Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/219 Thanks!
So welcome everybody.
This talk for today is by
Sasha and Malia.
They have looked at the security, or
maybe you could say, insecurity of
home automation systems.
In this case, the home network
and I won't waste your time, so
please give them a big round of applause.
Satya.
Yes, hello, my name
is Satya
and I'm Molly.
And in the next 45 minutes, we
are going to tell and show you how
to sniff automatic device traffic.
How to emulate hermetic devices
and how to attack automatic system.
This talk only focuses on the wireless
traffic, so we are not talking
about the wired components at all,
and we are also not covering
the numerous security issues of the LAN
interface.
So who of your does already
use a home automation system?
Oh OK.
And who of you
does already use home network?
OK, a few.
And who plans to
install the home automation system in the
future?
OK.
This is great.
This is the outline of our talk.
First, we are talking a little bit about
hermetic and general,
then
we have to we have to borrow you with a
little theory about the wireless
packets of hermetic and
then we will demonstrate your life
three possible different
attacks.
These three attacks cover
pretty much everything means meaning.
After these attacks, you can, as
an attacker, control pretty much
all the hermetic devices, except
when you're not using the default
as key when you changed it.
OK. Traumatic in general,
our original motivation
was we wanted to control
valve drives directly.
We were not satisfied with
the built in temperature control
algorithms of the
thermal control devices.
And yeah, soon found out
that it is not possible to control valve
drives directly.
Yeah. Initially, we just wanted to write
a new firmware for the valve drive
device,
but that soon exacerbated
into developing our own interface
software to control magic
devices, which we later named home
gear.
So let us show us an
example configuration.
Maybe you want to start with some
kind of starter kit.
Maybe you want to unlock
your door and switch on the light
with a remote controller.
And if you are satisfied, maybe you want
to add further components to the system
and therefore you may want to have
a control center.
This may consist of a LAN configuration
adapter in combination
with a server running, but costs server
software and a
home met home automation
administration software.
Or you may use
a standalone control center unit
with a firmware doing
as well as the job
as well. The job of the cost of us
as further functions
and
all. You may use Best Buy
reply with a
wireless adapter
extension running
home gear software.
Then you can add devices
like a smoke detector team
thermal controls to
regulate how your room temperature.
Yes. And the very beginning
we started by opening
Valve Drive device and
inside we found
an atmo microcontroller
wireless transceiver module
hidden in the back.
And of course, a motor and
the gear.
This device is provided and a very
tempah friendlier and faster,
providing the communication
interface between the microcontroller
and a transceiver module
as a pin.
So, well, we sniffed
the traffic on this
communication interface with
the Logic Analyzer
and
yeah, and soon understood
how the device works, and
we could soon emulate this valve
drive actually on this fast drive,
as you can see here, probably
maybe
is already running our own firmware,
which we later did not develop
anymore because it was not necessary.
OK?
The wireless packets the protocol
used by the hermetic devices is called
a bit costs, which stands for bi
directional communication standards
and works on a frequency
of eight hundred sixty eight megahertz as
a lot of wireless home automation
system
and
all the bit cost packets
look like this.
First, you see that packet length,
which does not include itself, so
the length counts only
the bytes
after have the length,
then
the first byte is a message counter,
which increments by
one with each message exchange
or packet exchange.
Byte one is the control byte,
which, for example, and
quotes the information here at Bit five
that the
communication is bidirectional.
This bit, for example, means that
there is a response
expected for this packet
by
two is the type off the message
by three to five, the sender address six
to eight the destination address and
after that, the payload.
There is one special destination address.
Zero three bytes zero,
which is the broadcast address.
Since most of the home medical
devices are battery
powered, you will need
some kind of power saving
strategy.
The first power saving
strategy is called awake on radio.
And as
it works, the following
the device wakes up
to receive ready mode
for two point four milliseconds,
and after that,
it falls asleep for three hundred
and fifty milliseconds
repeatedly, so it can
react on
packages almost immediately.
The second type of power saving
strategy is the Wake
Me Up mode, and this
mode the device sends
Wake Me Up packet
then is and receive ready
mode for two hundred and fifty
milliseconds and then
falls asleep for a variable
but deterministic amount
of time.
This mode is used by
some devices
for which do not
have to be reachable
all the time when they want
to exchange information
with the center.
They send a wake
me up packets and broadcast
mode, and the central can react
and initiate data
transfer.
Um, the third power
saving strategy is almost
the same as
the mode above, but without
a wake me up package.
This mode is used by
thermal control device and
if drive device.
One slide back this,
though, received ready motor draws
about 14 million
pairs of current.
So that's very what be empty
and about one week.
So if you use a wake on radio
mode, the average current
draw is reduced to about
100 micrograms.
And the other modes
reduce the current draw to about
20 micrograms.
Plus, additionally, the power
the current of the motor and the
microcontroller so that the batteries
can last one year or
even longer.
OK.
One important thing about
the Bitcoin protocol is that
the communication is completely
unencrypted.
But for some devices like, for example,
the key metric which opens which
locks and unlocks your door.
Of course, you need some kind of
authentication so that not anybody
can unlock your door to your
apartment or house
for this authentication.
And as challenge
challenge response handshake is used,
meaning, for example,
the central sense the command
open door to the schematic.
This is the command.
And then the key metric
metric generates a random
challenge since this challenge
back to the central, the central
and crypts.
This challenge with
the ASCII known by both
devices meaning
and creates this challenge
with the known shared secret.
And since this encrypted
message back to the key metric, the key
metric decrypt
the payload and then
knows, OK, the central is
my central and I am allowed to
unlock the door.
In the past, there were numerous
problems
with the ace handshake when
you changed the default ace
key. So still, some
people say that you should not
change the default, a
key and use and use the default
one to avoid problems.
And one other advantage of the ace
handshake is it has a
very high latency.
So, for example, you can't really use
it if you want to switch
flat floor lights, for example.
Yeah.
OK, yes.
Before showing our first attack,
I'd
like to mention the most simple attack,
the most simple attack is
a burglar who wears a
jamming device, which jams
the air traffic.
That means it sends a carrier
louder than the motion sensor so
that the alarm system cannot
hear the
motion detected from the motion
detector.
So now let's
start our first attack.
What are the requirements for the attack?
It's actually not a lot.
We are using a Raspberry Pi.
Then we need some kind of wireless
transceiver module for the rest.
Barry Pay in order to.
Yeah, being able to send and
receive bid cost packets,
you could use
the
so-called call, which
you can buy at password not to
eat.
But we are using
a self-made device we named CRC.
Yeah, which you can see.
Let me switch to them either there or
on our next slide.
Yeah, right.
We have a picture of it.
Uh, there's the webcam.
There it is.
This is the CRC
on the Westbury Pay.
And third, we need some kind
of software to interpret
the signals
of the wireless transceiver module.
And of course, we are using home gear.
That's again the
CRC here.
It's still named Cox.
Yeah.
Yes, our
first attack has
only and it's
not much more than copying a copy,
pasting it, most detect a
packet. For this, we need to
informations.
The first information is
the address of the
motion sensor used and
the second information is.
No, sorry.
We only need the address of
the motion detector.
The address of the switch and
A. address off the switch, of course.
Oh, I'm sorry
for that. We need to sniff
one packet containing
both information and
then
more or less copy pasting this packet
and sending it to the switch and
the light goes on without the motion
detector and detecting any motion.
The important question now is
when
we snuff packets.
Of course, there are a lot of packets and
the ether, especially when it's a
large automation system or
when there are a lot of devices.
So we need a way to
detect motion detector packets.
So how does a motion detector packet
look like?
The easiest way to get this information
is to look at
the at the device ExxonMobil files,
which you can find in the file system off
the CCU, or which was also
provided with a bit cost service
software, which you can download from the
hermetic website.
And then in this XML file, there is a
section called Frames,
which contains
most of the packets known
by this device.
And in
the end, this frame frames section.
You can find this frame,
which has a packet the message type
of one
x 10000
hexadecimal.
Yeah, and
that's a payload of
the payload size of four bytes
which encode it and byte two
of the packet.
Yeah, and has
a payload size of four bytes,
as you
can see here.
And with the last
NYBO being zero, this packet
really a specific for motion detectors.
So this is the
packet we are looking for and we are
sniffing for
after this packet.
I'm just telling you in advance because
you will you will see it in a few
seconds.
This is the packet from the motion
detector to the switch, and the switch
will respond with an acknowledged
packet.
OK, let's do the attack.
But of course, that I.
Some short information.
This is the system of
the victim.
And this is the hardware of the attacker.
OK, here
we are locked in
two times over
as h.
Into our referee pay.
And the first question is how do we
snuff packets?
It's nothing. Actually, it's pretty easy
because all the
packets are locked into
the home gear lock files, so we just use
tail.
It's a little hard to read from here.
Usually we do not lock in this route.
And here you can see all
the bit cross packets received
by home gear or by off by all wireless
transceiver module.
Now, Molly
inserts the battery into our
victim's motion detector.
We just removed it because otherwise
the light port would switch on and off
all the time.
And now we wait a little
bit, hopefully.
Mm-Hmm.
I think it's crashed.
No.
Yes.
It's crashed.
Hmm. As you can see, it works perfectly.
This is not part of the attack, by the
way. We just want to switch on
the light.
OK,
maybe we shouldn't have to remove the
batteries.
It is receiving some.
Yeah, it detects when the batteries are
inserted.
OK, now we know that's the motion
detector.
OK.
We can show you what we
wanted to show you, but we can use
a
little, we can generate our own packet.
We can construct our own packet.
We'll use the back up of our sniffing
before.
Yeah, OK.
I mean, only
we can sniff the two addresses
the anomaly. We wanted to sniff
the motion detector packet and
copy paste that to the right side.
But as that is not possible
now,
let's just connect
to our home gear daemon.
Now we
are connected.
Ah yeah.
Now we are within the command line
interface of hunger.
By default, home your nose
to virtual devices.
The second one we don't need now.
That's the virtual central
and the first one is
a device we call spy device,
which is actually the one the device
which locks all all these packets
to the lock file.
And we need the first one.
You know, no, it looks
perfect, needed some time for booting.
OK.
OK, let's show it once again.
Oh, we have to wait
some seconds until the lights turn
off again.
You can use it now.
Yeah, yeah.
But you can see already here
is the packet we just talked about
with a message type forty one.
Once get this, that is the
sender address. You can see the sender
address and the destination address
being the address off the switch.
Once again, yeah. Once again, OK, once
again.
OK, there it is again, and there is
the packet after that. Remove the
battery. OK, good after that.
Is that the acknowledged packet
from the switch?
OK. OK, now
we are really not.
We can't cheat anymore.
No, there is no.
If there are no batteries anymore in the
motion detector.
And now
when
we type up, you can see
the spy device supports a
command called scent with
which we can send arbitrary
but cost package.
And we are using this command
and just copying and just copy
the packet from the right side to the
left.
I press enter and nothing happens.
Hmm.
We did something wrong.
I think we'll try it again.
Try it again.
Yeah, we will.
We will.
Um, when you remember this, like
maybe you saw that part
of the payload is the counter
at Byte ten
here.
And when you sniff more packets
and you're as we sniffed more
than one packet,
you can see here.
For me, it's hard to see right now from
this angle. But if you look through all
these packets, you will see that the
counter increments by
one with each motion event.
So maybe let's just
try to do the same
and increment the counter by one
and
da.
That was the first attack.
You see, it's quite simple to emulate
hermetic devices.
And now the second attack.
OK, and how to annoy your neighbor?
Only one way to
know your neighbor.
You have a
thumb, a control device and
go mounted on on
the wall of your room and
therefore drive device mounted to the
valve of your radiator.
These two devices appear into each
other, and each one of them
is prepared to a.
So our next attack is not that
simple, but still, we
can manage to
change the set point temperature to
obvious on so that the vef drive
position is fully opened.
And no,
you
can imagine we can have some fun or
maybe a burglar can use it to.
First, also hacking to make the victim
open the window.
OK. And
that's.
Yeah.
Explaining how the attack moves.
Let's
hear. Maybe if you remember this slide,
we have a problem now because we can't
just send the new set point
temperature to the
thermal control device.
Why is that?
And our first example, the switch
we used to
turn on and off the light was
always receiving.
It was always and received ready mode.
The Thunder control now is
a device of this kind, meaning
it sends wake me up packets
every few minutes and then goes to
sleep again.
That means if we would use
the command send we used
it in the last attack, we would
need to send within this
window of 250 milliseconds.
That's kind of hard to do
manually, manually.
So we need a different kind
of approach.
Huh, huh.
Yeah, OK.
The first step is we
need to Information's
first information is the address
of the thermal control device,
and the second information we need
is the address of the victims,
etcetera.
And in the attack, we have to
change home a central address
to the victim centric address because
otherwise the victim's
thermal control device, which is part
of the victim's etc., would not
accept packets from our
home gear device because
it has the wrong address.
Then
we have to manually at
the victim's thermal controller, at our
home gear in order to make
home gear, manage the timing of the
attack because manually,
you can hardly hit
the two hundred and fifty milliseconds
window.
The third step is to change the
set point temperature,
and the
fourth step
is to switch to the thermal control
mode and central mode.
Because if the
time a controlled device is in a
non sentry mode, it would
not use this
temperature a set before by us
for the actual
first drive device.
Both the easiest way to
do both steps is using IPC
functions, set value and
thought perram set.
I saw a slide
before. Sorry.
Yeah, now
our first step is are we need
to identify the address
of it's under control
and to do that, we need a package
that is specific for Thelma
controls again.
And yeah, the
XML files are our friend.
So we just look into the example
file off the thermal control device
and there find a packet
with a message type of 58,
which is specific for some of the
controls. So we just need to sniff
for a packet of this message
type, which we are doing now.
While we talked home
there, of course, was regarding
all the pickups
received.
And as you can see here,
there is a packet with message
type fifty eight.
So this most definitely as a thermal
control device.
And this is
the address
of
our summer control one
d e seven nine zero.
The second address here, the destination
address, is the address of the Gulf
drive. So this is the packet sent from
the Thunder control to the Gulf drive.
And yeah, then the
second information we need is
the address of the central
to identify the central address
you need and just to look for
different kinds of status packets
sent to the centrist center to
the central. We are not.
Yeah, I'm not going to show you are.
Yeah, what the status packets are,
but there should be one here
and this list.
But before doing the attack,
please switch to the webcam to prove
the Oh yeah, that's right, we it's
almost close
here, for example.
That's one
C six nine four three.
That's the central address.
That's a status Typekit center for the
center. OK, yeah.
What's this?
What's
one second there?
OK, as you can see,
the left is opened
by only 17 percent.
Maybe show the shoulder, the control to
some control has the
actual temperature of
twenty one point eight degrees doesn't
matter and
what's
OK and
oh.
You have to release the button and
a set point temperature of nineteen point
five degrees.
And the mode is manual.
Uh, yeah,
that's OK.
OK,
now
let's do the actual attack
first.
You remember
the second device was the central.
This is the central address and this
address is wrong.
So we need to change it in order to
that. To do
that.
We remove the central.
And create a new one.
With a correct address with our victim
center address, one C six,
nine four zero,
then
we need ban completely arbitrary
serial number and really be anything.
We use the serial number
v central zero
one
and the device type.
As you can see here, the device type
off the central device of f
f f f f f d
i know
we have a new central.
There it is.
Now we select the Central.
And here you can see there is a command
called Trippier's Ed to
manually at Pierce without
pairing them with of the
central.
And we are doing exactly
that, Piers.
Ed, now we need the
device type first, the
device type you can find in
the X and L file, the device type off
the summer control is
three nine.
Then we need the address,
which was one seven
nine zero.
Then we need, again, an arbitrary serial
number.
We call it virtual thermal control
one and
the firmware version.
The most current firmware version is
2.1.
And this information you can also get out
of the box and all file or by just
inserting a battery in the summer
control, then will display the film.
The firmware version
and now
home gear knows the thermal control
of our of our victim.
We are logging out.
We don't need the command line interface
anymore, and
now
we need to tell home gear
to set the new set point temperature
for us
to do
that. As Marley already
told you, we are using our privacy
function. One way to do
that is
to use
a simple script.
I call that set point
the PSP
looks sorry,
and this script actually is pretty
simple. The class I'm using
pretty much only uses
the LRP C functions provided
by itself, so it's really nothing
special, and you can download it from the
Home Gear website.
And as you can see,
we are sending to our C function.
The first one is set value
to the
thermal controller we just created and
home gear.
You remember we named it
BTCS
one, the
very own. The variable name is set
point. Again, this information is out of
the XOM L file and
we set set point to 100
100 as a special value, meaning
always on
and
the second R B C function we are using is
put, Perram said. Put Perram said it was
used to set configuration parameters
and
so we are using put paramjeet
to change
the mode of the thermal control to a
central mode in case it is not in
sentry mode.
And again, this information
is out of the X and L file.
We change
the variable mode temperature regulator
to the value two and
two is the central
mode.
OK, now
we are just executing our script
on the right side, on the left side and
the lock. You can see that home
received both both our policy
packets. Now we need to wait a little
bit because,
yeah, it takes two to three minutes for
the thermal control to send a
wake me up Typekit.
And yeah, then home you start sending.
In the meantime,
I am showing you
what you will see.
There will be
a little more pickups than you saw in the
last example.
This is the wake me up packet.
And in response to the wake me up
at home gear will send a wake
up packet the time the control will
send and acknowledge, and then
home gear will send the new set point
temperature and this packet and
coat it in the payload bay side.
C eight being one hundred dot zero
are the special value always on
and and acknowledge again
and coded as two hundred
and decimal so that you can
encode values
between zero and 100
and 0.5 percent steps.
Yeah, OK.
And the second RBC
function put parents that calls
us home gear to do this directly after
setting the set point temperature
as the central
mode as a configuration parameter.
It is handled as
setting configuration parameters, which
is done always in the same way.
Setting configuration parameters starts
with a start configuration packet and
ends with an end configuration
packet, and in between
is the packet to actually set
the configuration parameter, which is
encoded here in the last byte.
A lot of information for one byte that
yeah, and in between our acknowledged
packets so that among knows that
the packets were really received.
OK, let's switch
back and
see if something happened.
Yep.
Um,
actually, it did it.
It did. Yeah.
Where's the wake me up picket?
OK.
Wake me up, Typekit
one sec.
OK. We in this case,
we responded to the packet
sent to the message Typekit five
eight, so not actually to the broadcast
packet. This is working too.
This is the packet sent from
the thumb of the controller to the valve
drive.
And after
this packet
here you can see the
set point temperature being set,
the configuration start packet,
the setting of
the mode to a central mode and the
configuration and packet.
OK, now I'm switching to the webcam
again,
and
as we can see, the valve
drive opens the valve.
Step by step.
Eighty eight percent.
OK, from 1998 to a maximum
almost fully opened.
And here to set the temperature, the set
point temperature is on.
And here you can see that the thermal
control is in central mode.
That was the second attack.
OK. Last one.
Time is short.
So, OK.
Yeah.
So that attack, we are going
to show you how to open
a victim's door
if the victim has not
changed the default, a key,
that's probably the case for a lot
of people. And if the reason is
being lazy.
But I think a lot of systems still
use the default as
we might do some while driving to
see how many people a chance
to ask.
So again, we need to
informations.
The first information is
the address of the key metric
device.
And the second information
we need to know is
that.
The kinetic device and the second
information is the address
of the victims Centra.
So we have to sniff both
informations, and
as soon as we got these two informations,
we
can send the command open door
together with the
handshake with a default key.
For that sniffing, we
might use the rest
verify and CRC,
but before using for sending
the ace handshake, we
need
land configuration adapter
together with a bit service running
on our computer.
OK.
Yes. Sadly, Home Gear Kent
doesn't know the default keys, so
we can't generate the ace
handshake.
OK, let's start by sniffing.
You already know the procedure.
And yeah,
Molly, you are the victim.
Close the door.
OK.
Hmm. Oh, yeah, the webcam can be.
OK, I have the door
still open.
No, a closet.
OK, and there you saw
here are the packets,
you know, put away the key.
OK.
This is the packet we received.
So the first the sender address
is the address of the remote,
and the second address is
the address of our key
metric to three d
six f.
So now and from previous from
the previous attacks you already know or
from or from the previous attack, you
already know the sentence address.
So now let's do
the attack
one sec.
What we need to do is
first,
we need to change the address
of the land configuration adapter
to the address of
the victim central. Otherwise, again, the
key metric wouldn't accept or packets.
Then we need to manually
add the victim schematic
to the bid cost service.
And after that, we can just use the RBC
functions, add value again to set the
state of the key.
In this case, the state would be open
or close the door, no lock or unlock
the door.
Oops.
OK, let's do it.
First, I don't touch the
key, the remote control.
This is the
configuration folder of
the Bidco service, C ProgramData Medical
Service,
and
you see the there are no devices,
that's why this folder is empty
and
I am copying the template
file into this folder
and
there are no secrets. I'm going to show
you what is in this template file.
Actually, we need to modify it to
and
to see this template file looks
pretty empty.
There are no um.
Yeah.
And and this template file, we just need
to enter to information
first, the address of the
schematic to a 336
F. That's what we just sniffed
and we need
two
three d d six f.
And we need to enter
these the serial number of
our bit interface off our because
of our land configuration adapter.
Of course, we know that one
and the address is three one
four seven eight five.
Three, one, four, seven eight.
OK, not for Typekit.
Close it now.
OK, now we start the
medical service
on our attack, our system.
It's running and
we are again using up.
The script looks the same as the one you
saw on the Raspberry.
It's really just sending set value.
And the door opens.
OK, now
how can you detect and prevent
these kinds of attacks?
Are the devices using the ace
handshake? Please change it.
I think in recent firmware versions,
most of the problems should have been
solved and we tried.
But till now we didn't find a way
to circumvent
the ace handshakes in general.
You can detect attacks
off the second kind if
the software supports this function.
Yeah, if the software supports
it by
trying to detect if an other device
uses your Centrals address,
of course of yourself, or if the soft
the software knows its own address.
So if somebody else uses its own address,
it's easy to detect that hunger actually
does that.
And you can only detect
an attack, but not
yeah,
you cannot prevent it.
OK.
And the third thing you can do
to prevent or not not to detect
attacks of the first kind is
to do a plausibility check off the
message counters.
Again, it's only
a detection of
a possible attack.
But yeah, there is no way
to prevent these kinds of attacks.
Thank you.
Yes, thank you very much for this
presentation.
We have time for a few questions.
But before if you leave the room, please
take all your trash with you.
And if you leave during the Q&A session,
please do so quietly.
Thank you.
Do we have questions from the internet?
And can we speak of an
to become?
Yeah, I'm fine.
The question is, can you also in a leader
turmoil control
so determine control itself cannot be
emulated by sending commands to it?
I don't completely understand the
question we could emulate all
the function of some control or
is the question to emulate the thermal
control in order to
took control of our drive?
I know actually home gear does
exactly that.
Home Gear is emulating
thermal control devices in order
to being
yeah in order for control of Alpha Drive.
It's a virtue thermal control
device running on home gear,
pretending as if this device
were physical,
physical under control.
Yeah.
OK, so
next question from the audience on
the left to you.
Oh yeah.
You basically for the attack, were you,
you know, you warm up your neighbor's
house, you're spoofing the central
control, right?
Is there not a race condition?
I mean, how does that work with the
official?
The real router, the real central.
You know,
what is it that we said, Yeah, we can.
Oh, you mean when both?
What? What happens when both devices sent
messages?
Yeah, that's a valid question.
And when the real
central controls the set
point temperature, it will not
set the set point temperature
every cycle, only every few cycles.
So in the cycle between that,
you can set your set point temperature
and of course, the valve drive will
open and close constantly.
But still, you have the same effect.
Next question from the right.
Would it be possible to
sort of while driving and
map the kinds
of devices using an ACR
radio?
You mean what the hardware requirements
for war driving would be?
Is it is it even possible to to
drive alongside the road and
map the kinds of devices
that are used in the buildings
on the left and right?
Yeah, it is possible, but
some devices only very
rarely send packets.
So in order to really detect all the
devices used in the houses
around you, you would have to wait a long
time in front of each house.
And have you tried that using an SDR?
No, only that.
Special hardware?
No, we did not use a software
defined radio.
It's not necessary.
We simply need a Raspberry Pi,
costing about
40 euros and
wireless adapter costing between
50 and 100
bucks.
I'm asking because you could simply
use a real tech modified.
So it's only 21 euros.
OK.
If you want to, possibly
you might use one as
it would work.
That would work if it supports
the
frequency eight hundred
sixty eight megahertz and
the.
The shifting mode, which was
actually used, the
CCU one
thousand one hundred a chip
does support several
transmission modes,
but I don't know exactly which
mode is used because
we don't need to know.
Thank you.
OK, next question from the left.
I'm.
This was exactly what I also would
have asked the frequency because
automated systems usually uses
800 megahertz and not 2.4GHz
rf because of
the the distance they
can play.
Um, so it is a standard
protocol. It was used in other popular
tablet protocol, so it was a standard
chip on the devices which
everybody abides by.
Yes.
The chip is standard, but the bit
cost protocol is the protocol
used is not standard.
It's a bit cross protocol document.
It's just but he knew all
about the company itself.
2B I'm not 100 percent sure
if it's documented, but I don't
think so.
We reverse engineered it.
I think.
So next question from the left.
Hi, I was wondering about the
challenge response messages
with the climatic exchange, with the
whole Matic system.
I was wondering if you could give us any
more information about how that is.
So for instance, the challenge that sent,
how does how does that get
integrated into the message that's
encrypted and returned?
I mean, how the how the payload
is calculated, right?
I mean, do you
just simply, we don't know.
We don't know exactly.
We don't know exactly. We can only guess.
Probably.
It's on the
slide.
Let me just see.
Let me just open it.
But where is it?
One sec.
And on this slide, you can see
that here are six
bites. And here are four bites,
and both are within
this and scripted
response. So this that is
10 of 16 bites used already.
So there are six bites left, and
probably at least three
of these six bites are one of the
addresses. Maybe the six bites are the
sender and the destination address.
We know that because Edra spoofing
is not working.
We tried that already
and but
we are not 100 percent sure if it works
and what
is also not possible by changing the
default ESD, probably
we have to try again.
We haven't worked on that for quite a
time, but probably
not only your
is used, but a combination,
maybe zade, whatever of your
ASCII and the default ASCII.
So you cannot just change the default
ASCII with a configuration adapter
and then implement the challenge
response.
Yeah, that's
that's still a little
mystery. How exactly the ace handshake
works.
OK, next question from the right
think sort of talk.
I'm wondering if you have looked into
other windows like if!
20?
Yes. Do we expect similar?
Uh, yeah.
Or is it different?
The first 20
is pretty stupid.
It's not. It's that existed
before dramatic automatic.
Yeah, they developed memetic after 20.
And at this 20
is uni directional.
The devices don't really have addresses
you have.
I don't know. I'm not.
I think you have master addresses and
group addresses and something like that,
but you have not unique device
addresses and there are not a lot of
addresses available.
Yeah, but we
plan to support other systems, too
in home gear like F.
S 20, for example.
Hermetic wire, of course.
OK, next question from the left.
Great work, guys.
What about the CRC board?
Did you design it by yourself or
is it somewhere to buy?
Why didn't you use the the
buzzwords stuff?
Yes, the main reason why we didn't use
the bus where stuff is, we
wanted to keep an exact timing.
This was necessary to
emulate a thermal controller,
communicating with the vef drive device
and the CRC
device we have designed
on our own.
It's a little bit inspired
by the Buswell's
C or C device.
It uses a special
button entry connector so
it can fit into a Raspberry Pi case.
But in contrast to the
bus, S.O.S.
device does not communicate
via you out via
a microcontroller with a
CC one one zero
zero two, but it communicates
directly via SBI with a
transceiver chip.
OK, another question.
Did you look into the R
W E stuff for it uses
exactly the same hardware, just a
slightly different protocol?
No, we haven't.
OK, next question from the right.
Did you get in touch with Ho Matic?
And if so, how did they respond?
Uh, yes,
I don't
know, I wrote.
And they are not.
We wanted to post home gear on,
on on the forum.
Hermetic inside and iQOO three was
not particularly happy about that.
And one reason was because
home gear uses the bid cost
services essential files, and they were
directly integrated into the software we
now remove that is not directly
integrated into home gear anymore.
It's it's still used by home gear, but
now it's being downloaded
on the client at the client site.
And
I wrote iQOO iQOO three because I don't
want to have any problems with them, but
until now they still haven't responded.
OK, then let's give them a
big round of applause.
Thank you very much
for this talk.