[00:00.000 --> 00:07.000] It would be inappropriate of me to comment on this particular issue, but maybe... [00:10.740 --> 00:14.100] That kind of sums it up. Sorry for you guys over there. [00:18.780 --> 00:25.120] If you like this shirt, there is a template and the LBGFX guys will make it up for you. [00:25.540 --> 00:28.900] My idea was, I thought, well, this guy gave up his job. [00:28.900 --> 00:37.860] He put his head above the parapet and gave up his job, so maybe I should do something for him. [00:39.120 --> 00:43.640] Print up a shirt, maybe they sell it for an extra five bucks, and we give him the five bucks. [00:44.300 --> 00:48.740] But then I thought, well, actually, Cisco are doing a pretty good job of marketing him at the moment, [00:48.740 --> 00:52.760] so I don't think we really need to bother on that one, so I think we'll just leave that be. [00:55.660 --> 00:59.220] Okay, so who am I? My name is MajorMalfunction. [00:59.220 --> 01:03.240] Some of you will know me. I've been involved in DEF CON since DC5. [01:03.240 --> 01:11.720] I've been working in the security industry since the 70s, and I do have a proper day job where I do this kind of stuff. [01:15.280 --> 01:19.260] Now, why did I start looking at infrared? Well, basically, infrared's everywhere. [01:19.260 --> 01:24.780] This talk is called Old School Hacking, because when I first started talking about it, [01:25.260 --> 01:30.280] people said to me, but that's such old technology. Why would you bother looking at that? [01:30.280 --> 01:35.420] Nobody uses that shit anymore. I thought, well, I think a few people do. [01:35.420 --> 01:40.300] So, you know, I asked around, and when I talk at conferences, I check with those conferences. [01:40.300 --> 01:47.000] So, you know, put your hand up if you've used an infrared control this week of any kind. [01:47.280 --> 01:52.140] Okay, put your hand up if you haven't used an infrared control this week. [01:52.840 --> 01:55.400] Well, electricity will come to your village soon, I'm sure. [01:58.100 --> 02:00.960] They're really useful things, you know. Change the TV. [02:01.720 --> 02:04.640] So, it's everywhere. Everyone still uses it. [02:05.380 --> 02:17.920] And it gets used in the obvious things like TVs for tuning and master configuration, package selection, central control of billing systems in those devices, vending machines. [02:17.920 --> 02:25.060] I found some vending machines in Amsterdam where you actually had to go to the bar and ask the guy to switch the thing on [02:25.060 --> 02:27.980] before you could use it, so cigarette machines at the back of the bar. [02:28.380 --> 02:32.460] You would go up to the bar, say, I want to use the cigarette machine, and he would ping it on. [02:33.200 --> 02:37.700] I'm not sure exactly what that was all about. I guess there's some kind of fraud going on. [02:37.700 --> 02:41.840] People find out how to trick the machine, so they want to keep it under control. [02:42.880 --> 02:47.620] They also get used, at least in the UK, for setting up the pricing. [02:47.620 --> 02:51.360] So you get those multi-vending machines where you have different goods in there. [02:51.360 --> 02:58.420] They actually program which slot costs what, so potentially there's a nice little hack there. [02:59.160 --> 03:04.640] Public display signs, obviously you can set scrolling LEDs up to do kind of wacky things. [03:04.980 --> 03:07.380] And garage door openers, car alarms. [03:07.580 --> 03:14.360] So actually car alarms that I first started looking at, in the early days I had a car with an infrared control, [03:14.900 --> 03:21.480] and I found that I could record the door lock and unlock codes on my Palm Pilot and play them back. [03:21.480 --> 03:23.020] And I thought that was pretty neat. [03:23.640 --> 03:28.240] And then I got a new car, still had an infrared control, but this stopped working. [03:28.240 --> 03:30.220] I could do it once, and then it stopped. [03:30.760 --> 03:32.800] And I wanted to understand why. [03:32.800 --> 03:39.640] So I started looking at the tools to do it, and I started developing an application [03:39.640 --> 03:44.940] to try and analyze what was going on with the signal and why I was having that issue. [03:45.920 --> 03:51.100] So, which I called the Project Murder, which was the usual sort of hacker horrible pun. [03:51.100 --> 03:54.680] So I'm using IRDA and I put my initials on the front, I get murder. [03:55.680 --> 04:03.540] And I got to a point on FreeBSD where I was actually able to read the codes, but I hadn't yet started to write them back. [04:03.920 --> 04:05.580] And then I discovered Lurk. [04:05.580 --> 04:13.940] And because of Lurk, I overcame my BSD bigotry and installed Linux on my box, and I've been using that ever since. [04:15.620 --> 04:17.340] So why bother with IR? [04:18.080 --> 04:23.140] Well, IR is very unlikely to be replaced, at least in the foreseeable future. [04:23.480 --> 04:26.240] It's a very good technology, it's very fit for use. [04:26.620 --> 04:29.300] It's cheap, you know, the components exist. [04:29.800 --> 04:31.300] It's very simple. [04:32.160 --> 04:35.960] When I say it's fit for use, I mean things like TV, you know, it's absolutely perfect. [04:35.960 --> 04:40.160] You can point it in a completely random direction, it will still bounce off the walls and hit the TV. [04:40.220 --> 04:44.120] And it's not going to change the channel in the hotel room next door to you. [04:44.200 --> 04:50.900] You start looking at putting things like Bluetooth in controls, and you've then got issues of leakage into other environments. [04:50.900 --> 04:56.240] So, infrared is actually a very good tool for the job it does. [04:56.240 --> 05:01.560] From a technical point of view, why should I waste my time fiddling with this stuff? [05:01.560 --> 05:05.120] Well, as a security professional, I think it's good. [05:05.120 --> 05:11.340] You know, you have to develop a mindset that looks around you for security issues all the time. [05:11.680 --> 05:17.400] When I move into a house, a new house or an apartment or whatever, or I get a new car, [05:17.400 --> 05:20.900] for the next few weeks, I will try and break into it. [05:20.900 --> 05:24.900] I will see how many ways I can get back into my house without actually using the door key, [05:24.900 --> 05:27.760] or going up to the alarm and doing what I'm supposed to do on the alarm. [05:28.220 --> 05:33.600] And it's just habit, you know, it's using that mindset or developing that mindset [05:33.600 --> 05:36.440] where you're looking for security problems all the time. [05:38.960 --> 05:42.140] And infrared, you know, you're sitting in a hotel room, there's nothing to do. [05:42.480 --> 05:44.400] There's your infrared control, there's the TV. [05:44.820 --> 05:46.920] The hotel's quite an interesting place. [05:47.240 --> 05:50.440] They're trying to sell me stuff, but they don't actually want to have staff to do it, [05:50.440 --> 05:51.920] so they rely on technology. [05:52.620 --> 05:55.440] If you think about last time you checked into a hotel, [05:56.040 --> 06:00.800] you probably interacted with one person right at the beginning when you checked in. [06:01.500 --> 06:06.380] And for the rest of your stay in that hotel, you were using automated systems. [06:07.020 --> 06:10.440] And that's apart from the catering staff, but just, you know, you're in a big hotel, [06:10.440 --> 06:12.060] you're sleeping in the bedroom and so on. [06:12.520 --> 06:14.520] But meantime, they're still trying to sell you stuff. [06:14.520 --> 06:17.160] They've got pay TV, they've got mini bars, [06:17.160 --> 06:19.900] they've got all this stuff where they're delivering a service [06:19.900 --> 06:21.960] without actually having any staff to do it. [06:21.960 --> 06:24.100] They're relying on technology to do that. [06:24.440 --> 06:27.380] There will be security problems with technology, [06:27.380 --> 06:32.220] and those problems will have direct parallels in the internet networking world [06:32.220 --> 06:34.940] and, you know, within the systems themselves [06:34.940 --> 06:37.500] that some of you may be involved in actually deploying. [06:38.200 --> 06:42.080] And it's fun. At the end of the day, as you'll see, it's quite fun. [06:43.360 --> 06:49.780] So it turns out that infrared really is the ultimate in security by obscurity. [06:50.760 --> 06:53.540] You've got really simple codes. [06:53.540 --> 06:55.200] Because they're sent, you can't see them. [06:55.200 --> 06:57.380] No one can see what's actually going on. [06:57.760 --> 07:01.220] They don't bother engineering any kind of security into it. [07:02.060 --> 07:05.980] If you know the right code to send, you have total control of the box. [07:05.980 --> 07:09.460] That is it. You know, I am God. Bang. [07:09.760 --> 07:11.880] I now control the box. I can do anything I want. [07:11.880 --> 07:14.900] There's no two-way authentication. There's no further pin numbers. [07:14.900 --> 07:15.920] There's nothing. [07:16.920 --> 07:20.700] They also tend to use what I term an inversive security model, [07:20.700 --> 07:25.200] where the actual control of what you're allowed to do is at the wrong end. [07:25.200 --> 07:26.920] It's in the hostile environment. [07:26.980 --> 07:29.200] It's in the environment that I control. [07:29.780 --> 07:32.600] And we'll look at that in more detail. [07:35.510 --> 07:38.810] Okay, so the simplest attack is the one I described with my car, [07:38.810 --> 07:41.330] where I could just record the code and replay it. [07:42.290 --> 07:47.430] And that also applies to garage doors, so garage door openers. [07:47.430 --> 07:52.170] I think you mostly use RF over here, but in the UK and some parts of Europe, [07:52.170 --> 07:54.810] infrared controls are still very popular. [07:55.690 --> 08:02.970] There's also little robot toys, TVs, the TVs in bars and clubs and things. [08:03.830 --> 08:06.950] And if you can record a code or you know the code, [08:06.950 --> 08:10.730] then you can affect those publicly visible devices. [08:11.450 --> 08:13.930] And if you can get a hold of special controls [08:13.930 --> 08:17.950] that do extra things on those devices, you can simply clone them. [08:17.950 --> 08:20.470] And then you have the code, and you replay it, [08:20.470 --> 08:22.450] and you can do the special thing. [08:25.680 --> 08:28.020] And the kind of tools you can use to do it, [08:28.020 --> 08:34.120] Casio produced some nice little infrared watches back in the 80s, I think. [08:34.980 --> 08:38.640] Apple Newton was one of the first handheld manufacturers [08:38.640 --> 08:41.640] to actually have built-in IR that had this capability. [08:42.160 --> 08:45.540] And now you have tools like Omni Remote, [08:45.540 --> 08:50.260] which runs on any Palm-based operating system that has an infrared control. [08:51.180 --> 08:54.200] It's a very neat system. You can get it from Pacific Neotech. [08:54.200 --> 08:56.760] There's the URL, download that. [08:57.700 --> 09:01.680] Philips Pronto is used in a lot of those big home automation systems. [09:01.680 --> 09:05.220] So you have a control, and you completely program what the buttons look like, [09:05.220 --> 09:07.900] what command they send, and so on. [09:08.100 --> 09:11.300] And again, there's a lot of website resource behind that. [09:11.300 --> 09:15.320] You can download existing codes for different systems, and so on. [09:18.570 --> 09:21.930] So here's our first example, RoboSapien. [09:22.970 --> 09:25.870] Last year, there was a guy here at DEF CON walking around. [09:25.870 --> 09:27.410] He'd obviously bought one of these toys, [09:27.410 --> 09:29.390] and he was walking it around, up and down the queues. [09:29.390 --> 09:31.010] Anyone remember seeing him? [09:31.770 --> 09:32.370] Yeah. [09:32.530 --> 09:35.870] So he was walking up and down, trying to get someone to buy it. [09:38.340 --> 09:40.140] So I sat down behind him, [09:40.140 --> 09:43.180] and started recording the commands he was sending. [09:45.600 --> 09:47.360] So he would walk it up the aisle, [09:47.820 --> 09:50.620] and I would turn it around and walk it away from the aisle. [09:51.400 --> 09:53.880] And he would turn it back and walk it back up the aisle, [09:53.880 --> 09:55.940] and I would turn it away and make it shrug its shoulders, [09:55.940 --> 09:58.380] or make a rude farting noise, or something. [09:58.820 --> 10:02.060] So basically, I was able to then... [10:02.620 --> 10:03.580] tag it. [10:09.480 --> 10:12.500] So this is a guy at work. He owns the black car. [10:12.920 --> 10:14.700] A friend of mine owns the green car. [10:15.200 --> 10:18.240] So I put my system in the back of the green car, [10:18.240 --> 10:20.320] one day when he was leaving, [10:20.320 --> 10:24.540] and the next morning, when he arrived. [10:25.360 --> 10:27.820] And then that evening, when he went to go, [10:27.820 --> 10:30.520] he walked up to his car, and he unlocked it. [10:30.560 --> 10:31.920] And I locked it. [10:33.520 --> 10:34.840] He unlocked it. [10:35.120 --> 10:36.560] And I locked it. [10:37.640 --> 10:38.940] And he unlocked it. [10:38.940 --> 10:40.020] And I locked it. [10:40.400 --> 10:42.020] And that went on for a few minutes. [10:42.100 --> 10:43.760] And then he started walking back to the office [10:43.760 --> 10:45.460] to try and, you know, make a phone call, [10:45.460 --> 10:47.860] do whatever he had to do to sort his life out. [10:47.860 --> 10:49.440] And I unlocked it for him. [10:50.280 --> 10:51.840] Because I'm a nice guy, really. [10:53.200 --> 10:54.240] So that was... [10:54.240 --> 10:55.680] That's one of the older systems, [10:55.680 --> 10:57.840] that obviously didn't tackle this problem, [10:57.840 --> 10:59.940] that, you know, why can't I do that to my car? [10:59.940 --> 11:00.460] I don't know. [11:00.460 --> 11:02.900] But his, I could just replay as often as I like. [11:04.640 --> 11:05.980] I couldn't actually steal his car, [11:05.980 --> 11:07.780] because it turns out he has an RF as well, [11:07.780 --> 11:09.440] which disables the engine. [11:13.220 --> 11:14.900] Okay, so that's a replay attack. [11:14.900 --> 11:15.940] Very simple attack. [11:15.940 --> 11:17.800] You have to have access to the source [11:18.380 --> 11:21.540] to see the original signal and replay it. [11:22.360 --> 11:24.200] But what if you don't know [11:24.200 --> 11:25.980] what the original signal looks like, [11:25.980 --> 11:28.940] or what the exact code is for that device? [11:28.940 --> 11:30.780] You can go and buy a similar one, [11:30.780 --> 11:33.840] but you don't know the code for the man next door. [11:33.840 --> 11:36.200] So I've got the same garage door opener as he has. [11:38.440 --> 11:40.980] Well, as I say, I found this tool, Lurk, [11:40.980 --> 11:43.080] which you can download. [11:43.080 --> 11:46.940] It's the Linux Infrared Control project. [11:47.420 --> 11:49.040] It has some visualization tools, [11:49.040 --> 11:50.420] which I find very useful. [11:50.420 --> 11:52.700] You can send an infrared signal into it [11:52.700 --> 11:54.840] and actually visualize what's going on. [11:55.640 --> 11:58.600] It auto-learns, so you just point a remote at it [11:58.600 --> 12:01.100] and it will learn all the tricky stuff for you. [12:01.100 --> 12:02.780] You don't have to do any thinking. [12:03.740 --> 12:07.760] And it produces an ASCII human-readable config file, [12:07.760 --> 12:09.500] which is very important, because that means [12:09.500 --> 12:11.820] you can look at it, you can read it, [12:11.820 --> 12:13.460] you can understand it, and more importantly, [12:13.460 --> 12:16.520] you can change it, which is what we're going to do. [12:17.840 --> 12:18.840] It's software-only. [12:18.840 --> 12:21.120] It will work with my infrared on my laptop. [12:21.680 --> 12:23.060] It only runs on Linux. [12:24.660 --> 12:27.300] Alternatively, you can buy an external device, [12:27.300 --> 12:28.840] which is a USB dongle. [12:29.240 --> 12:31.900] It's available from irtrans.de. [12:33.220 --> 12:35.340] It's a much more powerful transmitter, [12:35.340 --> 12:37.720] so you can do stuff from further away. [12:38.360 --> 12:39.740] And it solves a bunch of issues. [12:39.740 --> 12:43.880] The way LERP works is it plays with serial protocols. [12:44.740 --> 12:48.040] What irtrans does is it actually runs in native mode, [12:48.040 --> 12:51.360] so it knows how to send native infrared commands. [12:51.860 --> 12:53.320] And that will run on Linux [12:53.320 --> 12:57.900] or that other funny virus operating system. [13:00.180 --> 13:01.420] This is what it looks like. [13:01.420 --> 13:03.180] It's just a little USB dongle. [13:04.500 --> 13:06.420] Okay, so for my first example, [13:06.420 --> 13:08.980] I took my garage door opener [13:08.980 --> 13:14.840] and popped it open and found there's this dip switch. [13:15.800 --> 13:18.280] And the dip switch has eight positions, [13:18.840 --> 13:22.120] so therefore there are 256 possible codes. [13:22.780 --> 13:25.180] So what I could do to get into my neighbor's garage [13:25.180 --> 13:27.500] is try every one of them, [13:27.500 --> 13:29.500] but that would be fairly dull. [13:31.260 --> 13:33.760] I had a look with a piece of software [13:33.760 --> 13:36.540] that comes with LERP called XMODE2. [13:37.900 --> 13:42.700] Now what XMODE2 does is you point the control at it, [13:42.700 --> 13:44.660] hit a command, [13:45.420 --> 13:49.620] and it will draw for you the signal that it sees. [13:49.620 --> 13:52.020] So there's a carrier signal, which it then modulates, [13:52.020 --> 13:55.940] and you get to see if it's a long pause or a short one. [13:56.700 --> 13:59.180] So if I switch all of the eight switches on, [13:59.180 --> 14:00.180] I get this. [14:00.180 --> 14:02.140] If I switch them off, I get that. [14:02.700 --> 14:06.320] If I switch number eight on, this one pops up. [14:06.540 --> 14:07.800] Number one, that one. [14:07.800 --> 14:09.880] So I can see where the pattern starts and ends. [14:09.880 --> 14:12.900] It's obviously just a very simple one-to-one relationship [14:12.900 --> 14:15.140] between the switch and the pulses. [14:15.740 --> 14:18.140] So I concluded that I have a start bit, [14:18.140 --> 14:20.540] eight data bits, and four stop bits. [14:24.730 --> 14:31.050] So now I train LERP how to just duplicate a code [14:31.050 --> 14:32.870] or a couple of codes. [14:32.870 --> 14:35.330] In this case, I would only need one. [14:35.770 --> 14:39.490] Because what I'm looking for is to see how that code is represented. [14:39.910 --> 14:44.230] So LERP, basically, this stuff is to do with timings and carrier frequencies. [14:44.930 --> 14:47.830] This is the actual code that's being sent. [14:48.210 --> 14:52.870] So for a particular switch position, it will give me a particular hex value. [14:53.930 --> 14:56.390] So I know the hex for one command. [14:57.370 --> 14:59.830] So it's not that hard, then, to write a little script [14:59.830 --> 15:03.010] that produces the hex for every possible command. [15:03.450 --> 15:04.790] Which I do. [15:06.050 --> 15:11.010] And then I write another little script that spits out each command. [15:11.010 --> 15:18.650] And it took 54 seconds to send all 256 possible codes to my garage door. [15:19.930 --> 15:22.290] So here I am, down in the garage. [15:22.290 --> 15:26.070] I'll stick the laptop down, fire it up. [15:26.790 --> 15:29.690] A few seconds later, bingo, door opens. [15:30.870 --> 15:36.950] Now what was surprising here was I knew the code was actually quite far up in the range. [15:36.950 --> 15:40.390] I thought it was going to take 45, 50 seconds to go. [15:40.750 --> 15:44.270] What actually happened is it went within about the first five seconds. [15:44.850 --> 15:48.690] So I thought, okay, well, maybe there's a factory backdoor in here. [15:48.690 --> 15:51.990] The manufacturers have actually got a code that just always works. [15:51.990 --> 15:54.110] And that's the only code I'm going to have to send. [15:55.030 --> 16:00.370] Actually, it turned out that what had happened is the building management had run out of controls. [16:00.370 --> 16:03.350] And they'd gone back to the company that sold the original system. [16:03.390 --> 16:06.350] And they'd said, we need more remotes. [16:06.370 --> 16:08.470] The company said, oh, that company's gone bust. [16:08.470 --> 16:11.150] We can't sell you any. You'll have to buy a new system. [16:11.230 --> 16:14.950] So they engineered into the system a second reader. [16:14.950 --> 16:16.670] So we have two readers here. [16:17.130 --> 16:21.030] So this reader, which is 100% compatible with that reader, [16:21.030 --> 16:27.450] has been engineered in so that another bunch of remotes can send 100% compatible codes and open my door. [16:28.090 --> 16:31.530] So, stupidity. They didn't bother to actually check. [16:31.530 --> 16:34.950] Or maybe they just set the switches wrong and they couldn't get the thing to work, but whatever. [16:34.950 --> 16:38.170] They wasted a lot of time and money putting that system in. [16:39.610 --> 16:42.210] You'll notice there's a security camera here. [16:43.270 --> 16:49.270] So while I was doing all this and fiddling around and opening garage doors without keys, [16:49.270 --> 16:53.110] presumably someone was recording that video and watching me. [16:53.110 --> 16:56.630] So I got a visit the next morning from security. [16:56.950 --> 16:58.750] No, of course not. [16:58.750 --> 17:02.930] If you have security, at least pay attention to it, guys. [17:05.700 --> 17:08.140] Okay, so hotel TVs. [17:09.640 --> 17:15.480] I thought, if I can do this to a garage door, maybe I can do it to a TV system. [17:15.480 --> 17:22.060] So I need a TV system that actually does more than simply changes channels. [17:22.440 --> 17:25.740] So I had a look at a hotel TV system. [17:26.720 --> 17:31.100] And this is one of the examples where I say we were running an inverted security model. [17:31.780 --> 17:35.940] The TV is controlling which content I get to see. [17:35.940 --> 17:43.100] The hotel in most cases is streaming content, basically all the content without any control. [17:43.100 --> 17:45.400] The TV itself filters the content. [17:47.460 --> 17:53.640] When you actually select a channel to look at that content, there's no further authentication required. [17:53.640 --> 17:58.640] If I can persuade the TV to go and look at a channel I'm not supposed to be looking at, that's it. [17:58.640 --> 18:00.760] I just send it the command and I can have it. [18:01.320 --> 18:06.800] The content itself isn't wrapped in any kind of encryption, unlike satellite TV, [18:06.800 --> 18:11.260] where they expect you to be able to receive it even though you're not a subscriber, [18:11.260 --> 18:13.840] because it's a closed system. They don't need to. [18:13.940 --> 18:17.240] It's entirely within their own building. It's their own backbone. [18:17.660 --> 18:24.000] They control who gets to see what on that system, or so they think. [18:26.680 --> 18:31.780] Okay, so if the system's broadcasting stuff, presumably you can just plug in another TV, [18:31.780 --> 18:35.640] tune yourself in, and watch whatever you want on any channel. [18:35.640 --> 18:38.900] But humping a TV around is a pain in the ass. [18:39.520 --> 18:43.280] Instead of that, we have these little USB dongle thingies. [18:45.920 --> 18:49.700] So I plug this one in. This is in line with the back end. [18:50.740 --> 18:56.100] And on the master TV, I'm getting the content they expect me to see, the master menu. [18:56.460 --> 19:01.000] On this one, I've got another channel, because I've tuned to another channel. [19:01.940 --> 19:07.380] And if I flick through the channels, I find there's various other bits of content. [19:07.380 --> 19:10.220] This is all just system messages. [19:14.840 --> 19:18.200] Occasionally, I came across these strange screens, [19:18.200 --> 19:21.540] where they were seemingly putting up an advert for something. [19:21.900 --> 19:23.640] Which is an advert no one's ever going to see, [19:23.640 --> 19:26.300] because none of the official channels actually look at this. [19:28.000 --> 19:31.000] But what was most interesting on there is there's a URL. [19:31.000 --> 19:32.920] This is the company that makes the thing. [19:33.460 --> 19:37.560] If I go to that URL, there's a load of technical documentation. [19:37.560 --> 19:41.700] So there's PDFs. It tells me how the systems work. [19:41.880 --> 19:45.380] What else I might be looking for when I start looking at these things. [19:45.560 --> 19:49.680] What new features they're putting in. Which hotels they've put them in. [19:50.000 --> 19:53.940] So you spot a feature you're interested in, you can just go and look at their client list. [19:53.940 --> 19:57.680] Say, oh yeah, they're testing that over here. Let's go and stay there for a night. [19:58.960 --> 20:03.380] Some of the things they're thinking of putting in are truly scary. [20:04.000 --> 20:05.800] Webcam in your bedroom. [20:05.800 --> 20:10.480] Now, why would anyone want... oh no, okay, don't answer that. [20:11.820 --> 20:13.140] I think I know. [20:18.220 --> 20:21.080] And of course, they're broadcasting premium content. [20:21.420 --> 20:24.680] So this is a pay movie that I'm supposed to have paid for to watch. [20:25.580 --> 20:28.540] Which I can watch on my tiddly little screen here. [20:29.700 --> 20:34.160] Or I can root it back out and into the SCART and watch it on the TV. [20:38.220 --> 20:42.000] Okay, that's fine, but that's just looking at the back-end content. [20:42.000 --> 20:44.040] We haven't actually got control of the system. [20:44.040 --> 20:48.780] But we've proved the concept that there is stuff on the back-end which we can get to. [20:49.680 --> 20:52.920] So I started looking at the actual remote controls. [20:52.920 --> 20:58.520] Can I do the same trick that I did brute-forcing my garage door to the TV remote? [20:59.400 --> 21:02.000] What I found is the codes are much more complex. [21:02.000 --> 21:04.060] They're much bigger. They have more bits. [21:04.520 --> 21:09.720] And the reason they do that is because they group them. [21:09.720 --> 21:12.240] You have manufacturer collision avoidance. [21:12.240 --> 21:15.500] So you have multiple remotes in the same environment. [21:15.500 --> 21:18.000] You don't want them interfering with each other's devices. [21:18.320 --> 21:22.300] So you have a preamble that says, I'm a Sony or I'm a JVC or whatever. [21:23.500 --> 21:27.800] You may have a remote that controls the TV and the video from the same manufacturer. [21:27.800 --> 21:29.580] So you have different groups for that. [21:30.560 --> 21:33.440] And you have standard groups versus extra groups. [21:33.440 --> 21:38.120] So Philips may make a TV that they sell to hotels and to home. [21:38.120 --> 21:41.840] And you have different sets of controls for the different environments. [21:43.160 --> 21:46.280] There's also this interesting group here. [21:46.480 --> 21:47.760] The hidden group. [21:48.320 --> 21:50.020] This is what we're looking for. [21:52.040 --> 21:54.220] So this is what they look like. [21:55.220 --> 21:58.060] As you can see, it's a much longer code. [21:58.420 --> 22:02.300] It's much harder to emulate or guess. [22:02.300 --> 22:09.040] In fact, when I looked at it, it turned out to be a 14-bit code in this particular case. [22:10.200 --> 22:17.340] Now unlike a garage door, when I test these codes, I need to watch. [22:17.340 --> 22:18.920] I need to actually pay attention. [22:18.920 --> 22:22.340] Because something will happen and then 10 seconds later, [22:23.000 --> 22:26.400] I could send another command that cancels that and does something else. [22:26.400 --> 22:31.260] So unless I'm actually watching each command as it plays out, I may miss the event. [22:31.260 --> 22:34.620] So garage door, I can just leave it running, wait for it to pop. [22:34.620 --> 22:36.800] This, I actually have to spend time on it. [22:38.040 --> 22:44.240] And it turns out I need to take about two seconds per code to have time to react and watch [22:44.240 --> 22:49.060] and let the code settle down, not be interfered by the next one. [22:49.860 --> 22:52.880] Which would be nine hours to test the whole system. [22:53.180 --> 22:58.340] And I found that out the hard way because one night in Amsterdam after a conference, [22:58.340 --> 23:00.680] back in my hotel room, and I'm playing with this stuff. [23:00.680 --> 23:03.020] This was in the early days when I was just figuring it out. [23:03.300 --> 23:05.560] Next thing I know, it's five hours later. [23:05.700 --> 23:07.160] It's one o'clock at night. [23:07.280 --> 23:12.160] I've just spent the only night in Amsterdam playing with hotel-dam TVs. [23:13.640 --> 23:15.380] Coffee shops are closed. [23:15.760 --> 23:18.080] And I really fancied a cup of coffee. [23:20.640 --> 23:23.020] So I thought, now I have to fix this. [23:23.020 --> 23:26.360] I need to reduce the time it takes to do this stuff. [23:27.080 --> 23:30.140] So I tried to find a way to reduce the search space. [23:31.760 --> 23:36.520] So basically that meant looking at what bits are being used in the codes. [23:36.640 --> 23:40.540] So if I take each of the codes in turn, 0 to 9, [23:40.540 --> 23:49.140] and I look at which bits have actually been either set to 1 or toggled from 0 to 1 or 1 to 0, [23:49.140 --> 23:51.480] I work my way through them all. [23:53.480 --> 23:58.960] Basically just try each one, organize them in such a way that I can see what's going on. [23:59.660 --> 24:02.480] Finally get to the end, and I'm down to... [24:08.020 --> 24:09.460] Yeah, sorry. [24:09.900 --> 24:11.620] First two bits are used. [24:11.660 --> 24:14.260] I've got four bits I've never seen change here. [24:14.940 --> 24:18.040] And the last eight bits is the actual code. [24:19.420 --> 24:21.420] So I want to reduce that further. [24:21.420 --> 24:23.140] That's not enough of a result. [24:23.140 --> 24:27.380] So what I do is I take a single command, doesn't matter what command it is, [24:27.380 --> 24:29.740] in this case I took the power command, [24:29.740 --> 24:31.840] and I start toggling bits. [24:32.500 --> 24:37.140] So if I toggle the first bit of the power command from 1 to 0, [24:37.800 --> 24:41.140] and I send the command again, and the command succeeds, [24:41.880 --> 24:45.560] then I can assume that bit is not actually used, it's ignored. [24:46.040 --> 24:49.620] In this case the command fails, so I know that bit's important. [24:50.600 --> 24:54.060] This one worked, so that bit's ignored. [24:54.440 --> 24:58.480] And in fact, all three, those three were ignored, that one failed. [24:58.520 --> 25:02.740] So I now know I've got a total of ten bits I have to care about. [25:03.260 --> 25:06.180] Which gives me a thousand codes, which is about half an hour. [25:06.200 --> 25:07.420] So I can live with that. [25:10.640 --> 25:14.340] So I spit out a bunch of configs which have all the possible codes. [25:14.600 --> 25:18.760] In this case I did them as four groups because I couldn't... [25:18.760 --> 25:22.600] I really couldn't figure out how to do 14-bit bitfields in Perl. [25:22.600 --> 25:26.380] So I did four sets of 8-bit bitfields with a lead in. [25:27.740 --> 25:31.660] And then I spit those out, and I run those, and I watch what happens. [25:33.520 --> 25:37.260] And sure enough, I find a load of really interesting stuff. [25:39.020 --> 25:40.640] This one in particular. [25:42.940 --> 25:44.440] This is the God code. [25:44.440 --> 25:47.760] Bingo, it's a game in England. Bingo, I've won. [25:56.530 --> 25:59.310] Okay, so the kind of things you do with hidden codes. [26:01.150 --> 26:04.990] The internal, the housekeeping staff use them for daily things [26:04.990 --> 26:07.950] like setting what they've done to the minibar. [26:08.210 --> 26:11.530] If they've cleaned the room, they'll set a status report [26:11.530 --> 26:15.090] so they don't have to fill in forms and report at the end of the day. [26:15.090 --> 26:19.150] The hotel actually has real-time information as to what room's in what state. [26:20.150 --> 26:22.710] You've then got some one-off tasks that the engineers use [26:22.710 --> 26:25.930] if they're having problems with the TV or they're first setting it up. [26:26.350 --> 26:28.450] And some debugging information. [26:31.200 --> 26:32.900] Okay, so one of the first things you can do [26:32.900 --> 26:35.740] is you can start to reconfigure the TV. [26:36.180 --> 26:38.020] You can change the messages. [26:38.900 --> 26:40.880] So when the TV gets switched on, [26:40.880 --> 26:44.220] comes up with a welcome message or a channel message, [26:44.220 --> 26:47.020] you can assign the TV to another room. [26:47.700 --> 26:52.420] You can assign channels that are now free that used to be paid channels. [26:52.580 --> 26:57.120] And you can find channels that just simply don't exist on a normal TV. [26:58.060 --> 26:59.840] So here's an example. [27:00.340 --> 27:05.380] First thing any good hacker does is tag his TV. [27:08.560 --> 27:12.420] So now when you switch the TV on this room, that's what comes up. [27:13.560 --> 27:17.080] And if you can find it, I'll give you some really cool prize. [27:17.080 --> 27:18.680] Some bit of Defcon swag. [27:21.140 --> 27:22.620] Same thing in Amsterdam. [27:26.040 --> 27:30.020] Or you can change a big banner that comes up when you turn the TV on. [27:34.740 --> 27:37.080] So this is not only owned, but it's really owned. [27:37.080 --> 27:39.360] I've locked it, no one else is going to use it. [27:41.220 --> 27:43.540] Actually, I unlocked it before I left, of course. [27:44.220 --> 27:45.260] Just testing. [27:45.260 --> 27:48.280] This is for security, you know, for research purposes only. [27:48.280 --> 27:50.260] Don't go home and abuse this stuff. [27:50.260 --> 27:51.460] Kids. [27:54.470 --> 27:59.150] And I try and, you know, tip the hat to conferences I go to. [28:07.060 --> 28:11.280] Okay, so one of the other things you can do is change the filtering on the TV. [28:11.680 --> 28:14.300] Most broadcasters these days, [28:14.300 --> 28:19.900] they actually send a signal to say what the certificate of the film is that they're sending. [28:20.980 --> 28:24.960] And so responsible hotels, if you check in with children, [28:24.960 --> 28:28.820] they'll put filtering on the TV so that you don't get inappropriate content. [28:29.300 --> 28:32.460] So if you're a sensitive character like me, [28:32.460 --> 28:35.840] and you walk into an environment like this, [28:35.840 --> 28:39.340] and everything's just coming through, they're not filtering anything, [28:39.740 --> 28:43.780] then you may want to take the matter into your own hands and deal with it. [28:55.410 --> 28:58.110] So now only the good stuff comes into my room. [28:59.090 --> 29:01.330] None of that sports news crap. [29:04.590 --> 29:08.310] You can also just start to look for these invisible channels, [29:08.310 --> 29:11.730] back-end systems that may be leaking information. [29:13.350 --> 29:16.210] So, fairly simple test signal. [29:16.210 --> 29:18.830] They obviously use that for just tuning the TV in. [29:19.290 --> 29:22.670] Actually, it's more interesting that these numbers, [29:22.670 --> 29:26.330] they usually are something other than zeros. [29:26.910 --> 29:30.570] And there seems to be some strange correlation with them becoming zeros [29:30.570 --> 29:33.850] and the minibar billing stopping to happen. [29:35.830 --> 29:38.050] I have no idea why that would be. [29:41.980 --> 29:44.220] You get some debugging information. [29:44.220 --> 29:46.580] Again, there's some weird numbers that I don't know what they are, [29:46.580 --> 29:49.680] but it says code, so that's got to be interesting, right? [29:51.020 --> 29:53.880] I think most of it's signal strength, things like that. [29:56.000 --> 29:59.060] Occasionally, I'll even interrupt a good movie to do this stuff. [29:59.060 --> 30:08.670] Sometimes you find stuff that really is quite interesting. [30:08.670 --> 30:09.570] It shouldn't be there. [30:09.570 --> 30:12.170] I shouldn't be able to find information like this. [30:12.470 --> 30:16.090] I know I'm running some kind of DOS environment, [30:16.850 --> 30:19.110] and I've even got an IP address. [30:21.850 --> 30:24.810] So, there's obviously some kind of computer back there. [30:25.070 --> 30:26.710] Maybe I can talk to it. [30:29.730 --> 30:31.850] Maybe I don't want to talk to it. [30:45.090 --> 30:46.050] Strange. [30:46.770 --> 30:48.910] We've got a web server back there, too. [30:50.170 --> 30:51.670] That looks fairly harmless. [30:51.670 --> 30:54.410] So, I've got an object not found page. Big deal. [30:55.950 --> 30:58.470] Actually, see how my mouse moves? [30:59.370 --> 31:02.930] Turns out the up, down, left, right buttons did the same thing to this one. [31:06.880 --> 31:08.500] So, I poke around a bit. [31:09.580 --> 31:12.740] I get another not found page, but it gives me a nice helpful message. [31:12.740 --> 31:15.320] Actually, this pops up a bit after that first page. [31:15.320 --> 31:18.060] So, it gives me a link. So, I click on it. [31:18.900 --> 31:20.340] Gives me another link. [31:21.660 --> 31:25.520] Microsoft helpfully suggests, if I'm not getting what I want from this system, [31:25.520 --> 31:29.300] perhaps I should go to the home page, the system that served it. [31:29.720 --> 31:32.020] There's my IP address, which is a link. [31:33.020 --> 31:34.440] And it sends me here. [31:49.220 --> 31:52.900] What is that doing on the back end system on a TV? [31:54.100 --> 31:55.220] No idea. [31:55.220 --> 31:59.400] And I resisted picking up the keyboard and playing with it, obviously. [31:59.780 --> 32:01.800] Nothing further to see here. Move along. [32:06.540 --> 32:07.260] Oops! [32:11.720 --> 32:13.500] Who left that lying around? [32:16.190 --> 32:19.090] So, yeah, I can move around. I can click on icons. [32:19.090 --> 32:21.250] And when I click on them, things pop up. [32:22.150 --> 32:24.310] And they kind of do things. [32:25.210 --> 32:26.550] And they launch. [32:29.150 --> 32:32.930] So, I thought I'd be, you know, I found this stuff, I'd be friendly and helpful. [32:32.930 --> 32:35.590] Do a bit of tidying up while I'm here. [32:40.130 --> 32:42.510] They hadn't defragged for ages. [32:46.250 --> 32:47.930] Didn't like the color scheme. [32:55.810 --> 32:58.330] This is a CD that was in the CD drive. [33:01.200 --> 33:03.640] And I just love this comment here. [33:10.330 --> 33:12.970] So, any copyright enforcement officers in the building? [33:17.820 --> 33:19.820] Okay, so what else could we do? [33:20.300 --> 33:23.400] We could change the status of things in our room. [33:25.020 --> 33:25.940] Minibar. [33:27.080 --> 33:29.020] Oh dear, we're all zeros. [33:32.730 --> 33:35.430] Now, you might not want the hotel staff coming in [33:35.430 --> 33:37.590] and finding all these empty bottles all over the floor. [33:37.590 --> 33:40.490] So, you can DOS your room by setting it to clean. [33:42.810 --> 33:44.490] They'll never bother you again. [33:48.420 --> 33:50.480] I've even found things which [33:50.480 --> 33:52.880] the vendor who built the system [33:52.880 --> 33:56.880] obviously put that in, but the hotel hadn't paid for the full package. [33:56.880 --> 33:59.860] So, for example, on this system [33:59.860 --> 34:02.280] we can watch movies, [34:02.280 --> 34:04.480] we can play with a PlayStation, [34:04.480 --> 34:08.080] we can look at some hotel information, whatever, and that's it. [34:09.340 --> 34:11.280] But in the background there, [34:11.280 --> 34:13.020] there's an internet connection. [34:13.860 --> 34:16.480] This screen was not available by any other means. [34:16.480 --> 34:18.420] There was no way to officially get to it, [34:18.420 --> 34:20.720] but it was a fully functional internet connection. [34:20.720 --> 34:22.520] So, it was hooked up to their backend. [34:22.520 --> 34:26.580] It was using their internet connection, which they probably used for the hotel. [34:26.900 --> 34:29.620] And this was real content. If I clicked on those links, [34:29.620 --> 34:32.220] I could start digging down further [34:32.220 --> 34:35.260] and actually using Squeak's technique [34:35.260 --> 34:38.800] to then tweak HTTP URLs and things [34:38.800 --> 34:41.440] and basically find a way to get to a search engine, whatever, [34:41.440 --> 34:43.220] and then get out to the outside world. [34:46.120 --> 34:48.820] Sometimes you can actually control physical devices. [34:50.300 --> 34:51.900] This is a minibar. [34:52.420 --> 34:54.800] This is a red light that says it's locked. [34:55.060 --> 34:58.140] That's the beer I was going to have before this happened. [35:02.530 --> 35:06.270] So that was motivation to find the unlock code, obviously. [35:10.090 --> 35:12.390] We can see what other people are doing. [35:13.350 --> 35:14.290] And we can do that [35:15.350 --> 35:17.050] because you often see this message, [35:17.050 --> 35:19.410] you choose something, premium content, whatever, [35:19.410 --> 35:21.790] and it will say, please wait, we're assigning another channel. [35:22.290 --> 35:26.290] And so what they're doing is they're going to broadcast the content [35:26.290 --> 35:29.510] and then they're going to retune your TV to that channel, [35:29.510 --> 35:31.190] which only you can watch, obviously, [35:31.190 --> 35:33.530] because they control the TV, right? [35:34.790 --> 35:36.090] So do I. [35:37.810 --> 35:40.790] So this guy is obviously, he's watching a film, [35:40.790 --> 35:44.750] he's interested in mountain-dwelling women or something. [35:47.480 --> 35:48.820] It's harmless enough. [35:48.820 --> 35:50.320] Okay, he's watching a movie. [35:50.860 --> 35:53.100] But what if he's browsing the Internet? [35:54.640 --> 35:56.660] Then he goes to his webmail account [35:58.980 --> 36:00.860] and he reads his mail. [36:05.350 --> 36:07.610] And he replies to his mail. [36:09.490 --> 36:12.090] Maybe I should help him with his spelling or something. [36:16.470 --> 36:20.570] Okay, so I can also assign the TV to another room. [36:22.170 --> 36:24.910] One of the interesting things you can do [36:24.910 --> 36:27.490] on your TV in your room [36:28.650 --> 36:30.370] is look at your bill. [36:30.770 --> 36:32.930] So we choose account status. [36:33.490 --> 36:35.170] It looks up my name. [36:36.750 --> 36:38.210] And there's my bill. [36:38.210 --> 36:41.590] There's that strange round number appears again. [36:43.270 --> 36:45.410] So the reason it can show me my bill [36:45.410 --> 36:49.210] is because it knows that this TV is in my room. [36:49.270 --> 36:52.270] And it knows that because it has an address. [36:52.270 --> 36:55.390] In this case, it's A161. [36:56.390 --> 36:57.710] So if I change it [36:59.790 --> 37:01.730] and it's now A162 [37:03.990 --> 37:06.550] I'm looking at the bill of the guy next door. [37:08.790 --> 37:10.990] Wow, look at all those room charges. [37:11.410 --> 37:13.170] What the hell has he been doing? [37:14.550 --> 37:16.290] His minibar is probably empty. [37:16.290 --> 37:19.690] He's watched every pay-peak TV movie in the place. [37:19.690 --> 37:21.550] He's been having a wild time. [37:23.230 --> 37:25.350] I'm guessing when he goes down to check out [37:25.350 --> 37:27.070] there may be some discussion. [37:38.780 --> 37:41.880] And I'm a busy professional, he's probably a busy professional. [37:42.580 --> 37:44.680] I have a big heart, you can probably tell that. [37:44.680 --> 37:46.840] So I figure I'll help him out. [37:54.140 --> 37:55.960] And send him on his way. [38:08.680 --> 38:10.780] If I can do that for one room, [38:10.780 --> 38:12.380] I can do it for all of the rooms. [38:14.280 --> 38:16.200] So I have a little shell script. [38:16.340 --> 38:19.080] And I have a little tripod and a digital camera. [38:19.200 --> 38:22.080] And when I turn up in a hotel and I go to bed [38:22.080 --> 38:23.400] and I get up the next morning [38:24.820 --> 38:29.080] I have a little page like this. [38:30.400 --> 38:31.620] Yes, it was me. [38:31.620 --> 38:34.060] I did spend the night in Paris Hilton. [38:36.120 --> 38:36.960] Grow. [38:38.460 --> 38:41.360] So that page gives me a little thumbnail [38:41.360 --> 38:44.580] of every room in the hotel. [38:45.040 --> 38:47.460] Who's staying where, who's staying with who, [38:48.800 --> 38:51.680] where they've been calling, all kinds of stuff. [38:51.820 --> 38:53.520] Which rooms are empty, which are full [38:53.520 --> 38:55.060] because you get different messages. [38:56.600 --> 39:00.280] So by the time I'm done, I know the percentage occupancy of the hotel. [39:00.280 --> 39:02.700] I know who's there, who they're with, [39:02.700 --> 39:05.460] what they've been eating, drinking and viewing, where they've called [39:05.460 --> 39:07.260] and how long they've been there. [39:08.640 --> 39:10.380] It's pretty bad. [39:13.200 --> 39:14.680] Okay, now the good stuff. [39:14.680 --> 39:16.900] This is what you all really came for, right? [39:19.120 --> 39:20.560] Pay-per-view. [39:21.520 --> 39:26.020] So there seem to be two different kinds of TV pay-per-view. [39:26.280 --> 39:29.360] There's the ones that you actually choose a film [39:29.360 --> 39:31.060] and it gets played for you. [39:31.360 --> 39:33.940] And there's ones that just play in a cycle [39:33.940 --> 39:36.440] and when you choose the film you get tuned in. [39:37.700 --> 39:40.540] There's various different ways they control this stuff. [39:41.260 --> 39:43.720] One of them is they send a blocking signal. [39:45.500 --> 39:48.640] So in this case, we've been scanning, we found a channel, [39:48.640 --> 39:51.100] we've got the sort of cheesy 70s music, [39:51.100 --> 39:53.060] we think we've hit pay dirt, [39:54.500 --> 39:56.100] but it's being blocked. [39:56.500 --> 39:58.980] So I found a command that unblocks it. [40:00.280 --> 40:03.540] Just a boring old documentary from the 70s. [40:05.880 --> 40:07.900] Alternatively, you could just retune [40:07.900 --> 40:09.740] all the channels. [40:10.400 --> 40:13.720] So you don't have to search for individual ones. [40:14.740 --> 40:16.600] So we also program. [40:17.300 --> 40:19.640] I'm sorry, it's a bit blurry, this picture. [40:19.720 --> 40:21.980] Seems to be one of the sort of fundamental issues [40:22.380 --> 40:23.640] with this kind of research. [40:24.060 --> 40:27.200] It's just not possible to get a good picture one-handed. [40:30.920 --> 40:32.860] And there's that educational channel [40:32.860 --> 40:34.140] you've been looking for. [40:37.730 --> 40:40.910] And like any good hacker, you tag it for them. [40:50.260 --> 40:52.500] Now if all that seems like way too much trouble, [40:52.500 --> 40:54.840] they have this great feature called a Barker channel. [40:55.500 --> 40:58.520] Barker channel is what comes up [40:58.520 --> 41:00.480] when you first turn the TV on. [41:01.300 --> 41:06.940] Oh, it's changed. [41:11.290 --> 41:13.570] So that's infrared. [41:14.450 --> 41:16.650] Other things I've been looking at recently, [41:16.650 --> 41:19.110] back to the old car alarms, [41:19.110 --> 41:21.070] those central locking systems. [41:21.490 --> 41:23.590] They've started using RF. [41:23.690 --> 41:26.250] Garage door openers over here use RF. [41:26.310 --> 41:29.070] I think it's going to be a carrier change only. [41:29.890 --> 41:31.850] The codes will be the same. [41:31.850 --> 41:34.390] They're just using RF instead of infrared. [41:35.370 --> 41:37.310] Some interesting things with hotel safes [41:37.310 --> 41:40.790] while I was looking at hotels. [41:41.510 --> 41:43.270] We'll come to that in a second. [41:43.470 --> 41:45.490] Car alarms, I've already found that [41:46.830 --> 41:50.670] existing RF systems often have very simple reset codes. [41:51.850 --> 41:53.210] The reason they do that is [41:53.210 --> 41:56.230] so their engineers can unscrew a car [41:56.230 --> 41:58.010] if you get locked out of it. [41:58.650 --> 42:00.810] And I found this out because my wife phoned me. [42:00.810 --> 42:02.950] It was actually after DEF CON a few years ago. [42:03.290 --> 42:06.010] A few of us were sitting around, decompressing, having a beer. [42:06.010 --> 42:08.130] I get a call from my wife saying, [42:08.130 --> 42:09.730] oh, you won't guess what happened to me. [42:09.870 --> 42:12.570] I got locked out of the car in this really bad part of town [42:12.570 --> 42:14.670] with loads of shopping. It was getting dark. [42:14.890 --> 42:18.030] I had like three kids, not all mine, three kids with me. [42:19.170 --> 42:21.330] And I couldn't get in. I phoned the garage. [42:21.330 --> 42:24.690] They said, well, it's going to be two hours before we can get someone out to you. [42:25.430 --> 42:27.190] So she explained the situation. [42:27.930 --> 42:30.350] Single female in a bad place. [42:30.350 --> 42:33.270] They said, okay, we're not supposed to tell you this stuff, [42:34.210 --> 42:36.190] but this is what you do. [42:37.010 --> 42:39.670] So you can imagine my first question is, [42:39.670 --> 42:41.270] are you all right? No. [42:41.270 --> 42:44.630] My first question was, you did write down the code, right? [42:46.590 --> 42:49.490] And being a good hacker's wife, she said yes. [42:50.830 --> 42:53.750] And got a round of applause from the goons around me. [42:53.750 --> 42:56.370] So she gave me this code. [42:57.190 --> 42:59.070] A few weeks later I was driving with a friend [42:59.070 --> 43:02.510] and he's in a rental and we have to drop it off on a garage forecourt. [43:02.890 --> 43:06.590] And I noticed that he had the same remote as my wife's car. [43:07.330 --> 43:08.930] So I'm like, well, hang on a second. [43:08.930 --> 43:10.230] Let me just try something. [43:11.170 --> 43:12.390] Do the code. [43:13.190 --> 43:18.330] You don't want to know what 50 cars opening their doors at the same time sounds like. [43:26.560 --> 43:28.740] Especially when you're not supposed to have done it. [43:29.320 --> 43:31.600] By this time we were running down the road. [43:34.270 --> 43:36.050] Turns out that hotels, [43:36.050 --> 43:39.930] when you forget your PIN number that you put in, [43:39.930 --> 43:42.590] they come with, guess what, an infrared dongle. [43:43.370 --> 43:46.410] Don't have a hack for you for this one, but I'm looking into it. [43:47.850 --> 43:49.430] This is a great device. [43:49.430 --> 43:51.610] TV be gone. Who's played with these? [43:52.590 --> 43:53.670] Yeah, a few people. [43:53.670 --> 43:58.770] Very cool device. Press a button and it sends every known off signal. [43:59.170 --> 44:01.010] So press the button once and just wait. [44:01.010 --> 44:04.050] And the TV in the bar that's irritating the crap out of you [44:04.050 --> 44:07.910] because they're playing sports is going to go off. [44:08.570 --> 44:11.050] So I cracked one open and had a look. [44:11.050 --> 44:13.230] And it's a simple development chip. [44:13.330 --> 44:16.050] The guys who sell it sell a system [44:16.610 --> 44:19.970] where you can very rapidly develop applications that use it. [44:20.050 --> 44:22.650] So I thought I should come up with one of my own. [44:28.670 --> 44:30.850] You'll notice the happy smiling face here. [44:30.850 --> 44:33.210] I'll just flick between the channels for you. [44:36.820 --> 44:38.880] One button and it's owned. [44:38.880 --> 44:41.660] So I might work on that. [44:42.840 --> 44:44.980] That's it. Any questions? [44:47.420 --> 44:48.680] Yes, sir. [45:00.080 --> 45:02.780] I've seen some of the new modern systems [45:02.780 --> 45:05.880] and I haven't seen any better controls. [45:05.880 --> 45:09.700] The question was will modern systems fix this problem? [45:09.700 --> 45:12.640] The newer systems I've seen still have the exact same problems [45:12.640 --> 45:14.680] but it's actually worse. [45:14.680 --> 45:20.580] They're starting to do things like allowing you to put credit card details in through your TV. [45:20.580 --> 45:22.620] And as I said, webcams, stuff like that. [45:22.620 --> 45:26.820] So the potential for abuse is actually getting worse. [45:28.120 --> 45:28.980] Yes, sir. [45:35.140 --> 45:37.700] The question is have I played with street signs? [45:38.320 --> 45:41.060] The big screens in Vegas? [45:41.820 --> 45:44.600] It's very likely the very systems I'm talking to, [45:44.600 --> 45:46.040] the desktops I'm talking to, [45:46.040 --> 45:49.980] are probably on the same network as the systems that are controlling those signs. [45:50.340 --> 45:51.760] Just a thought. [45:51.760 --> 45:58.320] Yes, sir. [46:00.040 --> 46:01.600] Can I tell you what? [46:02.240 --> 46:04.360] Can I tell you what the codes are? [46:05.240 --> 46:07.200] I think you should work for that. [46:08.380 --> 46:10.800] I spent nine hours in a room in Amsterdam. [46:14.180 --> 46:16.660] Oh, for the car. [46:16.940 --> 46:18.280] It's actually very simple. [46:18.280 --> 46:21.440] All you did was take the battery out, [46:21.820 --> 46:25.800] press the unlock code ten times slowly, [46:25.800 --> 46:27.120] put the battery back in. [46:27.120 --> 46:30.720] I think that was just to discharge any capacitance that was in the system. [46:31.060 --> 46:35.740] And then again, press the unlock code ten times very slowly. [46:36.460 --> 46:38.860] And I think what's happening is it's saying to the car, [46:38.860 --> 46:42.380] I'm a brand new remote, you're a brand new car. [46:42.560 --> 46:43.780] Let's party. [46:48.380 --> 46:49.840] Any other questions? [46:54.220 --> 46:56.580] The question was are you able to get phone records? [46:56.580 --> 46:57.960] It depends on the hotel. [46:57.960 --> 47:00.180] Different folios show different detail. [47:02.400 --> 47:03.780] Okay, last question. [47:05.600 --> 47:06.600] There isn't one. [47:06.980 --> 47:08.100] Okay, I'll ask one. [47:13.620 --> 47:15.920] Do I have any literature? I don't have any with me, [47:15.920 --> 47:19.400] but I'll get the slides put up on the DEF CON site so you can view them. [47:19.400 --> 47:20.920] So that's it. [47:38.200 --> 47:39.620] Thank you, Major Malfunction. [47:39.620 --> 47:42.580] We need everyone out those doors, not the doors you came in. [47:43.080 --> 47:43.860] Those doors. [47:43.860 --> 47:47.260] We have a big line for the next presentation on war driving.