WEBVTT 00:00.000 --> 00:07.000 It would be inappropriate of me to comment on this particular issue, but maybe... 00:10.740 --> 00:12.520 That kind of sums it up. 00:12.520 --> 00:14.100 Sorry for you guys over there. 00:18.780 --> 00:25.120 If you like this shirt, there is a template and the LBGFX guys will make it up for you. 00:25.540 --> 00:28.900 My idea was, I thought, well, this guy gave up his job. 00:28.900 --> 00:37.860 He put his head above the parapet and gave up his job, so maybe I should do something for him. 00:39.120 --> 00:43.640 Print up a shirt, maybe they sell it for an extra five bucks, and we give him the five bucks. 00:44.300 --> 00:52.760 But then I thought, well, actually, Cisco are doing a pretty good job of marketing him at the moment, so I don't think we really need to bother on that one, so I think we'll just leave that be. 00:55.660 --> 00:56.880 Okay, so who am I? 00:57.680 --> 00:59.220 My name is MajorMalfunction. 00:59.220 --> 01:00.080 Some of you will know me. 01:00.080 --> 01:03.240 I've been involved in DEF CON since DC5. 01:03.240 --> 01:11.720 I've been working in the security industry since the 70s, and I do have a proper day job where I do this kind of stuff. 01:15.280 --> 01:17.260 Now, why did I start looking at infrared? 01:17.260 --> 01:19.260 Well, basically, infrared's everywhere. 01:19.260 --> 01:28.360 This talk is called Old School Hacking, because when I first started talking about it, people said to me, but that's such old technology. 01:28.360 --> 01:30.280 Why would you bother looking at that? 01:30.280 --> 01:32.420 Nobody uses that shit anymore. 01:32.940 --> 01:35.420 I thought, well, I think a few people do. 01:35.420 --> 01:40.300 So , you know, I asked around, and when I talk at conferences, I check with those conferences. 01:40.300 --> 01:47.000 So , you know, put your hand up if you've used an infrared control this week of any kind. 01:47.280 --> 01:52.140 Okay, put your hand up if you haven't used an infrared control this week. 01:52.840 --> 01:55.400 Well, electricity will come to your village soon, I'm sure. 01:58.100 --> 01:59.920 They're really useful things, you know. 01:59.920 --> 02:00.960 Change the TV. 02:01.720 --> 02:03.120 So, it's everywhere. 02:03.120 --> 02:04.640 Everyone still uses it. 02:05.380 --> 02:17.920 And it gets used in the obvious things like TVs for tuning and master configuration, package selection, central control of billing systems in those devices, vending machines. 02:17.920 --> 02:27.980 I found some vending machines in Amsterdam where you actually had to go to the bar and ask the guy to switch the thing on before you could use it, so cigarette machines at the back of the bar. 02:28.380 --> 02:32.460 You would go up to the bar, say, I want to use the cigarette machine, and he would ping it on. 02:33.200 --> 02:35.280 I'm not sure exactly what that was all about. 02:35.280 --> 02:37.700 I guess there's some kind of fraud going on. 02:37.700 --> 02:41.840 People find out how to trick the machine, so they want to keep it under control. 02:42.880 --> 02:47.620 They also get used, at least in the UK, for setting up the pricing. 02:47.620 --> 02:51.360 So you get those multi-vending machines where you have different goods in there. 02:51.360 --> 02:58.420 They actually program which slot costs what, so potentially there's a nice little hack there. 02:59.160 --> 03:04.640 Public display signs, obviously you can set scrolling LEDs up to do kind of wacky things. 03:04.980 --> 03:07.380 And garage door openers, car alarms. 03:07.580 --> 03:21.480 So actually car alarms that I first started looking at, in the early days I had a car with an infrared control, and I found that I could record the door lock and unlock codes on my Palm Pilot and play them back. 03:21.480 --> 03:23.020 And I thought that was pretty neat. 03:23.640 --> 03:28.240 And then I got a new car, still had an infrared control, but this stopped working. 03:28.240 --> 03:30.220 I could do it once, and then it stopped. 03:30.760 --> 03:32.800 And I wanted to understand why. 03:32.800 --> 03:44.940 So I started looking at the tools to do it, and I started developing an application to try and analyze what was going on with the signal and why I was having that issue. 03:45.920 --> 03:51.100 So, which I called the Project Murder, which was the usual sort of hacker horrible pun. 03:51.100 --> 03:54.680 So I'm using IRDA and I put my initials on the front, I get murder. 03:55.680 --> 04:03.540 And I got to a point on FreeBSD where I was actually able to read the codes, but I hadn't yet started to write them back. 04:03.920 --> 04:05.580 And then I discovered Lurk. 04:05.580 --> 04:13.940 And because of Lurk, I overcame my BSD bigotry and installed Linux on my box, and I've been using that ever since. 04:15.620 --> 04:17.340 So why bother with IR? 04:18.080 --> 04:23.140 Well, IR is very unlikely to be replaced, at least in the foreseeable future. 04:23.480 --> 04:26.240 It's a very good technology, it's very fit for use. 04:26.620 --> 04:29.300 It's cheap, you know, the components exist. 04:29.800 --> 04:31.300 It's very simple. 04:32.160 --> 04:35.960 When I say it's fit for use, I mean things like TV, you know, it's absolutely perfect. 04:35.960 --> 04:40.160 You can point it in a completely random direction, it will still bounce off the walls and hit the TV. 04:40.220 --> 04:44.120 And it's not going to change the channel in the hotel room next door to you. 04:44.200 --> 04:50.900 You start looking at putting things like Bluetooth in controls, and you've then got issues of leakage into other environments. 04:50.900 --> 04:56.240 So, infrared is actually a very good tool for the job it does. 04:56.240 --> 05:01.560 From a technical point of view, why should I waste my time fiddling with this stuff? 05:01.560 --> 05:05.120 Well, as a security professional, I think it's good. 05:05.120 --> 05:11.340 You know, you have to develop a mindset that looks around you for security issues all the time. 05:11.680 --> 05:20.900 When I move into a house, a new house or an apartment or whatever, or I get a new car, for the next few weeks, I will try and break into it. 05:20.900 --> 05:27.760 I will see how many ways I can get back into my house without actually using the door key, or going up to the alarm and doing what I'm supposed to do on the alarm. 05:28.220 --> 05:36.440 And it's just habit, you know, it's using that mindset or developing that mindset where you're looking for security problems all the time. 05:38.960 --> 05:42.140 And infrared, you know, you're sitting in a hotel room, there's nothing to do. 05:42.480 --> 05:44.400 There's your infrared control, there's the TV. 05:44.820 --> 05:46.920 The hotel's quite an interesting place. 05:47.240 --> 05:51.920 They're trying to sell me stuff, but they don't actually want to have staff to do it, so they rely on technology. 05:52.620 --> 06:00.800 If you think about last time you checked into a hotel, you probably interacted with one person right at the beginning when you checked in. 06:01.500 --> 06:06.380 And for the rest of your stay in that hotel, you were using automated systems. 06:07.020 --> 06:12.060 And that's apart from the catering staff, but just, you know, you're in a big hotel, you're sleeping in the bedroom and so on. 06:12.520 --> 06:14.520 But meantime, they're still trying to sell you stuff. 06:14.520 --> 06:21.960 They've got pay TV, they've got mini bars, they've got all this stuff where they're delivering a service without actually having any staff to do it. 06:21.960 --> 06:24.100 They're relying on technology to do that. 06:24.440 --> 06:37.500 There will be security problems with technology, and those problems will have direct parallels in the internet networking world and, you know, within the systems themselves that some of you may be involved in actually deploying. 06:38.200 --> 06:39.180 And it's fun. 06:39.180 --> 06:42.080 At the end of the day, as you'll see, it's quite fun. 06:43.360 --> 06:49.780 So it turns out that infrared really is the ultimate in security by obscurity. 06:50.760 --> 06:53.540 You've got really simple codes. 06:53.540 --> 06:55.200 Because they're sent, you can't see them. 06:55.200 --> 06:57.380 No one can see what's actually going on. 06:57.760 --> 07:01.220 They don't bother engineering any kind of security into it. 07:02.060 --> 07:05.980 If you know the right code to send, you have total control of the box. 07:05.980 --> 07:07.740 That is it. 07:07.740 --> 07:08.720 You know, I am God. 07:08.720 --> 07:09.460 Bang. 07:09.760 --> 07:10.920 I now control the box. 07:10.920 --> 07:11.880 I can do anything I want. 07:11.880 --> 07:13.320 There's no two-way authentication. 07:13.320 --> 07:14.900 There's no further pin numbers. 07:14.900 --> 07:15.920 There's nothing. 07:16.920 --> 07:25.200 They also tend to use what I term an inversive security model, where the actual control of what you're allowed to do is at the wrong end. 07:25.200 --> 07:26.920 It's in the hostile environment. 07:26.980 --> 07:29.200 It's in the environment that I control. 07:29.780 --> 07:32.600 And we'll look at that in more detail. 07:35.510 --> 07:41.330 Okay, so the simplest attack is the one I described with my car, where I could just record the code and replay it. 07:42.290 --> 07:47.430 And that also applies to garage doors, so garage door openers. 07:47.430 --> 07:54.810 I think you mostly use RF over here, but in the UK and some parts of Europe, infrared controls are still very popular. 07:55.690 --> 08:02.970 There's also little robot toys, TVs, the TVs in bars and clubs and things. 08:03.830 --> 08:10.730 And if you can record a code or you know the code, then you can affect those publicly visible devices. 08:11.450 --> 08:17.950 And if you can get a hold of special controls that do extra things on those devices, you can simply clone them. 08:17.950 --> 08:22.450 And then you have the code, and you replay it, and you can do the special thing. 08:25.680 --> 08:34.120 And the kind of tools you can use to do it, Casio produced some nice little infrared watches back in the 80s, I think. 08:34.980 --> 08:41.640 Apple Newton was one of the first handheld manufacturers to actually have built-in IR that had this capability. 08:42.160 --> 08:50.260 And now you have tools like Omni Remote, which runs on any Palm-based operating system that has an infrared control. 08:51.180 --> 08:52.480 It's a very neat system. 08:52.480 --> 08:54.200 You can get it from Pacific Neotech. 08:54.200 --> 08:56.760 There's the URL, download that. 08:57.700 --> 09:01.680 Philips Pronto is used in a lot of those big home automation systems. 09:01.680 --> 09:07.900 So you have a control, and you completely program what the buttons look like, what command they send, and so on. 09:08.100 --> 09:11.300 And again, there's a lot of website resource behind that. 09:11.300 --> 09:15.320 You can download existing codes for different systems, and so on. 09:18.570 --> 09:21.930 So here's our first example, RoboSapien. 09:22.970 --> 09:25.870 Last year, there was a guy here at DEF CON walking around. 09:25.870 --> 09:29.390 He'd obviously bought one of these toys, and he was walking it around, up and down the queues. 09:29.390 --> 09:31.010 Anyone remember seeing him? 09:31.770 --> 09:32.370 Yeah. 09:32.530 --> 09:35.870 So he was walking up and down, trying to get someone to buy it. 09:38.340 --> 09:43.180 So I sat down behind him, and started recording the commands he was sending. 09:45.600 --> 09:50.620 So he would walk it up the aisle, and I would turn it around and walk it away from the aisle. 09:51.400 --> 09:58.380 And he would turn it back and walk it back up the aisle, and I would turn it away and make it shrug its shoulders, or make a rude farting noise, or something. 09:58.820 --> 10:02.060 So basically, I was able to then... 10:02.620 --> 10:03.580 tag it. 10:09.480 --> 10:11.000 So this is a guy at work. 10:11.000 --> 10:12.500 He owns the black car. 10:12.920 --> 10:14.700 A friend of mine owns the green car. 10:15.200 --> 10:24.540 So I put my system in the back of the green car, one day when he was leaving, and the next morning, when he arrived. 10:25.360 --> 10:30.520 And then that evening, when he went to go, he walked up to his car, and he unlocked it. 10:30.560 --> 10:31.920 And I locked it. 10:33.520 --> 10:34.840 He unlocked it. 10:35.120 --> 10:36.560 And I locked it. 10:37.640 --> 10:38.940 And he unlocked it. 10:38.940 --> 10:40.020 And I locked it. 10:40.400 --> 10:42.020 And that went on for a few minutes. 10:42.100 --> 10:47.860 And then he started walking back to the office to try and, you know, make a phone call, do whatever he had to do to sort his life out. 10:47.860 --> 10:49.440 And I unlocked it for him. 10:50.280 --> 10:51.840 Because I'm a nice guy, really. 10:53.200 --> 10:54.240 So that was... 10:54.240 --> 10:59.940 That's one of the older systems, that obviously didn't tackle this problem, that, you know, why can't I do that to my car? 10:59.940 --> 11:00.460 I don't know. 11:00.460 --> 11:02.900 But his, I could just replay as often as I like. 11:04.640 --> 11:09.440 I couldn't actually steal his car, because it turns out he has an RF as well, which disables the engine. 11:13.220 --> 11:14.900 Okay, so that's a replay attack. 11:14.900 --> 11:15.940 Very simple attack. 11:15.940 --> 11:21.540 You have to have access to the source to see the original signal and replay it. 11:22.360 --> 11:28.940 But what if you don't know what the original signal looks like, or what the exact code is for that device? 11:28.940 --> 11:33.840 You can go and buy a similar one, but you don't know the code for the man next door. 11:33.840 --> 11:36.200 So I've got the same garage door opener as he has. 11:38.440 --> 11:43.080 Well, as I say, I found this tool, Lurk, which you can download. 11:43.080 --> 11:46.940 It's the Linux Infrared Control project. 11:47.420 --> 11:50.420 It has some visualization tools, which I find very useful. 11:50.420 --> 11:54.840 You can send an infrared signal into it and actually visualize what's going on. 11:55.640 --> 12:01.100 It auto-learns, so you just point a remote at it and it will learn all the tricky stuff for you. 12:01.100 --> 12:02.780 You don't have to do any thinking. 12:03.740 --> 12:16.520 And it produces an ASCII human-readable config file, which is very important, because that means you can look at it, you can read it, you can understand it, and more importantly, you can change it, which is what we're going to do. 12:17.840 --> 12:18.840 It's software-only. 12:18.840 --> 12:21.120 It will work with my infrared on my laptop. 12:21.680 --> 12:23.060 It only runs on Linux. 12:24.660 --> 12:28.840 Alternatively, you can buy an external device, which is a USB dongle. 12:29.240 --> 12:31.900 It's available from irtrans.de. 12:33.220 --> 12:37.720 It's a much more powerful transmitter, so you can do stuff from further away. 12:38.360 --> 12:39.740 And it solves a bunch of issues. 12:39.740 --> 12:43.880 The way LERP works is it plays with serial protocols. 12:44.740 --> 12:51.360 What irtrans does is it actually runs in native mode, so it knows how to send native infrared commands. 12:51.860 --> 12:57.900 And that will run on Linux or that other funny virus operating system. 13:00.180 --> 13:01.420 This is what it looks like. 13:01.420 --> 13:03.180 It's just a little USB dongle. 13:04.500 --> 13:14.840 Okay, so for my first example, I took my garage door opener and popped it open and found there's this dip switch. 13:15.800 --> 13:22.120 And the dip switch has eight positions, so therefore there are 256 possible codes. 13:22.780 --> 13:29.500 So what I could do to get into my neighbor's garage is try every one of them, but that would be fairly dull. 13:31.260 --> 13:36.540 I had a look with a piece of software that comes with LERP called XMODE2. 13:37.900 --> 13:49.620 Now what XMODE2 does is you point the control at it, hit a command, and it will draw for you the signal that it sees. 13:49.620 --> 13:55.940 So there's a carrier signal, which it then modulates, and you get to see if it's a long pause or a short one. 13:56.700 --> 14:00.180 So if I switch all of the eight switches on, I get this. 14:00.180 --> 14:02.140 If I switch them off, I get that. 14:02.700 --> 14:06.320 If I switch number eight on, this one pops up. 14:06.540 --> 14:07.800 Number one, that one. 14:07.800 --> 14:09.880 So I can see where the pattern starts and ends. 14:09.880 --> 14:15.140 It's obviously just a very simple one-to-one relationship between the switch and the pulses. 14:15.740 --> 14:20.540 So I concluded that I have a start bit, eight data bits, and four stop bits. 14:24.730 --> 14:32.870 So now I train LERP how to just duplicate a code or a couple of codes. 14:32.870 --> 14:35.330 In this case, I would only need one. 14:35.770 --> 14:39.490 Because what I'm looking for is to see how that code is represented. 14:39.910 --> 14:44.230 So LERP, basically, this stuff is to do with timings and carrier frequencies. 14:44.930 --> 14:47.830 This is the actual code that's being sent. 14:48.210 --> 14:52.870 So for a particular switch position, it will give me a particular hex value. 14:53.930 --> 14:56.390 So I know the hex for one command. 14:57.370 --> 15:03.010 So it's not that hard, then, to write a little script that produces the hex for every possible command. 15:03.450 --> 15:04.790 Which I do. 15:06.050 --> 15:11.010 And then I write another little script that spits out each command. 15:11.010 --> 15:18.650 And it took 54 seconds to send all 256 possible codes to my garage door. 15:19.930 --> 15:22.290 So here I am, down in the garage. 15:22.290 --> 15:26.070 I'll stick the laptop down, fire it up. 15:26.790 --> 15:29.690 A few seconds later, bingo, door opens. 15:30.870 --> 15:36.950 Now what was surprising here was I knew the code was actually quite far up in the range. 15:36.950 --> 15:40.390 I thought it was going to take 45, 50 seconds to go. 15:40.750 --> 15:44.270 What actually happened is it went within about the first five seconds. 15:44.850 --> 15:48.690 So I thought, okay, well, maybe there's a factory backdoor in here. 15:48.690 --> 15:51.990 The manufacturers have actually got a code that just always works. 15:51.990 --> 15:54.110 And that's the only code I'm going to have to send. 15:55.030 --> 16:00.370 Actually, it turned out that what had happened is the building management had run out of controls. 16:00.370 --> 16:03.350 And they'd gone back to the company that sold the original system. 16:03.390 --> 16:06.350 And they'd said, we need more remotes. 16:06.370 --> 16:08.470 The company said, oh, that company's gone bust. 16:08.470 --> 16:09.530 We can't sell you any. 16:09.530 --> 16:11.150 You'll have to buy a new system. 16:11.230 --> 16:14.950 So they engineered into the system a second reader. 16:14.950 --> 16:16.670 So we have two readers here. 16:17.130 --> 16:27.450 So this reader, which is 100% compatible with that reader, has been engineered in so that another bunch of remotes can send 100% compatible codes and open my door. 16:28.090 --> 16:29.850 So, stupidity. 16:29.850 --> 16:31.530 They didn't bother to actually check. 16:31.530 --> 16:34.950 Or maybe they just set the switches wrong and they couldn't get the thing to work, but whatever. 16:34.950 --> 16:38.170 They wasted a lot of time and money putting that system in. 16:39.610 --> 16:42.210 You'll notice there's a security camera here. 16:43.270 --> 16:53.110 So while I was doing all this and fiddling around and opening garage doors without keys, presumably someone was recording that video and watching me. 16:53.110 --> 16:56.630 So I got a visit the next morning from security. 16:56.950 --> 16:58.750 No, of course not. 16:58.750 --> 17:02.930 If you have security, at least pay attention to it, guys. 17:05.700 --> 17:08.140 Okay, so hotel TVs. 17:09.640 --> 17:15.480 I thought, if I can do this to a garage door, maybe I can do it to a TV system. 17:15.480 --> 17:22.060 So I need a TV system that actually does more than simply changes channels. 17:22.440 --> 17:25.740 So I had a look at a hotel TV system. 17:26.720 --> 17:31.100 And this is one of the examples where I say we were running an inverted security model. 17:31.780 --> 17:35.940 The TV is controlling which content I get to see. 17:35.940 --> 17:43.100 The hotel in most cases is streaming content, basically all the content without any control. 17:43.100 --> 17:45.400 The TV itself filters the content. 17:47.460 --> 17:53.640 When you actually select a channel to look at that content, there's no further authentication required. 17:53.640 --> 17:58.640 If I can persuade the TV to go and look at a channel I'm not supposed to be looking at, that's it. 17:58.640 --> 18:00.760 I just send it the command and I can have it. 18:01.320 --> 18:12.680 The content itself isn't wrapped in any kind of encryption, unlike satellite TV, where they expect you to be able to receive it even though you're not a subscriber, because it's a closed system. 18:12.680 --> 18:13.840 They don't need to. 18:13.940 --> 18:15.800 It's entirely within their own building. 18:15.800 --> 18:17.240 It's their own backbone. 18:17.660 --> 18:24.000 They control who gets to see what on that system, or so they think. 18:26.680 --> 18:35.640 Okay, so if the system's broadcasting stuff, presumably you can just plug in another TV, tune yourself in, and watch whatever you want on any channel. 18:35.640 --> 18:38.900 But humping a TV around is a pain in the ass. 18:39.520 --> 18:43.280 Instead of that, we have these little USB dongle thingies. 18:45.920 --> 18:47.580 So I plug this one in. 18:47.580 --> 18:49.700 This is in line with the back end. 18:50.740 --> 18:56.100 And on the master TV, I'm getting the content they expect me to see, the master menu. 18:56.460 --> 19:01.000 On this one, I've got another channel, because I've tuned to another channel. 19:01.940 --> 19:07.380 And if I flick through the channels, I find there's various other bits of content. 19:07.380 --> 19:10.220 This is all just system messages. 19:14.840 --> 19:21.540 Occasionally, I came across these strange screens, where they were seemingly putting up an advert for something. 19:21.900 --> 19:26.300 Which is an advert no one's ever going to see, because none of the official channels actually look at this. 19:28.000 --> 19:31.000 But what was most interesting on there is there's a URL. 19:31.000 --> 19:32.920 This is the company that makes the thing. 19:33.460 --> 19:37.560 If I go to that URL, there's a load of technical documentation. 19:37.560 --> 19:39.720 So there's PDFs. 19:39.720 --> 19:41.700 It tells me how the systems work. 19:41.880 --> 19:45.380 What else I might be looking for when I start looking at these things. 19:45.560 --> 19:47.480 What new features they're putting in. 19:47.700 --> 19:49.680 Which hotels they've put them in. 19:50.000 --> 19:53.940 So you spot a feature you're interested in, you can just go and look at their client list. 19:53.940 --> 19:55.880 Say, oh yeah, they're testing that over here. 19:55.880 --> 19:57.680 Let's go and stay there for a night. 19:58.960 --> 20:03.380 Some of the things they're thinking of putting in are truly scary. 20:04.000 --> 20:05.800 Webcam in your bedroom. 20:05.800 --> 20:10.480 Now, why would anyone want... oh no, okay, don't answer that. 20:11.820 --> 20:13.140 I think I know. 20:18.220 --> 20:21.080 And of course, they're broadcasting premium content. 20:21.420 --> 20:24.680 So this is a pay movie that I'm supposed to have paid for to watch. 20:25.580 --> 20:28.540 Which I can watch on my tiddly little screen here. 20:29.700 --> 20:34.160 Or I can root it back out and into the SCART and watch it on the TV. 20:38.220 --> 20:42.000 Okay, that's fine, but that's just looking at the back-end content. 20:42.000 --> 20:44.040 We haven't actually got control of the system. 20:44.040 --> 20:48.780 But we've proved the concept that there is stuff on the back-end which we can get to. 20:49.680 --> 20:52.920 So I started looking at the actual remote controls. 20:52.920 --> 20:58.520 Can I do the same trick that I did brute-forcing my garage door to the TV remote? 20:59.400 --> 21:02.000 What I found is the codes are much more complex. 21:02.000 --> 21:02.840 They're much bigger. 21:02.840 --> 21:04.060 They have more bits. 21:04.520 --> 21:09.720 And the reason they do that is because they group them. 21:09.720 --> 21:12.240 You have manufacturer collision avoidance. 21:12.240 --> 21:15.500 So you have multiple remotes in the same environment. 21:15.500 --> 21:18.000 You don't want them interfering with each other's devices. 21:18.320 --> 21:22.300 So you have a preamble that says, I'm a Sony or I'm a JVC or whatever. 21:23.500 --> 21:27.800 You may have a remote that controls the TV and the video from the same manufacturer. 21:27.800 --> 21:29.580 So you have different groups for that. 21:30.560 --> 21:33.440 And you have standard groups versus extra groups. 21:33.440 --> 21:38.120 So Philips may make a TV that they sell to hotels and to home. 21:38.120 --> 21:41.840 And you have different sets of controls for the different environments. 21:43.160 --> 21:46.280 There's also this interesting group here. 21:46.480 --> 21:47.760 The hidden group. 21:48.320 --> 21:50.020 This is what we're looking for. 21:52.040 --> 21:54.220 So this is what they look like. 21:55.220 --> 21:58.060 As you can see, it's a much longer code. 21:58.420 --> 22:02.300 It's much harder to emulate or guess. 22:02.300 --> 22:09.040 In fact, when I looked at it, it turned out to be a 14-bit code in this particular case. 22:10.200 --> 22:17.340 Now unlike a garage door, when I test these codes, I need to watch. 22:17.340 --> 22:18.920 I need to actually pay attention. 22:18.920 --> 22:26.400 Because something will happen and then 10 seconds later, I could send another command that cancels that and does something else. 22:26.400 --> 22:31.260 So unless I'm actually watching each command as it plays out, I may miss the event. 22:31.260 --> 22:34.620 So garage door, I can just leave it running, wait for it to pop. 22:34.620 --> 22:36.800 This, I actually have to spend time on it. 22:38.040 --> 22:49.060 And it turns out I need to take about two seconds per code to have time to react and watch and let the code settle down, not be interfered by the next one. 22:49.860 --> 22:52.880 Which would be nine hours to test the whole system. 22:53.180 --> 23:00.680 And I found that out the hard way because one night in Amsterdam after a conference, back in my hotel room, and I'm playing with this stuff. 23:00.680 --> 23:03.020 This was in the early days when I was just figuring it out. 23:03.300 --> 23:05.560 Next thing I know, it's five hours later. 23:05.700 --> 23:07.160 It's one o'clock at night. 23:07.280 --> 23:12.160 I've just spent the only night in Amsterdam playing with hotel-dam TVs. 23:13.640 --> 23:15.380 Coffee shops are closed. 23:15.760 --> 23:18.080 And I really fancied a cup of coffee. 23:20.640 --> 23:23.020 So I thought, now I have to fix this. 23:23.020 --> 23:26.360 I need to reduce the time it takes to do this stuff. 23:27.080 --> 23:30.140 So I tried to find a way to reduce the search space. 23:31.760 --> 23:36.520 So basically that meant looking at what bits are being used in the codes. 23:36.640 --> 23:51.480 So if I take each of the codes in turn, 0 to 9, and I look at which bits have actually been either set to 1 or toggled from 0 to 1 or 1 to 0, I work my way through them all. 23:53.480 --> 23:58.960 Basically just try each one, organize them in such a way that I can see what's going on. 23:59.660 --> 24:02.480 Finally get to the end, and I'm down to... 24:08.020 --> 24:09.460 Yeah, sorry. 24:09.900 --> 24:11.620 First two bits are used. 24:11.660 --> 24:14.260 I've got four bits I've never seen change here. 24:14.940 --> 24:18.040 And the last eight bits is the actual code. 24:19.420 --> 24:21.420 So I want to reduce that further. 24:21.420 --> 24:23.140 That's not enough of a result. 24:23.140 --> 24:31.840 So what I do is I take a single command, doesn't matter what command it is, in this case I took the power command, and I start toggling bits. 24:32.500 --> 24:45.560 So if I toggle the first bit of the power command from 1 to 0, and I send the command again, and the command succeeds, then I can assume that bit is not actually used, it's ignored. 24:46.040 --> 24:49.620 In this case the command fails, so I know that bit's important. 24:50.600 --> 24:54.060 This one worked, so that bit's ignored. 24:54.440 --> 24:58.480 And in fact, all three, those three were ignored, that one failed. 24:58.520 --> 25:02.740 So I now know I've got a total of ten bits I have to care about. 25:03.260 --> 25:06.180 Which gives me a thousand codes, which is about half an hour. 25:06.200 --> 25:07.420 So I can live with that. 25:10.640 --> 25:14.340 So I spit out a bunch of configs which have all the possible codes. 25:14.600 --> 25:18.760 In this case I did them as four groups because I couldn't... 25:18.760 --> 25:22.600 I really couldn't figure out how to do 14-bit bitfields in Perl. 25:22.600 --> 25:26.380 So I did four sets of 8-bit bitfields with a lead in. 25:27.740 --> 25:31.660 And then I spit those out, and I run those, and I watch what happens. 25:33.520 --> 25:37.260 And sure enough, I find a load of really interesting stuff. 25:39.020 --> 25:40.640 This one in particular. 25:42.940 --> 25:44.440 This is the God code. 25:44.440 --> 25:46.260 Bingo, it's a game in England. 25:46.300 --> 25:47.760 Bingo, I've won. 25:56.530 --> 25:59.310 Okay, so the kind of things you do with hidden codes. 26:01.150 --> 26:07.950 The internal, the housekeeping staff use them for daily things like setting what they've done to the minibar. 26:08.210 --> 26:15.090 If they've cleaned the room, they'll set a status report so they don't have to fill in forms and report at the end of the day. 26:15.090 --> 26:19.150 The hotel actually has real-time information as to what room's in what state. 26:20.150 --> 26:25.930 You've then got some one-off tasks that the engineers use if they're having problems with the TV or they're first setting it up. 26:26.350 --> 26:28.450 And some debugging information. 26:31.200 --> 26:35.740 Okay, so one of the first things you can do is you can start to reconfigure the TV. 26:36.180 --> 26:38.020 You can change the messages. 26:38.900 --> 26:47.020 So when the TV gets switched on, comes up with a welcome message or a channel message, you can assign the TV to another room. 26:47.700 --> 26:52.420 You can assign channels that are now free that used to be paid channels. 26:52.580 --> 26:57.120 And you can find channels that just simply don't exist on a normal TV. 26:58.060 --> 26:59.840 So here's an example. 27:00.340 --> 27:05.380 First thing any good hacker does is tag his TV. 27:08.560 --> 27:12.420 So now when you switch the TV on this room, that's what comes up. 27:13.560 --> 27:17.080 And if you can find it, I'll give you some really cool prize. 27:17.080 --> 27:18.680 Some bit of Defcon swag. 27:21.140 --> 27:22.620 Same thing in Amsterdam. 27:26.040 --> 27:30.020 Or you can change a big banner that comes up when you turn the TV on. 27:34.740 --> 27:37.080 So this is not only owned, but it's really owned. 27:37.080 --> 27:39.360 I've locked it, no one else is going to use it. 27:41.220 --> 27:43.540 Actually, I unlocked it before I left, of course. 27:44.220 --> 27:45.260 Just testing. 27:45.260 --> 27:48.280 This is for security, you know, for research purposes only. 27:48.280 --> 27:50.260 Don't go home and abuse this stuff. 27:50.260 --> 27:51.460 Kids. 27:54.470 --> 27:59.150 And I try and, you know, tip the hat to conferences I go to. 28:07.060 --> 28:11.280 Okay, so one of the other things you can do is change the filtering on the TV. 28:11.680 --> 28:19.900 Most broadcasters these days, they actually send a signal to say what the certificate of the film is that they're sending. 28:20.980 --> 28:28.820 And so responsible hotels, if you check in with children, they'll put filtering on the TV so that you don't get inappropriate content. 28:29.300 --> 28:43.780 So if you're a sensitive character like me, and you walk into an environment like this, and everything's just coming through, they're not filtering anything, then you may want to take the matter into your own hands and deal with it. 28:55.410 --> 28:58.110 So now only the good stuff comes into my room. 28:59.090 --> 29:01.330 None of that sports news crap. 29:04.590 --> 29:11.730 You can also just start to look for these invisible channels, back-end systems that may be leaking information. 29:13.350 --> 29:16.210 So, fairly simple test signal. 29:16.210 --> 29:18.830 They obviously use that for just tuning the TV in. 29:19.290 --> 29:26.330 Actually, it's more interesting that these numbers, they usually are something other than zeros. 29:26.910 --> 29:33.850 And there seems to be some strange correlation with them becoming zeros and the minibar billing stopping to happen. 29:35.830 --> 29:38.050 I have no idea why that would be. 29:41.980 --> 29:44.220 You get some debugging information. 29:44.220 --> 29:49.680 Again, there's some weird numbers that I don't know what they are, but it says code, so that's got to be interesting, right? 29:51.020 --> 29:53.880 I think most of it's signal strength, things like that. 29:56.000 --> 29:59.060 Occasionally, I'll even interrupt a good movie to do this stuff. 29:59.060 --> 29:59.740 Sometimes 30:03.510 --> 30:08.670 you find stuff that really is quite interesting. 30:08.670 --> 30:09.570 It shouldn't be there. 30:09.570 --> 30:12.170 I shouldn't be able to find information like this. 30:12.470 --> 30:19.110 I know I'm running some kind of DOS environment, and I've even got an IP address. 30:21.850 --> 30:24.810 So, there's obviously some kind of computer back there. 30:25.070 --> 30:26.710 Maybe I can talk to it. 30:29.730 --> 30:31.850 Maybe I don't want to talk to it. 30:45.090 --> 30:46.050 Strange. 30:46.770 --> 30:48.910 We've got a web server back there, too. 30:50.170 --> 30:51.670 That looks fairly harmless. 30:51.670 --> 30:53.550 So, I've got an object not found page. 30:53.550 --> 30:54.410 Big deal. 30:55.950 --> 30:58.470 Actually, see how my mouse moves? 30:59.370 --> 31:02.930 Turns out the up, down, left, right buttons did the same thing to this one. 31:06.880 --> 31:08.500 So, I poke around a bit. 31:09.580 --> 31:12.740 I get another not found page, but it gives me a nice helpful message. 31:12.740 --> 31:15.320 Actually, this pops up a bit after that first page. 31:15.320 --> 31:16.840 So, it gives me a link. 31:16.840 --> 31:18.060 So, I click on it. 31:18.900 --> 31:20.340 Gives me another link. 31:21.660 --> 31:29.300 Microsoft helpfully suggests, if I'm not getting what I want from this system, perhaps I should go to the home page, the system that served it. 31:29.720 --> 31:32.020 There's my IP address, which is a link. 31:33.020 --> 31:34.440 And it sends me here. 31:49.220 --> 31:52.900 What is that doing on the back end system on a TV? 31:54.100 --> 31:55.220 No idea. 31:55.220 --> 31:59.400 And I resisted picking up the keyboard and playing with it, obviously. 31:59.780 --> 32:01.040 Nothing further to see here. 32:01.040 --> 32:01.800 Move along. 32:06.540 --> 32:07.260 Oops! 32:11.720 --> 32:13.500 Who left that lying around? 32:16.190 --> 32:17.670 So, yeah, I can move around. 32:17.670 --> 32:19.090 I can click on icons. 32:19.090 --> 32:21.250 And when I click on them, things pop up. 32:22.150 --> 32:24.310 And they kind of do things. 32:25.210 --> 32:26.550 And they launch. 32:29.150 --> 32:32.930 So, I thought I'd be, you know, I found this stuff, I'd be friendly and helpful. 32:32.930 --> 32:35.590 Do a bit of tidying up while I'm here. 32:40.130 --> 32:42.510 They hadn't defragged for ages. 32:46.250 --> 32:47.930 Didn't like the color scheme. 32:55.810 --> 32:58.330 This is a CD that was in the CD drive. 33:01.200 --> 33:03.640 And I just love this comment here. 33:10.330 --> 33:12.970 So, any copyright enforcement officers in the building? 33:17.820 --> 33:19.820 Okay, so what else could we do? 33:20.300 --> 33:23.400 We could change the status of things in our room. 33:25.020 --> 33:25.940 Minibar. 33:27.080 --> 33:29.020 Oh dear, we're all zeros. 33:32.730 --> 33:37.590 Now, you might not want the hotel staff coming in and finding all these empty bottles all over the floor. 33:37.590 --> 33:40.490 So, you can DOS your room by setting it to clean. 33:42.810 --> 33:44.490 They'll never bother you again. 33:48.420 --> 33:56.880 I've even found things which the vendor who built the system obviously put that in, but the hotel hadn't paid for the full package. 33:56.880 --> 34:08.080 So, for example, on this system we can watch movies, we can play with a PlayStation, we can look at some hotel information, whatever, and that's it. 34:09.340 --> 34:13.020 But in the background there, there's an internet connection. 34:13.860 --> 34:16.480 This screen was not available by any other means. 34:16.480 --> 34:20.720 There was no way to officially get to it, but it was a fully functional internet connection. 34:20.720 --> 34:22.520 So, it was hooked up to their backend. 34:22.520 --> 34:26.580 It was using their internet connection, which they probably used for the hotel. 34:26.900 --> 34:28.060 And this was real content. 34:28.060 --> 34:43.220 If I clicked on those links, I could start digging down further and actually using Squeak's technique to then tweak HTTP URLs and things and basically find a way to get to a search engine, whatever, and then get out to the outside world. 34:46.120 --> 34:48.820 Sometimes you can actually control physical devices. 34:50.300 --> 34:51.900 This is a minibar. 34:52.420 --> 34:54.800 This is a red light that says it's locked. 34:55.060 --> 34:58.140 That's the beer I was going to have before this happened. 35:02.530 --> 35:06.270 So that was motivation to find the unlock code, obviously. 35:10.090 --> 35:12.390 We can see what other people are doing. 35:13.350 --> 35:21.790 And we can do that because you often see this message, you choose something, premium content, whatever, and it will say, please wait, we're assigning another channel. 35:22.290 --> 35:33.530 And so what they're doing is they're going to broadcast the content and then they're going to retune your TV to that channel, which only you can watch, obviously, because they control the TV, right? 35:34.790 --> 35:36.090 So do I. 35:37.810 --> 35:44.750 So this guy is obviously, he's watching a film, he's interested in mountain-dwelling women or something. 35:47.480 --> 35:48.820 It's harmless enough. 35:48.820 --> 35:50.320 Okay, he's watching a movie. 35:50.860 --> 35:53.100 But what if he's browsing the Internet? 35:54.640 --> 36:00.860 Then he goes to his webmail account and he reads his mail. 36:05.350 --> 36:07.610 And he replies to his mail. 36:09.490 --> 36:12.090 Maybe I should help him with his spelling or something. 36:16.470 --> 36:20.570 Okay, so I can also assign the TV to another room. 36:22.170 --> 36:30.370 One of the interesting things you can do on your TV in your room is look at your bill. 36:30.770 --> 36:32.930 So we choose account status. 36:33.490 --> 36:35.170 It looks up my name. 36:36.750 --> 36:38.210 And there's my bill. 36:38.210 --> 36:41.590 There's that strange round number appears again. 36:43.270 --> 36:49.210 So the reason it can show me my bill is because it knows that this TV is in my room. 36:49.270 --> 36:52.270 And it knows that because it has an address. 36:52.270 --> 36:55.390 In this case, it's A161. 36:56.390 --> 37:06.550 So if I change it and it's now A162 I'm looking at the bill of the guy next door. 37:08.790 --> 37:10.990 Wow, look at all those room charges. 37:11.410 --> 37:13.170 What the hell has he been doing? 37:14.550 --> 37:16.290 His minibar is probably empty. 37:16.290 --> 37:19.690 He's watched every pay-peak TV movie in the place. 37:19.690 --> 37:21.550 He's been having a wild time. 37:23.230 --> 37:27.070 I'm guessing when he goes down to check out there may be some discussion. 37:38.780 --> 37:41.880 And I'm a busy professional, he's probably a busy professional. 37:42.580 --> 37:44.680 I have a big heart, you can probably tell that. 37:44.680 --> 37:46.840 So I figure I'll help him out. 37:54.140 --> 37:55.960 And send him on his way. 38:08.680 --> 38:12.380 If I can do that for one room, I can do it for all of the rooms. 38:14.280 --> 38:16.200 So I have a little shell script. 38:16.340 --> 38:19.080 And I have a little tripod and a digital camera. 38:19.200 --> 38:29.080 And when I turn up in a hotel and I go to bed and I get up the next morning I have a little page like this. 38:30.400 --> 38:31.620 Yes, it was me. 38:31.620 --> 38:34.060 I did spend the night in Paris Hilton. 38:36.120 --> 38:36.960 Grow. 38:38.460 --> 38:44.580 So that page gives me a little thumbnail of every room in the hotel. 38:45.040 --> 38:51.680 Who's staying where, who's staying with who, where they've been calling, all kinds of stuff. 38:51.820 --> 38:55.060 Which rooms are empty, which are full because you get different messages. 38:56.600 --> 39:00.280 So by the time I'm done, I know the percentage occupancy of the hotel. 39:00.280 --> 39:07.260 I know who's there, who they're with, what they've been eating, drinking and viewing, where they've called and how long they've been there. 39:08.640 --> 39:10.380 It's pretty bad. 39:13.200 --> 39:14.680 Okay, now the good stuff. 39:14.680 --> 39:16.900 This is what you all really came for, right? 39:19.120 --> 39:20.560 Pay-per-view. 39:21.520 --> 39:26.020 So there seem to be two different kinds of TV pay-per-view. 39:26.280 --> 39:31.060 There's the ones that you actually choose a film and it gets played for you. 39:31.360 --> 39:36.440 And there's ones that just play in a cycle and when you choose the film you get tuned in. 39:37.700 --> 39:40.540 There's various different ways they control this stuff. 39:41.260 --> 39:43.720 One of them is they send a blocking signal. 39:45.500 --> 39:56.100 So in this case, we've been scanning, we found a channel, we've got the sort of cheesy 70s music, we think we've hit pay dirt, but it's being blocked. 39:56.500 --> 39:58.980 So I found a command that unblocks it. 40:00.280 --> 40:03.540 Just a boring old documentary from the 70s. 40:05.880 --> 40:09.740 Alternatively, you could just retune all the channels. 40:10.400 --> 40:13.720 So you don't have to search for individual ones. 40:14.740 --> 40:16.600 So we also program. 40:17.300 --> 40:19.640 I'm sorry, it's a bit blurry, this picture. 40:19.720 --> 40:23.640 Seems to be one of the sort of fundamental issues with this kind of research. 40:24.060 --> 40:27.200 It's just not possible to get a good picture one-handed. 40:30.920 --> 40:34.140 And there's that educational channel you've been looking for. 40:37.730 --> 40:40.910 And like any good hacker, you tag it for them. 40:50.260 --> 40:54.840 Now if all that seems like way too much trouble, they have this great feature called a Barker channel. 40:55.500 --> 41:00.480 Barker channel is what comes up when you first turn the TV on. 41:01.300 --> 41:06.940 Oh, it's changed. 41:11.290 --> 41:13.570 So that's infrared. 41:14.450 --> 41:21.070 Other things I've been looking at recently, back to the old car alarms, those central locking systems. 41:21.490 --> 41:23.590 They've started using RF. 41:23.690 --> 41:26.250 Garage door openers over here use RF. 41:26.310 --> 41:29.070 I think it's going to be a carrier change only. 41:29.890 --> 41:31.850 The codes will be the same. 41:31.850 --> 41:34.390 They're just using RF instead of infrared. 41:35.370 --> 41:40.790 Some interesting things with hotel safes while I was looking at hotels. 41:41.510 --> 41:43.270 We'll come to that in a second. 41:43.470 --> 41:50.670 Car alarms, I've already found that existing RF systems often have very simple reset codes. 41:51.850 --> 41:58.010 The reason they do that is so their engineers can unscrew a car if you get locked out of it. 41:58.650 --> 42:00.810 And I found this out because my wife phoned me. 42:00.810 --> 42:02.950 It was actually after DEF CON a few years ago. 42:03.290 --> 42:06.010 A few of us were sitting around, decompressing, having a beer. 42:06.010 --> 42:09.730 I get a call from my wife saying, oh, you won't guess what happened to me. 42:09.870 --> 42:13.530 I got locked out of the car in this really bad part of town with loads of shopping. 42:13.530 --> 42:14.670 It was getting dark. 42:14.890 --> 42:18.030 I had like three kids, not all mine, three kids with me. 42:19.170 --> 42:20.370 And I couldn't get in. 42:20.370 --> 42:21.330 I phoned the garage. 42:21.330 --> 42:24.690 They said, well, it's going to be two hours before we can get someone out to you. 42:25.430 --> 42:27.190 So she explained the situation. 42:27.930 --> 42:30.350 Single female in a bad place. 42:30.350 --> 42:36.190 They said, okay, we're not supposed to tell you this stuff, but this is what you do. 42:37.010 --> 42:40.710 So you can imagine my first question is, are you all right? 42:40.770 --> 42:41.270 No. 42:41.270 --> 42:44.630 My first question was, you did write down the code, right? 42:46.590 --> 42:49.490 And being a good hacker's wife, she said yes. 42:50.830 --> 42:53.750 And got a round of applause from the goons around me. 42:53.750 --> 42:56.370 So she gave me this code. 42:57.190 --> 43:02.510 A few weeks later I was driving with a friend and he's in a rental and we have to drop it off on a garage forecourt. 43:02.890 --> 43:06.590 And I noticed that he had the same remote as my wife's car. 43:07.330 --> 43:08.930 So I'm like, well, hang on a second. 43:08.930 --> 43:10.230 Let me just try something. 43:11.170 --> 43:12.390 Do the code. 43:13.190 --> 43:18.330 You don't want to know what 50 cars opening their doors at the same time sounds like. 43:26.560 --> 43:28.740 Especially when you're not supposed to have done it. 43:29.320 --> 43:31.600 By this time we were running down the road. 43:34.270 --> 43:42.590 Turns out that hotels, when you forget your PIN number that you put in, they come with, guess what, an infrared dongle. 43:43.370 --> 43:46.410 Don't have a hack for you for this one, but I'm looking into it. 43:47.850 --> 43:49.430 This is a great device. 43:49.430 --> 43:50.250 TV be gone. 43:50.250 --> 43:51.610 Who's played with these? 43:52.590 --> 43:53.670 Yeah, a few people. 43:53.670 --> 43:55.030 Very cool device. 43:55.250 --> 43:58.770 Press a button and it sends every known off signal. 43:59.170 --> 44:01.010 So press the button once and just wait. 44:01.010 --> 44:07.910 And the TV in the bar that's irritating the crap out of you because they're playing sports is going to go off. 44:08.570 --> 44:11.050 So I cracked one open and had a look. 44:11.050 --> 44:13.230 And it's a simple development chip. 44:13.330 --> 44:19.970 The guys who sell it sell a system where you can very rapidly develop applications that use it. 44:20.050 --> 44:22.650 So I thought I should come up with one of my own. 44:28.670 --> 44:30.850 You'll notice the happy smiling face here. 44:30.850 --> 44:33.210 I'll just flick between the channels for you. 44:36.820 --> 44:38.880 One button and it's owned. 44:38.880 --> 44:41.660 So I might work on that. 44:42.840 --> 44:43.780 That's it. 44:43.780 --> 44:44.980 Any questions? 44:47.420 --> 44:48.680 Yes, sir. 45:00.080 --> 45:05.880 I've seen some of the new modern systems and I haven't seen any better controls. 45:05.880 --> 45:09.700 The question was will modern systems fix this problem? 45:09.700 --> 45:14.680 The newer systems I've seen still have the exact same problems but it's actually worse. 45:14.680 --> 45:20.580 They're starting to do things like allowing you to put credit card details in through your TV. 45:20.580 --> 45:22.620 And as I said, webcams, stuff like that. 45:22.620 --> 45:26.820 So the potential for abuse is actually getting worse. 45:28.120 --> 45:28.980 Yes, sir. 45:35.140 --> 45:37.700 The question is have I played with street signs? 45:38.320 --> 45:41.060 The big screens in Vegas? 45:41.820 --> 45:49.980 It's very likely the very systems I'm talking to, the desktops I'm talking to, are probably on the same network as the systems that are controlling those signs. 45:50.340 --> 45:51.760 Just a thought. 45:51.760 --> 45:51.820 Yes , 45:56.260 --> 45:58.320 sir. 46:00.040 --> 46:01.600 Can I tell you what? 46:02.240 --> 46:04.360 Can I tell you what the codes are? 46:05.240 --> 46:07.200 I think you should work for that. 46:08.380 --> 46:10.800 I spent nine hours in a room in Amsterdam. 46:14.180 --> 46:16.660 Oh, for the car. 46:16.940 --> 46:18.280 It's actually very simple. 46:18.280 --> 46:27.120 All you did was take the battery out, press the unlock code ten times slowly, put the battery back in. 46:27.120 --> 46:30.720 I think that was just to discharge any capacitance that was in the system. 46:31.060 --> 46:35.740 And then again, press the unlock code ten times very slowly. 46:36.460 --> 46:42.380 And I think what's happening is it's saying to the car, I'm a brand new remote, you're a brand new car. 46:42.560 --> 46:43.780 Let's party. 46:48.380 --> 46:49.840 Any other questions? 46:54.220 --> 46:56.580 The question was are you able to get phone records? 46:56.580 --> 46:57.960 It depends on the hotel. 46:57.960 --> 47:00.180 Different folios show different detail. 47:02.400 --> 47:03.780 Okay, last question. 47:05.600 --> 47:06.600 There isn't one. 47:06.980 --> 47:08.100 Okay, I'll ask one. 47:13.620 --> 47:14.940 Do I have any literature? 47:14.940 --> 47:19.400 I don't have any with me, but I'll get the slides put up on the DEF CON site so you can view them. 47:19.400 --> 47:20.920 So that's it. 47:38.200 --> 47:39.620 Thank you, Major Malfunction. 47:39.620 --> 47:42.580 We need everyone out those doors, not the doors you came in. 47:43.080 --> 47:43.860 Those doors. 47:43.860 --> 47:47.260 We have a big line for the next presentation on war driving.