Hacker News Reader

Comment by eastdakota | Hacker News Reader

Also wonder if there’s a buffer overflow attack or some command that could cause them to get stuck flashing rapidly or something that would be really annoying. Surprised by the lack of encryption or any security on devices like these. For a long time there was no encryption on the Shure wireless mics most big shows use. Hopefully that’s been corrected as that seems like a real way you could cause (dangerous) problems at an event like a stadium concert.

View on HN

> Surprised by the lack of encryption or any security on devices like these.

Note how the worst scenario you could think of was "get stuck flashing rapidly". That's why there's no encryption.

I suppose you could (partially) ruin a concert if you infected all (or most) of the wristbands with your random blinking virus. But hitting so many would be hard, and for what gain?

Seems more like the sort of thing someone at 4chan or similar would do, just because they could. For shits and giggles.

But how is a random 4chaner getting a bluetooth signal close enough to all parts of the stadium without being noticed?

Inside person or from above or from below

This is a really lame James Bond movie!

I recognize that it is technically possible to cause mischief with these things, but they require access to substantial resources and are likely to get you arrested, all in the pursuit of basically nothing.

That’s literally a common troll MO. People often do things despite no logical or rational reason.

I’m reminded of a quote from Edmund Hillary after successfully climbing Mt Everest (he and Tenzing Norgay being the first humans to do so). A reporter asked him why he climbed it. His response:

Because it was there.

Bluetooth range is only limited if you care about transmission power regulations.

If you don't care about transmission power regulations you could also just jam the sound system, to heck with the pretty lights.

And then you'll get arrested.

Every large scale production event relies heavily on standard wireless microphones, which would be fairly trivial to disrupt from the parking lot.

Are digital spread-spectrum microphones used? Traditional "just modulate the mic to 485.250 MHz" systems seem too jammable/hijack-able nowadays, while a digital frequency-hopping scheme is more resistant to interference, intentional or accidental, at the expense of some milliseconds of latency.

Just looking at the most expensive wireless solution on the Shure website: Shure AD4Q Four-channel Axient Digital Wireless Receiver: 4-channel Digital Wireless Receiver with 184MHz Tuning Range, Frequency Diversity, and 256-bit Encryption, $7500.

If a large production ever has an issue with someone in the parking lot (or elsewhere) trying to jam them, the cost of one of these systems feels like basically nothing. You'll spend more on renting chairs.

As someone who produces large scale events in major cities I can tell you it's still not a solved problem. In places like Times Square there's just so much RF going on from similar devices that you can see bizarre intermittent problems. That's the observation I'm using to assume it could also be done intentionally.

Which, of course, would be a massive problem with the FCC and a felony and all that. But technically it's still possible I'm assuming.

To answer your question yes, for sure large scale productions have the top end devices, and plenty of backups.

It's infrared, not bluetooth.

I'm pretty sure it has both infrared and Bluetooth.

But if it really is only IR, then this is doubly pointless because I'd like to see someone come to the stadium with a massive IR spotlight that no one noticed.

And, it's presumably only an IR receiver so how would encryption even work?

You definitely could have an encryption protocol that works on a unidirectional 38kHz IR system. You put your public key in the receiver, then you, the sender, can sign a message with the matching private key and the receiver can verify the match. You can't authenticate that only authorised devices receive the message (which is usually what the secure crypto chips with a private key in them bring to the party). You also don't need to provide any kind of secrecy - the message content is about to be broadcast in thousands of LEDs. But then you've made it much less reliable as you have to get a lot of bits across in perfect order, and adding enough forward error correction to compensate affects throughput.

Plus if you or the venue staff fluff the crypto it's another failure mode that results in Taylor Swift's legal team uncapping their Mont Blancs.

Whereas the real beauty of this system is that it leans into the noisy channel and is designed so dropping a few bits here and there is basically imperceptible. Anyone in a position to mount a malicious IR transmitter that can overwhelm the existing ones (assuming that even works and doesn't just mutually interfere and break everything) is presumably already an insider and can probably just copy "naked_hitler_flipping_the_bird.mkv" to the Jumbotron controller anyway.

But isn't this trivially susceptible to a relay attack? Anyone could capture the IR sequences that cause the band to light up in each color, and rebroadcast them whenever they want.

But I think we're in agreement that this is pointless anyway...

> Anyone could capture the IR sequences that cause the band to light up in each color, and rebroadcast them whenever they want.

Add a monotonic counter/nonce

> But I think we're in agreement that this is pointless anyway...

Agreed.

They certainly could do that, but:

1. Most people at this sort of concert want things like this to work. I don't think there are many people who are going to buy a ticket to go just to screw with the LED wristbands. Then again, who knows, some people are unfathomably stupid.

2. It would be fairly difficult to sneak a 30W IR lamp into the concert undetected. I suppose you could do something (much) smaller and low power; maybe disguise it as a phone or a point-and-shoot camera (which concert security may or may not allow), but then you're not going to affect all that many devices. And it also might not be hard for security to find you if they can see some sort of radius of effect from where you're standing. You'd probably have to hold it up in the air, continuously, for a while.

Right, which is why I've been saying there's no point encrypting any of this!

Public key encryption is computational expensive in embedded devices and microcontrollers. Using a simmetric key encryption with a pre shared key it's simpler and less complex.

You could definitely ruin a concert by projecting offensive symbols or messages. Especially since if it's done well, most concertgoers would initially assume that it's part of the show.

But to actually create patterns you'd need a huge IR spotlight!

Obviously you use the wristbands themselves to propagate your hacked signal.

How? They receive IR but can’t transmit it!

Even if it was possible to propagate with the bands themselve (I think the vendor’s website mentions there is a Bluetooth version, maybe you could with that), you still have the problem of not knowing where any are, so if you actually want to show anything meaningful on a group of these, you can’t really. You can just make annoying flashes.

Why huge? Something couple times stronger than a TV remote should be fine, if focused. Unless they purposefully put a powerful IR attenuator in front of the receiver, as a security measure so that a would-be attacker would really need a a "huge IR spotlight".

Because distance and reflection are the attenuators here. A stadium-sized group of kids aren't very good at pointing your receivers at your rogue transmitter.

We've found the cybersecurity enthusiast that ruins everything.

> For a long time there was no encryption on the Shure wireless mics most big shows use.

Latency is really important for live audio at shows, so that was probably the priority.

Reply on news.ycombinator.com