The hackers took advantage of this process and created a script that would attempt to slip a modified packet into the update stream. Beside a quick redundancy check, in fact, they found that the remote didn’t check the firmware being loaded at all. The researchers were then able to send a firmware update to the remote that loaded essentially any firmware they liked.

The researchers could then invoke a network node that mimicked the cable box the remote was supposed to be communicating with. During the period that the box was down, the remote was vulnerable. Using a different form of attack – not described in the paper, but likely to be an SQL injection over Wi-Fi – they were able to trigger a crash in the cable box. To get around this issue, the team at Guardicore decided to remove the cable box from the equation. This makes intercepting them all but impossible if both devices – the cable box and the remote – are working properly. In addition, these signals are encrypted. The remote communicates with its home cable box not through standard Wi-Fi signals, but instead via short-range radio signals. The details of how they managed to achieve this are a little more complicated, though. At a more technical level, explained the researchers, they were able to trick the XR11 into downloading a modified version of the firmware that added a command to record and transmit audio via the on-board microphone the remote uses for voice commands.

They were then able to access these recordings via the internet. The researchers were able to take a popular model of Comcast TV remote – the XR11 – and use it to record voice commands. The hackĪt one level, the reported hack was simple enough. In this article, I want to take a look at the exploit, assess how likely it is to be feasible in the real world, and then think about its implications for the IoT more generally. One such paper was given by a group of researchers from Guardicore, who demonstrated that it is possible to turn Comcast TV remotes into eavesdropping tools. In the midst of these headline presentations, it was easy to miss some of the less dramatic research, and even easier to miss its implications. There was an understandable focus, of course, on remote working security, alongside a relatively high number of presentations dealing with the issues of the moment – Kubernetes, the IoT, and the Biden administration’s plans for cybersecurity. This year’s RSA Conference was certainly a surprising one. This blog was written by an independent guest blogger.

Vw upholstery