>>This is Jose Molina and he'll talk about more problems with home automation stuff.  Let's give him a big party track welcome? Applause 
(Applause)
	>> Perfect. Hi, everyone, it's nice to have so many people here, great, this is going to be a fun -- going to be a fun talk. So, it's good you are here, you can drink, have fun, this is the party track-- all right.  I will just start with the questions for you, and it is the following: If I were here to tell you someone can control every appliance in your room, except the locks and maybe the thermostat but everything else like the TV, lights, the blinds, everything else, would you stay at that room or would you check out tonight?  Not the locks.  They cannot do you any physical harm and they cannot steal your shit but everything else is controlled by someone.  Okay?  So think about it.  I will come back to this talk, to this question later.  
	So who am I?  I am a security consultant based in San Francisco.  This part of the talk is brought to you by (Inaudible) I want the second last name to be said so my name is Dr. Jesus Maria Molina--.  So, I'm a spanish guy. I'm from La Mancha where we roll our (indiscernable)and all that stuff.  My website is -- My Twitter handle is identifyandtrust. And give me tequila and I will give you more videos which are more fun. All these video I sell have plausibility, meaning I can say someone else did it with the iPad.  All right.  What did I do?  This is kind of the romantic side of security where someone goes to a place and they see something is broken and they will try to hack into or something, this is kind of this talk.  I have 48 hours to do this cause I was checking out, in the process I was able to control 200 + rooms at a five-star hotel by using an insecure home automation protocol.  So I was able to raise the blinds, the TVs, switch on everything, in 200 plus rooms.  While I was a guest in the hotel,  In China, okay, so give me credit for this, you know, because it was kind of scary!
	(Laughter)
 I did not hack anything.  I abused something. Okay, So that is different things!  The good thing is this is a story with a happy ending. Right, because I talked with Starwood and they were okay with this talk. Actually, they supported it, they say go ahead and do it.  I talk with the CIO, by the way that was the most awkward talk in the world.  My lawyer was on the phone with me, his lawyer was on the phone with him.  We were like, Hi, how are you doing?  We know you did something in our hotel! Explain what you did to us.
	(Laughter)
 But the fact is that they disabled the system right away and they have changed the policy on all hotels which are the seratones and the  -- (Inaudible) -- because of this.  They did the correct steps, you know, they did very good at that.  Well, let's go to the talk.  
	Um, the hotel is the St. Regis -- in China is the city, hotel is there in the 20 top stories of a skyscraper beautiful place.  This is kind of like Die hard three take over Die Hard one.  You know, -- but the feature of the hotel except that really caught my attention was an iPad.  This ipad was is able to control, appears in every room and is able to control every feature of the room.  So, the ipad comes in every room, With the iPad you can raise the blinds, switch on the lights and put the music on, switch on the channel for the TV, all that stuff, right.  
	So, I was there in the room and I was like, okay, so can I control the room with my laptop run it along with my ipad.  So, the first thing I did was, I said, whoa what is communicating between the ipad and the things in the room? So, the ipad is open to the (indiscernable) -- so I arose the ipad and where was the ipad connected to? The ipad was connected to the guest network at the hotel.  If you go to the hotel and you know the guess network is open.  You can -- you have to be for the Internet but you can be neighborly with all the people connected to.  So, the guest network is open to (indiscernable)--. So, the automation protocol these guys used from  
the iPad to every feature in the room needs to be secure.  Well, it was not!  Hence the talk here.  
	All right.  I checked what was connecting, what was sending the iPad to every device and I found out it was telegrams from single port.  So I went ahead and checked in the Internet what was this port about.  I decide that there was a KNX, who in this room knows what KNX is?  
	No one.  All right.  So KNX is a super extended protocol for home automation in Europe and China and Asian Europe really really oh centered there.  Because it's a standard.  In China, KNX is the only home automation standard.  If you want to make a deal in the airport you have to deploy KNX. This is kind of serious.  In the 1990s and it is very simple to deploy, you can see this is an activator so basically it you plack all the devices to the activator, and there is another wire, a wire protocol another wire you can send messages to and switch on the lights, raise the blinds and everything.  Right?  
	So it's an open standard and with open it means closed and that's another interesting fact here right?
(Laughter)
 First time I saw this I was like okay I will go to the Internet and download the standards and see what happens.  But you have to pay a thousand Euros to the lowest standard and that's an open standard.  So but the KNX people decided to give the standard to Universities so universities created open source clients and that's how I was able to understand the standard, by taking all these clients, looking at the code and then I could make out what was going on there.  
	And another fun fact is that there is absolutely no security.  Okay.  So, this is interesting.  This is from the 1990s where there was physical securities around all these wires so they didn't need to put any security.  However, they decided to create a evolution of the protocal called KNXIP which ended up being KNX messages with IP frames but didn't put any security either.  
	And that is known since 2006. So, 2006 there was a document saying hey there is no security and these people said there needs to be security but no idea anything except six months ago the KNX people send a new protocol evolution, new version of the protocal that has does have -- that does have some security on it that they say but I cannot download it so I really know.  Maybe in 5,000 years I can check it out!  
	So how this works in the hotel.  So every room has a single IP.  That is the IP that I saw they were communicating through.  That is a KNX IP router.  This KNX IP router what it does, it converts these IP information into KNX information.  KNX it's a wired protocol so all this goes through wires and as you see the wire protocol KNX has a different way of forming addresses.  They are like three numbers.  The first number there, you see like three numbers with the slashes. The first number is the area line. The second number is the area number.  Second number is the line number and the third number is the device number.  As you can see there a light will have 222 and a TV will have 223.  So, it's kind of easy to guess, right?  
	The rest of the hotel so the rest of the hotel if I wept to connect to another room you see the difference there?  Like there was another IP address that room is 777, next room is 7778.  The IP address is correct I think.  So then if you look at the device numbers for each device, like 222 in the room 7778, there was like 232.  Okay?  
	So it was a little more difficult than that.  You know there are different floors --but I went to different rooms and I was able to tell but what next number for each room. So, I was like I have them up for each IP address and room, oh, nice, that's maybe for me?  Alright, So the protocol said now that I know that every room has an IP address that every device in every room has an address, right?  
	So, the only thing I need to do now is code the protocol.  The protocol goes like this, you know, I send a connect request to the IP address, it says hey, yes, and they give me like a window of that I have to use after that.  
	I create a request and it sends back connector response, saying, hey, that's good.  You are connected to the KNX network. After this I send a permanent request and after this moment I can send anything I want to the KNX network. Meaning that I can send anything to switch on the lights and switch off the lights, open the blinds close the blinds. This packet I sent internally is called a kenney and it's what goes into the KNX network.  At the end I disconnect request and that's it!  If I have the protocol to connect to the KNX network I have the IP address for every room and I have the address KNX address for every device, what can I do with it?  I can raise every blind of the hotel at will.  
	So what I'm sending to the wire to the Kenney thing that I was talking about.  So you see, it's really simple.  Like UDP and enveloping a kenny frame.  So, all these numbers, they don't make any sense to you.  They didn't make any sense to me in the 40 hours I was in the room but after researching I was able to understand.  This is like part of the code of one of the open source plans I was told you.  This is not from the standard.  This is like something I said.  
	And I saw there's a lot of things there but the only important things you have to see there is there's an address and an action.  The Address is the address of the device I want to switch on.  The action is depending on the device and that's specified in the only open document that KNX has, which is how you use, what action do you use for each device.  For example, a light bulb, to switch on and off is AP and AP1.  To raise the thermostat, which is also controlled by a room it is like different stuff that you have to send but it's like you code it and that's it.  
	All right, so the question is:  Can I switch, and that was kind of the quest here, can I switchd a TV on in every room.  If you have been following the talk and I hope you have, you would understand that if I can switch one light bulb I can switch every device because I don't need the device, the device numbers and I need the device numbers for my room and if I can switch on the TV or blinds in my room, if I know the IP address of every room, then I can switch every TV on every room.  Okay.  So if I said you can switch one light bulb that means I can switch every TV.  
	I want to show you exactly that. Oh, by the way, I was super caffeinated so sorry about that!  So let me -- look at the left right there.  See what's going on there?  That's the first time I try to do this!
	(Laughter)
 That is happiness, of not being caught.  All right.  So 
(Laughter)
 I was doing that for posterity, so I wanted to record this.  Alright, so you see thelight bulb right there, I used the smallest light bulb because it was the absolute brightest. (Indiscernable) --raising the blind, turning on tv's but I think this was the most, the fastest to show, see the light goes on, the light goes off and I am using my laptop to do this. That was like after a whole night of working on this and I had to code my own protocal and stuff, you know. Okay, let's go back. Alright.  
	So we are in like I need to send in a ton of requests which you can use EIBD, which is (indiscernable) it's open source, you can download it righ now and you can start sending KNX frames on the wire. Very fast.  The problem is that the daemon you can not paralyze, it works, it connects with a single IP address and I said I wanted to have the power to raise every TV so I have to code my own in (indiscernable).  Really simple.  Very simple protocol.  It's a free protocal.  You need the KNX address of each device in the room. So, what I did is I pressed the iPad, plop, plop, plop, automated connection and it will give me every address and action of every device in the room.  They have this library of all these things.  After this I get the IP address of each room and KNX area and line.  That is required a little more complexity so what I did is change rooms all the time.  I will go, call downstairs, hey, I don't like this room, can you put me in another room? 
They will be, okay!
	(Laughter)
Two hours later, hey, I don't like this room.  Too much light coming on!  Can I change rooms?  They were like, okay.
(Laughter)
 I was, like, I cannot sleep in this room.  So, they end they give me this room which is the suite. 
(Laughter)
 And It's a beautiful duplex suite like beautiful floor-to-ceiling windows but there is a problem with this room because of what I've done there is no iPad.
(Laughter)
 I will continue.
	>> Are there any new speakers here?  Raise your hand.
	>> Yeah.
	>> Hey! We got one!  
(Applause)
	>> So, What do you think of foam hinge -- (Inaudible) -- right there?  That foam hinge right there?  Like right there.  Foam Hinge.  We ordered a full-sized foam Stonehenge for you.
	>> Yeah, I know, I know you told me. You told me, that's great. I love it.
	>> All right.
	>> Cheers!
	>> Cheers!
	>> Cheers
	 
(Applause)
	>> Come on!
(Applause)
	>> That was good.  Thank you very much. Do you have another one?  
	>> Good luck continuing.
	>> Alright, that was not tequila by the way.  That was some sort of pretty strong stuff.  Anyways... so the problem with the suite was there was no iPad.  So, I could not continue my research there.  So, I had to call back and say, hey, I really don't like this room.  You know.  I don't like duplex's, it's not my thing.  You have to go upstairs to sleep.  They changed my room again but the hotel manager came and I was like hey what's your problem?  And then I got -- again, I was in a hotel in China, not afraid of a media scene but something, anyway, they are asking this question, hey Jose you told us you can control every room but how do you make sure you can control every room?  So we created this HeartBleed program where outside each room there was the do not disturb light.  You see this like blue and red so the light sits outside the room so I can go outside and see Room 777 and I can see its heartbeating, 778. 
and I will see a heartbeating and if I had time I would show you a video.  But ugh, anyway. We can tell whenever I press that button I knew I had hacked that room.  I could switch on the TV in that room I can do anything in that room.  So I did that for a couple of rooms.  
	Alright.  Were there other devices connected?  Maybe, but the problem is I tried sending random requests to random addresses that were not used and at some point someone knocked at my door and I got super scared and I was like oh my God they caught me, I'm ready to go to Chinese jail.  Take me with you!  I do my best.  But it was the laundry lady, she was like laundry, laundry.  Then she went to the other room -- I guess I did something there.  But this has not been confirmed by the hotel. So, I am not really sure.  I think I probably did something.  
	So, what does it mean?  By the way, not the rainbow guys for the stoner people here next to me.  Anyway, for hotels, maybe it is to update their security policies.  They don't include things like home automation or smart tv's and things like this that we can take over because hotels in time on these devices.  Is this a problem in hotels?  The answer is yes. Are these particular hotels, they do not tell which ones until -- (Inaudible) --  For the Internet of Things we are -- anybody that deploys their own protocols, nobody knows if they are deploying and we give extra care when they deploy automation in certain spaces because they still think you have a cocoon  around them or something.  What's the worst that can happen?  When they first asked me this question, I was like I only had one ipad and now it controls every room of the hotel and the guy in the room does not know.  I switch on the TV and every TV in the hotel switches on or I could go with magnetic helmet and say oh, he once died that and like put my arms up and every blind will switch on like all the TVs will start to flicker that seems to be the worst thing that could happen. 
I could go create chaos -- but they dont think that's the worst thing that could happen now.  I think what the worst thing that could happen and the question they asking me for is because of this.  I ask you:  If I can control your room, will you stay in that room tonight?  I don't know what your answer will have been.  Probably the answer is like yeah, what's the worst that can happen you turn on my TV.  What they will say is it was Obama, can I control your TV?  If I go with an important news to you, do you want me to control your TV?  You just said to me it's okay for you to stay at your hotel even if your not going to switch on your TV.  Well just so you know saying to a President saying I will only switch your TV on if it's important news I need to tell you.  Your going to say yes because it's the same thing.  You are just like give me power over your TV implicitly you are going to say no to someone that has a reason to do this? Not like me switching on for sports. 
People don't care and that's the worst thing that can happen.  I talked to so many reporters, so many people about it and they always ask me the same damn question.  I don't care.  You Switch on my light bulb, I don't care you switch on my TV, that's okay.  You are not making any harm to me, your are not stealing any information from me.  So go ahead.  This is not a big security problem.  
	Well, I disagree. I disagree.  It's not a big security problem because I cannot do harm to you but at the end is your peace of mind which I'm playing with so be careful.  
	Thank you very much and have fun.
(Applause)