Italians do it better: pwning SHA2017 lights

TL; DR this is the story of how and why we hacked one of the signs of the SHA2017 to show the colors of the Italian flag.

As happened in the past summers, in these days I’m attending a Hacker Camp, and this time it’s SHA2017. As every year, we are so many that we organize together in “The Italian Embassy” at the hacker camp.
Near our Embassy, the organization placed a big sign saying “SHA2017” made with wood and RGB lights blinking, but the the blinking pattern only used the green channel.
The other evening I saw an organization guy messing with a the sign controller using a PC, an openwrt box, and a big transparent plastic box placed behind the sign.
I spoke a few words with him and he told me he was having trouble with the lights configuration…

So I came back to the embassy and talked with a few friends. This is how we decided to own the light controller  to show the colors of our flag, for fun!

Our idea was to tap the packets, understand the protocol and change the colors of the sign to the ones of the Italian flag.
After some time with tcpdump, we discovered that these boards use a DMX over TCP protocol. After an afternoon of trial and error, the result was a C++ program that sent the original DMX UDP packet with some bytes changed to change the light colors. Fortunately during the afternoon, our test went unnoticed.

At midnight, we decided was time to do it.

PWNED!!!

But this is not all… at end of SHA more details 🙂

Federico, Matteo, Mauro, Nicolò, Paolo, Samuele.

Annunci

Rispondi

Inserisci i tuoi dati qui sotto o clicca su un'icona per effettuare l'accesso:

Logo WordPress.com

Stai commentando usando il tuo account WordPress.com. Chiudi sessione /  Modifica )

Google+ photo

Stai commentando usando il tuo account Google+. Chiudi sessione /  Modifica )

Foto Twitter

Stai commentando usando il tuo account Twitter. Chiudi sessione /  Modifica )

Foto di Facebook

Stai commentando usando il tuo account Facebook. Chiudi sessione /  Modifica )

Connessione a %s...