Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering a mysterious UDP stream in my hotel (2016)

gkbrk.com

Post reply on HN
Print view View original

161–170 of 189 posts

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#161

Post by ahepp »

You can do something similar with

    ffmpeg -stream_loop -1 -re -i gettysburg.wav -f mp3 udp://239.0.0.1:1234
on one device, and

    ffplay -i udp://239.0.0.1:1234
on another device.

You can also play the stream with ffmpeg doing something like

    ffmpeg -i udp://239.0.0.1:1234 -f pulse default

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#162

Post by skylanh »

inferiorhuman wrote: post #101
op00to wrote: post #91

Earlier quoted context omitted.

When I worked at a core i2 .edu site, we had all the "hd" mbone tv streams. It was pretty wild considering HD was a "new" thing! Thanks for reminding me of that wonderful time!

Wikipedia had this quote from Mick Jagger: I wanna say a special welcome to everyone that's, uh, climbed into the Internet tonight and, uh, has got into the M-bone. And I hope it doesn't all collapse. What a time to be alive.

BUSINESS TECHNOLOGY; "Peering Out a 'Real Time' Window", By Peter H. Lewis, Feb. 8, 1995 https://www.nytimes.com/1995/02/08/business/business-technol...

The article also indicates Internet Multicasting's "Geek of the Week", there's an archive at: https://town.hall.org/radio/Geek/ Transcripts available at http://opentranscripts.org/sources/geek-of-the-week/

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#165

Post by forgotusername6 »

unwind wrote: post #68
blueberrychpstx wrote: post #67

Earlier quoted context omitted.

okay this is way over my head - but this would have to be steganography hiding in the audio file that could only be run by someone like OP, detecting; downloading; etc the udp data, right?

Today (but perhaps slightly less in 2016, not sure) you could easily imagine a microcontroller (or FPGA) with a microphone that bugs you, but encodes that audio (using steganography) onto a canned audio file of elevator music, and then sends the result over the network "in the open". To a casual observer snooping the relevant network, it would probably (as here) look as elevator music, but to the intended recipient w…

You don't even have to change the audio data. Just alter the packet pace slightly to encode the data. That way a cold trace like OP's is useless.

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#166

Post by eru »

jalbertoni wrote: post #150
koolba wrote: post #90

Earlier quoted context omitted.

Even better than a canned audio file would be machine generated music. Otherwise you could detect that the “same” song is being transmitted with slightly different bits. Or you could have an extremely long audio file so the repeat situation doesn’t occur.

There's a very simple way around this. Grab any encoding that uses a dictionary, like, I think zip does. Sent tiny zip files with an excerpt of a .wav file or something that needs to be compressed. The decompressed data is always the same, but the data in the dictionary used is where you store your sneaky bits. Sure, that's still mildly suspicious. But way less than the actual music data changing all the time.

You could also hide the bits in eg timing of package transmission or omiting an expected package every once in a while, it'll just look like udp dropped a package.

You can use a channel with lots of noise, because you can use error correcting codes to to restore the intended message.

(To elaborate with an example: sometimes a package might already drop randomly, or timings might be slightly delayed anyway.)

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#167

Post by gkbrk »

anyfoo wrote: post #139
kccqzy wrote: post #137

Earlier quoted context omitted.

There's nothing in the article that suggests that Wi-Fi is being used on the elevator. In fact I'd say most likely the elevator is using a wired Ethernet connection. It's just that the broadcast domain for the L2 network includes both the wired elevators and guest Wi-Fi.

Unless I misread, there's nothing that suggests Wi-Fi is involved at all. It rather sounds to me like the author was listening at the Ethernet port that the TV was plugged in (making this less of an issue, as some people in this thread thought). But this is not entirely clear to me...

> there's nothing that suggests Wi-Fi is involved at all. It rather sounds to me like the author was listening at the Ethernet port that the TV was plugged in

Author here. Everything on the article was received on the guest Wi-Fi network on my laptop without plugging into anything.

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#168

Post by eru »

sublinear wrote: post #73
unwind wrote: post #68

Earlier quoted context omitted.

Today (but perhaps slightly less in 2016, not sure) you could easily imagine a microcontroller (or FPGA) with a microphone that bugs you, but encodes that audio (using steganography) onto a canned audio file of elevator music, and then sends the result over the network "in the open". To a casual observer snooping the relevant network, it would probably (as here) look as elevator music, but to the intended recipient w…

> to the intended recipient who can decode the steganography Not just decode, but also decrypt. You'd probably want to encrypt not just for the secrecy, but so that the noise introduced by the steganography doesn't seem so suspicious.

Encryption is in another layer.

Basically, you'd use steganography to hide that you send a message. And that message would be encrypted. You can use almost any standard encryption scheme, as long as you remove headers etc. Any ciphertext of a crypto-system worth its salt will be indistinguishable from random noise without the key.

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#169

Post by eru »

rhacker wrote: post #107
ajsnigrutin wrote: post #92

Earlier quoted context omitted.

This would work if the elevator music was a never-repeating stream. With most elevator music, it's a few minutes of a "song" playing on repeat 24/7, so if you recorded a few repetitions of the "song", you'd probably see also repeated packets on the network. If the music was repeating but the stream was different all the time, then steganography could be the reason :)

I haven't actually heard elevator music as much as people say it exists. In fact I don't think I've every been on an elevator that had music.

The modern equivalent is probably mall music?

Re: Reverse engineering a mysterious UDP stream in my hotel (2016)

#170

Post by erdemozg »

ahepp wrote: post #161

You can do something similar with ffmpeg -stream_loop -1 -re -i gettysburg.wav -f mp3 udp://239.0.0.1:1234 on one device, and ffplay -i udp://239.0.0.1:1234 on another device. You can also play the stream with ffmpeg doing something like ffmpeg -i udp://239.0.0.1:1234 -f pulse default

jaw-dropped.gif

Such a powerful tool... And thank you for letting us know about this trick.

Post reply on HN