Reverse engineering a restaurant pager system
k3xec.com
k3xec.com
I mean, that's helpful, but....
In the before computers times there was an ironically titled book called 'Steal This Book'.
Amongst a verity of other things it describes one of the funniest and most beautiful hacks I've ever heard of. I'm leaving this as a hint for others for fun or the rare cases that I know are on here that absolutely need to eat without money.
It requires one trusted accomplice and an all you can eat buffet. The rest is up to you to find out. It always works flawlessly and has for over half a century.
> On The Road seems to be a picture of a high-trust society. Drivers assume hitchhikers are trustworthy and will take them anywhere. Women assume men are trustworthy and will accept any promise. Employers assume workers are trustworthy and don’t bother with background checks. It’s pretty neat.
> But On The Road is, most importantly, a picture of a high-trust society collapsing. And it’s collapsing precisely because the book’s protagonists are going around defecting against everyone they meet at a hundred ten miles an hour.
But then again he was a yuppie not a hippie trying to levitate the pentagon so that all the evil spirits fall out. ;)
And here we are where we are eh?
ISTR yuppies were years after the Youth International Party (and quite different).
Anyone?
Meant to say Kerouac was a beatnik, Abbie was a yippie who inspired a generation of dirty hippies.
And we've sunk further still but I don't know that there is a lasting term yet. Maybe it will be NPC? I favor Quaranteenie (which makes less sense but sounds more fun, I mean by it a teenager who was locked up during their formative years and ended up a politically active mentally ill ignoramus)?
You gotta keep in mind that there is a sizeable portion of any hacker culture that doesn't want to (or can't) do any part of the actual hacking that gets things figured out, but instead just want to use what was figured out in ways not intended by the original purpose of whatever was hacked. One might say the script kiddies of the physical side of things.
There are way more cooks in the kitchen than chefs.
1/858e-6 sec = 1165 Hz. They were likely trying for 1200 Hz, but the crystal was a bit off.
Somehow when they stack, they know where they are relative to the other pagers (at least something does).
Eg: Host sends "who are you" first device appends an ID number and then propagates the message forward in the chain. Each device does the same, until the last device in the chain (which detects electrically or via a timeout that there are no more devices) decides to loop the message back to the host.
Obviously, that's for power delivery: They stack to charge.
But it seems like data must be sent (in one direction) through the stack at the same time that charging happens -- to set IDs, and to let attract mode work.
One way I can conceive of to allow this to happen is by reversing polarity: Send power with one polarity for a 0, and in the opposite polarity for a 1.
Once a pager has some data, it can pass it along to the one stacked above it by doing the same thing -- in a manner not dissimilar to how things like RGB LED strings do.
Charging can happen at the same time as this data is received (and potentially modified) and then retransmitted by using a bridge rectifier in each unit for the charging circuit, so that (as far as the battery bits can see) the polarity remains constant.
(This sounds complex and slow, but using things like diodes and MOSFETs is cheap at mass production PCB stuffing scales, and the data rate needn't be fast. It may even be cheaper to do it this way than a more complex assembly with dedicated data pins.)
My own idea implies a potential of ~100% charging duty cycle even as low-speed data is being transferred, and that's good because charging seems to be the primary goal here in this application.
(My other idea, that I have not yet espoused, involves a waveform on top of a fairly-constant charging voltage. It can perform asynchronously, and might even be just amplitude modulation. But it probably means more parts and complexity than my first idea involves: Functional analog filters always seem to take a handful of parts to get the it right, whereas my polarity-swap idea only uses a couple of high-tolerance jellybean MOSFETs and some parts-bin diodes.)
Ooh, just AM off the power pin itself is another clever of doing it. All comes down to price and what's the cheapest to implement so you can drive the BoM on the puck's down as much as possible.
There are only two contacts between any device and the device below it, according to the photos. This trend continues upward for all subsequently-connected devices.
An interface with +, -, and ground implies three contacts.
basically rs232 signaling with just tx and ground
Protocol-wise, WS2812B for LEDs works basically by having every LED along the way take the first X bytes, interpret as a command to themselves, and forward the rest -- and that's how you can address a 100 LEDs on one data line.
Could the attacker write it themselves? Probably. Will reducing the cost by providing ready-made code increase attacks? Almost certainly. I wish that more people would consider whether releasing the code will be a net benefit (by enabling legitimate research, education, proof-of-concept demonstrations of vulnerability) or harm (by enabling malicious attacks). Even if the underlying exploit/vuln/feature is the same, form matters: A ready-to-use attack toolkit with multi-client management capability is much more likely to be useful to attackers than defenders, where a simple proof of concept that is hardcoded to show a pre-defined message with no easy way to change that is much less likely to be reused maliciously.
And pranking a pager system sounds pretty harmless, until you realize that a restaurant is likely quite strongly relying on it and essentially DoS'ing it has the potential to affect their business.
Or they would take reservations in advance, but almost none do that anymore.
Of course they could, and would, go back to shouting numbers, but there's a reason they introduced a pager system. It'd likely slow them down, and with the razor thin margins many restaurants operate at, even a small impact on their revenue could be problematic.
>Multiple keyboards call the same pager. The pager system long range supports multiple keyboard call the same restaurant pagers.
As an aside, all the church nursery references stand out to me. Are pager systems common for that and am I just out of touch?
[1] https://www.amazon.com/Retekess-Restaurant-Adjustable-Remind...