Reverse engineering a mysterious UDP stream in my hotel (2016) | Hacker News Reader

Reverse engineering a mysterious UDP stream in my hotel (2016)

gkbrk.com

504 pointscrecker86 comments

> I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 skipping 2 bytes and so on.

There is a useful tool called ‘binwalk’ that goes through a binary offset by offset looking for signatures like this. Don’t know if it would’ve worked here, but it’s pretty awesome for finding various data formats hidden in files, and was originally made for analyzing firmware files.

I dont understand this step . How does skipping n+1 number of bytes help in capturing the correct file ?

It's a way to find the start of the file header when you don't know the original offset. You have to have an idea about the target header format, and in this article the author was looking for an audio stream because each packet ended with LAME3.91UUUUUUU which is an mp3 audio encoder with a funny acronym. You use n+1 so each at each packet you're looking at a different part of the packet.

AFAIK often the file type signature is in the beginning of the data, however a proprietary elevator music solution could add their custom headers to the beginning of the stream, or, he might have captured data midstream

Thanks. That was helpful.

The idea is that the file within the byte stream does not have a clear start marker (due to the unknown length of the customer headers), so you bruteforce trying to find the file.

The assumption is that the packet is something like header + file (I don't know if header is the right terminology). You don't know how many bytes the header is, so you increment the header length until the remaining bytes are recognized as a file.

There is something missing from the English article, which is a shame. In the French article [1], he talks about another story at the end that implies lights.

He was able to control lights from all the bedrooms in another hotel by putting his laptop between the tablets controlling the lights and the ethernet cables. Funny story, the IP adresses were assigned based on the bedroom number, eg the bedroom 714 had an IP of 172.16.20 7.14.

Edit: my bad, the second story was included in the French article but was written by another person, Matthew Garrett. Here is the story in English: https://mjg59.dreamwidth.org/40505.html

[1]: https://linuxfr.org/news/son-et-lumiere-a-l-hotel

It's not actually missing from the English article. The French translation just combined two hotel-related articles into one, the light story is from another author.

EDIT: Just saw your edit, ignore this one :P

I updated my comment with a link to the original story, thanks!

Assigning IPs based on room number seems quite practical.

I noticed something quite similar at my old residential block, where wifi was provided building wide. When you connected to the (open) WiFi network you were in a VLAN with all other unauthenticated devices. Attempts to access the internet directed you to a captive portal. After signing in (it was over HTTPS) you were then punted in to your own VLAN, where you could see all your other authenticated devices on layer 2. The system remembered your MAC so you only had to do the captive portal once

We had something similar in one place I lived, sans VLANs I think, but not sure if it makes any diff?

With wireshark you could figure out the MACs available on the network and use the signin of someone else when they were not online by using their MAC adress.

> The system remembered your MAC so you only had to do the captive portal once

Staying in a Marriott in Oklahoma last week and my laptop joined the wifi. Captive portal said "welcome back Adam, click here to connect" WTF? How did they know who I am?

When connecting my phone I got a prompt to enter my room number / name and select higher speeds (which I get free for premium status) and saw the checkbox labeled "remember my device" ah, so, that's how they remembered me.

Did some digging and the last time I was in a Marriott was in 2019 (Thanks Pandemic!). In Tel-Aviv. Equal parts creepy and impressive and slick.

I did this when we set up a VPN for the our chain of retail stores: store 312 got 10.X.3.12, for example. Extremely handy for status checks since everyone in the company (including local managers) referred to stores by number.

This seams like someone configured multicast (smart!) in the hotel but did not use multicast-aware switches or did not turn on IGMP snooping. So the switches retrieved the package, did not know it was multicast and delivered it as broadcast to all connected endpoints.

> By default, a network switch which is not configured to use IGMP will forward Multicast traffic to all switchports on the switch. Devices will be responsible for filtering out the traffic that they do not want to receive.

https://service.shure.com/Service/s/article/multicast-and-ig...

And they haven't VLAN separated whatever is playing the elevator music, which would be standard practice.

Yes. Yet maybe the switches aren't VLAN aware either. Then – as far as I understand – VLANs would not have helped here either.

IP multicast only works over the broadcast domain, so VLANing off the speakers would work. You’d need multicast routing enabled on your routers to move multicast traffic between VLANs.

IP multicast routing and internetworking is a thing. There used to be working one to many internet TV based on multicast in the 90s (was called Mbone). There's contemporary experimental use of routed multicast on public internets too (see eg https://meetings.internet2.edu/2019-technology-exchange/deta...)

edit: seems the IETF are currently in process of deprecating any-source multicast and recommending people focus on keeping single-source multicast working well in as many networks as possible: https://datatracker.ietf.org/doc/rfc8815/

Oh, IP TV you get from you ISP in France today is totally multicast based ! Not on public internets tho, yes, that's limited to the ISP network.

I was on the local MBone segment at the NASA base (though a Navy installation) I worked at in the late 90s. It pretty much worked like you would expect, some interesting things that happened:

- Multicast frames caused our FDDI switches to reboot, had to filter everywhere those were used

- When setting up our local CoffeeCam, we used Multicast video stream -- this would have been accessable from anywhere (which would cause a security incident, no one can know when the Rear Admiral drinks coffee) so we were careful to monitor outbound advertisements and used a low TTL

- SDR, VIC, VAT, RAT, and all those other tools for doing multicast stuff worked but were very clunky

- NASA TV was broadcast over the MBone and times they would go to break in other broadcasts were continued to stream, I think various cameras were available

igmp snooping would be standard practice too

Even then, unless they restrict the multicast groups, all it takes is join from the client to receive the traffic.

True, but it would be difficult for a random device to discover the group in the first place if they aren't being forwarded the packets.

But really, this would just add one more layer of complication that doesn't buy you anything. It's not like this is security data. This is the kind of application where keeping it simple can help the reliability.

> What the hell? I can’t believe I spent time for this. It’s just elevator music.

Is it not wonderful to find out by some hacking that elevator music is broadcast via UDP in the hotel? It's a fantastic project for a hotel room!

Agreed...It's also wonderful to consider possible alternative outcomes: A free self-care hypnosis stream for hackers, a long outdated corporate announcement stream from the 1980s that's been continuously upgraded over the years by amused IT consultants, a forgotten stream from an open mic in the conference room, or maybe even an image data stream from a webcam on the roof...

I once stayed in an Airbnb 'hotel' (an entire building run as a self-service hotel in a downtown of a major city). Doing similar casual tinkering, I found the entire building's security system (keycards, external doors, access logs) on the guest wifi network, behind default passwords. I left a note in Airbnb to the hosts, but never heard back from them.

Some people truly live by "I did nothing wrong, so I have nothing to hide" philosophy and the same think that their guests also don't have nothing to hide and if they do? Maybe other people should see it, so there you go.

Possible. Or they just built a sloppy network.

Same issue with social media. People don't understand they need to protect their entire network and not just themselves.

I'm curious, was this "hotel" only available on Airbnb or did they have their own website or listings on other hotel aggregators?

I've seen this before where the building is only on AirBnB because it's zoned residental. I once stayed at an AirBnB where the little welcome binder you got when you got to the room included instructions on what to do if the cops knock on the door and start asking questions.

It's one of the caveats of bargain hunting. Sometimes you end up in sketchy situations.

Oh, I stayed in one in Xiamen like that. AirBnB did not make it clear on their website that in Xiamen AirBnB's are illegal (some cities in China they are legal and have a deal to do hotel registration with the police for you). We arrived to a pile of notices on the door "This is an illegal hotel, etc etc". Not super fun.

I had a long stay in a hotel in Europe one time. One day, the TV turned itself on and started playing a French music video. The TV was apparently connected to Wi-Fi and had some sort of Chromecast feature built-in, so anyone could play content to any room. Unfortunately all the settings were locked so I couldn't disable it, and had to keep it unplugged.

This was when I discovered Samsung TVs have a menu option to scan for viruses, which I still think is hilarious.

Pre-Internet age that would be a ground for some horror movies and creepypastas. Now we are talking about hackers and stuff.

P.S. Will we have horror movies based on Internet and IoTs, that would be very exciting.

> Will we have horror movies based on Internet and IoTs, that would be very exciting.

There’s Demon Seed from 1977, an actual horror movie about too-smart devices.

The concept was then revisited in 1984 as a romantic comedy, “Electric Dreams”.

There was also a made-for-Disney-TV movie in 1999 called Smart House that kind of approaches horror.

And home automation features briefly in Back to the Future II and The Computer Wore Tennis Shoes.

In 2002 I stayed in a hotel where the TV turned on whenever I turned on the bathroom lights.

The TV was angled so that its IR sensor was aimed towards the bathroom door. I always assumed that it was just interference from the bathroom lights starting up just happening to make the same IR pattern as the ON button on the remote.

I think it's unlikely the lights happened to send the right IR pattern.

I once hooked a TV remote up to a logic analyser to have a look and here's how the on/off signal looked for this brand: http://olivernash.org/2010/01/03/the-telly-terminator/rc6-6-...

Some further details here: http://olivernash.org/2010/01/03/the-telly-terminator/

Of course it's still possible!

I also had a long stay in a hotel, and I plugged in my own chromecast as what was available on their limited cable selection was...lacking.

After two instances of jokers starting to stream something over it I just left it unplugged when I wasn't using it. My bad for introducing an insecure device onto the hotel wifi rather than setting up my own little network, but I was lazy.

I guess at a minimum I should disable this option when I'm in a hotel!

> Let others control your cast media

> Show a notification on all Android devices connected to your Wi-Fi and let them control media casting from DEVICENAME

What would be a practical way to create a separate wifi network? Connect using a laptop then set up your laptop as a hotspot?

It looks like my phone supports sharing its Wifi connection over its hotspot. Nice to not need an extra device.

That was my rough plan, yeah. In fact I did it a few times for my xbox since the console did not at all play nicely with the hotel's captive portal.

My Apple TV, if you choose to make it available to devices nearby (can be turned off entirely), still requires a random code, which it displays on a connection attempt from an unknown device, to be entered on the connecting device.

It’s come in handy, because our neighbors sometimes accidentally choose our Apple TV instead of theirs apparently. The only thing that happens on our side is that the TV turns on and displays the code, but our neighbors don’t see the code and likely realize their mistake then.

It sounded familiar (no pun intended).

I wonder if it would be possible to multicast our own stream and get it played on the elevators. The malicious prankster in me thinks something along the lines of faked radio crosstalk where the other side is in the middle of a disaster. E.g. "This is $NAME of $MILITARY_RANK. The date is April 5, 2021. We have survived the April 4 nuclear attack at $CITY. Is anyone else out there?"

Author here, feel free to ask questions both on HN and over email.

This post brought me joy. The payoff at the end is hilarious!

Thank you for documenting this kind of tinkering in a blog.

Thanks, I was deeply inspired in 2016 from this blog post :) Nostalgia

Excellent rundown of how to do tinker with data, and great writing. If you have time please write more articles like that because they're very accessible to noobs like me, and allow me to follow along while experimenting on my machine.

Added your feed to my RSS reader in the meantime

Would you please post a link to the mp3?

2016

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

If curious, past threads:

Reverse Engineering a Mysterious UDP Stream in My Hotel (2016) - https://news.ycombinator.com/item?id=16197436 - Jan 2018 (15 comments)

Reverse Engineering a Mysterious UDP Stream in My Hotel - https://news.ycombinator.com/item?id=11744518 - May 2016 (181 comments)

> What the hell? I can’t believe I spent time for this. It’s just elevator music. It is played in the hotel corridors around the elevators. Oh well, at least I can listen to it from my room now.

This is a perfect April Fool's day article!

Recently we had a team building event in a local resort. While waiting for a wine tour, my manager scanned the opened wifi of the winery/hotel from his phone. It turned out that there was a Xiaomi tv in the wifi. We talked about streaming something nsfw there, but we decided that it would be unethical.

If it was in the resort's business center they may have left it intentionally open so that presenters can push their slides to the TV. Streaming NSFW content to it is going to be a quick way to cause inconvenience for everyone.

I don't think that it was the case. There were some other devices and the wifi name wasn't conference room or anything like that. It just looked like a sloppy setup with no password or whatsoever. Keep in mind that we weren't even in the lobby but we were social distancing on the lawn outside.

Stupid thought: What is the copyright status of the captured audio? Is it copyright infringement to upload it for everyone?

Elevator music is generally played under a license that allows for public performance (fun trivia: it's a copyright violation for businesses to play the radio in public spaces in the US which is why they pay for elevator music services). I imagine the case here lives on the edge of the license agreement, but presumably it's the music provider's software/hardware that's doing the broadcast and they would either look the other way at what the OP did (perhaps feeling that an unofficial device listening in is within the scope of the license) or, depending on local copyright laws, might file an infringement claim. Most likely, a single case like this would not be worth their effort to do more than send a sternly-worded email/letter, but if, say, someone published a tool to allow downloading the music for offline play, legal action would almost certainly be invoked.

But in all of this, IANAL, so I'm probably wrong.

You can’t know just from looking at the bits.

https://ansuz.sooke.bc.ca/entry/23

Multicast is used in this scenario because it is cheaper than establishing a TCP connection to 100 devices just to transfer the same packets to each of them separately.

By using multicast, the device playing the music can simply subscribe to the transmission and passively listen in.

This is also a great way to sync multiple LED strips (client) to some music (server).

For sure, but the hotel's systems should be separated from the guest network. That's a yikes and a half; I wonder what else is out there for someone willing to do a little probing.

It depends.

I built a system once that used a bunch of inexpensive SBCs. Due to their physical location being close to users who could easily physically tamper with them; I placed them on my client network and treated them just like regular clients rather than putting them on a more trusted network. I'm not going to put a $50 IOT device on a subnet next to $10,000 servers. If you only have a handful of devices maintaining them is easier by throwing them in the least trusted tier and applying standard user monitoring rather than trying to micro manage them. The data they're dealing with is inconsequential to the operation of the business.

By the way I'm not talking about Chinese IOT devices with default root passwords and ssh enabled. I'm talking headless Windows clients.

That's a really fair point! If any dork could pop a ceiling tile and get onto the network you've assumed is trusted, that's its own sort of problem.

Reminds me I did a similar thing on virgin trains in the UK once. I found a host visible on the customer wifi that streamed location data using NMEA protocol over tcp, which I guess was used for hardware showing live location somewhere on the train.

https://www.wireshark.org/ can often save some time in the collection and packet identification parts of such ventures.

He had discovered the stream in the first place using Wireshark, the python scripts were for extracting the data and trimming off the header on each packet.

Oh ya! I didn't read closely enough.

Unfortunately the url gave it away, or it would have been an exciting read.

What do you mean?

the slug is literally "/hotel-music/"

The slug for the article in the url is `hotel-music`. So you can kind of deduct what's it going to be in the end. I thought it was still nice.

What would happen if you sent your own UDP packets on the same port? Could you manipulate the elevator music? Or would it turn into noise as the elevators receive packets from both sources?

Not my space, but googling around a bit on how ADTS works, it can include everything needed to send a "playable" bit of MP3 data in a single frame.

So it seems like if you started sending multicast packets, the sound would be interleaved with the other stream. If you used a lower bitrate (they are using 192kbps) you could have a bigger piece of the playing time slice, since each of your packets would be a longer running snippet. Similarly, going mono vs stereo would extend that more.

Given that it's a hotel, lots of the devices probably have default admin passwords though, so shutting off the other stream is probably not hard :)

Oh man, this would be fun to do. Interleave at random moments an MP3 of sinister laughing.

Skipping 8 bytes at the front of each packet? Probably a sequence number or timestamp, a very normal think to do.

The revelation immediately reminded me of the decoder ring subplot in "A Christmas Story".

I love things like this so much. Poking and prodding on networks is just fascinating in itself.

This story comes up every year (2016). Click on past to see the older comments.

I loved the conclusion!

are you still in the hotel? ideas for your next blog post: push out your own packets to change the elevator music??

From 2016

You beat me to it! https://news.ycombinator.com/item?id=16197436

Year added above. Thanks!

[2016]

Reply on news.ycombinator.com