- Okay, looks like we're up and running.
Hi everybody, welcome.
Hi DEFCON, hi DEFCON 29.
Thanks for everybody tuning in from wherever you are.
Hopefully next year we get to all do this in person.
Here we are.
So hi guys, my name's Richard.
We'll get to that in a second.
This is my talk on barcodes and Old McDonald had a barcode,
E-I-E-I CAR.
I have to apologize for me looking back and forth.
I have two monitors and my slides are on another one.
So who am I? My name is Richard Henderson.
I'm a ham radio nerd. I'm an electronics dork.
I write for a living a lot, I'm a InfoSec professional.
I currently work as a CSO.
I've trained at DEFCON multiple years in the past.
I've gone 25, 26, 27,
DEFCON China Beta One.
I've run the Ham Radio Fox Hunt Contest at DEFCON
for a few years.
Did not run it this year,
didn't know what was going to happen.
So,
it'll be back next year, I hope.
And richsentme is how you can find me on
Twitter and LinkedIn.
So feel free to connect.
So,
let's talk here for a second.
What would happen if you built a system that was designed to
take inputs from barcodes that
didn't do any sort of input validation.
What sort of hi-jinks could you get up to?
Could you crash a system with nothing more than just
a simple string of text?
You sure can.
We'll come back to this screenshot multiple times
during the talk and we'll explain what it is we're seeing.
The bottom line is yes,
there are a lot of systems out there that
through nothing more than presenting in a string of text,
we'll make it fall over crash, reboot, denial of service.
So let's talk about the EICAR string.
The EICAR string is kind of the key here.
Although we'll get to other strings that
might cause mischief later.
But in this case, we're talking specifically about EICAR.
So what is the EICAR string?
That's the EICAR string.
It's a substantially long enough, random piece of text
that
with enough randomness in it
that you wouldn't find it just by chance.
So you know that if you see this string of text,
you are looking at the EICAR string.
So who created it?
What's it used for? How does it work?
In a nutshell, the EICAR test file was created by the
European Institute for Computer Antivirus Research,
EICAR.
And it's a method to test the functionality and
the ability of antivirus engines to actually function.
So it's used by pretty much every antivirus company or
tech company that incorporates
some sort of antivirus technology into their product.
So think like firewalls, email security appliances,
things like that.
And they use it to make sure their AV engines are working.
Well, why would they do that?
Well, when you're working with malware,
you want to avoid using real malicious malware samples
whenever possible.
Unless you have to work with something really malicious.
And the reason for that is imagine if you were just trying
to test your firewall to see
if it could detect a piece of malware
as it moved past the firewall, but it failed.
And you decided you'd use the latest and greatest
piece of ransomware that you found online.
When that ransomware escaped through the network and started
infecting other machines, that'd be pretty bad, right?
So EICAR came about as a way to safely test antivirus.
Create a text string,
which you can embed in another small file.
You can compress it, hide it,
and see if you're antivirus engine can detect it.
Think of it as a virus that the
general antivirus community has decided is a virus,
but doesn't have any malicious capabilities whatsoever.
Okay. QR codes.
Everybody's seen QR codes now, right, I would think.
Who created those? What are they used for
and how do they work?
So the "QR" in QR code means "quick response".
And it was created by the Japanese auto parts manufacturer,
DENSO, in the mid 1990s.
If you own a Japanese car,
your car is likely full of DENSO parts, oxygen sensors,
computers, things like that.
So why did they create it?
Well, there's a bunch of reasons, but the main reason is
you can simply just store a lot more information
in a QR code that you can in...
Do I have one around here somewhere?
Here we go.
Than in a
simple UPC card.
I'm not going to show you the whole UPC code because
that's got some sets of data on it.
And it's so like, you know, a standard UPC code,
you'd see on a box of cookies at the grocery store.
So,
what's inside a QR code?
So QR codes are really, really brilliant
when you look at them
and you start to dissect how they work.
So if you see 4.1. Position.
What that means... I'm pointing at the screen,
which I guess in a virtual talk, doesn't really do anything.
The position squares basically tell the scanning computer
how to orient the barcode.
You could see there's always those three position squares
and there's never a position square in the bottom right
of a barcode.
And that allows the computer to know that when
they're taking a picture of a QR code,
like this one right here,
it doesn't matter what way it's scanned.
The computer always knows that
this spot right here should be,
so this is mirrored, but it should be right there.
Alignment is really neat.
So alignment squares are used by the QR code to.
See, even though, if you present the barcode to it
like this on an angle,
it knows the alignment square right here is a square.
So it can create like those magic converging lines
we did an art school and high school,
in art class in high school.
To know that it can correct the image to make
everything square or square facing
the computer.
So what would happen if you put the two and two together?
You put the EICAR string on a QR code.
Well, you get something like this.
So again, I'm going to come back to this screenshot
in a couple of minutes and explain exactly what it is
we're looking at
and where this screenshot was taken.
But let's stop for a minute.
And we're going to talk about
where did this whole thing start?
Where did the idea of
turning EICAR into
a QR code come from?
So, special shout out to my friend on Twitter,
Rob Rosenberger,
who planted the seed in my head that there's probably a lot
of systems out there that could scan a QR code.
And a lot of them won't know what to do when they see the
EICAR string.
So in this case, if you look at the tweet here,
he put the EICAR string as a QR code on the side of his car,
I think on the front of his car as well,
with the idea of
maybe triggering antivirus response on
license plate scanners, toll booths, things like that.
But what was interesting is that the antivirus they had
running on his Android phone also triggered detection.
So we're gonna talk a little bit more about attack surfaces
in a couple minutes, but the idea here was to
get the code
picked up by cameras you might encounter
whenever you're driving around.
So like toll booth cameras, like automated toll booths,
automatic license plate reading cameras,
like the ones you see on top of police cars or
by law enforcement cars, municipal enforcement cars,
parking enforcement cars,
private parking lots is a good one.
So initially it was just a guess as to what might work and
without access to the actual system that scan the QR code.
If its scanned it, you probably won't know for sure
if it actually triggered something.
But it definitely does work.
I'm gonna share a couple video clips with you in a
couple of minutes to show you that it actually works.
So beyond a sticker on your car,
what else could you do with this?
So enter the embroidered
EICAR QR patch.
So what do you think might happen if you take the
EICAR text string with you, wherever you go?
Stick it on your backpack, put it on a hat,
stick it on your shirt, whatever.
In many cases you'd have to be
really, really close to the camera
to have it pick up the QR code,
but cameras are getting better all the time.
I mean, 4K cameras are not particularly expensive anymore.
I have one at the front of my house now,
cost a couple hundred bucks.
Go to Costco, Costco sells full 4K systems with dozens of,
well not dozens,
but a half dozen cameras for a few hundred bucks.
So cameras are getting better all the time,
and they're going to be able to pick these up,
even if you're not particularly close to the camera.
So.
Let's go to the next slide.
So devices that you think would need to read or
interpret a QR code absolutely can.
So this is a checkout terminal
for a very large, multinational retail/grocery chain
that I will not name.
Why would a checkout scanner that
should only need to scan a standard UPC code
that you find on like a box of cereal
need to read a QR code at all?
Well, this is clearly added functionality
provided to the retailer
by the checkout, machine checkout area manufacturer.
And it's probably built into the product during the
development phase.
You know, things like
they might want to add loyalty coupons,
purchase tracking, things like that.
And also, for example, they'll send you
a QR code coupon on your smartphone and you can scan it
and it can read it.
They build this into the product because they want to offer
all of this to all the customers
and not all the customers are gonna use it,
but they want it there just in case, right?
That's how things work with a lot of software today.
But what happened in this specific case?
So the code was scanned.
It correctly scanned the string.
Can you see my mouse? No, I guess you can't.
But if you look at the top left of the screenshot,
you can see that it clearly read the EICAR string from
the QR code.
And it just instantly returned this error.
So what happened after this was scanned?
So the checkout became unresponsive to all inputs.
Didn't matter what button you press, what you tried to scan,
what you tried to do.
It was totally unresponsive.
Even a manual intervention by the staff that are on site to
help you
check out,
really they're just there to stop you from stealing stuff.
But they came over. They couldn't make anything work.
They even said,
'We never seen anything like that before.'
And then the register eventually rebooted itself
after quite a long wait.
So I'll talk about more about,
what's probably happening behind the scenes in a minute,
but the reality is you could walk by a group of checkouts
and scan this and crash every single one.
And
no one would have any idea how to fix it
until it fixed itself.
Okay. So.
I'm gonna play a video.
This video is sent to me by a random friend,
cause I would never do anything stupid like this.
That would be really dumb.
This is a passport scanner at a port of entry,
some country, somewhere.
But many countries now offer you the ability
to pull up your smartphone,
fill out your customs form ahead of time.
And that app creates...
I don't think I have one available, let's see.
UI.
Yeah. It's not working. I'm sorry.
So,
they'll give you a QR code.
Basically, instead of getting those
old school paper customs forms
where you fill out where you went, what flight you were on,
what date you were gone, how much money you spent, you know,
do you have any drugs, all that usual stuff,
you just check off a bunch of boxes on a smartphone form.
And it gives you a QR code,
which the QR code contains the answers to
all your questions.
So what would happen if
you scanned one of those machines
with the EICAR string?
Let's see. And it's going to be hard to see.
So I'll walk through it here in a second, but let's.
- [Person From Video] Yeah.
- Stupid slides.
I'm gonna have to back up here for a second. Sorry guys.
Okay.
So I can't pause it and show you,
but basically what happened was that machine gave
a big fat red error message on the screen
and then froze completely
with just a total black screen.
So like I said,
I highly suggest you do not, do not try this at a border
cause believe it or not,
customs officers don't really like people screwing around
with machines at a port of entry.
So what happened here?
Don't know for sure.
But it did not like the input.
Was not expecting the input that it was hoping to get
and it froze the machine.
Did not cause, as far as I could tell, thankfully,
a general system outage across multiple terminals,
which would have been real bad.
You literally could walk over to the next machine
and scan your QR code there and it worked.
So what can we infer from that?
These terminals aren't super smart.
They limit the amount of information they send back to
a central database or central source,
which makes sense because its terminals are literally just
reading the questions you filled out on that form
and filling out the form for you via QR code.
But other systems are sending the interpreted QR code to
a centralized location for processing.
So let's watch a few minutes of video
and then we'll explain what happened here.
- [Person Recording] Thanks Richard.
Now we're stuck here because fucking Mike had to scan that
goddamn barcode.
He crashed the fucking machine.
It's fucked.
He scanned that fucking EICAR thing.
Now we're fucked.
Thanks Richard. Now we're stuck here because...
Minutes later.
- [Attendant Over Speaker] Sir, one moment.
- [Mike] Thank you.
- [Person Recording] Good job.
- [Mike] Are you recording a video?
- [Person Recording] Yes, I am. Good job.
- If they gave me the ticket back,
I could go to the other one.
- [Woman Recording] Yeah. Mr. Scan-it-on-fucking-everything.
- [Attendant Over Speaker] Is someone assisting you, sir?
- [Mike] No, there's nobody here.
I can use another machine,
but my ticket's in the machine, so.
- [Attendant Over Speaker] Okay, one moment, sir.
- [Mike] Okay, thank you.
- [Person Recording] Fuck me.
- So, so,
he got one of those tickets
from the parking garage when you go in and
then he stuck the EICAR QR code sticker on the ticket
and then inserted the ticket into the machine
and
the ticket wouldn't remove, nothing worked,
but there's still two more videos.
So let's keep watching.
- [Person Recording] 10 minutes later.
Still fucked.
- Hello hi there.
- [Attendant Over Speaker] Yes sir,
I am not able to reach anyone at this moment.
Can I get your first and last name?
- I'll just go to, there's a parking guy in the booth,
literally 20 feet behind me.
I'm just going to back up and go talk to him.
Like he's sitting there-
- [Attendant Over Speaker] Sir, if you want to do that.
- He's sitting there staring at me.
I don't know why he doesn't want to just come over.
- [Attendant Over Speaker] Well he should have came out
and help you, sir.
Long as he's sitting there.
- Yeah that would be nice,
but he's kind of an idiot apparently, so.
Anyway, I'll just back up and go see him.
- [Attendant Over Speaker] Okay sir, you can do that
or I can just open the gate and let you out.
I'll go talk to the guy.
Cause I mean-
- [Person Recording] Let's just open the gate then.
- If you can open the gate you can do that too, but I mean,
I haven't paid yet, so.
- [Attendant Over Speaker] If I can get
your name and number,
first and last name and a phone number.
- I'll just go to the guy back here. It's fine.
Don't worry about it.
- [Attendant Over Speaker] Okay.
- [Person Recording] Okay so, basically Mike crashed
the entire fucking payment system in
this entire fucking parking garage.
So no one can get out.
Apparently they can get in, but that's about it.
Fucked.
So the attendant's going up there to unlock the gate.
Go in front of this fucker.
Fucking hosed, bud.
Hosed.
Fucked up big time, buddy.
- [Mike] Yeah.
- Okay.
So what happened here?
What can we infer based on what we saw in those clips?
People are still able to get into the garage.
So clearly the ticket machines that print a parking ticket
on the way in don't require instant interactivity with
the database that's hosted somewhere else,
probably in a data center in some remote area.
And it makes sense if you think about it
because you don't want to slow the line down on the way in
if there's any sort of network congestion or delay,
the inbound machines likely just record
a timestamp of entry,
generate a unique bar code tied to that timestamp,
and then send it back to a database,
and set intervals every couple seconds,
couple minutes, who knows.
This would be great for areas that don't have the
greatest internet connectivity.
So like, you know,
parking terminal, think three levels down in a garage,
isn't going to have
the greatest network connectivity, right?
Or in some cases they're relying on cellular based links
and don't really want to waste bandwidth.
They want to save that for the exit phase,
which is what messed everything up.
So some people were able to exit
as you saw in the last clip,
but those were monthly parkers who had a different type
of pass card to exit.
So there's probably an entirely different system
that deals with that.
And if you look at the lot of parking machines that
have a separate reader for
monthly parkers to scan their badge.
So there's probably just a local file that cross references
unique IDs, tied to those ProxCards or
whatever ID card they use to get out.
And it looks for a match and that opens the gate.
But for people who had to pay to exit,
there was no way to get out.
The machines ate their tickets and gates wouldn't open.
So after that last video clip
my friends here talked to the the attendant.
And basically he said his PC wasn't working anymore.
He couldn't do anything.
He had to come out to manually open the gate.
He'd never seen anything like it.
So clearly what's happened is the QR string was transmitted
to some database somewhere else and it caused...
Do I have notes on that?
I don't.
Oh yeah.
So string got transmitted to
another computer somewhere else.
And whatever AV was running on that machine triggered
an antivirus alert and dropped it into a quarantine cycle
to clean the virus.
And the whole system went down.
They were in there 15, 20 minutes
trying to get out the garage.
And so were lots of other people.
So.
Oh, did it again.
I'm sorry.
So why does this attack work?
Well, pretty simply,
much like we've seen in the past decade or so with
industrial control systems and SCADA systems
where companies have just bolted on internet connectivity
to these devices with
very little or zero thought of
the security implications of doing so,
you know, they sell these to companies as
money saving measures.
You know, you don't have to send a repair person out to
some remote pumping station
because you can do it all remotely now
cause they're all connected to the internet.
They don't really spend very much time thinking out
people might be able to fuck with this stuff.
But the bigger part is that most of these smart machines are
all running Windows or Windows Embedded underneath.
So what does that mean?
So like, let's go back to a couple of
famous Windows Embedded malware attacks.
So Target and Home Depot are two of the most famous ones.
Attackers were able to design malware
specifically built to skim credit card numbers on those
Windows Embedded cash registers
and then exfiltrate all that data somewhere else.
I mean,
everybody knows,
What's the one of the first security measures
you put on a Windows machine?
You install antivirus, right?
So if your antivirus is just some typical out of the box,
antivirus commodity product.
And if you haven't done any customization
or any tuning of it,
which is often the case.
It should see the EICAR string think that it's being tested
and do exactly what it's supposed to do in order to show
that it's working properly.
And that's quarantine the system and clean it up.
So in most cases, an antivirus hits a quarantine cycle,
what does it do?
A lot of AV makes the system completely unresponsive,
makes it unavailable,
throws it into a reboot cycle to do like a low-level clean.
And this is what's happening here with a lot of these scans.
So.
Why are devices and systems scanning QR codes anyways,
when they should only be scanning like a UPC code?
Well,
there's lots of different barcode formats out there.
And I'll talk about that in a couple of minutes,
but
you don't always set the standard UPC code.
There's dozens of different types of barcode performance.
So they usually build in that type of functionality to be
able to cover all their bases, right.
So my gut tells me that most owners have no idea
that's even a thing on the systems they have,
and it's probably not easy to turn it off,
not without going back to the manufacturer and saying,
you know, we need to disable these types of
inputs scans.
Why would you even ask that?
You wouldn't even think to ask that question.
So, like I said earlier, you know,
added functionality by developer.
These companies want to be all things to all people.
So they just build it in and hide it from those people that
don't need it, but it's there if you need it.
So let's talk about attack surfaces.
What other things might you be able to scan
with the EICAR string?
So coupons, here's a carwash coupon,
A lot of newer or very modernized car washes,
the really cool ones with the neon lights
and the 16 colors of foam they spray on your car.
They have the ability to accept coupons
that you present to the payment machine.
And those coupons are often QR codes.
And why are they QR codes?
Because each QR code can be unique to
the person presenting it.
It's not like just a coupon code, right?
It allows them to track.
It allows the marketing people to track the effectiveness of
advertising campaigns, right?
So they know if this person used this coupon then
they'll probably do it again.
So you might want to offer them another,
but if someone else didn't use it,
then it may not be worth spending the resources on them.
So what happens if you scan the EICAR string there instead?
What else?
Price checking scanners.
Maybe, maybe not.
Really all depends what the scanner does with the data
and what the underlying system is.
So Target, for example.
Newer Targets,
the newest price code scanners at Target
are all Android based tablets.
Not like this one on the screen.
This is an older one,
but while the Target Android ones
can read the EICAR string
and you could see it if you go up and present it,
it'll actually interpret the string and
show it on the screen.
Nothing happens.
But other price code scanners?
Maybe.
So this is a discontinued older one that you'll see in a lot
of stores.
And you can see here
that
it's running Windows CE 5.0,
and it says right on the top,
'fast and intuitive barcode reading of
all linear and 2D barcodes.'
So linear barcode is just another way of saying like a
one dimensional barcode, like a UPC code.
And 2D means just that two dimensional barcodes
like a QR code.
And like I said, it's running Windows.
So many of the new ones.
You go back, you go to like a point of sale vendor,
people that provide these types of products
to small stores and stuff.
Most of them all transitioned over to Android,
but like we saw in Rob's tweet way back.
There's plenty of Android based antivirus products out there
that detect the EICAR string and will think there's a virus.
So what else?
Luggage tags.
Probably not.
All the luggage tags that I've seen in my travels
and the ones I can find online,
all use the 1D barcode format with
a short identifier strings.
Typically it's just two letters to signify the airline
and then a six digit
string of numbers to
uniquely identify that piece of baggage.
That doesn't mean there aren't systems behind the scenes
that can interpret a 2D barcode.
So,
if you stuck the EICAR strain to your suitcase,
who knows what would happen
and you probably never know what would happen
unless you can find a friend who works inside airport IT.
So if you're watching this talk and you work inside an
airport infrastructure, and you would like to try it out,
I would love to find out if it worked.
Feel free to let me know.
So the next one is my favorite.
Hard to see with the screenshot here, I know.
But,
automated license plate readers
on police cars and parking enforcement,
private parking lots, ALPR.
Most of the police cars, municipal enforcement,
private parking enforcement,
They all have Toughbooks in there cars.
You walk by these cars and see Toughbooks, right?
Most Toughbooks are always running Windows.
And if you look at the software,
I know it's really hard to see,
but you can see that this is running Windows.
The software that's provided by a very large company.
Obviously not going to name names,
but you can figure it out for yourself.
The company claims on its website,
that it works with all license plates.
No matter where they're from,
which means there's gotta be a lot of flexibility,
and leeway for how it's scanning things, right?
Because there's thousands of
different kinds of license plates,
different fonts, different spaces,
and different states and provinces, things like that.
So what if you stuck on EICAR sticker
next to the license plate and it picked it up?
It might.
I have another slide,
but I'm pretty sure I remember a story way back when someone
printed a SQL string on their hood in the UK
and it crashed the speeding ticket cameras.
Does that ring a bell, anybody?
It's ringing a bell for me.
But amazingly, I have yet to be able to find a parking
enforcement officer, a police officer,
who will actually let me actually try
to see if I can crash their system.
No matter how I phrase it or how nice I try to be,
no matter how I frame it around security research,
none of them are interested.
But what else?
QR codes are being much more prevalent
or much more used in things like big events, sporting games,
concerts, things like that.
So could you present the EICAR string to them as your ticket
and crash a central system?
It's very possible.
Hospitals.
Hospitals are likely very susceptible to this attack.
Lots of backend systems provided to hospitals
are Windows based.
I know this for a fact.
And I have someone close to me who works in healthcare IT
and deals with this kind of stuff all the time.
And their backend systems are all Windows based.
So here's like a patient bracelet with a type of QR code.
Here's for those of you with children,
when your a kid is born,
they put
a bracelet around the kid and a bracelet around you
just to track the baby through the hospital.
Make sure you leave with the right child.
Lots of QR codes on those ones.
So these are QR codes on blood transfusions
just to make sure
the right person gets the right blood and
follows the chain of custody of that blood as
it moves through the hospital.
So yeah, they should probably start looking for this.
Extending this attack.
So how do you want to make sure, if you're going to
test your own systems,
because this is the only time
you should be doing this, right guys?
There are, like I said earlier,
there are a lot of 2D barcode types out there.
So you should try and figure out which one
your target is using.
So here's EICAR as a Data Matrix QR code.
Here's the Aztec format.
You see this a lot on like Amazon packages, UPS boxes,
things like that.
That's the EICAR strain right there.
It doesn't look any different than any other one.
MaxiCode, you used to see on a lot of,
it was either UPS or FedEx a long time ago,
I think it was UPS.
I don't see that on their boxes anymore.
I really haven't been paying attention to UPS
and try not to use them.
MicroPDF417.
That's another barcode format
that you'll see in a lot of places.
There's the EICAR string there.
The Han Xin barcode format obviously is one
you probably don't see much here,
but you might see it overseas a lot.
You might see it on electronics components,
things like that that are manufactured overseas.
These are some of the ones that I was able to actually
encode the complete EICAR string into.
There are lots of other barcode formats out there,
but most of them will not take the EICAR string because
the character space is very limited.
In some cases it's just numeric,
in some cases it's just alphanumeric,
some cases it doesn't use the
extended Unicode character set.
So there was no asterixis, slashes or whatever.
So what I suggest you do is just go online and look for
a barcode generator.
There's some really good ones that will show all the dozens
of dozens of different barcode formats out there.
And you can put in whatever information you want.
There are some that are used
specifically for bank transfers,
where you put in account details
and a receiving bank, sending bank.
You could hide the EICAR string
in one of those pretty easily.
But beyond the EICAR string,
could you take some malicious JavaScript
and have a system parse it?
Or could you do something as simple as sending someone to
a malicious URL?
Yeah, QR code.
You sure can.
So this is from (indistinct) many years ago.
Where this is, if you interpret this QR code is just the,
the standard cross-site scripting
alert script
that you would write to test for
the existence of a cross-site
scripting attack.
So you could use this to try and maybe see if something is
vulnerable to a cross-site scripting overload.
There are cases of malicious QR codes being used in the past
in places like Russia,
to fool people into signing up for premium SMS scams.
So like $6 a message type scams,
that's happened in the past.
But what other systems might you be able to attack
beyond just like barcode scanners?
What would happen if you decided to encode the EICAR string
into an RFID tag?
Automatic teller machines often use Windows underneath.
Could you use the payWave/smart card?
You know, the little chip, proximity chip thing that
you're seeing in a lot of places
around the world just to quick, you know, tap and go,
could you code the string onto a chip and scan it into the
ATM or the data machine?
So I'm not going to try and find out,
but maybe someone else will,
who owns an ATM for experimentation will.
Railroads.
A lot of railroads have been using RFID tags on
cargo containers to track cargo movement and
have been doing it for decades.
I first learned about this more than 20 years ago
as I
was living in Toronto at the time.
And there was a main rail line going right by the house
I was living at.
And we would often go like, just watch the trains and stuff.
And there was a little hut.
And there was a big Yagi antenna pointed at the tracks.
And you could see when train rolled by,
it was pointed in such a way,
or it was just pointing at the front edge of the containers
and doing some reading at the time they stick RFID tags on
the containers to be able to tell
customers where their cargo is.
So if someone wants to know, you know,
I've got something that's gotta be in Los Angeles in a week
and it's just leaving New Jersey,
I want to see where that
thing's moving through the rail network.
And the way I was able to confirm it was,
I was a much younger guy.
I was much more willing to go ask questions.
There was a rail crew working in that little mini hut.
I went up and asked them what they were doing.
And they literally were happy to explain,
'Oh yeah, this was an RFID system.
Look, here's the manual you use.'
So don't be afraid to ask people because they typically just
think that you're a hacker spirit.
You just want to learn how things work, right?
So, but beyond that,
so now a whole bunch of retailers are using RFID tags to
both combat theft and to make checking out a way faster.
So I don't know if you've been in a Uniqlo
anytime in the recent couple of years,
But you literally just walk up to the cash register with
your bundle of clothes and you just set it down.
And they, they know within like a second,
what it is you got, what sizes they are,
and they tally it all up.
They don't have to scan each one anymore.
It makes things really fast,
but
you can get,
so here's some of the Uniqlo tags,
they use three different types of RFID tags in their stores.
So come back to that in a second,
but you can buy on even on Amazon right now.
Let me see if I have a picture of it.
I do. Okay.
Come back to that a second, but you can clone RFID, like,
I mean, look at
the RFID Thief that Bishop Fox made many, many years ago.
I'm pretty sure Proxmark3 can do it,
but you can buy just about anything on
AliExpress or Amazon these days.
That's a roll of RFID tags you can write to,
I think you buy on Amazon for two bucks.
So it would be very simple to encode the EICAR string into
some RFID tags and go see if you could
make things stop working.
Is this shit legal? Well, I am not a lawyer.
So, but the question really is what is the legality around
walking around with a giant barcode on your backpack and
causing random camera systems to crash.
I mean, you didn't give them the permission to
scan your barcode
and why should they be scanning barcodes anyways, right?
But if you decided to start actively scanning things like
you walk up to the cash register,
you scan it with the EICAR string and it causes things to
crash and they catch on to what you're doing.
That's probably not going to work out well for you.
You know, maybe a mischief charge, computer mischief charge,
who knows.
But do you want to try it out for yourself?
I mean, how can you do this?
Sticker Mule, love Sticker Mule.
Great place to get small runs of stickers, done cheaply,
but there are lots of other sites out there that will do
stickers for you cheap.
Laser labels work great.
Remember QR codes are pretty flexible,
are very fault tolerant as to, you know,
how rough the scan will be, because you have to remember,
like if you put something on a UPS package and it crosses
miles of conveyor belts, you know, sometimes those stickers,
those QR codes are going to get slightly roughed up.
So there's quite a bit of error correction inside QR codes
to help.
So you can print them all at home yourself.
So embroidered patches, like I showed in an earlier picture,
I sell them.
I do not sell them for a lot of money.
I'm not doing this to make money.
Figure out how to find them yourself.
So I'm not going to shill them here, make them yourself.
I can share the design with you.
If you want to make a whole bunch yourself, reach out to me.
I'll tell you who my manufacturers overseas
and introduce you to them.
You can make a whole bunch of patches yourself,
but if you're at DEFCON, DEFCON proper and not watching
this online, come see me at the end of the talk.
And I'll give you a patch for free because
I got hundreds of them, hundreds,
and I have a new special never really seen before and
never released giant
EICAR QR string.
So come on up, see me.
And you can get a patch for free.
If you're watching this online,
reach out to me on Twitter or something
and think I'll go create a
special coupon code for you or something.
So with that being said,
as part of the in-person talk, time for questions.
For the rest of you,
did you find something interesting trying this out
at home yourself?
Let me know either on Twitter or you can
email at richard@goatse.cx.
Yes, that's my real email address, goatse.cx.
Some of the old timers will probably get a kick out of that
email address.
And if you're not a gray beard like me,
then don't go looking up what goatse.cx is.
So thanks for listening. I really appreciate it.
It was fantastic to be able to talk to you all today.
And I look forward to hearing from some of you
in the future.
Cheers.