A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors

Video in TIB AV-Portal: A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors

Formal Metadata

A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors
Title of Series
Part Number
Number of Parts
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
There are multiple x86 processors in your monitor! OSD, or on-screen-display controllers are ubiquitous components in nearly all modern monitors. OSDs are typically used to generate simple menus on the monitor, allowing the user to change settings like brightness, contrast and input source. However, OSDs are effectively independent general-purpose computers that can: read the content of the screen, change arbitrary pixel values, and execute arbitrary code supplied through numerous control channels. We demonstrate multiple methods of loading and executing arbitrary code in a modern monitor and discuss the security implication of this novel attack vector. We also present a thorough analysis of an OSD system used in common Dell monitors and discuss attack scenarios ranging from active screen content manipulation and screen content snooping to active data exfiltration using Funtenna-like techniques. We demonstrate a multi-stage monitor implant capable of loading arbitrary code and data encoded in specially crafted images and documents through active monitor snooping. This code infiltration technique can be implemented through a single pixel, or through subtle variations of a large number of pixels. We discuss a step-by-step walk-through of our hardware and software reverse-analysis process of the Dell monitor. We present three demonstrations of monitoring exploitation to show active screen snooping, active screen content manipulation and covert data exfiltration using Funtenna. Lastly, we discuss realistic attack delivery mechanisms, show a prototype implementation of our attack using the USB Armory and outline potential attack mitigation options. We will release sample code related to this attack prior to the presentation date.
Computer animation Water vapor
Area Computer animation Internetworking Physical law Mereology Metropolitan area network Shareware
Computer animation Video game Office suite Router (computing) Information security Traffic reporting
Musical ensemble Maxima and minima Web browser Cryptography Computer icon Degree (graph theory) Kernel (computing) Computer animation Bit rate Causality Green's function Encryption Right angle Information security Window Physical system
Pixel Touchscreen Computer animation Bit rate Hacker (term) Multiplication sign Virtual machine Speech synthesis Web browser Office suite Booting
Area Googol Computer animation Multiplication sign Device driver Office suite Endliche Modelltheorie Sphere Form (programming)
Computer animation Bit rate Staff (military) Office suite Variable (mathematics) Power (physics)
Medical imaging Word Process (computing) Computer animation Computer file File format Right angle Endliche Modelltheorie Figurate number Quicksort Food energy
Computer animation Bit rate Multiplication sign Computer hardware Parallel port Quicksort Endliche Modelltheorie Pole (complex analysis) Software protection dongle
Computer program Standard deviation Touchscreen Open source Multiplication sign Control engineering Mereology Type theory Computer animation Software String (computer science) Thermal radiation Right angle Information security Communications protocol
Serial port Process (computing) Computer animation Bit rate Personal digital assistant Bus (computing) Motion capture Parallel port Quicksort
Revision control SCSI Computer animation Information Plotter Right angle Monster group
Dependent and independent variables Multiplication sign Parameter (computer programming) Data transmission Message passing Computer animation Bit rate Whiteboard Data structure Sanitary sewer Reading (process) Metropolitan area network Spacetime
Standard deviation Greatest element SCSI Inheritance (object-oriented programming) File format Control engineering Gradient Control flow Microcontroller Mereology Raw image format Code Power (physics) Logikanalysator Frequency Message passing Computer animation Bit rate Different (Kate Ryan album) Bus (computing) Right angle Asynchronous Transfer Mode
Medical imaging Computer animation Entropiecodierung Different (Kate Ryan album) Flash memory Gradient Volumenvisualisierung Right angle Data structure Quicksort Table (information) Code
Hexagon Computer animation Bit rate String (computer science) Gradient Device driver Whiteboard Funktionalanalysis Social class
Word Dependent and independent variables Computer animation Open source Computer file Bit Right angle Quicksort Physical system
Word Computer animation Sheaf (mathematics) Student's t-test Computer Hand fan
Computer animation Funktionalanalysis Cartesian coordinate system
Computer program Standard deviation Computer file Bit Line (geometry) Rectangle Code Radius Computer animation Semiconductor memory Telecommunication Software testing Right angle User interface
Point (geometry) Message passing Process (computing) Computer animation Bit rate Eigenvalues and eigenvectors Range (statistics) Core dump Touch typing Quicksort Mereology System call
Point (geometry) Sign (mathematics) Computer animation Computer hardware Funktionalanalysis Directed graph
Point (geometry) Control engineering Device driver Water vapor Microcontroller Mereology Flow separation Computer Computer animation Bit rate Software Semiconductor memory String (computer science) Core dump Right angle Spacetime
Pixel Uniform resource locator Touchscreen Computer animation Bit rate Link (knot theory) Bridging (networking) Single-precision floating-point format Core dump Microcontroller Computer System call
Revision control Medical imaging Pixel Computer animation File format Weight Right angle Peg solitaire Booting Power (physics)
Area Point (geometry) Dynamical system Computer animation Information Product (business)
Medical imaging Computer animation Information Control engineering Control flow Cuboid Bit Data structure Heat transfer Form (programming)
Point (geometry) Computer animation Bit rate Cellular automaton Cuboid Water vapor Mountain pass
Computer animation Multiplication sign Buffer solution Counting Bit Right angle Form (programming)
Pixel Finitismus Computer animation Cellular automaton Single-precision floating-point format Pattern language Figurate number Endliche Modelltheorie
Axiom of choice Pixel Bit Nominal number Shareware Optical disc drive Word Computer animation Bit rate String (computer science) Green's function Linearization Physical system
Point (geometry) Medical imaging Inference Numbering scheme Computer animation Mapping Core dump Right angle Bit Procedural programming Table (information)
Web page Point (geometry) Medical imaging Data management Process (computing) Computer animation Structural load Right angle Funktionalanalysis Table (information) Cryptography Parsing
Point (geometry) Dynamical system Thread (computing) Computer animation Mathematical analysis Control flow Bit Figurate number System call
Web page Point (geometry) Stapeldatei Matching (graph theory) Touchscreen Multiplication sign Structural load Maxima and minima Medical imaging Computer animation Self-organization Table (information) Exception handling
Overlay-Netz NP-hard Pixel Touchscreen Process (computing) Multiplication sign Code Power (physics) Expected value Arithmetic mean Computer animation Software Bit rate String (computer science) Vertex (graph theory) Energy level Address space
Metre Presentation of a group Touchscreen Content (media) Code Computer System call Metadata Power (physics) Sparse matrix Bit rate Personal digital assistant Order (biology) Whiteboard Table (information)
Pixel State of matter Multiplication sign Plotter Set (mathematics) Mereology Medical imaging Bit rate Different (Kate Ryan album) Endliche Modelltheorie Physical system Curve Touchscreen Bit 10 (number) Proof theory Radical (chemistry) Type theory Process (computing) Vector space Uniformer Raum Order (biology) Right angle User interface Pattern language Whiteboard Point (geometry) Trail Link (knot theory) Online help Menu (computing) Computer Code Theory Revision control Goodness of fit Bridging (networking) Touch typing Software testing User interface Graph (mathematics) Control engineering Polygon Shareware Graphical user interface Word Computer animation Software Factory (trading post) Speech synthesis
Computer program Presentation of a group Word Bit rate Control engineering Set (mathematics) Information security System call Twitter
. death at the top the and the and the and the B brought
to the hi guys sorry for the delay I just want before we start the dark I just want to let you know that there will be giving this awesome stake thing Bonner I wasn't do
if you answer all the questions so please pay attention to him and it's very hard is they just what I make a quick announcement before I introduces goes on so just a reminder that there is no but tonight at 9 of the city which is where the concert was lost sight and it's at the saddest fear for those of you who haven't been there before in the past it's an experienced so with that I like to introduce entree was washable no and yet in tutorial we'll be talking about waters next the OK yes like judge so we're going to get out that really cool thing if you answer 1 really question
so the title of our talk is monitored directly in here is the cast of
characters and this I'm all jotain is trying to set the demo that over there the strong François is right on the internet is a canadian is great and
this is the law from hatcheries and I've never met you were so what is made up of the I and I personally I speak to memorialize here is concerned area
man named Chris will be part of the story and
and area man of concern should he which will also be her 1st get primary main
objective we're going after monitors that's what this talk is about you know why monitors the what is
this is really a security problem you know that's always talk about so I thought you know in retrospect you why I did the monitoring and I think that what to do
with you badly day I used to existing cubicle life he was very sad I found a picture of my actual hedge fund cubicle office thing friend and I think those Machel desk and taken contains actual sadness uh enabling I went back to
school I a I a you maybe subconsciously wants to dismantle cubicle life technology so jot maniacal University la work on the cell phones we looked at each reporters and you would did work with Cisco routers so the last thing that's left in a picture a is the
monitors the monitors gone down today that's that's what we're doing but I'm in more of a user's
nova look at this website GATE it's chase outcome there's a green little locker degree means good OK I would probably you know posit that we've probably spent about a billion dollars creating all of the technology in the infrastructure to support the kernel got all the technology to support and infrastructure where we can put a green icon on that browser window right so we can feel safe about encryption but looking at the letters in which we see
this browser through right it's a monitor so you know if you want a compromise the system as a whole rate maybe let's look at the minimum the cost of 1 billion dollars of the crypto and all infrastructure secure group around to her own browser and uh maybe whatever the cause of bypassing the security in the monitors maybe it's a lot may be too little and so we talk about they end right a good
hackers a lazy hackers of going after to the car on the browsers change the pixel from that and let's see if we can just change the pixel and the screen itself OK so the story
serves back until the 15 rate will travel and at the time uh right so
I get this really sweet you monitor in my office great in fact and John has 2 and we look at it would plug it into a
machine and the 1st thing that it says is hot you speech ITC solution from Texas Instrument and also you know is illegal 34 10 boot device right so we look at that and we say that's pretty cool it's very interesting
and then like a minute of googling later we find this post fund del suppor form
right a or about it you can download this like we're driver but really you know it will use it for firmer update and you should never need this so every fine Ray and I was at that time that's that's also really interesting so
you know I sedan John page stare down a sphere 34 inch model we have enough office we already have sweet monitors why don't we that according to their like will who cares and then area manner concern area may increase over here colorization and
he says like have you guys know hearts like there's no end to this senseless savagery and also I have a million of them plug and very sad day and others that all of
that's the saddest story ever heard why but how about dense let's give that's due to the inherent variability they will be sad so great this is our
interplay we love these people they're very talented dedicated people working in a office and it just so happens that the interns get standard issue you know tell you 24 10 minus but they
are and you know like 15 minutes ago later we find is really very informative document that says you know you 24 for 10 years the former upgrade instruction rate is so clear that I think it's almost like insultingly clear because you'll
that this is such a little says like you plug the power cord in the power core wall thing but here's a staff 3 and you do the rest but the
rest of the document very formative show screenshots of this tool that they'll released to do for update rate lots of Reveries who information like if you look at the the for the name of the file the former image right so you know if you find it the we maybe can do this process of figure out how you know a of they words in a model and very interesting things access rights supersede he command or it's 500 who knows what that does rape but whatever this thing is this process takes from were copies of from use the amplitude directly into purses search on a monitor with that's comical picked so we do
more going you know we find all sorts of things like Genesis energy probe and then this
hardware from the nineties rated this thing takes a pole of all power supply rate and that has a parallel port articles the VGA and some other mystery dongle every vendor due every manufacture monitor make something sort of secretly similar to this but it's not not the same and we found this in time monitors made you know like late nineties early 2 thousands of the by
modeling we find St microlens somehow symbolic in Alexis there been is a thing that you know as the micro makes and somehow all this stuff ended up in the dome monitors gay
so would love a global users will be found that the string after 3 that's what we started and that's part of the tool that G problem Genesis critical G probe OK I and this you know in the early 2000 appear to be very industry-standard type of software that people use to manage to solve running monitors they Morgan later and this is the
story so Genesis Inc was the operating and at around 2002 they saw themselves to as the micro array but they're also the people who created you program and they were very high creating that face a standard for this protocol called DDC which of about right and then as the microbial genesis in 2008 radiates have their own IP and you Provan's stuff that they want to miss the other and created this strip called the DP 600 or 60 x and a hundred 80 x and then that was put into a looks forward and in x company that designed the screen controllers which is you know partially all by fast time and then later you del source ill-afford right into the dough monitor and this is kind of the reason why we have terrible security you know in modest Davison which mishmash of you know where this technology came from uh and you know
we got a copy of G probe just by looking around googling that's what it looks like
you know it has the ability to communicate to connect to the device in this case the monitor over your parallel serial USB basically the story is as long as there is some way to get onto the ITC bus of the monitor G protein of the the former and do all sorts of other diagnostics which is called they and then we took the use the former
tool uh we capture the use the traffic rate and now it's it's very noisy lots lots of traffic and this is the capture of what this snippet that of from Robert process and before we get into the details of that let me
just a brief story about DC DC stands for display data channel right it's the standard that new was created by a visa and there are many
versions in some versions of the uses there's the C version 1 to I think 3 and to be in some versions the of the plot the I plus a b blob about 1 else OK but now let's look at what I package that has this information looks like going over the years before so this
is a scuzzy command riches send using USB monsterous vertical away
and use B and then add this is another back at which encapsulates BDC to be back at our which has appeared on cheaper back on the which you can now you know up to ask about like history read are
and you wanna do like run board or anything like that this is a DDC Dewey I packet structure which contains a DDC destination sewers man of the CB prefix which is like which are open for ban and and cheaper message and checksums that back
so the nearly like how you do a small command and Dr. the mind about this very simple common from very simple and and it's basically I might ask hate I wanna talk to you by sending evasive vendor-specific see gold and I ask for uttered history as a SKOS as a space argument and and then a montage say is that I acknowledge that the 1 adopted me and our money to say but BCC is that I acknowledge that you acknowledge that the 1 about me so and and I also acknowledge that you want to do it is to read over so the last 2 packets is like end of transmission for the acknowledgment of the request coming and then again and then again that the mother BCC is our gap could you please give me a response by presenting a scuzzy command and then asking for a good response to me and say that I acknowledge that you want to get the response so it is that I acknowledge that you acknowledge that you want a response so here the responsible that's still told packets rates to do this very simple Cohen and we saw this over USB B you would figure that out and now we decided was time to take apart some 4 inches monitor and see what we see so you know that if you take a out of
off the back cover this is with the mayor are model look like by the logic analyser in the bus part did not come standard that hours that an air and yeah and I you know on the top you have all that standard power equipment grade on this side is this a little use the controller which will get back to it on the bottom is a USB hub and that they will thing with aluminum great heat sink that's the stuff that's the thing that we want to execute the code and then France or mapped
out all the different parts rate so the main and stock the STEP UP AT T 28 right out and right next to it is the multiplexer fry to see and connected to that ravier ITC is this USB 26 49 is programmable controllers such of rate and that's something that's on the side of the monitor that you can plug in a sea of you were connected on the left side of the ball exactly so that's that 1 is a dumb use the rate which will get to so when Japan's send this package Ray all as your become a packet what happened was the packet went through the USB hub so the reason why the 1st command is a undocumented scuzzy all sea of command is a goes up the hub to the 26 49 over USB rate and that puts that divides into like super sneaky cytosines Russia receive mode In the 2nd packet that you send rate if this were a format over your be break gets sent to the hub to the controller and the controller then takes the capsule is the packet takes the period near the raw ITC message right with the right and ITC bus and a sensor directly to the the the microcontroller that the stock rate and that's why you have so many packets basically you know you put this thing in that that the US you into does cancelation and this allows you to go whatever right it's a message you want onto the bus you can do ITC messages that you can come and communicate with the sock right and what should you do with that but merely for the
pore over we found that to make about this guy flash so we did the obvious thing dump the
flash and this is what a in-house of entropy analyzer that we haven't is renders essentially white is really random black is now a animal trainer just the right off the cuff you look at the image that's obviously some kind we're table structures were interested in that but this kind of looks like code grade 3 different segments of code who knows what it does probably data and it's a little village the and of this income you know that probably looks like some sort of compressed data so we're interested in what the the next obvious thing
is you know what's the strings rate and we found exactly what we found was defined with this analogs Morris grade is internal destination for the board class and guessing and effective from Rob they talk shows up with Mars that hex which is a small driver that allows you to communicate with the board but don't worry for 10 and you know if you look at the other commands rate you have really cool stuff like Yemenis were always the showed the hide is exactly the kind of functions that we wanna play with so we do the next obvious thing
it's like let's open up an idea or a and I didn't really like it and I don't
like Texas excited that's why you know the greatest didn't really do all the with that this assembly and the reason why is because this is terrible a 186 right which is and and all 16 bit 6 system that can extend to either a 24 bit 24 20 yeah 24 bits source said select so it does all sorts of funky stuff and don't really you know know what to do with it and then I go little I
heard of somebody 2008 exactly when it's the microbot genesis and all the stuff posted on overseas it with a very specific question about a very specific file some guesses somebody probably work in this in 2008 and Evora wrote a very reasonable response like this is you know how I the words and you know through all 186 is all the edges do this the and I look at it will
get a see section like I don't do the neuron going home and I'm not a fan of working with exceeds and general and then of
the year passes send Radio and succinct and uh naively was
sitting around and we really so we can this so
well as you know we what we want to know how the student computer words we have to do with the 6 I'm Israelite Arnold sets as go far right and then you'll find can respond ordered new
virtual there's a very long insightful explanation of exactly the winners of ITER and how to deter 186 and knew he was even as an disassemble Mars acts the IDD just show as a light blue the it's you just do this obviously so you know we we did it any of you know either
elite so many segments of the final you wanna see we fail was hard and then of fog and but please don't look at this
but it was like because that my basically and put cross-references in every function there was no was the and so I just added a hockey was it in place applications define the divergence and that
as documented in their probe on top that tradition we found was that history to which we can read any resisters with EAP anyway we want our so definitely there's good execution and this
is 1 of those commands we found it is undocumented through the DOE bit of which allowed us to put show on in there all see and in the maybe up there about 1 so keep in mind this is
all just straight standard gene probe interface spread has run code as read memory has right memory radius or legitimate communication were not exploiting so the next thing we would say that OK let's write a whole program OK so we found this really cool AP test 3 which is no way to run diagnostics and that this is always the file a filled rectangle right but but still rectangle with colored that's exactly 1 meningitis as those do run right let's plant shellcode and hijacking this that and then it works but was like really gross let that any of your little heart from
us that is the a worse but this is kind will look like we had to look at this and debug it for hours and hours and the on it'll make if you did that 1 little lowered wings by the way yet just what is science
science rate OK so far at this point this is what we know about the from where we got a moralist assembled you know we have this range of 8 0 0 0 0 to these 0 0 0 0 there and they and then we solve new pretty quickly that they're all these little far calls to the F 0 0 there's and we really cares about that because that's not part of the former gay and you know it's stuff something as part of the sort that the former of the process that is in touch and so I said Hollis that stumped some data definitely have a disagreed eigen dump data for your speed and get down the way for it down and on is very slow at this place was that 1 kilobyte everybody's on Indians so what about you have 120 Mbytes requires like stalled messages earliest us to to get right so that you can only extract up to 120 bytes it's 827 but something we comes out so while this
designating a sign marking the hardware so I figure maybe there's a way to do something with hardware maybe we can play with the GPI owes maybe we can axletree trait data using something else aside from USB maybe we can maybe you can find it if you feel that we can repurpose so I just use everything is available and I flip the bins and so I finally found
something I found 1 thing we can actually flipped the sprawling more out there we 3 others more later but at this point I 1 so with 1 I can do a sink cereal or something like that and then I can axletree data may be like a makerbot something which I did and we also figured might as well just hijack the printer function and some dynamic and and have a look at what's happening in the monitor
in real-time and extract some strings because we had no you by we can find it maybe that's fine play with maybe if their but at this point we actually see some activity when pressed buttons this did not take us anywhere but it's was worth a shot so further literally water
often something guys and cynical reimplemented your in GPI Ireland's monitor all the back and a 5 rate many came back at data in a worst rate how cool set and OK so we did some dumps very dynamic data coming out of modern finally and now we realize that 0 so Levitical going we realized we were really wrong about without about this former it's not always the from OK Pinellas and this over it really is all cm executables him for on-chip microcontroller and it turns out there isn't always the but inside the stock go cm and always tier 2 separate computing devices the is to effectively go to cost writing in the red part is with all I ran and purpose of Ireland is it's an actual wrong that's sits inside the chip that acts as a driver that allows the all cm controller to come to connect to work with the always the controllers right was all done through shared memory and you make of space is a tiny little network inside a tiny light using our you know I'm on and there so many cool things to do in this monitor you can do
actually PAP bridges display inside itself but you can display to screen someone go there and then we use we had that like a we go over like a million years rate and we find this piece of
gold itself what is the stock 88 . com its definition of a place where you want to go to include link to the end but you should click on every single link because it's such a great website but it does have a the datasheet for exactly the chip that were looking for so this chair you know and what is a she will learn a upon about internal as in all the registers and then stuff that we never thought we knew we would find it had little microcontroller inside the monitors they so with with that you know the document with his glasses of core execution were late were ready to put at least pick a single pixel on the screen the call we won the location rates are like let's display of
pictures and the following 3 questions we have asked for a was the 1st version weighted transport
image right the 2nd question is like how how the display the transform it was together with the 1 and also 1 of the colors on the colors work that is you know what it is it like a compressed images that J peg know was the format of each pixel was a form of of the image excetera so
you know we we we will look at if you plug the power into the monitor nothing happens in connect anything to it the dollar comes of this is kind the monitors boots going and you know as we saw that a really will this thing must be like in the forward right and after many constructive you know sober and
and highly productive discussions area between John and I we we're just looking at the static
stuff and you know John line that's obviously covered yeah you know so maybe this picture knows but unlike well below the all like what is that really maybe that's a good thing you know and there are some great hand if you stare at this thing for
long enough like cattle why does is to me when it does like crazy things that you will bring it get you more drawn right so we're doing this in France or in Italy
guys like this things and was made by preferred to just press buttons and see what's happening some pressing buttons and dumping at the same time because of this we don't pronounce some dumping always information from to compare what's happening in random with stable 1 what's changing some to see evening and get a better picture of happening so a lot of great dynamic data as things are happening as men user coming up and down so we get to we get this which was undeceiving numerable John's been analyzing those information for so long uses comes in point this in France what that was definitely a command or is this kind of you get that is there so this is
our command control structure of UST are you can specify the climate system and the size of the image you want to display are you what which quality you want and and then you can also compress the image and you know expanded in the West itself and
so this is an interesting works on the OCM on stocks to be always the sends commands and speed our controls such as informed forms of 2 there like 3 or 4 structures you send out to the main gene and that that's how we fixed on transfer and display image and this this is a candidate if you if you passed this you will be able to display our thinking box and get epilepsy or something but that's a bit too would
be eyes which are required are which is an as yet and lead to which you can leave waters and the always as France and the right EVI and that's what
happens when there were getting better at doing this look it's getting cute here rate still blinking when you want it's so
you it yeah blinking fast in our genome-wide is a going faster than before but I don't know what
a quick of I was of no points but it it's really grows if you look at it this does make notches so you see this I'm able to like move the command box now and I was really happy and those weeks of work within a week of work and we can think what's this is from the cells in the
OK so we have 1 2 down the all we need to know is the count of that like form of picture you know what is the color of packet data were done with the display whatever we want so we
fill the buffer worth incrementing values are like 0 1 2 3 and then you know we got that which is that no expected right because they were expecting you know maybe like very slightly different colors because removing you know 1 bite at a time to you 1 bit really that's no haven't base so we looked at that relate and the way we
understand the size that these were scientists so we took a microscope I would put it right in the
model I wouldn't display by will look away example comes out a pixel and we're figures 1 hour a week the called that color and the comma in there which 1 do it for and have a finite book yeah exactly that's also another layer of R and the other 1 on it's not as can be seen both grows
and then so I've never seen this before that that's really cool because Eulalie saying that are array which is dot the g in the beta labels 3 things is a single pixel cell OK and know the value we put up there is always 3 3 0 3 3 3 3 3 3 3 so same colors and patterns and know it's we now we give each each individual RGB like RGB value through this all microscope and that's well we got so instead of
the same value was cellulases you 3 3 0 0 3 3 0 0 and a and this is what we got here on the on the microscope so for 1 super amazing thing on that would run a demo on you when is the answers question right k how many bits per pixel is it the word and 6 now yet so we were putting in the word 3 3 0 0 3 3 0 0 0 on getting this thing on the string 24 % of its who added to for it I can you actually don't
for this but it's a but I thought I can nominal would you do regret that 32 bits right there is a bit odd that there's a bit green and a bit linear but so how can you encode using 4 but obviously like you have to use some kind of comic of able and we went through the documentation that's what we use but this is that so you get access to the full system you get access to 16 arbitrary tatoeba college so you can display any color of your choice 16 guy lavatories rate and Anzio we found out in later that it is the transparency and so where is the column a
bit logical and what we found is that when you go have
16 colors but each color is actually 32 bit the right so you can do all the colors you want to is limited by the number of colors you can use any image going right so
called you know let's find a color look-up tables modifiability we can change the colors they and then orally or how we do that and
the inference of the of course I'm obsessed or so it seems so just but this point we we found out there an excellent external as the RAM which is like more data dumps and perfected the the procedure and now we can dump all 128 megabytes of external as the Rams trying to see what's in there for you find images were from find more mn and we continue will continue to work with they're the that the OCM from with mapping STEM so that it's also it's sex right so we will also work really hard all you're doing this obviously the way so this 1 for a long time In like 2 days later we all find
we're looking for I squared is and then it
turns out it's exactly the same OK so it's the same as the how the command goes from those him processor to those the so basically there's a color look-up table that sits inside all cm from 1 a function loads it sets of a DMA engine and the 40 images inside the full parser and it puts it into that's sermon at the DOA the page set deposit and does magic right so this is world
1 OK like we actually will do frame with former on management the loaded and displayed put where we want so we made this whole unicorn and that it's a rainbow has a title as locks that comes out of it because now we can do as many as a lot as we like and put it anywhere we want and that's why this year magic come in all this work for just making a unique on fire but with locks for crypto it's good OK so at this point you know I'm very
happy I'm not worrying raised flagrant later Friday nite they I go John and the the that's a lot 16 colors to those look great you know the the colors and so high on it's really have have but we when we look
around and we saw that daddy high would that support the we but public so but we
like instead of finding this I found a peak was so a bit thread that allows it happens 16 1256 scholars suggest deftly enough for that you and that is a that I found out how to put break points and the chip and then begin to dynamic analysis and figure out like how with every call is working and so you
can answer Newport batch so if you would have found this before it is of like a 1 enactment work it would have been only a week maximum we found this little lower 95 % that 1 is work right and if we use this from day 1 it would have been the soul of much less this is we have to scroll through all the pages menus not PDO so loads slowly 1 page of times and you have to give them equal to downloaded the is literally all the colors something terrible used that race early had tabulate breakpoint
following with the notes that working very it
so because I don't drink so just keep working with the someone workers I get some interns images keep we just keep working at until we figure out pretty much everything except for the 256 colors but that'll come and this point yeah and dumping more and more and to the point where we actually can put in AGI together and get something working so we have all the stuff the organ show and so more into this sleepy begins Callen and so some of the screen and everyone knew that so they get it to load image put it to a different place we have a really call them and talk about until later but match is literally the next like we
found is really amazing treasure OK so somewhere deep in the code addresses vertical crack pixels rate and you know the hard hammer expectation was that those job is to put pixels on the screen to overlay menus and whatever but apparently it can also see every pixel to like why has the power I don't really know what's cool fact it's their means you can have a piece of software that will to the string and also manipulate the so use imagination and maybe you can track where things are the screen and change them dynamically who knows and so in the end in review
right we were able to change every pixel we can see every place on the screen and uh this is uh the thing which we did call fund had I don't really have much time to actually at the level of it and so the idea of and had is to take the
software and use the the very ubiquitous harbor find all these embedded devices in order to turn those devices into data transmitted they rated transporters and in this case we adapted from Sparse Code trilogy BIO with a longer tracer along the table on the board which was long enough for us to transmit something probably a few meters away so probably outside this rooms and then saw flipping just a single GPL and and you know this is gonna call because this is building off of the markers stuff he did right from the Vedic freaking to you don't then freaking LCDs and here we now have the power to compute on the data on the screen and then use going itself actively transmit not just the raw content of the screen with the computer metadata defined on the screen and over here is a cheap TV antenna that's an internal rate at were transmitting somewhere like 16 megahertz rate uh subtlety and that's that code is also you in the and get OK so and of talk were going to so I don't Bryan Russell led them oscillate gently this is what
Greek would society we'll get there was from so the poster back at the we call of it it's a very special about our College Chapel back but if you if you remember it all from presentation that is in the amount of concern and Chickie ahead and so I'm to the promise we deem promising made promise a we would use this for the devil ahead its sorry and but how I should also explain that the use the armory rate of with all over POC go it's busy running Linux and it's just doing all that use the traffic that we were talking about before so if you want if you upon if you want a random guy and I just want move watching you can use our API downloaded on get out and you are getting this better also we can get rid of him half the users they have this that's creative commons whatever it's not let me let me give us a packets that's right the 2nd 1 it the so that means go and get a very informative this for a discussion that side well
so that's a nice demo excited I have to this
if the so as we all know about
this if this website but it has it is very informative as I have learned all these years our but it is missing it is it is always miss 1 thing which is less than a given it that led John do every day you go it In the years yes I did did everything you think you know what I wanna see everything's OK that's OK the very little of the last last demo the big you know so this is a little
less this so this is just a screenshot of you you know there's no factory behind this thing but have you know maybe there's a familiar this is with your typical HMI human machine interface will look like as a graphical interface to something like and thus a process thing right you have computers controlling uniflorous obtains involve and that all reporting that growth and status and generally speaking you green is good and red is bad right and you know when you have a red light on a big tanker whatever you know its promise unusual into people probably freak out so just look at the screen and K was who haven't done to see if the pattern there you go right so instead of going after the nationwide that the PLC is the network you know what if you wanted to influence human behavior just on the monitor good luck tracking that count rate I and URIs rate so that's so that's heard demos only have 1 moment at for all bonuses refinements are proof of concept we just put it in the are as follows located on demands obedience we go wrong the 1st time consuming the amusement we're probably uses of was just whichever comes 1st opaque so you know let's talk a little bit about the implications of this thing I know how big is the problem OK so we actually had some folks look into the business and of this and we estimate that the over last 10 years that we've made over billion monitors trade and I would guess by by a large majority the monitors that we have work in some ways very similar to this dominant in the sense that hasn't always the controller and you could put a menu thing on the screen and runs software rate that drives that system so yeah pretty much everywhere models probably vulnerable to this or some variant of this day very and that's a problem and you know how practical is this attack for your uh help radicals attacks of of vectors so if you notice that the way we did this had we had to physically plug in a USB cable rate and that's how the use speech ITC interface work but i and keep in mind the 1 the DDC to in the DTC commands were originally designed to do the go back over all the data channels including VGA nation in my uh so there's always a possibility that that commenting go through that the channel and also gray as soon as you have access to the ITC but even if he didn't have a legitimate you know we bridge they got you there were however you got how we get there as long as you and ITC bison you working with something similar to this right you should be able to you know do something like what we've done here and he noticed a very modern the very new 34 inch curve monitor with the USP to ITC solution right I mean that tells me that maybe that the board is not exact the same in the former versions of different but they were so using this methodology of you know getting some bridge to touch ITC in order the parties answering controllers to do something like a from a of the and uh so the user beware how realistic will be if with the fixed the if there was a fixed and know I thought this 1 through a little bit rate so in order to fix this thing you either have to do something like a physical recall of the billing models which they're happening or you have to release the suffer update to fix the issue which means probably you have to do something similar to our you know our path rate or you have the release the former update process right to all the users of the world which will actually help the adversary the back as fashion helps a good that's great because you know the reason why we can do this and 104 models states is we have a higher monitors but if you release the the way uniform from wrote that is done and everything then that's probably not good so the way we fix it is when the slightly tricky and and uh we haven't
put the code up and get out of the word in nebulae were actually do it today that's supposed to be a link the we're will definitely and and uh this is like no Francis that all of the code that we we came up with all the code that you ran demo and a lot of documentation of the API as we found new ways of using graph pixel ways of displaying images in our ways of doing front and stuff and you know so let's great please contribute if you if you like this work you know take apart your monitor take part in France monitors theory see was society this year this is 1 set of data points and obviously there's thousands of different manufacturers for monitors and poly tens of thousands of different from word versions bubble plot that you know if we started getting more data points you would probably get a better idea you know how widespread this type of attack can be and then you know lastly really were now and during that time you know where we probably have to download the pesos coming out of a screening test is yet another secured from where the worry about rate and that's not great so you know if we can come together and try to fix this problem and some tangible way that of the most excellent so in conclusion greater happiness the story we spotted owl and as of
yesterday Dell has not released the security their to fix the shark attack so that's so gonna happen and many
monitors were harmed in the making of this presentation and uh but the bed that the
happy ending is the Chris now lives happily with this set my unmodified 34 inch mile uh so you got our no that's not dead so that's it are there questions the yes the the yeah the old old high that the yeah thanks so the chair that have we never met so it is made up of words that have to be in the 1st edition how much alcohol was consumed during you know on january think it's cool and how much of it was consumed the the making this presentation 25 bottles of wine out of its I would say that you want but they will you know they clearly got the Japanese so the and 2nd that he mentions that you have to use me about the deal control accusing Desert Eagle Cottle tool to talk directly in the D G C R so that's the next thing that we will look to any started to look at a a clear now we we Newton's sufficient so last year that's a big over the western great and I like a city in any prefer on a monitor that gets you on ITC bison there what we do it rate will probably be able to get you to the this call it any other questions this trend yeah the reader min program have the