park this - hack in the box security conference · the m5 costs $485-$515 retail, per online...
TRANSCRIPT
![Page 1: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/1.jpg)
Park ThisYet Another Parking Meter Talk
![Page 2: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/2.jpg)
Who’s Paul Moreno?
● EMEA Security Engineering Lead for Uber BV
● Advisory Board Member for Bugcrowd and Nanosec
● Former Head of Security for Pinterest
● Sound to Light Artist and likes long walks on the beach etc.
![Page 3: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/3.jpg)
What?
![Page 4: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/4.jpg)
Electron Microscope!?
![Page 5: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/5.jpg)
![Page 6: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/6.jpg)
● IPS Group Inc.
● The hardware
○ Capabilities
○ Identified chips and bits
○ Funny business
● What’s next…
![Page 7: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/7.jpg)
IPS Group Inc.
● Based in Sunny San Diego
● Founded in 1994
● Private, venture backed ~$2.8m
● PCI Level 1 certified
● No CSO?
Not to be confused with The IPS Group, Group IPS, IPS Group BV, IPS
Group Limited, or I-P-S Group
![Page 8: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/8.jpg)
IPS Group Inc.
![Page 9: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/9.jpg)
IPS Group Inc.
![Page 10: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/10.jpg)
The
M5
![Page 11: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/11.jpg)
The M5
● Costs $485-$515 retail, per online proposals
● $5.75 per month in license and wireless fee’s
● $.08 per credit card transaction
● Takes your money… via coins, chip cards, smart cards, NFC?
“Cloud” managed WCGW?
![Page 12: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/12.jpg)
The M5
● Costs $485-$515 retail, per online proposals
● $5.75 per month in license and wireless fee’s
● $.08 per credit card transaction
● Takes your money… via coins, chip cards, smart cards, NFC?
“Cloud” managed WCGW?
Made in San Diego?
![Page 13: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/13.jpg)
Parky McParkface
![Page 14: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/14.jpg)
Parky McParkface Teardown
● Main Processing Board
● Modem / Solar Panel
● Display / Reader Assembly
Also...
● Coin Validator
● Other parts: Batteries, antennas, LEDs, buttons and shit
![Page 15: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/15.jpg)
Parky McParkface Teardown
● Main Processing Board
![Page 16: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/16.jpg)
Parky McParkface Teardown
● Main Processing Board
● Rechargeable battery
● RFID chip, TRF7960
● 2.4gmhz LAIRD wireless chip
(not enabled)
● I2C, other ports
● Mixed Signal Controller
![Page 17: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/17.jpg)
Parky McParkface Teardown
● Main Processing Board
Texas Instruments M430F5438A
● Ultra low voltage
● JTAG interface
● Hella UARTS
![Page 18: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/18.jpg)
Parky McParkface Teardown
● Modem / Solar Panel
![Page 19: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/19.jpg)
Parky McParkface Teardown
● Modem / Solar Panel
Telit CE910-DUAL
● CDMA / 1xRTT
● Verizon Networks
● USB Port?
![Page 20: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/20.jpg)
Parky McParkface Teardown
● Display / Reader Assembly
![Page 21: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/21.jpg)
Parky McParkface Teardown
● Coin Validator
![Page 22: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/22.jpg)
Parky McParkface Teardown
● Other parts: Batteries, antennas, LEDs, buttons and shit
![Page 23: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/23.jpg)
Parky McParkface Teardown
● Rechargeable battery?
![Page 24: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/24.jpg)
Parky McParkface Teardown
● Rechargeable battery?
Lithium Thionyl Chloride (Li-SOCl2)
Not rechargeable…
Found online for ~$1 a piece in
quantity possibly less in mass
![Page 25: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/25.jpg)
What’s Next?
● Attempt to read the firmware off the FPGA
● Get it back online, using a Samsung Network Extender
● Take a look at the modem AT Commands
● Replace firmware
Free Parking?
![Page 26: Park This - Hack In The Box Security Conference · The M5 Costs $485-$515 retail, per online proposals $5.75 per month in license and wireless fee’s $.08 per credit card transaction](https://reader036.vdocument.in/reader036/viewer/2022070711/5ec99cd27bca3b712d021eb6/html5/thumbnails/26.jpg)
Thank You