so everyone give a round of applause for joe
all right we're in oh uh everyone thanks for coming it's great to see you all here
uh my name is joseph gabay and today i'm going to be talking to you about smart shopping cart wheels
uh if this seems familiar uh i two years ago my first time at defcon actually i gave a presentation
about when i first started my work on these i did a little bit of early exploration and uh
found some cool things you could do with them that i'll be talking about now but uh this talk is a
continuation of that i found a completely new brand of wheel and did a good amount of reverse
engineering and i'd like to take you all on that journey with me so before i get any further i want
to give a quick disclaimer especially because a couple of my co-workers are out in the audience
here today uh this is a personal project this has all been done on my own personal time with
my own personal equipment uh with my own personal curiosity uh none of this reflects my employer or
anything i do professionally and uh yeah this is just me doing my thing trying to have some
fun and learn some stuff so what this talk is uh i'm gonna be taking you on the journey that
i went on to reverse engineer this wheel there's a lot of troubleshooting there's a couple dead ends
i'm going to be pulling at some stuff that's oh that's neat but it doesn't go anywhere else
and that's the nature of reverse engineering my ultimate goal with
this project was to try and defeat and bypass the anti-shoplifting features that rocatech introduces
and i think i got to that point and you know my previous talk was kind of more focused on
just that this one's going to be bringing you along on how i did it we're going to be looking
at devices for hardware firmware and security vulnerabilities we're going to be playing around
with debuggers and programmers like pick kits logic analyzers like sales and cool software
stacks like yudra and audacity do some fun stuff
we're going to instrument a shopping cart with a bunch of sdrs and go war shopping we're going to
do some old school audio freaking what this talk isn't this isn't leaked hacking i'm not dropping
some hot new zero days uh this isn't an endorsement or instructions on how to shoplift
any more than the lock picking village is instructions endorsement on burglary
uh you know we're hackers we talk a lot about security systems and how to defeat and bypass them
and a lot of times that's a purely academic and intellectual
exercise and this is what this was for me and uh yeah at the end of this i'm going to show you how
to defeat the security system you know use use that power responsibly and also this isn't going to be
a 100 definitive teardown of how this system works this is reverse engineering you know it
was limited in scope i probably got some things wrong and if there's any rocotech engineers out
there listen just be like oh no we didn't do that at all you got that wrong yeah that's the
nature of the beast but at the end of the day i i figured i had to walk out of a shopping
center with a out the cart locking up and i consider that a victory so who am i uh i'm a
hacker i'm a robotics engineer i don't know why that's cut off for some reason but in my previous
life i was a robotics engineer i worked in a lot of startups with embedded systems and electronics
i jump out of airplanes for fun i freak shopping carts and i really question has anyone ever seen
the other side of the moon and who i'm not i'm not an expert at some of these things i'm not a
nervous engineering expert you know i do pull some code off of the micro controller and i do open up
gamer and look at it it's pretty basic so there isn't a whole lot to do there you know maybe
someone with a sharper eye than me could see some stuff that i missed but that wasn't instrumental
to getting to the end results but i still think that's an important part of the journey to look at
i'm also not a radio engineer an electrical engineer and there's equally some stuff i missed
there again i'm also probably not 100 correct here so if you see anything that i missed or i
said anything that's completely wrong you know i've got my email address if you want to talk to me
at the end of this, shoot me an email. I'd love to learn stuff. So I talked about how two years ago
I talked about these wheels, and I want to give a super quick recap. So for those of you who aren't
familiar with security wheels on shopping carts, they're basically a wheel. They're usually on
either one or two of the wheels on a shopping cart, and they have some mechanism that can lock
and unlock the wheel to immobilize the cart. Usually these are used to prevent shopping carts
from walking off in urban areas where they're connected directly to sidewalks, but some companies
advertise that you can have anti-shoplifting features, you know, make sure somebody went
through the checkout lane before exiting the store, otherwise it'll lock. And that's one of the big
things Rokitech advertises and that we'll be looking at. There's two main players in this
system, Gatekeeper Systems, and I've seen them all across the country, and then Rokitech, which is
a smaller player that I've only seen in one place. We'll talk about that in a second. But they have
some major commonalities.
The big one is that they have a buried perimeter wire that's broadcasting a radio signal at a very
low frequency, usually around 10 kilohertz, and that's a big pain to transmit at. We'll get into
that later, but it's very similar to those invisible fence systems you'll see for, like, dogs.
They can receive lock and unlock commands at these ultra-low frequency bands, as well as some of them
have capabilities of receiving some commands at 2.4 gigahertz, which is a much friendlier band to
broadcast.
So they have some locking mechanisms. These are both two Gatekeeper Systems wheels, two different
styles. One of them has an internal wheel that will expand and lock the wheel like a clutch, and the
other one has a plastic piece that's spring-loaded and will come down and cover the wheel and prevent
it from rolling forward. And the Rokitech has a slightly different one. We'll get into that during
the mechanical teardown. But this is a picture of the buried wire system that you'll actually see in
the parking lots. A store nearby me was having their parking lot locked. And they had a lot of
parking lot and sidewalk redone. And this wire was nice and exposed for me to look at and play with.
So that was pretty fortuitous. But this is what it actually looks like underneath that seam you'll
see in the parking lot. Or inside supermarkets, you'll sometimes see them integrated directly
underneath, like, the tile, you know, for, like, the Pro-Check system. And last, this is the real
fun part of the last talk, is the methods I used to capture these signals. So these signals are in the
tens-of-kilohertz range. That's ultra-low frequency. Anything that we normally deal with is almost
always going to be over at least a megahertz. So that's a couple orders of magnitude lower than we're used to
dealing with. And it gets weird dealing with that. But one of the interesting things we'll notice is 10
kilohertz isn't the audio range. If that were sound waves, we'd be able to hear it. So we need some sort of
electronics. We need some device to convert the radio waves into electronic signals. And then some device to
something that can deal with 10 kilohertz electronic signals, like an audio amplifier.
So to do this, I made a loopstick antenna, which is a pretty basic kind of antenna. They're not
very good at transmitting, but they're okay at receiving. And it's a ferrite core and some
enamel wire, both you can grab them off Amazon, put it into a cordless drill and put on some
Netflix and just wind the antenna. The more loops you have, the more pickup you're going to get.
You have to do a little bit of balancing for the impedance matching and whatnot, but you can find
a ham radio handbook if you really want to dive deep into that math. And you take this and you
solder it to a headphone jack. You'll see there's a little resistor that's hooked up there, and what
that does is it actually convinces your phone or audio device that instead of a headphone jack,
it's a microphone jack, so you can use this to record. So I had to dig through my old
electronics and I made a loopstick antenna. So I'm going to show you what I did with this.
electronics bin to find a phone that actually had a headphone jack. Anyone remember those?
But eventually I found one, and this is the method that I was using to capture the ultra-low
frequency signals, and we'll talk about how to broadcast those later. So I mentioned there's a
new kind of wheel, and that's Rokitech. How I came across this involves a funny story with my dad.
So my dad's a weird guy, as you can imagine, if you know me, and he loves collecting curios. He
recently retired, so he's had a lot of time to scour eBay and local garage sales, and this is
his workshop, and you can see all the fun stuff he has. And yes, that is a functional phone booth
in the back. He's got three of them. No, he doesn't realize how cool that would make him here.
This is completely unrelated to hacking. He just thinks they're cool, and I love him for that.
But anyway, so one day I get a call from my dad. Hey, Joe, I got one of those shopping carts that
has the smart wheel, but it's locked.
Do you have any chance you could help me unlock it? And I'm like, yeah, sure. This is my thing, I guess.
So, you know, I head up to my parents' house in the garage, and he not only has the wheel,
he has the whole cart attached to it, which I don't ask where he gets these things, and I think
it's better that way. But I take a look at the wheel, and lo and behold, it's one I've never
seen before. And no wonder, you know, he's trying to use the website that has the little buttons to
unlock it, and it wasn't working, and he was wondering why. I said, well, of course,
because I haven't seen this before. So I go and look it up, and that's how I discovered Rokitech.
So this is what the wheel looks like, and you can see some of their marking material. This was
actually, I took this from a store, a grocery store near my house. You know, Rokitech focuses
a lot more heavily on the anti-shoplifting angle in their technology than Gatekeeper Systems,
which is more about retaining your carts on property. So just slight different approaches,
but Gatekeeper Systems does also.
advertise that they have a similar system to what we're going to talk about, but I haven't ever
seen it used. So now my curiosity was piqued, and also I had to unlock this cart for my dad.
So I need to do some research. There's a couple great wells of information I go to when I'm
trying to do OSINT, and so publicly available information, FCC filings, always a huge gold
mine. If you have anything that's going to be broadcasting, receiving anything with radio stuff,
you have to disclose a huge amount of information to the
FCC about the frequencies, the bands, and usually it's easier just to include the whole
instruction manual, because it's going to have all the info they want. If you care about security,
you can carefully redact it and only have what you need. But in this case, Rokitech had quite a
bit of information. What you can also look at is patent information. A lot of times there's very
technical descriptions of how systems work, because that's what a patent is. And in return for
that disclosure, you get protection. But disclosure is disclosure, and that can tell us a lot.
And lastly is marketing information. Companies tell us a lot about how things work when they're
trying to get us to buy things. And we'll talk about what we found there in the next couple
slides, but then afterwards for further research, you have to do some field research and get your
hands dirty. So that's physical disassembly, taking RF captures, and some reverse engineering.
So in terms of marketing material, this is from one of their brochures, and this looks pretty
standard and doesn't seem like it has a lot, but it has a couple things that stand out.
One, it claims that it has an RF receiver that can up and download data. So that immediately
peaked, all right, what data are they uploading? What data are they recording? Because you could
be tracking, all right, where is this cart going in the store? You could be tracking shopping
habits, et cetera. So that piqued my interest. And in terms of thinking about some of the design
assumptions, it's also battery powered, and it lasts very long. That seems a little silly,
but what that tells me is it's
a sealed battery system. It's not meant to be serviced or easily replaced very often. So it's
probably going to be designed and optimized around saving power rather than, say, security.
Because if you're doing encryption every time you send a signal, that's a lot of CPU time,
and if you only have that little unrechargeable battery, that's life. So you see a lot of design
decisions and a lot of security decisions get made and eschewed for other technical design
reasons.
And that's
a big,
big thing that you can look at in reverse engineering.
So moving on to the FCC filings. So the wheel itself had a FCC ID number on it,
and the first three or five letters of that are actually common to the company that makes it.
So you can punch in that first five and get a list of all of the FCC filings that Roketec
has ever made. So from this, you can pivot to seeing stuff like this little box here,
which is what they attach to the checkout counter. And when the payment goes through,
it sends the signal out.
And that's what tells the cart you're allowed to leave.
So this is the FCC filing for it, and I've taken out a couple snippets of it. The big part,
it has a couple information up all above there. It talks about the 2.4 gigahertz of signal,
the B signal it emits. And it also talks a little bit about the test procedure. Now,
this is useful for the 2.4 gigahertz, but I also found the one for the box that
actually connects to the buried loop wires and sends out all of those signals. And,
uh,
it tells us right there the exact frequency that it's using, 8.13 kilohertz. And it also
tells us that there's three different 8.13 kilohertz signals, the A signal, the C signal,
and the H signal. It also tells us a little bit, if the relevant shopping cart casters receive two
A signals and lock. So, all right, if it gets two of those signals, it'll lock. That's probably the
one at the entrance of it. And we can start figuring out how this works. And later on,
we'll turn this into a flow chart and start looking at how we can bypass it.
So, I've talked about loop stick antennas. I've talked about the frequency. How are we going to
actually capture and process these? So, we can do this in the audio frequency. We can use a
loop stick antenna to capture it. And we can actually, because it just comes out as an MP3
file and those radio waves get encoded as sound, we can open up an Audacity, like,
and just treat it as a regular sound file. And then we can play it back as a radio file. So, we have all the parts we need.
It's time to go war-carting. So, this is my little setup. I've got my laptop here. I've got a SDR to capture
some of the signals. And I've got a loop stick antenna connected to my phone with a little dab
of hot glue so nothing comes out because 3.5 millimeter headphone jacks did have some flaws.
Can't do this with Bluetooth though, sadly. But anyway, so I had this all running on an audio
recorder app. And I had a GQRX recording from the SDR for the megahertz and gigahertz signals.
And I put this all into my war-cart. And you can see the smart wheel in the corner there. And
just put my backpack down in there, you know, completely innocent. It's where I keep my reusable
shopping bags and my reusable shopping SDRs and all the important stuff there. So, what my plan
was, my plan was to go into this grocery store, engineer a situation in which my cart would lock,
you know, completely innocently, feign ignorance, and wait for the kind clerk to come up and with a
lock the cart for me. And at which point I would capture a copy of that unlock signal and I'd have
what I need. With the gatekeeper system, thankfully, I was able to buy a couple of the remotes the
stores have on eBay. With Rocotech being a bit more obscure, I wasn't able to, so I had to go
and find these signals a different way. So, that was the method and it worked. So, I went in, used
the Coinstar machine for a bit. Oh, no, I should probably get a bigger cart before I go shopping.
Locked and the alarms went off and the store clerk came rushing out, super apologetic, and I was
like, no, it's okay, I promise. But anyways, I got it. So, this is, you can see there's a couple
different bursts, but towards the right there, that's what the unlock signal was. And we're
gonna clean that up in a little bit and look at that a bit closer, but as a result of this little
war shopping experience, I got a good amount of signals. So, I got a copy of, there's a perimeter
itself. So, if you try to take the cart out of there, the cart will just lock automatically.
There's the arming lock signal, which is at the entrance of the shopping area. So, you take it,
bring it into the market, it gets armed, and then if you try to bring it out again, it'll lock.
There's obviously the unlock signal, which can unlock a locked cart. There's a megahertz level
alarm mute that can mute the alarm once it gets set to that IntelliBox we just saw. And then
there's the per check signal. And that per check signal is what the,
uh,
uh,
a checkout counter is sending to the wheel to say, hey, it's been paid for. If you, once you
get the, uh, exit signal, you know, don't lock. Now, you can see here in GQRX, I did capture a
copy of the 2.4 gigahertz per check signal. Uh, I'm not gonna go too deep into that for reasons
I'll talk about in a second. Uh, there actually wasn't a whole lot happening at 2.4 gigahertz,
but this signal is also repeated at the kilohertz frequency, and that's a lot more useful for what
we're going to do.
Uh, both because it's paradoxically easier to transmit at kilohertz for what we're going to do,
and because a gigahertz capable SDR is slightly annoyingly expensive. You know,
you have to get a HACC RF and, you know, it's, you can't get that high with the, uh, real cheap
SDRs. So, this is what the unlock signal looks like. It's, uh, 8.15 kilohertz tone. Uh, it looks
like it's kind of broken up a little bit, but, uh, in Audacity, I recreated it just from a pure
tone, and it was just a solid noise, and that consistently unlocks the wheels. So, that's, uh,
that appears to be what it's listening for. The arming signal is, uh, again, at 8.15 kilohertz,
but it's 50 millisecond length pulses at a 33% duty cycle. So, it's just kind of pulsing that.
And you're gonna notice, uh, all of these signals are pretty basic. You know, they're either solid
tones, pulses, or very basic shifts. And I'm gonna talk about this at the very end when I speculate
on design decisions, but I, I think this is a very intentional design because it's easy to do with
low processing power. The cost is security, and that's gonna let us do some fun things later, but,
uh, this is the lock signal. This is a 7 kilohertz pulse, 30 milliseconds with a 50% duty cycle.
And then, uh, this is the one that I really wanted to get, the per check signal. So, you can see
there's a couple things I actually, uh, uh, checked out, bought a pack of gum to do it again, so I
could see if there was any difference, you know,
between subsequent ones, and the answer is no. And if we, uh, adjust the contrast a bit and zoom
in, we can see what that looks like. Uh, it might be a little hard if you're not used to reading
spectrograms, but, uh, what you can see is there's a couple lines that are parallel, and
partway through, they dip down a little bit and then go back up, and that's kind of repeated like
a ladder across a bunch of different frequencies. So, what this is, it's a tone, and I'm not sure
what frequency it was originally intended to be at. Things can get a little weird with harmonics,
but you can see, it drops down by 250 hertz, goes back up, and, uh, that is the signal that it's
allowed to leave. And now, if I can, I actually have what that sounds like, uh, if you, you know,
this was a recreation of it, so I cleaned it up a lot, it was very, very faint in the original audio,
but if you take that pattern, and you, uh, retune it, it sounds like this.
And that's all, uh, it takes.
Okay.
Well, that's enough, uh, and that's all it takes to unlock the shopping cart. So,
let's get a little freaky. And for those of you, uh, unfamiliar with what freaking is,
it refers back to, uh, a famous hacker, John Draper, who figured out that you could use the
toy plastic whistle in a Captain Crunch cereal box. If you played it into an old-school payphone,
it was the right frequency as some of the control codes, and it would let you basically access admin
mode.
And so, freaking is kind of one of those fun little, you know, using unconventional signal methods to get control
that you shouldn't have. And I, I think this is adjacent enough to it where, uh, uh, we can call it that.
So, a couple things let us do this really easily. These signals lack any sort of authentication or security.
It's the same signal each time. There's no rolling code, nothing get incremented, it's the same each day,
there's no time stamping. Uh, and again, this was probably done because all of those things are computationally expensive,
and every processor cycle takes a couple joules, and you have a limited amount of those in your lifetime.
And, you know, if you can make the difference between a year, uh, a wheel that lasts two years in the field versus one that lasts five years,
that's huge from a marketing perspective. And, you know, unfortunately, a fact that's not, uh, at heart to people who aren't in this room is security isn't number one.
You know, there's so many other business factors that go into these design decisions, and, uh, a lot of times, security gets put in the wayside.
You know, I don't think their threat model here was super sophisticated. I don't think they expected some random nerd
to get real curious and reverse-engineer it. So, I think it could be forgiven, but, you know, you can see the impact of other
factors and design decisions into the security of a system. And, you know, in my day job, when I do assessments of commercial devices,
you see this a lot more, and it's a lot more pronounced.
You know, you can start to come across posing the same facts about the other ones with the same composers, right?
to see corporate politics in security decisions. So when we're talking about freaking these wheels,
we need to talk briefly about what parasitic EMF is. So whenever you're putting current through a
wire, you're creating a magnetic and a radio field. They're kind of the same thing. It's a
whole physics thing. But basically, you put current through a wire, you're creating radio waves.
And normally, that's a bad thing. You know, you're putting energy into the air that's not going into
the thing you want it to. And in the case of a speaker coil, you know, that's energy that's radio
waves, just a tiny amount, but that's not going to, you know, moving your membrane and creating sound.
But in our case, since we're trying to transmit a signal at the audio range, when we play an audio
file, the parasitic EMF is also in the kilohertz range. So if we play the right audio file,
through our speaker, at a loud enough volume and hold it next to one of these wheels, we can
control the wheels and send the lock and unlock signals. And that's what we're going to be doing.
So I had this successfully working with the Gatekeeper Systems wheels. And the website I'm
going to link to at the end has buttons you can just push play for lock and unlock, and it plays
the little audio and you hold it up to the wheel. And I'll have a demo in the physical security
village if people want to try it themselves. But I was having inconsistent results with these
records. And I was trying to figure out how to do that. And I was trying to figure out how to do
that with the Rokitech wheels. And I couldn't figure out why. So I need to go deeper. And the
only way to do it was physical disassembly. And I have no idea why these things were on eBay. But
I'm not complaining. So I got a couple samples that I could tear down destructively if I needed
to and really dive into it. So now it's time to get into reverse engineering. And this is where
the concept of scope comes in. You know, this is a hobby project. Whenever you're reverse engineering
something, there's near infinite scope available. You can go as deep as you want and deep as you have
time for. And when you're reverse engineering, you need to carefully select that scope. You know,
there were some things that I found was a dead end and I, you know, left them as it was. But if I
wanted to, I could have gone a lot deeper. You know, there's a couple mystery chips that I was
like, all right, that's what this probably is. And I could have fully traced out the PCB and made
more educated guesses. But I didn't because I didn't want to and that's okay.
That wasn't in the scope that I set for this project. You know, reverse engineering can be
sometimes like looking at some footprints and trying to figure out what the person had for
lunch. You know, you're looking at some weird things and trying to intuit something completely
orthogonal. And if you're good, sometimes you can. And it wouldn't be a presentation that I
give if I didn't sneak in a Terry Pratchett quote. And I think this really speaks to the heart of
reverse engineering is what happens to people who ask too many questions? They need answers. And
it serves them right. And we got some answers. So I got this wheel and I started tearing it down.
And mechanically, it's pretty similar to other wheels. You know, it has a battery compartment, a
sealed PCB enclosure, some mechanism to lock it. You know, you have a little locking latch that's
controlled by a pawl and that pawl rotates, releases that latch and then it interferes with that
internal wheel and prevents the wheel from spinning. Nothing too crazy. If we look into that
sealed PCB area, we get
to the circuit board, the real area of interest. So we've got that inductor. You know, that's
going to be the kilohertz antenna. It's basically the loop stick antenna that I made except it has
much better amplifier equipment designed by a real engineer. We see that underneath it, there is
a missing chip footprint. That's going to be a lot of fun in a couple seconds. We see the main
microcontroller, a PIC18F23K20. Of note is this chip doesn't have 2.4 gigahertz capability.
So the 2.4 gigahertz capability they're advertising is kind of curious since they need some sort of
transceiver unless they're doing something really, really basic and weird with raw signal. We see
there's a header that will later turn out to be a programming header and we have some wires that
connect to the battery connector and the motor connector. Looking at the back, we have a mystery
chip. That's going to be fun. It's just labeled N100B and has DE4 printed on it, nothing else. And
we have just a little tactile signal file. And the last one on the left is going to be the PIC18F23K20.
sensor that's used as a limit switch so it can tell, you know, when it's in the locked or unlocked
state. So now we get to use a technique that I really like using for tracing out PCBs, which is
overlaying images. So we have the front and the back of this board, and we can see that the traces
jump from the front to the back, and it's a pain to trace out with a multimeter and try to keep
track of it. So for smaller boards like this, you can sometimes do it, but even on small boards
where you don't have to, I find it's really useful if you take good straight-on photos of the front
and back, you load it up in GIMP or Photoshop and mess with the transparencies, and you can get a
really cool overlay. And so you can kind of see where holes, where traces, where vias and everything
align and what components they talk to. And from here, you can pull up the data sheet for components
that you can identify, and you can start tracing out all of those traces. And having that transparent
image and being able to flip back and forth is super helpful.
So in this case, I traced out these pins, and I found that that header had VPP, VDD, PGD, and all of
those lovely, lovely things that people who work with microcontrollers will recognize as the debug
header. So the next step was to grab a debugger and see what I could find. So this is a pick kit.
It is the standard debugger for pick microcontrollers. They're super cheap on Amazon,
like 20 bucks. I got one and hooked it up.
So you hook it up, and then you load up pick kit 2 plus. Pick kit 2 plus is the premium software
that has all the fancy features, but pick kit 2 minus is the free one that doesn't.
But it has enough for me. You connect it via USB, take care of the bootloader stuff for your pick
kit, select your device, go through the rigmarole, and if you're lucky, we're in.
So we get a couple cool things. We can see that we've got program memory,
we've got some configuration bits, and we've got EEPROM data. Now, a quick word about the
configuration bits, because this is also something I see a lot in the commercial world. Set your
security bits. You know, microcontrollers have code protection. You can code protect it so people
pull off the code. You can write protect it so people can't overwrite the code you put on.
You can even do external block table reads, which I have no idea what they are.
And you can see what they do in the data sheet if you look up that table,
and I'll save you the trouble, none of them are set on this. None of the security bits are set.
So that means we can pull off the code from the microcontroller and open up in a reverse
engineering program, like Ghidra. And interestingly, there's only about 2 kilobytes of actual code.
That I managed to pull off. Everything was set to OXFF. It looks like it was mostly the resets
and the interrupts that were set, and a couple other bits of code. So I'm not an RE expert. I
could be missing things. I had a couple friends who are look at it, and they also agreed that
there was not a lot. So based on the fact that this is a really basic microcontroller,
I'm guessing the fact that it's really just handling the, you know, the limit switch for
the motor, powering the motor, and then maybe doing some super basic signal processing and then
interrupting based on that. And, you know, maybe a couple bits for a state machine and tracking
that. But it really seems like it's that basic and it's not doing any encryption, any data uploading
or downloading or anything like that. And then we've got this mystery chip on the back. And
we've also got that mystery footprint of an unpopulated chip. And I'll talk more about this
in the speculation section, but that's probably where they put the 2.4 gigahertz stuff if they
wanted to implement it later. But from tracing it out early,
I noticed that all of the pins on that mystery chip get broken out to both the main microcontroller
and also that unpopulated header. And that unpopulated header makes it real easy to, well,
easy to connect fly wires. This is miserable work. This is my first attempt at it. I ended up
having to completely redo it. But you take a little 30-gauge wire or some enamel wire,
if you have it, you wrap it around and you solder it real tiny.
Use lots of flux and a small soldering iron tip. From there, you can hook it up to a Saleh
logic analyzer. A logic analyzer is basically a whole bunch of, it's like an eight-channel
oscilloscope. It's not as high resolution, but it can do some really cool stuff.
And run it through the boot and see what we get. And we get some interesting stuff. This
is in digital-only mode. And one thing I noticed is everything was dead until I touched the wheel.
When I moved it, those lines, you see the yellow, green,
and purple ones lit up. So they were sending something. And I was a little confused.
So it looks like there's some sort of accelerometer and it's only listening for
signals when it's in motion. Again, probably a battery-saving feature, but that would explain
why I was getting inconsistent results with my replay attacks, because I had it on the
bench top with the speaker and it wasn't moving, so it was just ignoring any signals.
But looking at some of these signals, they're nearly identical. Slightly different,
but why would they replicate them? So I switched it to analog mode and we see
that they are very similar waveforms, but it's the antenna. I played a couple of the lock signals
and we see those waveforms and we see on the upper traces similar modified waveforms.
My theory is that they're doing, they're filtering in hardware. So they have passive
components and they're doing their radio signal processing and a couple of their mathematical
hardware levels so they don't have to do it in the processor. If they need to find the absolute
value or the magnitude of it, you can do that with passives and save yourself compute time.
So we kind of set the SaleA to a mixed digital and analog mode and got a good capture. This is
the whole boot sequence. You arm it, you put it at the arm thing and you can see it lock and
it goes through this whole thing. If you're wondering if there's any serial data there,
no, there wasn't any serial on any of those lines. I think there is chip-to-chip communication lines,
there, but because that chip is unpopulated, there's just no communication happening.
So with this, we can make a flow chart and that's going to help us bypass this. So we have an idea
of the basic states it can operate in. We have an idea of the signals it's listening for and can
listen for, and we can start thinking of bypasses. So I just put together a quick little flow chart
of how it works. One big caveat is if it gets the arm signal within 30 seconds of the first one, it
doesn't lock. So you brought it through and then brought it back quickly and it doesn't lock and
it goes back to idle and that's going to be important. So looking at this flow chart, we can
see three possible paths to bypass this. One is the very obvious one where we just replay the
per check signal to it and say, hey, yeah, you're okay to leave and you leave and I've tested this
in the store with an empty cart and successfully been able to get the cart back out without it
triggering the alarm. There's other ways too. The 30-second disarm can be exploited. So if you're
in the store, you bring it out and then you bring it up to the buried line again and then back it
out and it's entered the idle state again, thinking it was back into the little cart corral area,
but it's actually in the store and it's not going to arm until you take it back out.
And then the last one, and this is probably the most reliable since the other two give you no
feedback, is to bring it through a lock cycle. So you have a lock signal and an unlock signal.
You bring it into the store, you play the lock signal to force it to lock,
then you play the unlock signal to force it to unlock.
And then it's back in its idle state disarmed because it thinks it's already been through it.
And with that, you have positive feedback knowing that it's working and you're not just playing a
speaker sound at it and hoping it picked it up and it's not going to alarm. So those are the
three main methods for bypassing this that I found. And now, as I promised, it's time for a
quick little bit of speculation. This is me just shooting off the cuff stuff I think they're doing
or is going on that I'm not a hundred percent sure on.
So let's talk a little bit about their 2.4 gigahertz and how they have it.
Their FCC documents and their marketing materials say they do, but their PCB says they doesn't.
You'll notice they have, there's a little trace going around the entire perimeter for that and
those are usually used for gigahertz antennas. But you'll also notice if we zoom in where that
connects to the board, all of the passive components are depopulated. That combined with the
depopulated, you know, what looks like it could be a microcontroller,
I'm going to guess that they designed this to be able to at some point do 2.4 gigahertz,
but either for design reasons, economics, or battery saving reasons, they said, hey,
we can make this only work off, you know, the 8.1 kilohertz range and we don't need to do this
radio stuff. And maybe if a customer did want to do the advanced stuff and be able to upload and
download data, you know, they could have a revision of this that does have that built in, but
I haven't been able to find this and I've gotten a handful of these
wheels off eBay from all different parts of the country and none of them that I've opened up have
had those chips populated or any indicator that it's doing more advanced communications.
So that mystery chip on the back, that could be a crappy little system on chip that's handling the
2.4 gigahertz. I imagine if it were, it would have been closer to that in those antenna traces.
My honest guess is that's an accelerometer and that's how it's actually sensing when it's in
motion. A lot of accelerometers have ultra low power modes, but they're not going to be able to
do that. They're going to be able to do that. They're going to be able to do that. They're going to
send an interrupt signal when it's in motion. So you're not actually doing any communication or
like reading and data processing. You're just, hey, was this in motion within the past couple
seconds? And that's consistent with what I'm seeing on the logic analyzer. And the 2.4 gigahertz
could probably be added later, but probably won't because that's going to use a lot of power that
you don't have. I want to give a couple of thanks and shout outs. First of all, it's my dad for
bringing these wheels to my attention to
the DEF CON staff and goons for making this happen and for somehow letting me on stage again
to talk about shopping carts. Like two years ago, you gave me a stage and I talked about shopping
carts for 20 minutes. And like this year, you guys have no excuse. I told you what I was going
to do. You knew what I was going to do, but you all still showed up here and I'm real thankful
for all of you. I'd also like to thank all of my friends and loved ones, some of whom are here,
some of whom are back home. And we'll see this in video. Hi, mom. Hi, dad.
And then just everyone who's made all of the software stack that I use this, the people who
made Audacity, URH, Ghidra, thanks, NSA, and all the other tools, as well as just the random
people on eBay who have these things for sale. I don't know how people end up with these, but
that's how it goes. This is just a quick references. And that's it. I'm going to
have a demo in the physical security village. I'm going to go set it up right after this,
where we have, I modified some wheels to be transparent so you can see what's going on inside
of them. We have a demo in the physical security village. I'm going to go set it up right after this,
a website, bgaydocrime.com slash carts. It has little play buttons where you can
play these audio files. And if you want, check us out in the Flamingo, in the physical security
village. We've got, I've got four of these wheels, some of the gatekeeper systems, two of
the Rokatex, and you can actually try this yourself with your phone. If anyone has any
questions, happy to answer them. I'll also be around the physical security village if we run
out of time. Thank you.
Thank you. Thank you all for coming. This was a lot of fun to work on. I had
a lot of fun and I'm just real thankful to be here and that you all let me talk about
shopping carts to you for so long. Any questions? Bueller? Bueller? All right. Well,
thank you, folks. Have a good one. If you have any questions, feel free to grab me after the talk.
I've got pretty distinctive hair. All right. Have a good one, folks.
Bye-bye.