WarezTheRemote? Under the Couch, and Listening to You
summary
Exploit demonstrates a man‑in‑the‑middle against the Comcast XR11 voice remote by impersonating the paired X1 box over RF, crashing the box’s Control Manager (via simple fuzzing) and answering encrypted firmware queries in plaintext; attack uses a CC2530‑based stack (CC2530) and sends ~1500 packets to upload a modified image (just 36 bytes modified) that makes the remote check hourly and record 10‑minute streams; proof works from ~65 ft through a wall, audio intelligible ~15 ft, upload ~20–30 minutes.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 1:17The Remote
- 3:26How to Hack a Remote
- 5:46Code Samples
- 7:53Understanding the Firmware
- 9:27Code Sample
- 11:14HalOnOff
- 14:25Firmware Upgrades
- 16:09Our Work
- 16:34Firmware Upgrade
- 19:03Interference
- 20:19Cryptography
- 24:39Final Process
- 26:31Equipment
- 27:03Replacing Firmware
- 27:49Testing
- 29:00Taking Over the Microphone
- 29:12Firmware
- 30:08New Firmware
- 31:29New Flow
- 32:16Field Tests
- 32:26Initial Attack
- 33:49Audio Decoding
- 34:59Comcasts Response
- 35:27Recap
- 36:49IoT Research
- 37:53Future RF
- 39:17Conclusion
related talks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
55mAttacking Industrial Remote Controllers
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
44m"Attacking industrial remote controllers for fun and profit"
01h 06mComputrace Backdoor Revisited
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem