and I start toggling bits.
1472500	1477140	So if I toggle the first bit of the power command from 1 to 0,
1477800	1481140	and I send the command again, and the command succeeds,
1481880	1485560	then I can assume that bit is not actually used, it's ignored.
1486040	1489620	In this case the command fails, so I know that bit's important.
1490600	1494060	This one worked, so that bit's ignored.
1494440	1498480	And in fact, all three, those three were ignored, that one failed.
1498520	1502740	So I now know I've got a total of ten bits I have to care about.
1503260	1506180	Which gives me a thousand codes, which is about half an hour.
1506200	1507420	So I can live with that.
1510640	1514340	So I spit out a bunch of configs which have all the possible codes.
1514600	1518760	In this case I did them as four groups because I couldn't...
1518760	1522600	I really couldn't figure out how to do 14-bit bitfields in Perl.
1522600	1526380	So I did four sets of 8-bit bitfields with a lead in.
1527740	1531660	And then I spit those out, and I run those, and I watch what happens.
1533520	1537260	And sure enough, I find a load of really interesting stuff.
1539020	1540640	This one in particular.
1542940	1544440	This is the God code.
1544440	1547760	Bingo, it's a game in England. Bingo, I've won.
1556530	1559310	Okay, so the kind of things you do with hidden codes.
1561150	1564990	The internal, the housekeeping staff use them for daily things
1564990	1567950	like setting what they've done to the minibar.
1568210	1571530	If they've cleaned the room, they'll set a status report
1571530	1575090	so they don't have to fill in forms and report at the end of the day.
1575090	1579150	The hotel actually has real-time information as to what room's in what state.
1580150	1582710	You've then got some one-off tasks that the engineers use
1582710	1585930	if they're having problems with the TV or they're first setting it up.
1586350	1588450	And some debugging information.
1591200	1592900	Okay, so one of the first things you can do
1592900	1595740	is you can start to reconfigure the TV.
1596180	1598020	You can change the messages.
1598900	1600880	So when the TV gets switched on,
1600880	1604220	comes up with a welcome message or a channel message,
1604220	1607020	you can assign the TV to another room.
1607700	1612420	You can assign channels that are now free that used to be paid channels.
1612580	1617120	And you can find channels that just simply don't exist on a normal TV.
1618060	1619840	So here's an example.
1620340	1625380	First thing any good hacker does is tag his TV.
1628560	1632420	So now when you switch the TV on this room, that's what comes up.
1633560	1637080	And if you can find it, I'll give you some really cool prize.
1637080	1638680	Some bit of Defcon swag.
1641140	1642620	Same thing in Amsterdam.
1646040	1650020	Or you can change a big banner that comes up when you turn the TV on.
1654740	1657080	So this is not only owned, but it's really owned.
1657080	1659360	I've locked it, no one else is going to use it.
1661220	1663540	Actually, I unlocked it before I left, of course.
1664220	1665260	Just testing.
1665260	1668280	This is for security, you know, for research purposes only.
1668280	1670260	Don't go home and abuse this stuff.
1670260	1671460	Kids.
1674470	1679150	And I try and, you know, tip the hat to conferences I go to.
1687060	1691280	Okay, so one of the other things you can do is change the filtering on the TV.
1691680	1694300	Most broadcasters these days,
1694300	1699900	they actually send a signal to say what the certificate of the film is that they're sending.
1700980	1704960	And so responsible hotels, if you check in with children,
1704960	1708820	they'll put filtering on the TV so that you don't get inappropriate content.
1709300	1712460	So if you're a sensitive character like me,
1712460	1715840	and you walk into an environment like this,
1715840	1719340	and everything's just coming through, they're not filtering anything,
1719740	1723780	then you may want to take the matter into your own hands and deal with it.
1735410	1738110	So now only the good stuff comes into my room.
1739090	1741330	None of that sports news crap.
1744590	1748310	You can also just start to look for these invisible channels,
1748310	1751730	back-end systems that may be leaking information.
1753350	1756210	So, fairly simple test signal.
1756210	1758830	They obviously use that for just tuning the TV in.
1759290	1762670	Actually, it's more interesting that these numbers,
1762670	1766330	they usually are something other than zeros.
1766910	1770570	And there seems to be some strange correlation with them becoming zeros
1770570	1773850	and the minibar billing stopping to happen.
1775830	1778050	I have no idea why that would be.
1781980	1784220	You get some debugging information.
1784220	1786580	Again, there's some weird numbers that I don't know what they are,
1786580	1789680	but it says code, so that's got to be interesting, right?
1791020	1793880	I think most of it's signal strength, things like that.
1796000	1799060	Occasionally, I'll even interrupt a good movie to do this stuff.
1799060	1808670	Sometimes you find stuff that really is quite interesting.
1808670	1809570	It shouldn't be there.
1809570	1812170	I shouldn't be able to find information like this.
1812470	1816090	I know I'm running some kind of DOS environment,
1816850	1819110	and I've even got an IP address.
1821850	1824810	So, there's obviously some kind of computer back there.
1825070	1826710	Maybe I can talk to it.
1829730	1831850	Maybe I don't want to talk to it.
1845090	1846050	Strange.
1846770	1848910	We've got a web server back there, too.
1850170	1851670	That looks fairly harmless.
1851670	1854410	So, I've got an object not found page. Big deal.
1855950	1858470	Actually, see how my mouse moves?
1859370	1862930	Turns out the up, down, left, right buttons did the same thing to this one.
1866880	1868500	So, I poke around a bit.
1869580	1872740	I get another not found page, but it gives me a nice helpful message.
1872740	1875320	Actually, this pops up a bit after that first page.
1875320	1878060	So, it gives me a link. So, I click on it.
1878900	1880340	Gives me another link.
1881660	1885520	Microsoft helpfully suggests, if I'm not getting what I want from this system,
1885520	1889300	perhaps I should go to the home page, the system that served it.
1889720	1892020	There's my IP address, which is a link.
1893020	1894440	And it sends me here.
1909220	1912900	What is that doing on the back end system on a TV?
1914100	1915220	No idea.
1915220	1919400	And I resisted picking up the keyboard and playing with it, obviously.
1919780	1921800	Nothing further to see here. Move along.
1926540	1927260	Oops!
1931720	1933500	Who left that lying around?
1936190	1939090	So, yeah, I can move around. I can click on icons.
1939090	1941250	And when I click on them, things pop up.
1942150	1944310	And they kind of do things.
1945210	1946550	And they launch.
1949150	1952930	So, I thought I'd be, you know, I found this stuff, I'd be friendly and helpful.
1952930	1955590	Do a bit of tidying up while I'm here.
1960130	1962510	They hadn't defragged for ages.
1966250	1967930	Didn't like the color scheme.
1975810	1978330	This is a CD that was in the CD drive.
1981200	1983640	And I just love this comment here.
1990330	1992970	So, any copyright enforcement officers in the building?
1997820	1999820	Okay, so what else could we do?
2000300	2003400	We could change the status of things in our room.
2005020	2005940	Minibar.
2007080	2009020	Oh dear, we're all zeros.
2012730	2015430	Now, you might not want the hotel staff coming in
2015430	2017590	and finding all these empty bottles all over the floor.
2017590	2020490	So, you can DOS your room by setting it to clean.
2022810	2024490	They'll never bother you again.
2028420	2030480	I've even found things which
2030480	2032880	the vendor who built the system
2032880	2036880	obviously put that in, but the hotel hadn't paid for the full package.
2036880	2039860	So, for example, on this system
2039860	2042280	we can watch movies,
2042280	2044480	we can play with a PlayStation,
2044480	2048080	we can look at some hotel information, whatever, and that's it.
2049340	2051280	But in the background there,
2051280	2053020	there's an internet connection.
2053860	2056480	This screen was not available by any other means.
2056480	2058420	There was no way to officially get to it,
2058420	2060720	but it was a fully functional internet connection.
2060720	2062520	So, it was hooked up to their backend.
2062520	2066580	It was using their internet connection, which they probably used for the hotel.
2066900	2069620	And this was real content. If I clicked on those links,
2069620	2072220	I could start digging down further
2072220	2075260	and actually using Squeak's technique
2075260	2078800	to then tweak HTTP URLs and things
2078800	2081440	and basically find a way to get to a search engine, whatever,
2081440	2083220	and then get out to the outside world.
2086120	2088820	Sometimes you can actually control physical devices.
2090300	2091900	This is a minibar.
2092420	2094800	This is a red light that says it's locked.
2095060	2098140	That's the beer I was going to have before this happened.
2102530	2106270	So that was motivation to find the unlock code, obviously.
2110090	2112390	We can see what other people are doing.
2113350	2114290	And we can do that
2115350	2117050	because you often see this message,
2117050	2119410	you choose something, premium content, whatever,
2119410	2121790	and it will say, please wait, we're assigning another channel.
2122290	2126290	And so what they're doing is they're going to broadcast the content
2126290	2129510	and then they're going to retune your TV to that channel,
2129510	2131190	which only you can watch, obviously,
2131190	2133530	because they control the TV, right?
2134790	2136090	So do I.
2137810	2140790	So this guy is obviously, he's watching a film,
2140790	2144750	he's interested in mountain-dwelling women or something.
2147480	2148820	It's harmless enough.
2148820	2150320	Okay, he's watching a movie.
2150860	2153100	But what if he's browsing the Internet?
2154640	2156660	Then he goes to his webmail account
2158980	2160860	and he reads his mail.
2165350	2167610	And he replies to his mail.
2169490	2172090	Maybe I should help him with his spelling or something.
2176470	2180570	Okay, so I can also assign the TV to another room.
2182170	2184910	One of the interesting things you can do
2184910	2187490	on your TV in your room
2188650	2190370	is look at your bill.
2190770	2192930	So we choose account status.
2193490	2195170	It looks up my name.
2196750	2198210	And there's my bill.
2198210	2201590	There's that strange round number appears again.
2203270	2205410	So the reason it can show me my bill
2205410	2209210	is because it knows that this TV is in my room.
2209270	2212270	And it knows that because it has an address.
2212270	2215390	In this case, it's A161.
2216390	2217710	So if I change it
2219790	2221730	and it's now A162
2223990	2226550	I'm looking at the bill of the guy next door.
2228790	2230990	Wow, look at all those room charges.
2231410	2233170	What the hell has he been doing?
2234550	2236290	His minibar is probably empty.
2236290	2239690	He's watched every pay-peak TV movie in the place.
2239690	2241550	He's been having a wild time.
2243230	2245350	I'm guessing when he goes down to check out
2245350	2247070	there may be some discussion.
2258780	2261880	And I'm a busy professional, he's probably a busy professional.
2262580	2264680	I have a big heart, you can probably tell that.
2264680	2266840	So I figure I'll help him out.
2274140	2275960	And send him on his way.
2288680	2290780	If I can do that for one room,
2290780	2292380	I can do it for all of the rooms.
2294280	2296200	So I have a little shell script.
2296340	2299080	And I have a little tripod and a digital camera.
2299200	2302080	And when I turn up in a hotel and I go to bed
2302080	2303400	and I get up the next morning
2304820	2309080	I have a little page like this.
2310400	2311620	Yes, it was me.
2311620	2314060	I did spend the night in Paris Hilton.
2316120	2316960	Grow.
2318460	2321360	So that page gives me a little thumbnail
2321360	2324580	of every room in the hotel.
2325040	2327460	Who's staying where, who's staying with who,
2328800	2331680	where they've been calling, all kinds of stuff.
2331820	2333520	Which rooms are empty, which are full
2333520	2335060	because you get different messages.
2336600	2340280	So by the time I'm done, I know the percentage occupancy of the hotel.
2340280	2342700	I know who's there, who they're with,
2342700	2345460	what they've been eating, drinking and viewing, where they've called
2345460	2347260	and how long they've been there.
2348640	2350380	It's pretty bad.
2353200	2354680	Okay, now the good stuff.
2354680	2356900	This is what you all really came for, right?
2359120	2360560	Pay-per-view.
2361520	2366020	So there seem to be two different kinds of TV pay-per-view.
2366280	2369360	There's the ones that you actually choose a film
2369360	2371060	and it gets played for you.
2371360	2373940	And there's ones that just play in a cycle
2373940	2376440	and when you choose the film you get tuned in.
2377700	2380540	There's various different ways they control this stuff.
2381260	2383720	One of them is they send a blocking signal.
2385500	2388640	So in this case, we've been scanning, we found a channel,
2388640	2391100	we've got the sort of cheesy 70s music,
2391100	2393060	we think we've hit pay dirt,
2394500	2396100	but it's being blocked.
2396500	2398980	So I found a command that unblocks it.
2400280	2403540	Just a boring old documentary from the 70s.
2405880	2407900	Alternatively, you could just retune
2407900	2409740	all the channels.
2410400	2413720	So you don't have to search for individual ones.
2414740	2416600	So we also program.
2417300	2419640	I'm sorry, it's a bit blurry, this picture.
2419720	2421980	Seems to be one of the sort of fundamental issues
2422380	2423640	with this kind of research.
2424060	2427200	It's just not possible to get a good picture one-handed.
2430920	2432860	And there's that educational channel
2432860	2434140	you've been looking for.
2437730	2440910	And like any good hacker, you tag it for them.
2450260	2452500	Now if all that seems like way too much trouble,
2452500	2454840	they have this great feature called a Barker channel.
2455500	2458520	Barker channel is what comes up
2458520	2460480	when you first turn the TV on.
2461300	2466940	Oh, it's changed.
2471290	2473570	So that's infrared.
2474450	2476650	Other things I've been looking at recently,
2476650	2479110	back to the old car alarms,
2479110	2481070	those central locking systems.
2481490	2483590	They've started using RF.
2483690	2486250	Garage door openers over here use RF.
2486310	2489070	I think it's going to be a carrier change only.
2489890	2491850	The codes will be the same.
2491850	2494390	They're just using RF instead of infrared.
2495370	2497310	Some interesting things with hotel safes
2497310	2500790	while I was looking at hotels.
2501510	2503270	We'll come to that in a second.
2503470	2505490	Car alarms, I've already found that
2506830	2510670	existing RF systems often have very simple reset codes.
2511850	2513210	The reason they do that is
2513210	2516230	so their engineers can unscrew a car
2516230	2518010	if you get locked out of it.
2518650	2520810	And I found this out because my wife phoned me.
2520810	2522950	It was actually after DEF CON a few years ago.
2523290	2526010	A few of us were sitting around, decompressing, having a beer.
2526010	2528130	I get a call from my wife saying,
2528130	2529730	oh, you won't guess what happened to me.
2529870	2532570	I got locked out of the car in this really bad part of town
2532570	2534670	with loads of shopping. It was getting dark.
2534890	2538030	I had like three kids, not all mine, three kids with me.
2539170	2541330	And I couldn't get in. I phoned the garage.
2541330	2544690	They said, well, it's going to be two hours before we can get someone out to you.
2545430	2547190	So she explained the situation.
2547930	2550350	Single female in a bad place.
2550350	2553270	They said, okay, we're not supposed to tell you this stuff,
2554210	2556190	but this is what you do.
2557010	2559670	So you can imagine my first question is,
2559670	2561270	are you all right? No.
2561270	2564630	My first question was, you did write down the code, right?
2566590	2569490	And being a good hacker's wife, she said yes.
2570830	2573750	And got a round of applause from the goons around me.
2573750	2576370	So she gave me this code.
2577190	2579070	A few weeks later I was driving with a friend
2579070	2582510	and he's in a rental and we have to drop it off on a garage forecourt.
2582890	2586590	And I noticed that he had the same remote as my wife's car.
2587330	2588930	So I'm like, well, hang on a second.
2588930	2590230	Let me just try something.
2591170	2592390	Do the code.
2593190	2598330	You don't want to know what 50 cars opening their doors at the same time sounds like.
2606560	2608740	Especially when you're not supposed to have done it.
2609320	2611600	By this time we were running down the road.
2614270	2616050	Turns out that hotels,
2616050	2619930	when you forget your PIN number that you put in,
2619930	2622590	they come with, guess what, an infrared dongle.
2623370	2626410	Don't have a hack for you for this one, but I'm looking into it.
2627850	2629430	This is a great device.
2629430	2631610	TV be gone. Who's played with these?
2632590	2633670	Yeah, a few people.
2633670	2638770	Very cool device. Press a button and it sends every known off signal.
2639170	2641010	So press the button once and just wait.
2641010	2644050	And the TV in the bar that's irritating the crap out of you
2644050	2647910	because they're playing sports is going to go off.
2648570	2651050	So I cracked one open and had a look.
2651050	2653230	And it's a simple development chip.
2653330	2656050	The guys who sell it sell a system
2656610	2659970	where you can very rapidly develop applications that use it.
2660050	2662650	So I thought I should come up with one of my own.
2668670	2670850	You'll notice the happy smiling face here.
2670850	2673210	I'll just flick between the channels for you.
2676820	2678880	One button and it's owned.
2678880	2681660	So I might work on that.
2682840	2684980	That's it. Any questions?
2687420	2688680	Yes, sir.
2700080	2702780	I've seen some of the new modern systems
2702780	2705880	and I haven't seen any better controls.
2705880	2709700	The question was will modern systems fix this problem?
2709700	2712640	The newer systems I've seen still have the exact same problems
2712640	2714680	but it's actually worse.
2714680	2720580	They're starting to do things like allowing you to put credit card details in through your TV.
2720580	2722620	And as I said, webcams, stuff like that.
2722620	2726820	So the potential for abuse is actually getting worse.
2728120	2728980	Yes, sir.
2735140	2737700	The question is have I played with street signs?
2738320	2741060	The big screens in Vegas?
2741820	2744600	It's very likely the very systems I'm talking to,
2744600	2746040	the desktops I'm talking to,
2746040	2749980	are probably on the same network as the systems that are controlling those signs.
2750340	2751760	Just a thought.
2751760	2758320	Yes, sir.
2760040	2761600	Can I tell you what?
2762240	2764360	Can I tell you what the codes are?
2765240	2767200	I think you should work for that.
2768380	2770800	I spent nine hours in a room in Amsterdam.
2774180	2776660	Oh, for the car.
2776940	2778280	It's actually very simple.
2778280	2781440	All you did was take the battery out,
2781820	2785800	press the unlock code ten times slowly,
2785800	2787120	put the battery back in.
2787120	2790720	I think that was just to discharge any capacitance that was in the system.
2791060	2795740	And then again, press the unlock code ten times very slowly.
2796460	2798860	And I think what's happening is it's saying to the car,
2798860	2802380	I'm a brand new remote, you're a brand new car.
2802560	2803780	Let's party.
2808380	2809840	Any other questions?
2814220	2816580	The question was are you able to get phone records?
2816580	2817960	It depends on the hotel.
2817960	2820180	Different folios show different detail.
2822400	2823780	Okay, last question.
2825600	2826600	There isn't one.
2826980	2828100	Okay, I'll ask one.
2833620	2835920	Do I have any literature? I don't have any with me,
2835920	2839400	but I'll get the slides put up on the DEF CON site so you can view them.
2839400	2840920	So that's it.
2858200	2859620	Thank you, Major Malfunction.
2859620	2862580	We need everyone out those doors, not the doors you came in.
2863080	2863860	Those doors.
2863860	2867260	We have a big line for the next presentation on war driving.