leo.blog();

Hey everyone, I have been staying at a hotel for a while. It’s one of those modern ones with smart TVs and other connected goodies. I got curious and opened Wireshark, as any tinkerer would do.

I was very surprised to see a huge amount of UDP traffic on port 2046. I looked it up but the results were far from useful. This wasn’t a standard port, so I would have to figure it out manually.

At first, I suspected that the data might be a television stream for the TVs, but the packet length seemed too small, even for a single video frame.

This article is also available in French.

Grabbing the data

The UDP packets weren’t sent to my IP and I wasn’t doing ARP spoofing, so these packets were sent to everyone. Upon closer inspection, I found out that these were Multicast packets. This basically means that the packets are sent once and received by multiple devices simultaneously. Another thing I noticed was the fact that all of those packets were the same length (634 bytes).

I decided to write a Python script to save and analyze this data. First of all, here’s the code I used to receive Multicast packets. In the following code, 234.0.0.2 is the IP I got from Wireshark.

import socket
import struct

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(('', 2046))

mreq = struct.pack("4sl", socket.inet_aton("234.0.0.2"), socket.INADDR_ANY)
s.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

while True:
data = s.recv(2048)
print(data)

On top of this, I also used binascii to convert this to hex in order make reading the bytes easier. After watching thousands of these packets scroll through the console, I noticed that the first ~15 bytes were the same. These bytes probably indicate the protocol and the packet/command ID but I only received the same one so I couldn’t investigate those.

Audio is so LAME

It also took me an embarrassingly long time to see the string LAME3.91UUUUUUU at the end of the packets. I suspected this was MPEG compressed audio data, but saving one packet as test.mp3 failed to played with mplayer and the file utility only identified this as test.mp3: data. There was obviously data in this packet and file should know when it sees MPEG Audio data, so I decided to write another Python script to save the packet data with offsets. This way it would save the file test1 skipping 1 byte from the packet, test2 skipping 2 bytes and so on. Here’s the code I used and the result.

data = s.recv(2048)
for i in range(25):
open("test{}".format(i), "wb+").write(data[i:])

After this, I ran file test* and voilà! Now we know we have to skip 8 bytes to get to the MPEG Audio data.

$ file test*
test0:    data
test1:    UNIF v-16624417 format NES ROM image
test10:   UNIF v-763093498 format NES ROM image
test11:   UNIF v-1093499874 format NES ROM image
test12:   data
test13:   TTComp archive, binary, 4K dictionary
test14:   data
test15:   data
test16:   UNIF v-1939734368 format NES ROM image
test17:   UNIF v-1198759424 format NES ROM image
test18:   UNIF v-256340894 format NES ROM image
test19:   UNIF v-839862132 format NES ROM image
test2:    UNIF v-67173804 format NES ROM image
test20:   data
test21:   data
test22:   data
test23:   DOS executable (COM, 0x8C-variant)
test24:   COM executable for DOS
test3:    UNIF v-1325662462 format NES ROM image
test4:    data
test5:    data
test6:    data
test7:    data
test8:    MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo
test9:    UNIF v-2078407168 format NES ROM image

while True:
data = s.recv(2048)
sys.stdout.buffer.write(data[8:])

Now all we need to do is continuously read packets, skip the first 8 bytes, write them to a file and it should play perfectly.

But what was this audio? Was this a sneakily placed bug that listened to me? Was it something related to the smart TVs in my room? Something related to the hotel systems? Only one way to find out.

$ python3 listen_2046.py > test.mp3
* wait a little to get a recording *
^C

$ mplayer test.mp3
MPlayer (C) 2000-2016 MPlayer Team
224 audio & 451 video codecs

Playing test.mp3.
libavformat version 57.25.100 (external)
Audio only file format detected.
=====
Starting playback...
A:   3.9 (03.8) of 13.0 (13.0)  0.7%

The Revelation/Disappointment

What the hell? I can’t believe I spent time for this. It’s just elevator music. It is played in the hotel corridors around the elevators. Oh well, at least I can listen to it from my room now.

Leave a Comment

Comments

Guest on 2023-03-02 19:54:41

Spam probability: 0.00%

You can use `binwalk’ to search for file signatures (not quite the same ones as libmagic, but similar ones) at any offset in the file. As an upside, it also detects things like copyright strings and other helpful stuff.

Cheerio on 2023-02-28 14:23:39

Spam probability: 0.00%

Nice! Question: was the TV connected to an interface on your laptop as a proxy? Else how did you know about the multicast packets?

C on 2023-02-28 14:03:35

Spam probability: 0.00%

What made you think to try an offset? Is that a common way these files are formatted?

Guest on 2023-02-25 12:07:12

Spam probability: 1.50%

RESPONDING TO: or interjections of mysterious, echoed "voices from the past" at various intervals...Is there somebody there?...What are you doing?...This can’t be real...the sound of a watermelon being smashed...reverbed laughter...a quiet child’s voice... CREATE A TOOL TO SPOOF THE MULTICAST. BE SPOOKED COMPLAIN DEMAND A REFUND!

noone on 2023-02-25 10:38:44

Spam probability: 0.00%

as it was UDP protocol, that would be interesting if you did the source spoofing for some fun

Guest on 2023-02-25 03:55:37

Spam probability: 0.11%

now the immediate question i get is can you transmit your own packets and change what music plays?

Hotel Guest on 2023-02-24 22:35:32

Spam probability: 0.05%

Nice one. Made me laugh!

Vince on 2023-02-24 21:14:48

Spam probability: 0.32%

What a great article. Love the writing style and the digestible deep dive into reversing.

JW on 2023-02-24 19:24:30

Spam probability: 0.65%

Sir, this is really inspirational.

Yomom on 2023-02-24 17:04:42

Spam probability: 0.03%

Lol all for the elevator music. Was thinki g smart TV was snooping on everyone

Guest on 2023-02-24 16:52:19

Spam probability: 1.86%

Legend.

yo ss ef on 2023-02-24 14:14:02

Spam probability: 0.15%

I liked this article

Guest on 2023-02-24 13:30:26

Spam probability: 0.98%

Well done and very entertaining. A good read and learn.

Andrea on 2023-02-24 10:25:43

Spam probability: 9.40%

as most things in life what seems mysterious it’s usually pretty disappointing. Love this article!

Jesper Bylund on 2023-02-24 07:45:23

Spam probability: 0.10%

You sir, are an inspiration!

Adrian on 2023-02-24 07:33:57

Spam probability: 0.00%

This is great!

**Phoneguy ** on 2023-02-24 07:14:28

Spam probability: 0.04%

Music on hold / elevator music is usually sent as multicast hence why you and the elevator speaker is getting it.

kino on 2023-02-24 06:12:43

Spam probability: 0.04%

Would have been even funnier if one of the songs was Rick Astley’s "Never Gonna Give You Up".

Tldr’er on 2023-02-24 05:52:27

Spam probability: 0.01%

How long all this took?

Person #3686426 on 2023-02-24 04:33:47

Spam probability: 0.02%

I’m respectfully adding a vote for you posting that sweet elevator music file.

YM on 2023-02-24 03:51:19

Spam probability: 0.55%

Like it

Guest on 2023-02-24 03:41:23

Spam probability: 0.01%

I wonder if you could broadcast your own music on the same port?

Why-offset on 2023-02-24 02:06:26

Spam probability: 0.00%

What made you think to save the data with offsets? Is that representative of the total time of the elevator music?

**big man ** on 2023-02-24 01:09:22

Spam probability: 0.98%

really interesting article

Guest on 2023-02-23 22:35:19

Spam probability: 0.13%

Time to start streaming some black metal into the elevators.

lurker on 2023-02-23 22:20:20

Spam probability: 0.02%

So glad there is evidence that I’m not the only one who would have gone down this rabbit hole!

Tux on 2023-02-23 22:06:43

Spam probability: 1.22%

Gold! Thanks for the write up, and the ride.

**Resetnos ** on 2023-02-23 21:18:05

Spam probability: 8.96%

Appreciated this article wanted to say Thank you for sharing.

Guest on 2023-02-23 21:15:34

Spam probability: 0.02%

Next step: Send out some mp3’s with the same format to the same multicast address. Kick that hotel party up a notch.

SDWAN nerd on 2023-02-23 20:57:08

Spam probability: 0.29%

Multicast is cool :)

Guest on 2023-02-23 20:51:10

Spam probability: 1.05%

...or interjections of mysterious, echoed "voices from the past" at various intervals...Is there somebody there?...What are you doing?...This can’t be real...the sound of a watermelon being smashed...reverbed laughter...a quiet child’s voice... Could be lots of fun

Guest on 2023-02-23 20:42:00

Spam probability: 0.69%

love it! nicely done

ilya on 2023-02-23 20:18:37

Spam probability: 0.05%

elevator music or how ghosts communicate?

kjkent on 2023-02-23 19:46:58

Spam probability: 0.09%

Looks like you missed out on a lot of free NES ROMs there!

Stephan on 2023-02-23 18:58:54

Spam probability: 0.96%

For those asking for a link for the elevator music: https://www.youtube.com/watch?v=xNjyG8S4_kI

JR on 2023-02-23 18:22:43

Spam probability: 0.00%

Nice. Who would have thought? I wouldn’t have expected that you could reconstitute the mp3 by stripping N bytes and concatenating the rest. Maybe someday I’ll find a use for that. Thanks.

reptoid clone of john wayne and elvis on 2023-02-23 17:25:41

Spam probability: 0.34%

now who woulda thought that they’d do it that way haha now spoof it ;)

Guest on 2023-02-23 17:13:59

Spam probability: 0.68%

Hilarious Good job

I am a guest on 2023-02-23 17:13:50

Spam probability: 0.16%

please now post the elevator’s music you dumped

I am a guest on 2023-02-23 17:12:38

Spam probability: 0.29%

I absolutly LOVE this kind of article! A mistery, a sharp mindad and a laptop.

am I spam? on 2023-02-23 15:45:02

Spam probability: 10.47%

I want to buy this c0de for the elevator to enlarge arsenal of things. This is not sp4m. once in a lifetime opportunity.

stav_and_nick on 2023-02-23 15:32:53

Spam probability: 0.23%

As someone who worked in hotels for years: you’d cry if you knew how vulnerable most are, even the big expensive ones On the other hand: management is barely competent enough to run the business of selling rooms to people, so concerns about us spying on you is also funny to read.

SHCreeper on 2023-02-23 15:20:58

Spam probability: 0.40%

I love the abrupt end to the story. It’s a short read, so I can really recommend it to every one who wants a 3 minutes break from their doom scrolling.

Jan on 2021-05-30 09:30:53

Spam probability: 0.00%

Interesting read, do you happen to have a capture (PCAP, plain blob etc) of the stream?

Guest on 2021-04-02 06:09:13

Spam probability: 0.21%

The suspense was killing me throughout. Funny ending, nice writeup.

Anonymous Coward on 2021-04-01 20:45:14

Spam probability: 0.05%

So..... what would happen if you did ARP spoofing to silence the actual source, and multicasted something else? I’m not going to suggest you multicast audio from an adult movie, but it is the 1st of April after all.......

b1tninja on 2021-04-01 18:09:34

Spam probability: 0.01%

What you should have thought next was, hey holy shit, the elevator listens to udp rtsp stream? And I have the multicast group

Guest on 2021-04-01 16:51:51

Spam probability: 0.02%

Oh man, all that effort for elevator music. Beautiful. <3 Thanks for the chuckle.

admin on 2021-04-01 14:30:31

Spam probability: 0.02%

Thanks for the report @Guest, I fixed the errors that were reported on this page. It should validate cleanly now, unless anything got cached along the way.

Zombielinux on 2021-04-01 13:57:10

Spam probability: 0.00%

Now I’m curious as to what hardware they’re running to catch the stream.

Guest on 2021-04-01 13:13:27

Spam probability: 0.14%

For the future, why not use tail to not need to save the file offsets out? `tail –bytes=+8 test.mp3 | file -` You can use a sh FOR loop as well

Guest on 2021-04-01 12:54:12

Spam probability: 0.13%

Just commenting en-passant to notify that no, it’s not actually valid HTML. (but I CBA with an email for that)

jimmy on 2021-04-01 12:33:29

Spam probability: 0.02%

I was kinda hoping to get a link to an mp3 file so I could listen as well.

utahcon on 2021-04-01 12:20:23

Spam probability: 0.02%

great read, this was useful in understanding a bit of the RE mentality. Thanks! Enjoy your muzak!

SmallProject on 2021-04-01 12:08:59

Spam probability: 0.00%

So... can you control the audio the hotel plays? Lots of fun potential if so

Dude on 2021-04-01 12:07:24

Spam probability: 0.01%

But now you probably can broadcast your own music to elevator!

Cam on 2019-06-10 20:52:02

Spam probability: 0.09%

Good read, thanks!

iTacoTaco on 2019-06-05 20:38:41

Spam probability: 0.08%

On the bright side, now you can host a party in your room except it only plays elevator music.

haha on 2018-11-02 20:50:52

Spam probability: 0.03%

was fun to read. but still idk why they streaming lame music to all folks in their network xD

cakeisnolie1 on 2016-05-25 23:49:28

Spam probability: 0.00%

I’m a fan. Particularly the save same file with incremented offsets bit. That’s a good simple trick I may reuse someday to decode common formats wrapped in uncommon headers.

BriansRottingCorpse on 2016-05-22 03:34:43

Spam probability: 0.01%

I love that you wrote this, others may have quit once they realized it was elevator music.

agreenbhm on 2016-05-21 14:38:36

Spam probability: 0.00%

I suppose that makes sense, rather than using unicast for the music. The question remains though why the hell those audio systems were on the public wifi network. I wonder if the actual elevator controls, CCTV, etc are also on the same network.