RE: (stupid one) physical security of remotes?

This is a multi-part message in MIME format.

------=_NextPart_000_007D_01C5FFF8.DD61BEB0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

There was a presentation at Defcon 13 (this past summer) with the title "Old
Skewl Hacking - Infrared" by Major Malfunction that showed a lot of the
possibilities for abuse of infrared setup boxes. It showed how he used
infrared to hijack someone else's email session, view charges of other
people's rooms and even get control of an NT box that was somehow connected
to the TV system. The presentation was mostly focused on hotels but I'm sure
similarly evil things could be done with home setup boxes. You might be able
to find the presentation slides online.

Regards,

Cosmin Stejerean

-----Original Message-----
From: Michal Zalewski [mailto:[email protected]] 
Sent: Friday, December 09, 2005 12:28 PM
To: [email protected]
Cc: [email protected]
Subject: (stupid one) physical security of remotes?

Now, I have this ridiculous question about a topic that is not strictly
infosec-ish (at least not historically); still, this is probably the best
place to ask, so I'll go ahead...

It's not terribly important, but got me wondering while I was doing
research on something just remotely related to that topic.

The question is: has anyone at least semi-comprehensively researched and
reported on the potential for abuse of infrared remote control
communications in cable TV set-tops and various other appliances of this
nature?

Yeah, it is well-known and well-documented that various harmless pranks -
such as turning the device on or off - can be played with universal
remotes or computer-controlled transmitters (including high-output hacks
that could work over considerable distances, with no line-of-sight). In
fact, there are commercial products trying to capitalize on this
possibilitty [http://www.thinkgeek.com/gadgets/electronic/755e/].

What I couldn't find are reliable discussions of the opportunities for
going beyond mere annoyance - by causing actual financial harm or legal
trouble to single victims or entire communities. It's easy to think of
such attack scenarios, e.g.: a) in many hotels and using some set-top
boxes, it is possible to automatically order PPV or request other paid
services and have the customer automatically charged a hefty fee he'd have
a real hard time fighting off; b) more advanced digital TV boxes can be
reconfigured or even locked out to prevent use by owners; c) media center
appliances let you send out mails or attack websites (whoop!).

Granted, (a) in non-hotel situations can be mitigated by PIN requests, but
just how many people configure any PINs on settop boxes, unless they have
unruly kids...

I also couldn't find any information on efforts to remediate this, even
though many similar technologies had their flaws addressed in the meantime
(replay attacks on wireless car / garage entry, proximity card replay
attacks, snooping of wireless phones, networks, random bluetooth pairing,
RF keyboard attacks, etc).

I know there must be some anecdotal mentions of hotel PPV attacks, of
"heard something like that on CCC congress" variety - but have you seen
anything that indicates that vendors of such technologies are aware of
abuse potential, and did something (or dismissed the threat)?

Or is it really something that went unnoticed by the mainstream for all
these years? If anything, even if such attacks never occur to real people,
this would be a great way to duck your way out of the court - "but judge,
it wasn't me who sent out all these nastygrams from my nifty XP Media
Center gizmo!".

Mind you, I do not mean to claim this is a serious threat, nor a unique
one. I'm just curious, and surprised I couldn't Google anything up.

Cheers,
-- 
--------------------------- bash$ :(){ :|:&};: --
   Michal Zalewski * [http://lcamtuf.coredump.cx]
Don't look back, the lemmings are gaining on you!
----------------------------- 2005-12-09 18:27 --

       http://lcamtuf.coredump.cx/silence/



------=_NextPart_000_007D_01C5FFF8.DD61BEB0
Content-Type: application/x-pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIKljCCBA0w
ggO3oAMCAQICEHmgZS+wflanSYRLs1zFY/kwDQYJKoZIhvcNAQEFBQAwgaYxJTAjBgkqhkiG9w0B
CQEWFmNhYWRtaW5AY3RpLmRlcGF1bC5lZHUxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhJbGxpbm9p
czEQMA4GA1UEBxMHQ2hpY2FnbzEaMBgGA1UEChMRRGVwYXVsIFVuaXZlcnNpdHkxDDAKBgNVBAsT
A0NUSTEhMB8GA1UEAxMYRWxsaW5ndG9uLmN0aS5kZXBhdWwuZWR1MB4XDTk5MTEwNjIzMTYzOVoX
DTA4MTIyMjE0MzQ1MlowgaYxJTAjBgkqhkiG9w0BCQEWFmNhYWRtaW5AY3RpLmRlcGF1bC5lZHUx
CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2FnbzEaMBgGA1UE
ChMRRGVwYXVsIFVuaXZlcnNpdHkxDDAKBgNVBAsTA0NUSTEhMB8GA1UEAxMYRWxsaW5ndG9uLmN0
aS5kZXBhdWwuZWR1MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANR8Sgf0R/vFN0pdjHzakhPqpGY9
SrRLEykQfmrFsoqpc8mxzNr0bI/KGjF9/8WonTE91JBiyTED2pfZwy2PRFkCAwEAAaOCAb0wggG5
MBMGCSsGAQQBgjcUAgQGHgQAQwBBMAsGA1UdDwQEAwIBRjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
DgQWBBQN6YS18LeqWEJW/vRYyzJP8ybtpjCCASwGA1UdHwSCASMwggEfMIIBG6CCARegggEThoHH
bGRhcDovLy9DTj1FbGxpbmd0b24uY3RpLmRlcGF1bC5lZHUsQ049RUxMSU5HVE9OLENOPUNEUCxD
Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERD
PWN0aSxEQz1kZXBhdWwsREM9ZWR1P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmpl
Y3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludIZHaHR0cDovL2VsbGluZ3Rvbi5jdGkuZGVwYXVs
LmVkdS9DZXJ0RW5yb2xsL0VsbGluZ3Rvbi5jdGkuZGVwYXVsLmVkdS5jcmwwEAYJKwYBBAGCNxUB
BAMCAQEwIwYJKwYBBAGCNxUCBBYEFO9bOBW+kd29PnvDfi8viydyKlpLMA0GCSqGSIb3DQEBBQUA
A0EAbYC4XAd9XO8qtEU7FfGoXe2DEVyyjqQ0fmZqAvXF+SJC7ZrIVwHC0RVEe3DZ0R7zwJmfLleU
FxBE3VaXURLuDzCCBoEwggYroAMCAQICCi6TXksAAQAAee8wDQYJKoZIhvcNAQEFBQAwgaYxJTAj
BgkqhkiG9w0BCQEWFmNhYWRtaW5AY3RpLmRlcGF1bC5lZHUxCzAJBgNVBAYTAlVTMREwDwYDVQQI
EwhJbGxpbm9pczEQMA4GA1UEBxMHQ2hpY2FnbzEaMBgGA1UEChMRRGVwYXVsIFVuaXZlcnNpdHkx
DDAKBgNVBAsTA0NUSTEhMB8GA1UEAxMYRWxsaW5ndG9uLmN0aS5kZXBhdWwuZWR1MB4XDTA1MDUw
ODIxMTQxMFoXDTA2MDUwODIxMTQxMFowgdoxEzARBgoJkiaJk/IsZAEZFgNlZHUxFjAUBgoJkiaJ
k/IsZAEZFgZkZXBhdWwxEzARBgoJkiaJk/IsZAEZFgNjdGkxFjAUBgoJkiaJk/IsZAEZFgZjc3Rj
aXMxFTATBgNVBAsTDExhYm9yYXRvcmllczEXMBUGA1UECxMOTGFiIEFzc2lzdGFudHMxDDAKBgNV
BAsTA0NUSTEYMBYGA1UEAxMPY3N0ZWplcmUwODg4ODg4MSYwJAYJKoZIhvcNAQkBFhdjc3RlamVy
ZUBjdGkuZGVwYXVsLmVkdTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA8i05BRMnmJ18hgYK
EOF0d2ueObEUYqNQFioGmY6xdRWnR2LxGubw/z9XbEagh8fdDt27utHsyjwXM1ZS0kvuODCNa8Ps
6Qb1UGq82rhwhFGLUJtbs5aOqUn/7xlWvfmrWC9snTiMFPJCCgkygD9X59mg5tLKD4pMTQXMD76p
4o0CAwEAAaOCA78wggO7MAsGA1UdDwQEAwIFoDBEBgkqhkiG9w0BCQ8ENzA1MA4GCCqGSIb3DQMC
AgIAgDAOBggqhkiG9w0DBAICAIAwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFGikHs8A
Ybqe7k64T1CGZ7ObD/EhMCkGCSsGAQQBgjcUAgQcHhoAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8A
cjAfBgNVHSMEGDAWgBQN6YS18LeqWEJW/vRYyzJP8ybtpjCCASwGA1UdHwSCASMwggEfMIIBG6CC
ARegggEThoHHbGRhcDovLy9DTj1FbGxpbmd0b24uY3RpLmRlcGF1bC5lZHUsQ049ZWxsaW5ndG9u
LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
cmF0aW9uLERDPWN0aSxEQz1kZXBhdWwsREM9ZWR1P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/
YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludIZHaHR0cDovL2VsbGluZ3Rvbi5j
dGkuZGVwYXVsLmVkdS9DZXJ0RW5yb2xsL0VsbGluZ3Rvbi5jdGkuZGVwYXVsLmVkdS5jcmwwggFD
BggrBgEFBQcBAQSCATUwggExMIG9BggrBgEFBQcwAoaBsGxkYXA6Ly8vQ049RWxsaW5ndG9uLmN0
aS5kZXBhdWwuZWR1LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNl
cyxDTj1Db25maWd1cmF0aW9uLERDPWN0aSxEQz1kZXBhdWwsREM9ZWR1P2NBQ2VydGlmaWNhdGU/
YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MG8GCCsGAQUFBzAChmNodHRw
Oi8vZWxsaW5ndG9uLmN0aS5kZXBhdWwuZWR1L0NlcnRFbnJvbGwvZWxsaW5ndG9uLmN0aS5kZXBh
dWwuZWR1X0VsbGluZ3Rvbi5jdGkuZGVwYXVsLmVkdSgxKS5jcnQwNQYDVR0lBC4wLAYKKwYBBAGC
NwoDAQYKKwYBBAGCNwoDBAYIKwYBBQUHAwQGCCsGAQUFBwMCME0GA1UdEQRGMESgKQYKKwYBBAGC
NxQCA6AbDBljb3NAY3N0Y2lzLmN0aS5kZXBhdWwuZWR1gRdjc3RlamVyZUBjdGkuZGVwYXVsLmVk
dTANBgkqhkiG9w0BAQUFAANBAAKA+xuSUF002trgUoDoaCMK6s4Jj0FaG1VbKmwc6UU2bkPw00/A
BFB4EICKx3Z8eLZJFLaOE1vkMDr4HoY+b+wxggO6MIIDtgIBATCBtTCBpjElMCMGCSqGSIb3DQEJ
ARYWY2FhZG1pbkBjdGkuZGVwYXVsLmVkdTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCElsbGlub2lz
MRAwDgYDVQQHEwdDaGljYWdvMRowGAYDVQQKExFEZXBhdWwgVW5pdmVyc2l0eTEMMAoGA1UECxMD
Q1RJMSEwHwYDVQQDExhFbGxpbmd0b24uY3RpLmRlcGF1bC5lZHUCCi6TXksAAQAAee8wCQYFKw4D
AhoFAKCCAlowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUxMjEz
MjEyMTE4WjAjBgkqhkiG9w0BCQQxFgQUGWhXWW7QimXo7Cmpxfcnp3a2mkIwZwYJKoZIhvcNAQkP
MVowWDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw
DQYIKoZIhvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUwgcYGCSsGAQQBgjcQBDGBuDCBtTCB
pjElMCMGCSqGSIb3DQEJARYWY2FhZG1pbkBjdGkuZGVwYXVsLmVkdTELMAkGA1UEBhMCVVMxETAP
BgNVBAgTCElsbGlub2lzMRAwDgYDVQQHEwdDaGljYWdvMRowGAYDVQQKExFEZXBhdWwgVW5pdmVy
c2l0eTEMMAoGA1UECxMDQ1RJMSEwHwYDVQQDExhFbGxpbmd0b24uY3RpLmRlcGF1bC5lZHUCCi6T
XksAAQAAee8wgcgGCyqGSIb3DQEJEAILMYG4oIG1MIGmMSUwIwYJKoZIhvcNAQkBFhZjYWFkbWlu
QGN0aS5kZXBhdWwuZWR1MQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcT
B0NoaWNhZ28xGjAYBgNVBAoTEURlcGF1bCBVbml2ZXJzaXR5MQwwCgYDVQQLEwNDVEkxITAfBgNV
BAMTGEVsbGluZ3Rvbi5jdGkuZGVwYXVsLmVkdQIKLpNeSwABAAB57zANBgkqhkiG9w0BAQEFAASB
gKJpFUtD2j1SFmkpLzY4hgnlGEi/35MKhSvLmv7bByeYnD3PNri7hXKxKMcrtI70roeb2lt2db3r
8guA9TFRw04pHYI0bFrbS7gCMdl9ioVBQhK0ZEIcMi3d12eP+2sb44S5epH9rhn4oSQvnlzzrtzX
MmsEa6K6RqYD3pd1jrkEAAAAAAAA

------=_NextPart_000_007D_01C5FFF8.DD61BEB0--