18 ms·
Reverse engineering a mysterious UDP stream in my hotel (2016)
- WirelessGigabit 4y agoSo either the elevator is on the same network, or they misconfigured the broadcast to all networks instead of the one needed. First one being much worse as it shows a failure to understand network segregation.
- monocasa 4y agoEh, the sound system on the elevator being hooked up to the guest and entertainment network isn't really a sin in my eyes.
- jvm___ 4y agoAs long as it's segregated that way. Someone was able to gain access to their Dr's office's network by accessing the wifi-enabled fish tank thermometer. I forget if the details of how exactly they accessed it, but it was an example of an Internet of Things device making a security hole in a network.
- duskwuff 4y agoIt wasn't a doctor's office, it was a casino: https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/ https://www.washingtonpost.com/news/innovations/wp/2017/07/2...
- shanebellone 4y ago"Someone was able to gain access to their Dr's office's network by accessing the wifi-enabled fish tank thermometer" I think you're mistaken/misremembering. It was a casino. https://www.entrepreneur.com/business-news/a-casino-gets-hacked-through-a-fish-tank-thermometer/368943 https://www.entrepreneur.com/business-news/a-casino-gets-hac...
- deleted 4y ago[deleted]
- jameshart 4y agoUntil someone on the guest network starts broadcasting audio into the elevators
- monocasa 4y agoTo what end?
- JUNGLEISMASSIVE 4y ago[dead]
- bheadmaster 4y agoChaos!
- monocasa 4y agoRain will go up, cats will chase dogs, and the elevators will play acid jazz instead of smooth jazz.
- Salgat 4y agoThat's more of an annoyance than a safety issue though. This is definitely one of those YAGNI things where it's not worth worrying about until it becomes a recurring issue, which is highly unlikely.
- paisawalla 4y agoPersonally, even the remotest possibility of someone broadcasting "evacuate your rooms, there is a fire/active shooter in the building" seems worth spending a few hours protecting against.
- gambiting 4y ago....why? No, honestly, why? Would you protect against someone running down the corridor shouting the same thing?
- snickerbockers 4y agoit's not the elevator it's, a speaker inside the elevator. nobody's hacking any elevators with this.
- gloyoyo 4y agoYes, you could zap any devices near-by
- malfist 4y ago> shows a failure to understand network segregation Why? It's highly likely they just don't care. Which is fine. It's an elevator speaker.
- outworlder 4y agoIt's also highly likely that they do not care about more things if they do not care about this. Sure it's an elevator speaker and probably you can't do much (probably! 'simple' devices are packing ever more hardware). But something is sending those packets. What's that? Can it be hacked? What else can that device/server see? Are there other devices sharing the network with customers?
- anyfoo 4y agoIt's multicast, not broadcast (which means the networks could still be separated, among other things), and it's not too surprising that the network for the entertainment system carries this (by today's standard) low bandwidth stream. Yeah, with a better/better configured switch it could not reach the individual client unless it subscribed to the multicast stream, but again, who cares about that low bandwidth stream... you should not trust any hotel network anyway, those audio packets won't do extra harm.
- yencabulator 4y agoMulticast, uh, finds a way.
- deleted 4y ago[deleted]
- jessaustin 4y agoPreviously: https://news.ycombinator.com/item?id=26633792 https://news.ycombinator.com/item?id=26633792
- dang 4y agoThanks! Macroexpanded: Reverse engineering a mysterious UDP stream in my hotel (2016) - https://news.ycombinator.com/item?id=26633792 https://news.ycombinator.com/item?id=26633792 - March 2021 (86 comments) Reverse Engineering a Mysterious UDP Stream in My Hotel (2016) - https://news.ycombinator.com/item?id=16197436 https://news.ycombinator.com/item?id=16197436 - Jan 2018 (15 comments) Reverse Engineering a Mysterious UDP Stream in My Hotel - https://news.ycombinator.com/item?id=11744518 https://news.ycombinator.com/item?id=11744518 - May 2016 (181 comments)
- Maxburn 4y agoI thought this story sounded familiar.
- navigate8310 4y agoProbably their turn to farm some karma.
- 1-6 4y agoPerhaps they have some form of dementia and keep repeating their discovery.
- hnthrowaway0315 4y agoDoes that mean someone can hijack the stream and play some end of world audios?
- ChrisMarshallNY 4y agoSounds possible, but you’ll have to deal with address contention. Play some good old Rammstein, to make your elevator journey more pleasant.
- andy_ppp 4y agoOr the sound of an elevator jamming…
- lb1lf 4y agoThis reminded me of an evil prank I did on some friends of mine when in university - CD burners had just become a thing, and at the local concert venue where we volunteered, a handful of burned CDs soon appeared at the mixing console with various music the engineers liked to listen to while getting ready for a gig. Anyway, I ripped the discs, added a nice 50Hz hum under the music and burned new copies which I then left by the CD player. Yup. Cue frustrated sound engineers trying to debug the ground loop which only manifested itself when the CD was playing. I never dared admit to the prank, but rather swapped the hum CDs for the originals before someone got a chance to investigate this thoroughly...
- bdhcuidbebe 4y ago[flagged]
- thimkerbell 4y agoI was once in a shopping center parking lot where what sounded like a private conversation was being broadcast at an al fresco dining establishment on one side. It makes you think.
- teepo 4y agoReminds me of the film "The Conversation". Check it out if you get a chance. https://www.imdb.com/title/tt0071360/ https://www.imdb.com/title/tt0071360/
- dark-star 4y agothis could use a "(2016)" in the title....
- dang 4y agoAdded. Thanks!
- larsonnn 4y agoSPOILER ALERT: did you play it reverse? I bet there is some hidden message…
- peterleiser 4y ago"To win the game, you must kill me, John Romero!" https://www.youtube.com/watch?v=k2IcSsoPLnI https://www.youtube.com/watch?v=k2IcSsoPLnI
- Dowwie 4y agoThe digital equivalent of a beach metal detector enthusiast
- matzf 4y agoMetal detectorists! Ah no, oops, you had it right, force of habit ;)
- boucher 4y agoI'm not sure if the habit is because of the show or not, but I wanted to note for anyone who might be reading that "Detectorists" is a really charming British show that I highly recommend.
- TomK32 4y agoSpring is coming up, the perfect time to re-watch Detectorists.
- penguin_booze 4y ago"Did you find gold?" "Oh for fuck's sake".
- hackernewds 4y ago"Metal detectives" perhaps?
- graiz 4y agoWould have been more entertainig if he had broadcast his own UDP music. Perhaps the 8bits were some checksum to prevent such hackery?
- maxloh 4y agoWhat will the elevator speaker do if it received 2 music packets instead of 1?
- lagniappe 4y agoIt's UDP, so it'd probably take it, or at most silently discard one, by my guess
- tragomaskhalos 4y agoOr record and broadcast yourself saying "this elevator is going directly to HELL" in a spooky Vincent Price voice!
- cyclotron3k 4y agoOr David S Pumpkins music every time the doors open
- kibwen 4y ago> But what was this audio? Was this a sneakily placed bug that listened to me? [...] I can’t believe I spent time for this. It’s just elevator music. Joke's on you, it's a bug listening to you in your room while using steganography to merely appear to be elevator music!
- blueberrychpstx 4y agookay this is way over my head - but this would have to be steganography hiding in the audio file that could only be run by someone like OP, detecting; downloading; etc the udp data, right?
- unwind 4y agoToday (but perhaps slightly less in 2016, not sure) you could easily imagine a microcontroller (or FPGA) with a microphone that bugs you, but encodes that audio (using steganography) onto a canned audio file of elevator music, and then sends the result over the network "in the open". To a casual observer snooping the relevant network, it would probably (as here) look as elevator music, but to the intended recipient who can decode the steganography, it would be a covert listening device.
- sublinear 4y ago> to the intended recipient who can decode the steganography Not just decode, but also decrypt. You'd probably want to encrypt not just for the secrecy, but so that the noise introduced by the steganography doesn't seem so suspicious.
- ajsnigrutin 4y agoThis would work if the elevator music was a never-repeating stream. With most elevator music, it's a few minutes of a "song" playing on repeat 24/7, so if you recorded a few repetitions of the "song", you'd probably see also repeated packets on the network. If the music was repeating but the stream was different all the time, then steganography could be the reason :)
- jawadch93 4y ago[dead]
- t0bia_s 4y agoSite is blocked by NextDNS.
- radicality 4y agoWhich rules? Works for me on Nextdns. I have the “NextDNS Ads & Trackers”, and “Adguard DNS” blocklists enabled, and I think also enables every non-beta feature under Security.
- t0bia_s 4y agoEnergized Blu Go
- niels_bom 4y agoTIL about BibTex, very cool. https://en.wikipedia.org/wiki/BibTeX https://en.wikipedia.org/wiki/BibTeX
- ValtteriL 4y agoI wonder what brand of elevators were using this scheme
- hummus_bae 4y ago[dead]
- pfoof 4y agoThe question is: why? Why distribute the music that way, why not just attach it to a radio directly, or some RPi that will pull the stream, or just have it prerecorded. Despite its simplicity, seems to be overengineered.
- moffkalast 4y agoScience isn't about why, it's about why not!
- anyfoo 4y ago> Why distribute the music that way Because distributing music over multicast works very well, and it's rather simple in nature: You get audio frames as UDP packets, you play them. Because it's multicast, they reach where they should. > why not just attach it to a radio directly Because you lose control of what's being played, and there are probably not many "elevator music" radio stations. > or some RPi that will pull the stream Because then every location that plays the music has to pull an individual stream, quickly saturating the bandwidth for no reason, instead of just subscribing to the multicast stream. I also would not say "some RPi" is less engineering, and less maintenance, than the current solution that likely uses an off the shelf multicast audio system. > or just have it prerecorded Because you lose control of what's being played without a significant replacement step, when you could just play a multicast stream instead. > Despite its simplicity, seems to be overengineered. I'm honestly not convinced I read a less "overengineered" solution so far...
- hot_gril 4y ago> I'm honestly not convinced I read a less "overengineered" solution so far... Prerecorded music on an MP3 player sounds like the one simpler solution, though it wouldn't put the elevators in sync with each other or let you control it remotely.
- anyfoo 4y agoYes, but if you want to do even as much as not play the music in the middle of the night, now your MP3 player needs a clock. That clock may drift, or it may drop out completely when the power goes out, unless you synchronize that clock over the network. But if you have network on your MP3 player, you may as well let it subscribe to the multicast stream instead of reading the stream from internal storage. If you do not have network, and you want to change the schedule of when your music plays, have fun to send out some maintenance crew to every single one of those devices. And don't forget any...
- marcodiego 4y ago" There was obviously data in this packet and file should know when it sees MPEG Audio data, so I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 skipping 2 bytes and so on. Here’s the code I used and the result." Wouldn't binwalk do just that?
- thesh4d0w 4y agoThere's a lot of those types of things in this. Why write a python script to receive the packets, when he just talked about using wireshark?
- ww520 4y agoActually the multicast audio is a pretty good system. There're multiple elevators. Broadcasting makes it simple to sync up the music on them. Using a Wifi speaker has much lower cost than adding a wired speaker to a moving elevator. It’s also simple and low cost to add extra WiFi speakers in other areas of the hotel, creating an ad hoc PA system.
- kkielhofner 4y agoI worked on a WiFi multicast video streaming solution and while it theoretically works as well and is as easy as you describe in practice it can be a complete nightmare. Full disclosure this was a few years ago so things may have improved. I also can’t remember all of the specifics but there was a lot of low-level driver work, firmware tweaks, specific configurations of just about every WiFi param you can think of, etc.
- inferiorhuman 4y agoSonic used to offer mbone connectivity (including BBC channels) back when they were an internet service provider and not a web provider. It was pretty nifty but never very user friendly to set up.
- op00to 4y agoWhen I worked at a core i2 .edu site, we had all the "hd" mbone tv streams. It was pretty wild considering HD was a "new" thing! Thanks for reminding me of that wonderful time!
- inferiorhuman 4y agoWikipedia had this quote from Mick Jagger: I wanna say a special welcome to everyone that's, uh, climbed into the Internet tonight and, uh, has got into the M-bone. And I hope it doesn't all collapse. What a time to be alive.
- 4y ago
- RektBoy 4y agoTime for new elevator music :)
- 0xDEF 4y agoWhat is the historical reason we don't have true multicast on the Internet when it works fine on local networks?
- flying_sheep 4y agoThis is a piece of good Hacker news. Nice job
- deleted 4y ago[deleted]
- jojobas 4y agoI'd have a second stream playing looped rickroll.
- tablespoon 4y agoI am disappointed he didn't include some of the music he captured.
- jaimex2 4y agoWheres part 2 where you start broadcasting your own elevator music?
- AbusiveHNAdmin 4y agoOr moaning noises, akin to the treat airline passengers famously enjoyed last year over planes' PAs.
- ObviousHumanGPT 4y agoNo one is going to use UDP to bug a room. They're going to encode the audio over prerecorded noise and broadcast on 500/600mhz, i.e pretend it's a stage microphone that a musician left on in their bag.
- indus 4y agopiped music, tap-in and listen.
- ahepp 4y agoYou can do something similar with ffmpeg -stream_loop -1 -re -i gettysburg.wav -f mp3 udp://239.0.0.1:1234 on one device, and ffplay -i udp://239.0.0.1:1234 on another device. You can also play the stream with ffmpeg doing something like ffmpeg -i udp://239.0.0.1:1234 -f pulse default
- skhm 4y agoI’ve done this to make music remotely on the CLI from my phone SSHd into a VPS, forwarding pulseaudio/JACK and listening to the stream in a browser in the background. fun times
- ahepp 4y agoNice! I assume if it was over the WAN you probably had to unicast it? I've experimented a tiny bit with the builtin pulseaudio RTP sink/source, but I've not used it extensively. I'm not sure if cutting out ffmpeg would be beneficial.
- skhm 4y agoI wrote a little post about it: https://a.skh.am/2020/08/31/tidal-ios.html https://a.skh.am/2020/08/31/tidal-ios.html Managed to get the lag down to a usable amount for algorithmic music, but would not be suitable for playing an instrument remotely
- erdemozg 4y agojaw-dropped.gif Such a powerful tool... And thank you for letting us know about this trick.
- c0deR3D 4y agoIs it then possible that one can "decorate" the elevator music? At least at a interference level. :p
- pajko 4y agoThe port might be a reference to room 2046: https://m.imdb.com/title/tt0212712/ https://m.imdb.com/title/tt0212712/
- mxhdrm 4y agoAnyone thought of spoofing the IP of the gateway (UDP won't care, right?) and sending your own song around the corridors? Sounds like fun
- gorkish 4y agoSounds to me like the hotel needs a network engineer to properly configure IGMP and multicast on that network.