19 ms·
Reverse engineering a mysterious UDP stream in my hotel (2016)
- _joel 6y agoFrom 2016
- bellyfullofbac 6y agoIt sounded familiar (no pun intended). I wonder if it would be possible to multicast our own stream and get it played on the elevators. The malicious prankster in me thinks something along the lines of faked radio crosstalk where the other side is in the middle of a disaster. E.g. "This is $NAME of $MILITARY_RANK. The date is April 5, 2021. We have survived the April 4 nuclear attack at $CITY. Is anyone else out there?"
- 1shooner 6y agoI once stayed in an Airbnb 'hotel' (an entire building run as a self-service hotel in a downtown of a major city). Doing similar casual tinkering, I found the entire building's security system (keycards, external doors, access logs) on the guest wifi network, behind default passwords. I left a note in Airbnb to the hosts, but never heard back from them.
- varispeed 6y agoSome people truly live by "I did nothing wrong, so I have nothing to hide" philosophy and the same think that their guests also don't have nothing to hide and if they do? Maybe other people should see it, so there you go.
- nuclearnice1 6y agoPossible. Or they just built a sloppy network.
- ganzuul 6y agoSame issue with social media. People don't understand they need to protect their entire network and not just themselves.
- _rs 6y agoI'm curious, was this "hotel" only available on Airbnb or did they have their own website or listings on other hotel aggregators?
- jandrese 6y agoI've seen this before where the building is only on AirBnB because it's zoned residental. I once stayed at an AirBnB where the little welcome binder you got when you got to the room included instructions on what to do if the cops knock on the door and start asking questions. It's one of the caveats of bargain hunting. Sometimes you end up in sketchy situations.
- Cerium 6y agoOh, I stayed in one in Xiamen like that. AirBnB did not make it clear on their website that in Xiamen AirBnB's are illegal (some cities in China they are legal and have a deal to do hotel registration with the police for you). We arrived to a pile of notices on the door "This is an illegal hotel, etc etc". Not super fun.
- gostsamo 6y agoRecently we had a team building event in a local resort. While waiting for a wine tour, my manager scanned the opened wifi of the winery/hotel from his phone. It turned out that there was a Xiaomi tv in the wifi. We talked about streaming something nsfw there, but we decided that it would be unethical.
- yardie 6y agoIf it was in the resort's business center they may have left it intentionally open so that presenters can push their slides to the TV. Streaming NSFW content to it is going to be a quick way to cause inconvenience for everyone.
- gostsamo 6y agoI don't think that it was the case. There were some other devices and the wifi name wasn't conference room or anything like that. It just looked like a sloppy setup with no password or whatsoever. Keep in mind that we weren't even in the lobby but we were social distancing on the lawn outside.
- cimnine 6y agoThis seams like someone configured multicast (smart!) in the hotel but did not use multicast-aware switches or did not turn on IGMP snooping. So the switches retrieved the package, did not know it was multicast and delivered it as broadcast to all connected endpoints. > By default, a network switch which is not configured to use IGMP will forward Multicast traffic to all switchports on the switch. Devices will be responsible for filtering out the traffic that they do not want to receive. https://service.shure.com/Service/s/article/multicast-and-igmp-in-depth?language=en_US https://service.shure.com/Service/s/article/multicast-and-ig...
- richardwhiuk 6y agoAnd they haven't VLAN separated whatever is playing the elevator music, which would be standard practice.
- cimnine 6y agoYes. Yet maybe the switches aren't VLAN aware either. Then – as far as I understand – VLANs would not have helped here either.
- imadethis 6y agoIP multicast only works over the broadcast domain, so VLANing off the speakers would work. You’d need multicast routing enabled on your routers to move multicast traffic between VLANs.
- fulafel 6y agoIP multicast routing and internetworking is a thing. There used to be working one to many internet TV based on multicast in the 90s (was called Mbone). There's contemporary experimental use of routed multicast on public internets too (see eg https://meetings.internet2.edu/2019-technology-exchange/detail/10005525/ https://meetings.internet2.edu/2019-technology-exchange/deta...) edit: seems the IETF are currently in process of deprecating any-source multicast and recommending people focus on keeping single-source multicast working well in as many networks as possible: https://datatracker.ietf.org/doc/rfc8815/ https://datatracker.ietf.org/doc/rfc8815/
- gkbrk 6y agoAuthor here, feel free to ask questions both on HN and over email.
- baryphonic 6y agoThis post brought me joy. The payoff at the end is hilarious! Thank you for documenting this kind of tinkering in a blog.
- crecker 6y agoThanks, I was deeply inspired in 2016 from this blog post :) Nostalgia
- tomcooks 6y agoExcellent rundown of how to do tinker with data, and great writing. If you have time please write more articles like that because they're very accessible to noobs like me, and allow me to follow along while experimenting on my machine. Added your feed to my RSS reader in the meantime
- bredren 6y agoWould you please post a link to the mp3?
- pikzel 6y agoUnfortunately the url gave it away, or it would have been an exciting read.
- k__ 6y agoWhat do you mean?
- rkachowski 6y agothe slug is literally "/hotel-music/"
- duiker101 6y agoThe slug for the article in the url is `hotel-music`. So you can kind of deduct what's it going to be in the end. I thought it was still nice.
- globular-toast 6y agoWhat would happen if you sent your own UDP packets on the same port? Could you manipulate the elevator music? Or would it turn into noise as the elevators receive packets from both sources?
- tyingq 6y agoNot my space, but googling around a bit on how ADTS works, it can include everything needed to send a "playable" bit of MP3 data in a single frame. So it seems like if you started sending multicast packets, the sound would be interleaved with the other stream. If you used a lower bitrate (they are using 192kbps) you could have a bigger piece of the playing time slice, since each of your packets would be a longer running snippet. Similarly, going mono vs stereo would extend that more. Given that it's a hotel, lots of the devices probably have default admin passwords though, so shutting off the other stream is probably not hard :)
- dhosek 6y agoOh man, this would be fun to do. Interleave at random moments an MP3 of sinister laughing.
- hivacruz 6y agoThere is something missing from the English article, which is a shame. In the French article [1], he talks about another story at the end that implies lights. He was able to control lights from all the bedrooms in another hotel by putting his laptop between the tablets controlling the lights and the ethernet cables. Funny story, the IP adresses were assigned based on the bedroom number, eg the bedroom 714 had an IP of 172.16.20 7.14. Edit: my bad, the second story was included in the French article but was written by another person, Matthew Garrett. Here is the story in English: https://mjg59.dreamwidth.org/40505.html https://mjg59.dreamwidth.org/40505.html [1]: https://linuxfr.org/news/son-et-lumiere-a-l-hotel https://linuxfr.org/news/son-et-lumiere-a-l-hotel
- gkbrk 6y agoIt's not actually missing from the English article. The French translation just combined two hotel-related articles into one, the light story is from another author. EDIT: Just saw your edit, ignore this one :P
- hivacruz 6y agoI updated my comment with a link to the original story, thanks!
- nly 6y agoAssigning IPs based on room number seems quite practical. I noticed something quite similar at my old residential block, where wifi was provided building wide. When you connected to the (open) WiFi network you were in a VLAN with all other unauthenticated devices. Attempts to access the internet directed you to a captive portal. After signing in (it was over HTTPS) you were then punted in to your own VLAN, where you could see all your other authenticated devices on layer 2. The system remembered your MAC so you only had to do the captive portal once
- deleted 6y ago[deleted]
- osivertsson 6y ago
- rgovostes 6y agoI had a long stay in a hotel in Europe one time. One day, the TV turned itself on and started playing a French music video. The TV was apparently connected to Wi-Fi and had some sort of Chromecast feature built-in, so anyone could play content to any room. Unfortunately all the settings were locked so I couldn't disable it, and had to keep it unplugged. This was when I discovered Samsung TVs have a menu option to scan for viruses, which I still think is hilarious.
- eunos 6y agoPre-Internet age that would be a ground for some horror movies and creepypastas. Now we are talking about hackers and stuff. P.S. Will we have horror movies based on Internet and IoTs, that would be very exciting.
- teddyh 6y ago> Will we have horror movies based on Internet and IoTs, that would be very exciting. There’s Demon Seed from 1977, an actual horror movie about too-smart devices. The concept was then revisited in 1984 as a romantic comedy, “Electric Dreams”.
- nitrogen 6y agoThere was also a made-for-Disney-TV movie in 1999 called Smart House that kind of approaches horror. And home automation features briefly in Back to the Future II and The Computer Wore Tennis Shoes.
- gwbas1c 6y agoIn 2002 I stayed in a hotel where the TV turned on whenever I turned on the bathroom lights. The TV was angled so that its IR sensor was aimed towards the bathroom door. I always assumed that it was just interference from the bathroom lights starting up just happening to make the same IR pattern as the ON button on the remote.
- ocfnash 6y ago
- bonyt 6y ago> I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 skipping 2 bytes and so on. There is a useful tool called ‘binwalk’ that goes through a binary offset by offset looking for signatures like this. Don’t know if it would’ve worked here, but it’s pretty awesome for finding various data formats hidden in files, and was originally made for analyzing firmware files.
- uhinter 6y agoI dont understand this step . How does skipping n+1 number of bytes help in capturing the correct file ?
- knaik94 6y agoIt's a way to find the start of the file header when you don't know the original offset. You have to have an idea about the target header format, and in this article the author was looking for an audio stream because each packet ended with LAME3.91UUUUUUU which is an mp3 audio encoder with a funny acronym. You use n+1 so each at each packet you're looking at a different part of the packet.
- bunfunton 6y agoAFAIK often the file type signature is in the beginning of the data, however a proprietary elevator music solution could add their custom headers to the beginning of the stream, or, he might have captured data midstream
- uhinter 6y agoThanks. That was helpful.
- fastball 6y agoThe idea is that the file within the byte stream does not have a clear start marker (due to the unknown length of the customer headers), so you bruteforce trying to find the file.
- michaelhoffman 6y agoI loved the conclusion!
- gwbas1c 6y ago> What the hell? I can’t believe I spent time for this. It’s just elevator music. It is played in the hotel corridors around the elevators. Oh well, at least I can listen to it from my room now. This is a perfect April Fool's day article!
- deleted 6y ago[deleted]
- spicybright 6y agoI love things like this so much. Poking and prodding on networks is just fascinating in itself.
- bootwoot 6y agohttps://www.wireshark.org/ https://www.wireshark.org/ can often save some time in the collection and packet identification parts of such ventures.
- deleted 6y ago[deleted]
- lgats 6y ago2016 https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=Udp%20hotel&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- deleted 6y ago[deleted]
- monocasa 6y ago[2016]
- anticristi 6y agoStupid thought: What is the copyright status of the captured audio? Is it copyright infringement to upload it for everyone?
- dhosek 6y agoElevator music is generally played under a license that allows for public performance (fun trivia: it's a copyright violation for businesses to play the radio in public spaces in the US which is why they pay for elevator music services). I imagine the case here lives on the edge of the license agreement, but presumably it's the music provider's software/hardware that's doing the broadcast and they would either look the other way at what the OP did (perhaps feeling that an unofficial device listening in is within the scope of the license) or, depending on local copyright laws, might file an infringement claim. Most likely, a single case like this would not be worth their effort to do more than send a sternly-worded email/letter, but if, say, someone published a tool to allow downloading the music for offline play, legal action would almost certainly be invoked. But in all of this, IANAL, so I'm probably wrong.
- teddyh 6y agoYou can’t know just from looking at the bits. https://ansuz.sooke.bc.ca/entry/23 https://ansuz.sooke.bc.ca/entry/23
- rurban 6y agoThis story comes up every year (2016). Click on past to see the older comments.
- beeforpork 6y ago> What the hell? I can’t believe I spent time for this. It’s just elevator music. Is it not wonderful to find out by some hacking that elevator music is broadcast via UDP in the hotel? It's a fantastic project for a hotel room!
- themodelplumber 6y agoAgreed...It's also wonderful to consider possible alternative outcomes: A free self-care hypnosis stream for hackers, a long outdated corporate announcement stream from the 1980s that's been continuously upgraded over the years by amused IT consultants, a forgotten stream from an open mic in the conference room, or maybe even an image data stream from a webcam on the roof...
- zelon88 6y agoMulticast is used in this scenario because it is cheaper than establishing a TCP connection to 100 devices just to transfer the same packets to each of them separately. By using multicast, the device playing the music can simply subscribe to the transmission and passively listen in.
- ourcat 6y agoThis is also a great way to sync multiple LED strips (client) to some music (server).
- myself248 6y agoFor sure, but the hotel's systems should be separated from the guest network. That's a yikes and a half; I wonder what else is out there for someone willing to do a little probing.
- zelon88 6y agoIt depends. I built a system once that used a bunch of inexpensive SBCs. Due to their physical location being close to users who could easily physically tamper with them; I placed them on my client network and treated them just like regular clients rather than putting them on a more trusted network. I'm not going to put a $50 IOT device on a subnet next to $10,000 servers. If you only have a handful of devices maintaining them is easier by throwing them in the least trusted tier and applying standard user monitoring rather than trying to micro manage them. The data they're dealing with is inconsequential to the operation of the business. By the way I'm not talking about Chinese IOT devices with default root passwords and ssh enabled. I'm talking headless Windows clients.
- myself248 6y agoThat's a really fair point! If any dork could pop a ceiling tile and get onto the network you've assumed is trusted, that's its own sort of problem.
- bbulkow 6y agoSkipping 8 bytes at the front of each packet? Probably a sequence number or timestamp, a very normal think to do.
- deleted 6y ago[deleted]
- dang 6y agoIf curious, past threads: Reverse Engineering a Mysterious UDP Stream in My Hotel (2016) - https://news.ycombinator.com/item?id=16197436 https://news.ycombinator.com/item?id=16197436 - Jan 2018 (15 comments) Reverse Engineering a Mysterious UDP Stream in My Hotel - https://news.ycombinator.com/item?id=11744518 https://news.ycombinator.com/item?id=11744518 - May 2016 (181 comments)
- TheDudeMan 6y agoThe revelation immediately reminded me of the decoder ring subplot in "A Christmas Story".
- yezr 6y agoare you still in the hotel? ideas for your next blog post: push out your own packets to change the elevator music??
- mfashby 6y agoReminds me I did a similar thing on virgin trains in the UK once. I found a host visible on the customer wifi that streamed location data using NMEA protocol over tcp, which I guess was used for hardware showing live location somewhere on the train.