Thursday, November 15, 2007

Hotel TVs and stupid security controls

A quickie while I'm still logged on:

Ever come across a web application that only performs input validation via JavaScript? It'll pop up and stop you from submitting a form with illegal characters, but it's obviously just a client-side control, and therefore trivial to bypass using a proxy tool like Paros or Burp. Stupid, but I guess it stops the dumbest of script kiddies.

Earlier this week, I decided to plug my iPod into my hotel TV's A/V input jacks so I could watch a movie on the larger screen. No-brainer, right? They even have the inputs on the front to make it really easy. Then I noticed that I couldn't change video inputs on the stupid thing - no buttons on the remote, no menus, nothing. That's because instead of a normal remote, the TV had a special one programmed for the OnCommand pay-per-view service, and they conveniently left out the input selection function.

The OnCommand unit is a small box that sits in-line between the coax cable running from the wall to the TV. It has a RJ-11 cable that plugs into the television and intercepts the IR signals from the special remote, allowing you to control and purchase "premium content". I did some research and found that a few people have messed with these older hotel PPV systems; in fact, there's an article from 2005 in Wired about how easily they can be hacked. Basically, you can do plenty if you have a USB TV tuner (and/or an expensive, commercial "master remote" that the hotels use to program these things).

The basic premise is that the PPV movies are broadcast in the clear over regular channels, but until you pay for them the OnCommand box prevents your remote and TV from tuning to them. In other words, if you can bypass the IR control you can tune to whatever you want. It's "fake" security, just like the JavaScript input validation. (That was a hell of a long way to go for a bad analogy).

I didn't care about free PPV, I don't want to steal anything - I just wanted to enable the damn video jacks. Acting on a stupid impulse, I bought an $8 universal remote and programmed in the codes for the TV's manufacturer. With a press of the "menu" button I had access to all of the TV settings, including adjusting the tuning and channel locks, and most importantly, switching video inputs. It was that easy.

What a stupid design - just let people use the damn inputs, you'll still sell plenty of porn. In the meantime, I guess I'll always pack this universal remote when I travel. Wow, what a nerd I am.