Noooooooooo touch!

great the door's closed so here we go uh my name is Michael I am a security researcher at RN cyber defense you can find me on the social things uh mostly lurking um with those handles and my talk is called no touch and the reason for the 10 o will become apparent soon enough um I am an ex software engineer devops engineer um I studied electronic engineering and so I while I mostly work with computers to make a living I like to play with Hardware when I get a chance and I am a hex coffee hexon bides or well former bides organizer um I also like to say I'm kind of a rebel the reason I say that is because the

photographer who was taking shot like pictures of all the people who were working and wanted pictures um I asked him if I could he was telling me how to stand and how to look how to smile and I asked can I stand with with my arms folded like this and he said no so kind of I kind of just do what I want just wanted to put it out there I'm sort of a badass anyway so the talk is centered around this thing now I'm sure you've all seen this before it's quite a common thing that uh yeah they're all over the place this is one variant of them there are a couple of others they all look

different but they all function exactly the same way um and they serve various purposes so the one is to um exit an area that you are allowed to be in so on one side there will be key fob or code or Biometrics or something and on the other side there will be one of these um and for anyone who's used them you know that if you put your hand somewhere between C 10 cm or you know one sometimes you have to get really really close but you got to put your hand pretty close to the thing and then it triggers and then something happens so there are also use for Ticket issuing for parades boom

opening for parking areas um so in jber we have these things because we want to keep people trapped inside in case something happens I don't know jber is weird but I live there now um and the thing that I noticed and the reason that I got interested in these things is because um I noticed that they were on the secure side of of area is that you you shouldn't otherwise be allowed to get into which is fine because you can only you know put your hand in front of them and then it will let you out and you have to be in the secure area for that to work but I thought maybe maybe that's not entirely true so I I I went

down a bit of a rabbit hole um yeah so this goes on to why do I care about this they protect areas that you can't get into otherwise and yeah they have been defeated before so shout out to Simon who wasted some office supplies um took a piece of wire and a paper and sort of got it through the door and used that to to trigger it um but I thought maybe there's a more impactful way like not all doors have gaps and you know it's not always it's not always easy to implement and attack like that um so I started looking into how they work and as whether there was some viability to this so there were a couple of options

so from a blackbox perspective there were a few possib abilities the one I they pick up proximity so your hand gets close it's switch so there are a few ways that this is possible the one was ultrasonic not likely because there was sort of a solid opaque or semi-opaque um cover and sound usually want some kind of a grill to get through um that would block a lot of sound so not likely that uh radar I put there for fun because it's also just entirely nonsensical um it would work technically but it's just going to be way too expensive and it's just the wrong technology so we're left with Optical so Optical super simple um the

premise is that it uh emits the light and picks up the reflection and if it picks up enough of a reflection then you know it's it's it's got a positive signal so the other hint that it was probably light that we were dealing with is that the plastic over there if you take a picture of these things with the light on you'll see that there's sort of a red glow and it's the same way that 3D glasses work the old school 3D glasses so generally that red kind of tinge um suggest that uh infrared light is allowed to permit uh pass through the the lens um so the 3D glass is the same thing happens the blue lens allows blue

light the red light uh red lens allows red light and so your each eye sees a different thing so that was hint number one we're probably dealing with infrared reflectance so we got some idea of how this thing works but to figure out anything more um is going to require opening it up so 270 round later we have the insides of this so it's no longer a black box um it's sort of a clear box I guess the box is gone I don't know where the Box went so I've opened this thing up um I bought this in November 2019 which is kind of interesting to note because the production date on the things is June

2019 so that's like a couple of months later which suggests that these things are being produced at quite a rate um because usually that you know that that Gap isn't so small if these things are sitting in a stock room somewhere and there's excess of them um the other thing is that 2019 was a year before 2020 where they got super popular because people got all into not touching stuff um so yeah that was the front and the back of it which is not we going have to go into the the nitr of it but this is the Shroud that goes in the front um so if you look here there's um one light that emits and another that

receives and this little shroud is what stops the two from like directly interacting with one another the light has to go out of the device and come back via some reflective thing like a human hand or a piece of paper so first things first multimeter just a shout out to the humble multimeter anybody who has any interest in electronics this is where you start and you start in continuity mode and you touch things and you wait for the beep and then you know that the things that you're touching are connected together and that's that's like so much of Hardware reverse engineering is just doing that Rogan not Rogan uh Dale's talk just now uh that's

what he spent hours and hours doing with sea shanties and warm beverages um figuring out how a keyboard was mapped it's just this on continuity mod so if you don't have one like change that um so through a the process of poking at things and Visually identifying and you know just knowledge I had before I figured out that this was kind of the structure of it so these are all the different things and what they do not super important but now I had an idea of how it it functioned so nominal test was to adjust the sensor to work from 10 cm away so you'll have noticed anyone who's used these things before the sensitivity is

not constant some of them work like really well some of them you look at and they switch the other ones not so much you kind of have to almost touch them um and there's a sensitivity knob for that so I adjusted it to be 10 cm as my sort of Baseline um and the goal is of course to see if I can extend this range somehow in a typical application the no touch sets inside a secure area and there's a GL last door is Biometrics or something on the outside the attack is outside and you want to kind of Bounce It Off the Wall so it's it's quite ambitious what I'm what I'm doing um but yeah we're

going to see see how we do so attack number one mirrors so the thing emits infrared and detects a reflection and hands are not super reflectors but mirrors mirrors are better at reflecting things so here's a picture of a mirror I took I'm sorry the like yeah this is this is the best I could do um but it it's very reflective there's my phone and there's my hand everything um and lining it up perfectly a flat normal mirror I managed to get 60 cm range which isn't like a crazy amount but it's six times nominal which was you know it was quite a a result um but given the the attack scenario it's not it's not it's not a

deal so the next option was fun mirrors which are like normal mirrors with fun so the concave mirrors work in a way that because they're bent this um picture on the left hand side is uh the concave mirror the light that hits the mirror sort of converges at a point so there is a point at which like there's an ideal distance depending on the design of the mirror but in general they kind of magnify stuff and you know you can get better range out of these things um because they're sort of magnif in what's coming at them so testing with that I managed to get two met which is 20 times the normal range which is cool

like again it's more than 10 um CM but again it's uh you know that whole scenario of like through the wall through the glass against the wall of that so if by some chance they've made it very sensitive and it works at 20 cm like at 4 M which is closer to being useful but but they're usually configured to work at like 1 because I don't know people want to see people suffer um and the other thing that gets in our way here is all my tests so far have been line of sight so I have another picture of for you this is a wall so as you can see there is no reflection of I mean my hand and my

phone are there I promise that's how I got the photo but there is no like you can't see that because walls don't reflect stuff like mirrors do um in fact like my hand I don't know if any of you can can anyone see their face in my hand right now okay okay so one person I'm I would get that checked out um but the point is that kind of yeah it um it takes away from the success of the mirrors because a wall is not a mirror and that's kind of what we're dealing with in a realistic scenario anyway so we'll shove that for now um next thing was to have a look at how this thing worked internally and see

if there were other approaches we could take here so the first thing was to look at the sensitivity knob this is how where you adjust how far away it will work from um and what was interesting with the tear down actually tracing the circuits is that this doesn't affect their sensitivity at all all it does is adjust how much current goes through the LED that emits and thus changing the brightness of the emitting LED so this means that our sensitivity is actually constant it's our strength of the the emitted light that that varies um so this gets interesting when you start considering external light sources because if you're in control of the power of the light well maybe um you

can use this to your advantage so first thing is to see how does this thing work inside Shadow out to the humble or less slightly less humble logic analyzer um they're probably about 10 times the price of of a multimeter but they're really great you can get them for cheap as well um and this essentially gives you a um if you attach it to any electronic thing I mean within reason some stuff will make the smoke come out but for the most part if you connect it to electronics you get a signal analysis of the logic voltages over time so you can see what pins are doing and you can connect it like this handy little clip that's designed for

exactly this pin package this is the same Bo that you saw earlier with the relays and the lights and all of that stuff so connected directly and now you can see what's going on inside so first thing I was looking at what is being emitted so it's emitting stuff really fast it's the first thing um and you can see here has sort of a timing diagram and zoomed in is the bottom one so it's the same Trace just zoomed um first thing i' caught my eye is why are those blocks solid if it was just on and off then it should just be an M square but they're not so we zoom and enhance and we see

this so this is a very high frequency if this was audio you wouldn't hear it it's well out of perceivable range of human hearing so it's it's really really quick um and that brings us to the question why is there a 30 khz signal um this is kind of important so I'll quickly go over this but light occurs naturally all over the place um yeah an infrared is no exception so in this case so here has a infrar is often used for um giving a visual representation of uh heat emitted by something it's in a different wavelength but it's still infrared and so as you can see this dog has it's it's radiating some amount of

infrared from its its eyes and its mouth and its ears and if the thing only responded if the sensor only responded to naturally occurring um light or like the presence of infrared light then if this dog opened its eyes inside a secure area the door would open and that's that's stupid I mean it won't really it's not the right wavelength but you get the point like it's it's too unpredictable so what they do is if you're using infrared for any kind of signaling application including uh TV remotes works on a very very similar principle um TV remotes dictate a 38 khz carrier frequency but the principle Remains the Same so instead of having on and off infrared you've got a carrier

and if that's present then you have an on Signal so that's all it is so on is 30 khz in this case off is off so introducing the receiver this is the piece of Hardware that receives the the reflected infrared and you can see this is sort of the top of a data sheet seet it's speced for 30 khz it says 45 M range I don't know how they decided that um but anyway 950 Nom is the wavelength which is fine that's easy enough to get um yeah and this is this is the thing that deals with um receiving the signal so here's another logic analyzer Trace so this is the next thing to see how

does the receiver react when it's receiving a signal so putting your hand in front and as you can see there's a 30 khz carrier at the top and then when the carrier is present that pin goes low and so there two carate there is no timing drift in here in those two things were captured at exactly the same time this is one screenshot so this raised the question why is there a lag why is this thing reacting after the the stuff's happened and there's a couple reasons to that so you can see there's a little lag over there I think you can measure it there you go 2845 M micros it's not a lot of time

that's nine Cycles so I thought well maybe it's the speed of light right light doesn't transmit like instantly it takes time to get places but I threw that into a calculator and said 85 M and my hand was here so it wasn't that that was the next thing so I dug into it a little bit to try and figure out what why is there this delay the short answer is well it's the long answer but I'll say the short answer there's stuff inside the receiver what it is doesn't matter um but the point is there's some amount of processing it's not just a dumb component there's gain control and band pass and the the things in in the screen

so there's stuff going on and it's adding a delay and it's it's a processing delay the the context doesn't matter too much here but what's interesting is that the delay is spec to be between seven and 15 Cycles so I don't know if you saw but it said nine in that case which is within that spec but it isn't always predictably nine sometimes it might be more sometimes it might be less the ideal is apparently 10 you know but we don't know so that made me conclude it is not speed of light it is just a processing delay and it's not a constant which is great because it means that there's tolerance if the delay is

not constant it means we don't have to lock up like perfectly within phase of what the thing is emitting So in theory fingers crossed we can just blast something at it that looks similar and it will work turns out it doesn't work like that so this is just a quick sidebar on Hardware hacking in general um Hardware design and Hardware hacking are faced with the same problems um in Hardware design it's a pain in the ass but in Hardware hacking it's fantastic so there's a bunch of things you need to account for if it is too hot if it's too cold if there's too much interference if the traces are too thin if the moon is

in retrograde or like there's so many things the power stability timing whatever there's there's a ton of stuff that can go wrong in hardware and so you have to design to account for a lot of that stuff environmental stuff impacts how your Hardware Works which means often Hardway is made in a way that deals with that stuff um and it gives you tolerance for example so yeah it it makes it more likely that you're going to find a way in so a lot of attacks for Hardware are actually based on introducing interference or messing with the power ability of changing these environmental factors that are not accounted for um so while Hardware is a complex Beast there

is often uh there are often a lot of extra Avenues you can take um there's not just like will debug the software it doesn't work and then so it's just I think that's pretty cool and it means that there's a lot you can do um outside of the stuff so three hints inter infrared reflectance is how the thing works constant sensitivity it doesn't matter if you're introducing an external light source um which is good for us and the third thing is wide tolerances so the timing doesn't have to be perfect so nominal operation looks like this if you put your hand in front of the sensor the top is the mitter the middle is what the receiver's picking up

and then eventually this is the red line is the gate opening so you'll see as I bring my hand closer more of the emitted light is picked up by the receiver and when enough of it matches the door opens so that's great and then once the door's open so that red line on the bottom when it's high that means that the relay is energized which means the the door open or unlocked or whatever there's about a second into that there's another pulse to just say are you still there if it receives a reflection it stays open and if not at the end it will close again so you may have noticed if you put your

hand as soon as you take it away it doesn't switch off immediately it takes about a second so see I had these last time and I didn't see them I forgot to take them out again anyway so if you emit a fixed signal let's see what happens so we've got a 30 khz carrier we've measured that so let's just blast it with 30 khz and see what happens so these are the timing um so looking at how it does it it's on for 14 milliseconds it's all for 30 so we're going to try and just replicate that pattern easy peasy so here's the trace the spoof signal is what I'm emitting at the top and you can see the receiver is

picking that up and it's dropping the pin low great it's reacting the way I'm expecting it to and because the timing is not exact the phas is kind of drifting as we go and obviously the next slide is going to show them going into phase and then the door's going to open and then no it doesn't do that so instead as soon as there was some sort of overlap of the spoof signal and the emitted signal the pattern changed so it's clear on the right hand side but the pattern is now different and the timing like it's completely different to what I initially tried so I figured this is probably some method to um you know

to uh fight against SP signals and to um yeah prevent external interference from opening the doors which made me sad um so you yeah you can see here as soon as there was overlap the signal changed completely so this wasn't a good time I'm at this point I I I'll be honest I shelv the project for a little bit while I focused on things that made me happy um and I wasn't h i mean I wasn't happy about this and I assumed this is going to be hard um I don't know how I'm going to get this timing exactly right and get it in phase and all of these things so I just left it

alone um something important to take away from this is I was wrong um I thought I had hypotheses about why it was working the way it was and the hurdles in my head were entirely artificial um and so yeah I I had to get over that before I tried it again and realized that what I thought was the case was not um and also trying something that doesn't explicitly work is also often a good way to discover how things function so even if it doesn't give you the result you want if you get some different output um you get a better idea of how the thing works internally um I took this from Leon slide he did a a keynote um at hex on um

yeah and and I think the context is a bit different but the premise is similar um and it's about artificial hurdles so thinking you know this has already been done you don't want to do it again because well people have done this or it's too easy or or there's this artificial thing that you think well this can't work because I think this is how this functions or whatever even if that's true even if you can't um you don't figure out how the thing works if you don't crack it trying more stuff teaches you something about how the thing works and can lead you in a different direction so I think there's value in pushing on when things get

tough and to try and fight against those artificial hurdles so that's my um motivational talk for the day anyway so this was kind of the Crux of the next section was security features and reliability features can often look the same so in this case the changing pattern meant that it was somehow confirming that the reflections were being detected um if it was security then I would expect a fixed offset so I'm reading my slides but I did write down what I wanted to say um basically anti-interference techniques can look a lot the same as security but they weren't necessarily be as stringent um so with that in mind um sometimes if you think it's secure

maybe it's just trying to be reliable and you can still get away with some nonsense if you you try harder the reason that this is likely to be um anti- interference and not security features is because this device is mass-produced it has no branding on it it isn't made by anyone it just it Wills itself into existence by the magic of China and it ends up on a boat and then we get it and we sell it and someone makes a lot of money and it's wonderful um but if you think about that like the R&D time to make something like the secure is not going to like that's not a thing so it just needs to be reliable and they are

reliable you put your hand in front of them they're open that's all you want so yeah if you start thinking about it like that these cheap Chinese devices probably aren't trying to you know be super secure chances are they're just designed with a minimum requirements to make it reliable so let's test this and see what happens right so there's a lot of words here but basically there may be a chance to fix this if we just try and emit the second pattern so instead of emitting anything in the first place we just start with pattern number two and see what happens because at some point that is going to intersect with the emitted pattern and

it's going to change the pattern but now we're already meting the thing it's expecting to get maybe that'll work so same thing as we did in the first place exactly the same process except the timing is now different so we've got those plug it into a thing that generates light and boom in my office I'm opening the door see the red line goes up and it comes down again so that's cool so now we've managed to spoof a signal that actually makes a door open the problem is those red lines those red lines signify where I put my hand in front front of the Sens and move it away again to block the light that

I'm emitting for some reason my constant beage of signal was getting blocked out as interference by the receiver and if you look at the data sheet again again data sheet is the Bible of any hardware component if you can find it um there is quite a lot of suppression um of interference uh from various things mostly fluoresent lamps but other stuff as well um and that's probably what we're doing we're just triggering this uh disturbance pattern rejection so look at the timing again with the empty space on either side and that it's about 85 seconds so let's try blasted for 85 SEC milliseconds and then be quiet for 100 so pause on that successful attack

compromises of the correct carrier frequency and correct pulse pattern that's only two things the pulse patterns a bit um to figure out cuz it could be 500 microc it could be 30 milliseconds that's a big gap and if you're high time and your low time aren't correct then it might not work so there's a pretty wide range the carrier frequency however is fairly easy to get right because it's probably going to be something between 30 and 40 khz in one khz jumps so you've got about 10 say 11 options there um anyway so that's that's kind of the attack on any of these things um that I've figured out so the next thing was to build some hardware for it so 3D

printing is cool if you download stuff of thingiverse but it's extra cool if you start designing stuff from like for specific purposes and it it just blows my mind how you can just make a thing from nothing and then suddenly it exists in two hours um so that was my first prototype of a blaster because of course I want range this is the thing so I had a tiny LED inside my office it was working I don't want that I want to open this thing from far away so that's an LED with a heat sink on the back there's a lens to focus it nice and tight then I put a laser on the side cuz

I thought that would be cool and made space for the PCB oh that that came later but there's the laser I like it cuz it says danger on on the laser it makes the whole thing look a lot more scary um and then a third design where I I shove the the juny PCB at the back there and you can see there's the X uh targeting laser so another the question is does this actually work now I've done this talk once and for those of you who saw it would have seen I had a tripod and I had that junky thing on it um but that's not really practical if you are to like if you're doing a red team and you want

to get in somewhere you can't like what about your tripod get your power supply connected like dodgy Expos PCB and blast like people are going to ask questions so what I wanted to do is make this more compact more portable so this is what I had in mind is this the right one yes so this is a torch you can buy it from take a lot or very Mark wherever it's quite bright and it's got this cool function where you can adjust the focus so you can make it super tight sorry for those in the front um yeah it's got a rechargeable battery it's a nice torch so what if we take the torch as a

platform and we build all of that stuff into that so I'm going to switch off the mic as I walk across

cu

if I take this light and I shine it then nothing happens because it's a torch but if you take this one

so what's cool about that is that I you may have seen I didn't pull it out I didn't zoom in or do anything I just had that big wide beam and obviously if I make it tighter it's going to be more intensity and it's going to work better so if we do the same

thing

sorry I had an unfortunate unfortunate uh Hotel accident yesterday and I broke myself um you can bounce it off a

wall so I could probably put it at the back of the room and Trigger it from there but like you get the point it works for from far away um and it works fairly reliably and it would probably switch more frequently but I'm actually switching between two different patterns which I'll get to the relevance of that just now but that made me feel a lot like this guy um partly because he's got the cast on but also I I feel like a combination of the two like the guy who invents the cool stuff and then the James Bond who walks around with the the crime tools um doing doing Secret Agent things um so yeah this is the tor I used it's uh it

works you can see it from two nautical miles away whatever that means um but I went to the shops and I bought it and modified the inside of it so you can see there's uh the circuit there's a little red arrow pointing at the actual controller that does the switching um and it generates a signal and there on the right hand side at the bottom is the the LED and I mean this is not a very big big I mean it's not the tiniest torch but the entire thing has to fit in the head so this was quite a a challenge so shout out to Dylan for listening to all of my rants about how Hardware is

not supposed to work um yeah the next thing was other vendors um turns out some of these things are even easier so this one if I were to have it on top of there I don't because I didn't I ran out of time to set up a test drink for it but if that one was there it would also be triggered and it actually goes green and stays green like it doesn't even switch off and that's because the torch is switching between the two but in less than a second and so while it's before it switches back off it's getting triggered again and so yeah this can be used for these ones and those ones and

it's it's pretty reliable look Leon I put a video in my PowerPoint it's just a video of me playing with it outside with it switching between the two different protal so yeah that was that was quite fun um right we broke into a library cuz I mean it was time for some practical attacks right like doing this in a room is kind of boring like it doesn't let me in anywhere nothing happens so we actually found somewhere where there was access control on the outside a glass door and then I used the knowledge to reflect my light there were books on a bookshelf I think there were like 30 books in this Library it wasn't

the best library but anyway we got in and we weren't supposed to be there we also triggered the sensor on the other side of the room because we had light of sight and we confused the nonsense out of the cleaning lady who was outside cuz she heard the door click open and nobody was even in the room so that was cool I also broke into a block of flats in town where there was a 5ish meter path an alve to the side a sensor inside and I bounced It Off the Wall like actually it doesn't matter as long as as it's letting in me into somewhere I'm not supposed to be I'm happy so it works is the point and yeah so the

next steps were were laser um but that's done but the the X well it looks cool it it's not very bright and so it's not super super helpful runtime adjustment of parameters would be cool to be able to change the carrier frequencies to adjust the timing I've en I've encountered two of these sensors where I couldn't open them um same vendor I say vendor they don't have a name but they look the same um but they they just didn't respond to the torch put your hand in front of them they work fine so I need to figure out what the difference is there but to be able to change the parameters means I could fiddle you know adjust the carrier

frequency change the timing and try and brute force it into working and then to be able to actually receive the LED uh the light emitted by the sensor to detect what the carrier was and what the timing is um see I still have five minutes so that's that's kind of my next steps um to try and make it a bit more versatile but for now covering two vendors um it works for 90 95% of everything I've tried um I also tried straight line um range and I managed to trigger it from 30 m away um I call it the yeti cuz it's like the yeti pictures where it's a green blob in the distance and I

promise it's the Sens of switching on um but the kind of take away from this is that this is not good um because in reality these things are used in Secure areas because people are fooled by the premise that they are secure and that they are that you can only trigger them by putting a hand in front of the thing which you can't do if you're not in the room unless you have this torch in which case you can um but they don't know that that and yeah this is kind of a tricky one there's a couple of uh questions here um so they should only be used as convenience buttons really not security measures they shouldn't be used inide

sensitive areas kind of referred to point. one they shouldn't be used where an attacker has line of sight or can even see a wall like you shouldn't really use them unless they're dispensing soap or doing something something else so I don't know if you've noticed but I was really disappointed when I got here for the first time and I saw exit buttons that were buttons so in this building they use buttons so I thought it would be quite cool to demo it here but that's not happening um and then for manufacturers so there are answers that I could suggest but the point is I don't know who the manufacturer is these sensors willo themselves into

existence because of a a market demand and then people sell them and I don't know how like I don't know where they come from so I mean it's funny but it's also a genuine issue like what do you do about responsible disclosure I can't contact the vendors and say well this doesn't work um and so at the end of the day my my answer to it is just awareness from people who Implement these things um I did go to an office um a while ago and I managed to get all the way into their secure area um and they have since resolved the issue but like that was that raised awareness um so um I'm not selling these things to

the public yet I'm having some ethical conversations with myself we'll see how that goes um but yeah that's that's that's basically it it's it's a hard problem to solve because it's hardware and with software you know you can update it and now well the new version and everyone that gets deployed from now is patched whereas with this you can't patch it like you just have to replace it or use it differently so the only real answer for me is to get Implement is to think about these things differently um and for it you know people who understand how these things work to be you know asking the right questions basically so my takeaways are to be curious that is how

all of this came about um I I looked at the senses and I thought well these things don't look complicated or expensive so I wonder if we can fool them into thinking they've picked up a hand and turns out you can um the other thing is to break things I didn't actually break anything but I have been doing this for a while um but if you do break something well that's like it's actually okay like maybe you waste a little bit of money but you've probably learned something in the process and I think that that scares people away from Hardware hacking more than it should um except if you break yourself but most Hardware hacking is low voltage so you

should be okay and the last one which I think is the most important is to push through when it gets challenging so the things that stopped me I bought that in 2019 I will remind you this research is an old research I did it this year it's taken me like that long to just sit down and focus and get through it and convince myself that the problems that I was facing were artificial until I had confirmed them or disproven them so the easiest part of this stuff was doing the stuff I already knew and then beyond that it was a learning experience which has been valuable and now I've you know at a point where I'm standing here

talking to you so yeah push through when it gets challenging don't let that discourage you when you know things get hard that's when you learn the most and turns out that the hurdles I thought I had were just artificial and it was actually technically quite a simple simple attack so yeah that's me thank you for listening

any questions yes

you I've made a lot of mess on some tiles those um the one that I that I set off by accident yes um I I don't so it depends right so the senses uh like again TV remotes work on a different carrier frequency so they won't pick this up um the two vendors I've tried they worked on two different carrier frequencies so the one attack didn't work on the other um but yeah 30 khz seems to work on some so dispenses so go mad make a

mess for this one was well it was there it was 5177 microc off 600 and something on and for the other one it kind of didn't matter if there was a 31 khz carrier just switched so that one was a lot less fussy even though it looked like it was better designed so yeah just depends on the device was one over there off uh no it's just a crime torch I guess y

so I have actually looked at that um theoretically there is a flipper zero in the world with the recording of the correct pattern I haven't I haven't tested whether it actually works if it emits I don't know if the carrier frequency is factored into that it's a whole thing um um technically yes I think the emitter you can have you'd have to write some code for it but it could be possible the big issue is that the LED is small and weak and this led is big and strong and that I mean that's the main thing so this is a 5 wat LED um the biggest like normal form factor led I could find was 2 Watts um with a very

narrow beam angle but um in this case I'm just throwing a lot of power at the problem so zero would work but I think by default the range would be quite limited but technically

yes yeah if it's got if it switches quickly enough then yeah I don't have one I just have this SP mark one but it was pretty cheap you know it's kind of Fun Works cool I think that's it thanks everyone enjoy the of the

day