Due to time constraints, we didn’t analyse the remote control in depth, but feel this area is interesting and ripe for more research. There are also two microphones on this board, along with a 4mbit flash chip and a wealth of debug ports, along with the usual infrared LED. Under that sticker there is an UE878NMEG IC, equipped with WiFi. A cursory look inside the remote control unit reveals a complex device: Those unfamiliar with smart TVs may be surprised to learn that the Q60’s remote control is not a simple infrared emitter. We clearly needed a way to emulate the remote control remotely. However, remote hackers couldn’t use the TV’s remote control, which made things difficult – in particular, the TV would power itself down after some inactivity and the remote control would be required to power it back up. This meant we could all connect to the TV itself, which was equipped with an Ethernet connection. This involved adding an isolated network segment dedicated to TV research, in order to isolate it from company traffic. The first step in this is obvious – we set up a VPN to the TV. This is very useful for our research, but we noted a number of disparities between the emulated environment and the actual TV, and so we wanted to ensure that the TV hardware was used whenever possible. Some investigation of this revealed it to be running a modified version of qemu and an x86 build of the TV’s guest OS. We could somewhat mitigate this by using Samsung’s development tool chain, which includes an emulator for the TV. Furthermore, the team needs 24/7 access to the devices (everyone knows the best hacking always happen at 2AM, fuelled by energy drinks!). Our first hurdle was one of practicality – once we buy the TV, how can we make it available to a team of geographically-dispersed hackers? Most of our research was based in our Singapore office, but we were joined on the work by staff in Poland and the UK.
0 kommentar(er)
