15 ms·
Reverse Engineering a Mysterious UDP Stream in My Hotel
- Animats 10y agoAt least they play music. I once stayed in a Howard Johnsons Motor Lodge in Pittsburgh near CMU, where, at corridor intersections, they had speakers to generate some ambient noise to mask voices from the rooms. Most places that do this use white noise, or water sounds. But this was Pittsburgh. They were playing faint machinery noises - whirr, chunk, etc. At first I thought someone had left a PA microphone open in the boiler room or something, but no, it was deliberate.
- geoffeg 10y agoTrent Reznor would love to stay at that hotel.
- dghughes 10y agoI'm surprised public washrooms don't play music or it seems very few do. I bet so many people in stalls wait for someone to start the air dryer or turn on a tap i.e. strategic pooping. It can be a embarrassing disaster with those modern auto shutoff air hand dryers.
- hack_a_laugh 10y agoAlternatively, they could just have speakers that made random fart noises.
- DyslexicAtheist 10y agoand at the Google campus they play "Watt is love. Baby don't Herz me no Morse"
- Riseed 10y agoThis Freakonomics podcast episode discussed (the lack of) bathroom music: http://freakonomics.com/podcast/time-to-take-back-the-toilet-a-new-freakonomics-radio-podcast/ http://freakonomics.com/podcast/time-to-take-back-the-toilet...
- dfc 10y agoI will save everyone else the trouble of slogging through that podcast. They never actually discuss the lack of bathroom music. The lack of music in public bathrooms is mentioned a number of times but its always a jumping off point for another mini-discussion about something else tangentially related to bathrooms or music in public spaces. You can listen to the entire podcast and you will have no better understanding of the lack of music in public bathrooms.
- copperx 10y agoThank you. You have saved at least one human work-hour. I'll promise I'll do something productive with that hour.
- function_seven 10y agoIt's been a couple hours. So what'd you do?
- Godel_unicode 10y agoI for one used my hour to poop.
- wting 10y agoJapan has portable, artificial white noise makers for bathroom privacy. They're called otohime, or "sound princess." - video: https://www.youtube.com/watch?v=f0eqo6jU9gc https://www.youtube.com/watch?v=f0eqo6jU9gc - example gadget: http://www.japantrendshop.com/keitai-otohime-toilet-sound-blocker-p-851.html http://www.japantrendshop.com/keitai-otohime-toilet-sound-bl... - background and wall mounted examples: http://travel.cnn.com/tokyo/shop/sound-princess-loo-001106/ http://travel.cnn.com/tokyo/shop/sound-princess-loo-001106/
- microcolonel 10y agoOh my god, that name is an amazing pun. Younger princess -> sound princess
- deleted 10y ago[deleted]
- arthurcolle 10y agoCan you explain this pun? Not getting it!
- angrow 10y ago"otohime" is how to pronounce one of the terms of address for the second daughter of the first Kamakura shogun. The Second daughter, hence, the "younger princess". The Japanese word for sound is also pronounced "oto". So, a device which makes noise to help you be discreet...
- kaffeemitsahne 10y agoNothing embarrassing about pooping in a toilet.
- internaut 10y agoWow that's steampunk!
- kohanz 10y agoUgh, one of the offices I used to work in used such a white-noise "noise abatement system". It gave me terrible headaches that cleared up as soon as I started spending less time in that building. A good friend who designs buildings and such features told me this happens to 10-20% of people. The irony was that it was one of the quietest offices I'd ever worked in - nobody talked to anybody else!
- tominous 10y agoI used to work in an office which used fanless thin clients instead of normal desktop PCs. It was fantastic. Since then, normal offices filled with desktop fans have seemed almost painful to my ears. It makes a real difference by the end of the day.
- dzhiurgis 10y agoTo me it is the air conditioning fans that are roaring. Today modern laptops emit almost no sound. Also noise cancelling headphones was a good investment for me. Strange, that device created for use in helicopters proved so useful in office environment.
- tripzilch 10y agoIf you like, try playing this album some time, as background ambient music: https://www.youtube.com/watch?v=bfHCt5z1kd8 https://www.youtube.com/watch?v=bfHCt5z1kd8 (Brian Eno - Neroli) Without fail, it makes everyone in the room talk more calmly, at a quieter volume. It's one of my favourite ambient albums ever (if anyone knows more of something quite like this, I'd love to hear suggestions). It even works on children, I work at a youth centre, just playing it over a relatively shitty PA can calm down an over-active morning in 5-10 minutes.
- nowprovision 10y agoah damn, not a network guy but couldn't they put lifts on their own subnets and avoid populuting the constrained airway. good read :)
- deleted 10y ago[deleted]
- nowprovision 10y agosince this is same local network could u forge this and play hardcore porn audio?
- maxaf 10y agoThere are some much nicer and more fun, also arguably less destructive, pranking options: - text-to-speech output based on a definitive history of elevators - same for an exhaustive safety lecture that'll probably horrify some guests - BBC programming interspersed with random bits of Arabic speech - sound of iPhone ringing using the most common ringtone - toilet flushing noises - JFK's "we choose to go to the moon" speech - "thank you for using the elevator - achievement unlocked! Please visit the hotel's reception desk to collect your prize. Your raffle code is: ID-10T" - "dear guests: a gentle reminder that floors in our hotel are zero-indexed" - mouse scratching sounds on full blast - Soviet anthem on repeat ... I can do this all day.
- JoshGlazebrook 10y agoDefault ringtone ringing would be hilarious.
- david-given 10y ago... I've suddenly realised that if someone were to improvise a two-hour lecture similar to _The Art of Boxing_ from Frog Fractions and upload it somewhere, then I would probably find a way to use it. Somehow.
- deleted 10y ago[deleted]
- lynxaegon 10y agohaha! Best reverse engineering of elevator music ever :)
- janci 10y agoNow I know what to do in a hotel! https://www.youtube.com/watch?v=1Un_oHaf798 https://www.youtube.com/watch?v=1Un_oHaf798
- jaimehrubiks 10y agoI laughed hard
- haloboy777 10y agoThanx for the link... XD
- nickpsecurity 10y agoDude that's awesome! Thanks for the link.
- detaro 10y agoReminds me how surprised I was when I found out that many IP phone installations use multi-cast strictly to distribute on-hold music to all phones, instead of the phones pulling files from a server or storing it locally.
- digi_owl 10y agoMy first thought is that it is related to RIAA or equivalent rules, rather than something technical.
- gvb 10y agoTwo reasons: 1. Multicast is 1:N so one stream can be played on all phones. Pulling the files from a server would be N:N so your network bandwidth would be consumed unnecessarily due to all the phones streaming the same data. Also, the phones are going to have limited memory so storing music locally is not going to scale well (phone memory is a cost that gets multiplied by N phones). 2. Synchronization, especially for the elevator scenario: if the music outside the elevator door isn't synchronized to the music inside the elevator, it will be rather disconcerting. BTW, I suspect the streaming audio you saw was "background music" that could be played from the phones speakers. "Ambiance audio" would tie in with #2 synchronization; having adjacent phones playing unsynchronized "ambiance audio" would also be jarring. Music on hold will be inserted by the PBX (head end), not the individual phones. Inserting "music on hold" by the phone would mean that music would be sent by the PBX to the phone back to the PBX and then to the "on hold" line where having the PBX insert it involves only the link from the PBX to the "on hold" line.
- detaro 10y agoYeah, it's efficient and easy to update. Was just surprised since applications for multicast crossing subnet borders are fairly scarce, so I guess multicast routing got configured just for that, and is one of these things you don't see mentioned very often. Thanks for the details!
- Aloha 10y agoNot hold music - I don't know of a single PBX (IP or otherwise) where hold is accomplished in the phone - but many phone systems can do background music and paging, this would be a great use for multicast.
- mhd 10y agoYou had to follow that shaggy dog a long time, but it finally led you to the girl from Ipanema.
- binaryanomaly 10y agoHehe, nice story! Congrats ;)
- omash 10y agoThat was just the carrier, hiding the steganographic payload.
- Endy 10y agoI bet the payload is in that NES cartridge. Check the data against the NES cart header list, or just try loading it in NESticle. That's what I would have started with, rather than focusing on the meaningless LAME MP3 data.
- kalleboo 10y agoThere is no NES cartridge data. It looks like OP is using an outdated magic file with a bug that was fixed in april https://fossies.org/diffs/file/5.26_vs_5.27/magic/Magdir/console-diff.html https://fossies.org/diffs/file/5.26_vs_5.27/magic/Magdir/con...
- matiasb 10y agoIt was an ex-NSA agent talking to his mom :)
- KillerRAK 10y agoI applaud the effort and your curiosity. Any good tunes on that stream? Perhaps you're working on a remix?
- deleted 10y ago[deleted]
- m00dy 10y agoNice story
- tharshan09 10y agoCan you send your own UDP packets to the elevator then?
- alfiedotwtf 10y agoThis is why I read the comments.
- kriro 10y agoThis is the correct follow up question. Nothing like sending out some ants via mail. https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_...
- vacri 10y agoThe hole in Schneier's story is that you can't just send them any old letter. It has to be a card that you've purchased from them. It's not much of a revelation: "If I actively purchase a token to have something inoffensive sent to an address, why, the company will send it without verifying that the person who handed over the money is the recipient!".
- sp332 10y agoIt's not about getting them delivered for free. It's about targeted anonymous harassment (or a prank, depending on your point of view). See also https://shipyourenemiesglitter.com/ https://shipyourenemiesglitter.com/ or http://poopsenders.com/ http://poopsenders.com/ neither of which are free.
- vacri 10y agoI fail to see a significant difference between purchasing an ant farm and using the card to anonymously send the sealed tube of ants to a victim... and just anonymously posting something yourself to the victim.
- 10y ago
- tonyedgecombe 10y agoI was in an elevator a while ago when there was a ringing followed by a voice trying to sell PPI services (a regular source of spam in the UK). The emergency system was just an embedded phone.
- benjohnson 10y agoIn the US too - the reasoning is that it's simple and should work in a power outage as the telephone company usually can power it from the central office. Conversely, VoIP would depend on too many technologies working well to be reliable enough for emergency use.
- superuser2 10y agoI've definitely seen elevator phones attached to the PBX with VoIP trunking, but all the components were on battery backups.
- jlgaddis 10y agoAt a previous employer (large .edu), we moved to VoIP several years ago but keep several PSTN lines -- including all of the emergency ones, such as for the elevator. We could have moved them to VoIP as well but we figured, in a true emergency, it was one less thing to have to worry about.
- godzillabrennus 10y agoIn Chicago building codes mandate elevators have a pstn line in place. Even luxury homes with small elevators.
- hexane360 10y agoWell, I mean people have died from being stuck in their own elevators: http://www.cbsnews.com/news/elderly-couple-dies-trapped-in-home-elevator/ http://www.cbsnews.com/news/elderly-couple-dies-trapped-in-h...
- Namidairo 10y agoHave you tried throwing the raw recording against SoX? Worked pretty well when I had an unknown recording to play for which I had guessed the format. (Which turned out to be IMA-ADPCM with reversed byte ordering)
- SoonDead 10y agoExcellent story, although the URL spoiled it for me, might worth changing it to something more vague.
- slinkyavenger 10y agoIt's about the journey, not the destination. But are you seriously suggesting he change it to a clickbait URL?
- brianpan 10y agoThe story is the journey, and there is no story without suspense. The URL is the dust jacket- some people are going to see the URL even before the title. No one said anything about clickbait. Any URL without the spoiler is better.
- SoonDead 10y agoI'm suggesting he change it to Hotel_UDP.html from Hotel_Music.html so it does not spoil that it's music.
- known 10y agoI'd start with tcpflow -p -C -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'
- jlgaddis 10y agocf. ngrep [0] [0]: https://en.wikipedia.org/wiki/Ngrep https://en.wikipedia.org/wiki/Ngrep (Yes, I chose to link to Wikipedia instead of its home page on SourceForge.)
- x0 10y agoBeautiful. Where has this been all my life.
- eeeeeeeeeeeee 10y agongrep is awesome
- deepsun 10y agoDoes it drain battery of mobile devices not listening to the port? Have you tried multicasting your own audio to the same port? That might have been fun.
- umanwizard 10y agoWaking up the WiFi hardware is not particularly expensive, and there is usually going to be tons of multicast stuff going around any crowded wifi network anyway. So it doesn't seem like this would be a big concern for battery.
- david-given 10y agoI did a bunch of multicast programming in the early days of Android, and I discovered that: - most Android devices back then required a special OS call to tall the wireless chipset to listen to multicast packets at all --- otherwise they'd just ignore them and not wake up; - in about half the devices, this switch didn't actually work; - in an astonishing amount of consumer routers, multicast routing doesn't actually work; - multicast on mobile is so, so, so not worth the effort. I expect that multicast is way better supported these days. I would be totally unsurprised if it were not.
- indolering 10y ago> I expect that multicast is way better supported these days. I would be totally unsurprised if it were not. I wouldn't be, how often is multicast really used? Coming from the broadcast era, it seemed like a no-brainer. But the internet is built for n:n communication. Special cases for n:1 cost more in terms of engineering effort than would be saved in bandwidth and processing overhead.
- SmellyGeekBoy 10y agoSome IPTV services in the UK use it (at least BT and TalkTalk with their YouView packages and probably off-the-shelf YouView as well). I had a bit of a nightmare trying to get it working with BT TV when I upgraded from their godawful HomeHub to an ASUS router. Pretty much every time I've upgraded my router firmware I've lost TV service and had to reconfigure it. Apparently multicast is hard, even if you're a networking company!
- cmarcond06 10y agoIs this legal? What if the media was from Hotel Cameras?
- Endy 10y agoHe listened to a public stream, there's no indication that they were attempting to secure it in any way. So, legal. Now, if he had done as others have suggested and injected "malicious" packets into the stream, then we'd have a question.
- icebraining 10y agoAt least around here, if it was from cameras, the hotel would be the one committing an illegality.
- Endy 10y agoYou don't have an expectation of privacy in hallways and elevators.
- icebraining 10y agoYes, I know that's the US concept. Around here the view is a little less binary, as the law recognizes a difference between being seen (or even being filmed occasionally, by an handheld camera) and surveillance cameras, which can be used to track your movements. The hotel could still have them, mind you, but transmitting them in the clear would be a clear violation of the law, which in fact specifically cites the "transmission of the recordings over a network" as something that must be secured.
- daveheq 10y agoI love knowing I get spammed with elevator music over WiFi at a hotel the whole time.
- deleted 10y ago[deleted]
- kw71 10y agoNext time you see a multicast stream, try playing it with vlc.
- robterrell 10y agoThat was my thought, too -- I would have just tried vlc and missed all the coding fun.
- Laforet 10y agoMe too. I had a friend who was convinced that he's being attacked when a steady stream of UDP packets started reaching his router for days. Asked him to open it in VLC and it turned out to be local news from his ISP's misconfigiured IPTV service.
- Laforet 10y agoMe too. I had a friend who was convinced that he's being attacked when a steady stream of UDP packets started reaching his router for days. Asked him to open it in VLC and it turned out to be local news from his ISP's misconfigiured IPTV service.
- Endy 10y agoMaybe. But what interests me most is that NES header data.
- rspeer 10y agoIt's the same data as the MP3 data he found, just truncated at a different offset. Apparently it doesn't take much to make `file` think it's detecting an NES ROM.
- kalleboo 10y agoIt looks like OP is using an outdated magic file with a bug that was fixed in april https://fossies.org/diffs/file/5.26_vs_5.27/magic/Magdir/console-diff.html https://fossies.org/diffs/file/5.26_vs_5.27/magic/Magdir/con...
- ReedJessen 10y agoThis is really well written. Good length for one quick bus ride. I was on pins an needles until the end. Great blog post.
- djabatt 10y agoGreat network engineering. I think we all need a set of tools that allow us to find if we are being bugged by all the networked smartTV's, printers VOIP phones etc. Not to mention the Amazon Echo. I dig it if someone had a Wireshark/Python app that allowed everyone to listen to with Amazon Echo was sending to Amazon.
- darpa_escapee 10y agoThe hacker in me would love to see an analysis of the traffic, but the consumer in me hopes that the Echo sends and receives encrypted data.
- dkopi 10y agoBinwalk is a great tool for finding potential files within a given binary stream: https://github.com/devttys0/binwalk https://github.com/devttys0/binwalk It has an incredible list of supported file types.
- jaybosamiya 10y agoForemost is also extremely useful for the same purpose, and I've found it more useful at least in my work during CTFs https://en.wikipedia.org/wiki/Foremost_%28software%29 https://en.wikipedia.org/wiki/Foremost_%28software%29 A `sudo apt-get install foremost` works on Ubuntu to install it, IIRC
- x0 10y agoBinwalk is great, I love extracting stuff from big binary blobs of router firmware, or dumping all the memory on a Linux computer with LiME (https://github.com/504ensicsLabs/LiME https://github.com/504ensicsLabs/LiME) and using Binwalk to see what's in there!
- TerryADavis 10y agoGod sees you. God will testify about all the CIA deeds. God says... typists blacklisted amity encouraged yews distention sorcerer anachronistic quartos masseuses eggplant Fredric distortions ablest munches cements fief's losers playing countryside's Renault's sonar's tubers Barbie hypoglycemia reins bandanas telecommutes Burma subdivided furnished Sihanouk's
- daveguy 10y agoSpoiler: Revelation/Disappointment -- it is elevator music. Or is it? Maybe he gave up too quick. Maybe that is how they disguise the secret spy transmissions! https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography
- internaut 10y agoCame here to say this. There two modes. One for normal people. Parents, cops, investigative journalists, government employees etc. Then there's the mode for geeks. Then your base case should be that everybody is Norman Bates
- i336_ 10y agoHm... what's in the other 8 bytes that had to be skipped?
- punnerud 10y agoDo you know you are a nerd when you laugh out loud after reading this? My girlfriend: Was that something I would also laugh at? Me: Most likely not ;)
- buttershakes 10y agoIt's probably a microphone hidden in his room that encodes the data stenographically into elevator music. More seriously, no investigation as to what happens when you try to inject your own data?
- selectiveupvote 10y agoOkay, I got a good laugh out of this one and appreciate it.
- caylorme 10y agoNow just copy the headers and send some multi cast audio of your own to hijack the elevator and bathroom audio :) Could make for a good prank
- gnicholas 10y agoA story with a decidedly less innocuous outcome: https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-yours-6356710fa180#.y3bctq5uy https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...
- ngcazz 10y agoAs someone who doesn't really grok either Python or IP programming, I really enjoyed how simple yet educative (and ultimately, funny) this blog post was. Definitely will be trying this exercise the next time I end up at a hotel with a laptop. I wonder how hard it might be to hijack the stream to have the receivers play your own packets.
- chris_wot 10y agoEr, if they are transmitting data to a multicast IP address, what's to stop you doing the same? If they haven't done a check on the IP address that they are receiving the data from, then it would now be trivial to panic people in elevators by recording a fake emergency broadcast. Not jus that, but what else is that hooked up to? If they are multicasting to your IP address and your IP address isn't the lift, then you can do some IGMP snooping to see what else there is out there. Or you could do a DoS on the lifts to see what happens. Of course, it might be nothing. But when I get in a lift, I'd hope this sort of thing wasn't possible.
- rocky1138 10y agoOut of general interest, do you have a copy of the mp3 we could listen to? I couldn't find one in the article.
- gravypod 10y agoI'd love to see someone spoof those UDP multicast and play death metal or something rather then elevator music.