8 ms·

Can you send your own UDP packets to the elevator then?

alfiedotwtf 10y ago
This is why I read the comments.
kriro 10y ago
This is the correct follow up question. Nothing like sending out some ants via mail. https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_...
- vacri 10y ago
  The hole in Schneier's story is that you can't just send them any old letter. It has to be a card that you've purchased from them. It's not much of a revelation: "If I actively purchase a token to have something inoffensive sent to an address, why, the company will send it without verifying that the person who handed over the money is the recipient!".
  - sp332 10y ago
    It's not about getting them delivered for free. It's about targeted anonymous harassment (or a prank, depending on your point of view). See also https://shipyourenemiesglitter.com/ https://shipyourenemiesglitter.com/ or http://poopsenders.com/ http://poopsenders.com/ neither of which are free.
    - vacri 10y ago
      I fail to see a significant difference between purchasing an ant farm and using the card to anonymously send the sealed tube of ants to a victim... and just anonymously posting something yourself to the victim.
      - kqr 10y ago
        The difference is that if you're anonymously mailing ants to a person you're doing it out of malice. The bad person is the person directly responsible for sending the ants out. The company doesn't want to mail ants to the wrong people, but they have no safeguards against it either. They're not acting out of malice, but they're peforming a malign action anyway. They're relying on your good spirit to ensure the ants end up in the right place.
        vacri 10y ago
        There is no difference to the victim if the company sends the ants directly, or if you receive the ants and then re-post it. This is one of those ridiculous scenarios that security folks dream up. I imagine Schneier doesn't live in a concrete bunker with a blast door, because a regular door can conceivably be broken open with a sledgehammer. The vast majority of homes do not have a sledgehammer-proof door, because it's not actually a problem. Same with the shipping of ants.
        kqr 10y ago
        There is no difference to the victim, but there is a difference to the company. In one case they are guilty of shipping live ants to an unsuspecting victim, and in the other case they're not even related to the incident.
itsthecourier 10y ago
That's the evilest thing I can imagine. :')
TheGeminon 10y ago
It would be possible to send packets to the elevator, but the elevator playing them would be another issue. If there is no authentication at all (as it it just plays all packets it receives on UDP 2046) I would imagine you would get an interesting mix of "valid" elevator music and your own "invalid" music. On the other hand, those first 8 bytes of the packet may be some authentication/verification scheme which would have to be reverse engineered. Also, it may only play UDP packets coming from 234.0.0.2:2046, which would likely mean you would have to convince the DHCP server to assign you that address instead of its intended host.
- jasonjayr 10y ago
  Or just inject them into the network w/ spoofed source addresses.
  - DyslexicAtheist 10y ago
    yeah and deliver some badass mixes of The girl from Ipanema. :-) Though I wonder if he had time to look at the packets long or careful enough. Would have been interesting to inspect all these devices closer too. Were there also other sessions established maybe that could hint at controlling them? E.g. such as volume of the sound? I doubt that the actual elevator would be controlled could be controlled remotely: https://www.youtube.com/watch?v=oHf1vD5_b5I https://www.youtube.com/watch?v=oHf1vD5_b5I
    - gurkendoktor 10y ago
      If anyone else is scratching their head about the references to The Girl From Ipanema in this thread... :) > "Garota de Ipanema" ("The Girl from Ipanema") is a Brazilian bossa nova jazz song. > Numerous recordings have been used in films, sometimes as an elevator music cliché.
      - DyslexicAtheist 10y ago
        indeed :-) https://thequickword.wordpress.com/2014/08/25/your-code-is-like-elevator-music/ https://thequickword.wordpress.com/2014/08/25/your-code-is-l...
supersan 10y ago
That would definitely be another interesting read! I'm not a networking guy, but I definitely want to know if it is possible to stop the packets from going to their final IP? Can they be intercepted and replaced with other data? This feels as exciting as what they do with video feeds in Hollywood movies, i.e. where the hacker puts in her own camera loops replacing live feed.
- corndoge 10y ago
  Probably difficult to intercept the packets, but since they're apparently broadcast over the whole hotel network, it would likely be straightforward to send your own out to be mixed in with the real packets and get some sick elevator glitch muzak going.
  - 13of40 10y ago
    With custom equipment I bet you could listen for the packet header and broadcast a colliding signal every time a legitimate one was being sent. Since it's UDP, there would be no retry and neither the sender nor the receiver would be the wiser.
    - brianwawok 10y ago
      It could be a NAQ protocol and resend if a sequence number gets missed.
ChuckMcM 10y ago
This would be the obvious follow up, then you can make your own "elevator music" and send it out. But that probably depends on understanding what's in the first 8 bytes too :-)
- thaumasiotes 10y ago
  I don't see why, since the first ~15 bytes of each packet are constant. It might be necessary to understand them if they ever varied...
detaro 10y ago
Depends on the network topology and setup. If the speakers also are using the Wifi, then probably yes.
- vinhboy 10y ago
  I assume if his wifi can pick it up with wireshark, then whatever is receiving should be able to pick up whatever his wifi send out. Right?
  - detaro 10y ago
    Not necessarily, the speakers could be in a different network, then they do not listen to what he sends directly. if the AP/router knows the multicast source is not in the wifi (and it probably does) it won't accept packets from there and not forward it to other networks. Since it is multicast seeing the packet doesn't mean the path to a specific receiver goes through your network.
kilroy123 10y ago
I would certainly try this if I was him. There was another recent post about a hotel that had android devices controlling the lights, in the entire hotel. Which had no auth protection at all. I'd bet money, it would be the same for the elevator music.

This is why I read the comments.

kriro 10y ago

This is the correct follow up question. Nothing like sending out some ants via mail. https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_...

vacri 10y ago
The hole in Schneier's story is that you can't just send them any old letter. It has to be a card that you've purchased from them. It's not much of a revelation: "If I actively purchase a token to have something inoffensive sent to an address, why, the company will send it without verifying that the person who handed over the money is the recipient!".
- sp332 10y ago
  It's not about getting them delivered for free. It's about targeted anonymous harassment (or a prank, depending on your point of view). See also https://shipyourenemiesglitter.com/ https://shipyourenemiesglitter.com/ or http://poopsenders.com/ http://poopsenders.com/ neither of which are free.
  - vacri 10y ago
    I fail to see a significant difference between purchasing an ant farm and using the card to anonymously send the sealed tube of ants to a victim... and just anonymously posting something yourself to the victim.
    - kqr 10y ago
      The difference is that if you're anonymously mailing ants to a person you're doing it out of malice. The bad person is the person directly responsible for sending the ants out. The company doesn't want to mail ants to the wrong people, but they have no safeguards against it either. They're not acting out of malice, but they're peforming a malign action anyway. They're relying on your good spirit to ensure the ants end up in the right place.
      - vacri 10y ago
        There is no difference to the victim if the company sends the ants directly, or if you receive the ants and then re-post it. This is one of those ridiculous scenarios that security folks dream up. I imagine Schneier doesn't live in a concrete bunker with a blast door, because a regular door can conceivably be broken open with a sledgehammer. The vast majority of homes do not have a sledgehammer-proof door, because it's not actually a problem. Same with the shipping of ants.
        kqr 10y ago
        There is no difference to the victim, but there is a difference to the company. In one case they are guilty of shipping live ants to an unsuspecting victim, and in the other case they're not even related to the incident.

itsthecourier 10y ago

That's the evilest thing I can imagine. :')

TheGeminon 10y ago

It would be possible to send packets to the elevator, but the elevator playing them would be another issue. If there is no authentication at all (as it it just plays all packets it receives on UDP 2046) I would imagine you would get an interesting mix of "valid" elevator music and your own "invalid" music. On the other hand, those first 8 bytes of the packet may be some authentication/verification scheme which would have to be reverse engineered. Also, it may only play UDP packets coming from 234.0.0.2:2046, which would likely mean you would have to convince the DHCP server to assign you that address instead of its intended host.

jasonjayr 10y ago
Or just inject them into the network w/ spoofed source addresses.
- DyslexicAtheist 10y ago
  yeah and deliver some badass mixes of The girl from Ipanema. :-) Though I wonder if he had time to look at the packets long or careful enough. Would have been interesting to inspect all these devices closer too. Were there also other sessions established maybe that could hint at controlling them? E.g. such as volume of the sound? I doubt that the actual elevator would be controlled could be controlled remotely: https://www.youtube.com/watch?v=oHf1vD5_b5I https://www.youtube.com/watch?v=oHf1vD5_b5I
  - gurkendoktor 10y ago
    If anyone else is scratching their head about the references to The Girl From Ipanema in this thread... :) > "Garota de Ipanema" ("The Girl from Ipanema") is a Brazilian bossa nova jazz song. > Numerous recordings have been used in films, sometimes as an elevator music cliché.
    - DyslexicAtheist 10y ago
      indeed :-) https://thequickword.wordpress.com/2014/08/25/your-code-is-like-elevator-music/ https://thequickword.wordpress.com/2014/08/25/your-code-is-l...

supersan 10y ago

That would definitely be another interesting read! I'm not a networking guy, but I definitely want to know if it is possible to stop the packets from going to their final IP? Can they be intercepted and replaced with other data? This feels as exciting as what they do with video feeds in Hollywood movies, i.e. where the hacker puts in her own camera loops replacing live feed.

corndoge 10y ago
Probably difficult to intercept the packets, but since they're apparently broadcast over the whole hotel network, it would likely be straightforward to send your own out to be mixed in with the real packets and get some sick elevator glitch muzak going.
- 13of40 10y ago
  With custom equipment I bet you could listen for the packet header and broadcast a colliding signal every time a legitimate one was being sent. Since it's UDP, there would be no retry and neither the sender nor the receiver would be the wiser.
  - brianwawok 10y ago
    It could be a NAQ protocol and resend if a sequence number gets missed.

ChuckMcM 10y ago

This would be the obvious follow up, then you can make your own "elevator music" and send it out. But that probably depends on understanding what's in the first 8 bytes too :-)

thaumasiotes 10y ago
I don't see why, since the first ~15 bytes of each packet are constant. It might be necessary to understand them if they ever varied...

detaro 10y ago

Depends on the network topology and setup. If the speakers also are using the Wifi, then probably yes.

vinhboy 10y ago
I assume if his wifi can pick it up with wireshark, then whatever is receiving should be able to pick up whatever his wifi send out. Right?
- detaro 10y ago
  Not necessarily, the speakers could be in a different network, then they do not listen to what he sends directly. if the AP/router knows the multicast source is not in the wifi (and it probably does) it won't accept packets from there and not forward it to other networks. Since it is multicast seeing the packet doesn't mean the path to a specific receiver goes through your network.

kilroy123 10y ago

I would certainly try this if I was him. There was another recent post about a hotel that had android devices controlling the lights, in the entire hotel. Which had no auth protection at all. I'd bet money, it would be the same for the elevator music.