Presentation Material
Abstract
Have you ever been fascinated hacking into Television networks and broadcasting custom audio or video signals like in Die Hard movie. Then this talk is for you.
In December 2011, the Lok Sabha passed a Bill to make digitisation of cable television mandatory in India, starting with the top metros on or before June 30, 2012 and pan-India by 2014.The Cable Television Networks (Regulation) Amendment Bill, 2011 mandates that all cable TV operators will have to transmit TV signals in an encrypted format through a DIGITAL addressable system.
With this bill most houses would be in an IP-TV network using a setup-boxes. So now with this modification each device is uniquely identified and is connected to the cablenetwork and is granted an IP. So now local service providers can send in various command supported by the device and stream video to this device of their choice. They can shut down adevice remotely if (no payment) or even display a custom text message that will scroll on top of a video.
So we will demonstrate attacks on Cable TV networks and streaming a panic video|Text to 1000s of houses.We spent a lot of our summer moving from one Cable TV operator trying to understand “How stuffs work” and trying to understand the various process involved. So in our talks we cover the various attacks we can do on these devices, so it would be treat for Reversing Exploitation lovers as well as Web application enthusiast.
AI Generated Summarymay contain errors
Here is a summarized version of the content:
The speaker discusses several security bugs found in cable operator systems. One bug allows hijacking of any other cable operator, which was fixed but led to another bug being discovered. This new bug involves a forum where cable operators discuss issues, and registering with a malicious link can take down the entire nation’s cable system.
Another bug is related to setup box firmware updates, which occur over TFTP protocol. The speaker demonstrates how an attacker can push a malicious update to all setup boxes by having control over the middleware server.
Additionally, the speaker mentions an IPV implementation bug that allows remote management of setup boxes running on Linux with a default Tetra (TET) configuration. By reversing the system, an attacker can find the hard-coded password and issue commands to upgrade firmware remotely.
The speaker also shows a demonstration of how to replace the initial operator logo with a custom image, highlighting the lack of firmware signing or security measures in these systems.