Pierluigi Paganini
April 20, 2021
Recently I bought a X-RAY machine from China to have some ghetto-style desktop setup in order to inspect/reverse engineer some PCBs and hardware implants.
The first thing striked my curiosity, even before purchasing it, was its remote. Which were the odds that the little teeny-tiny remote was just using an ASK/OOK modulation with no replay-attack protection whatsoever?! Very high of course.
c
Nonetheless, I ordered it anyway and used it as an excuse to try again my WHIDelite and the new toy that Joel sent me over (EvilCrowRF).
But first let’s follow a more-systematic approach with HackRF and URH:
After recording a packet we can confirm that it is using an ASK/OOK modulation.
After creating a simple substitution decoding, we get exactly the same values that both EvilCrowRF & WHIDelite showed during the initial tests.
Just for the sake of confirmation, I did replay the packet with both HackRF, WHIDelite & EvilCrowRF. In all cases, the forged packet was successfully received and decoded by the unit, which fired X-RAYs like it was a Marie Curie’s party
Here a quick video review of the whole replay attack:
https://youtu.be/RIdf2yIPB84
Some resources related to the tools and devices used:
In case of more cool hacking stuff, do follow @whid_ninja on Twitter!
P.S. Disclaimer, if you are planning to buy this model of Dental X-ray Machine… keep in mind that is NOT considered safe in Europe. The Health Protection Agency from UK, even released a report regarding these devices coming from China. Be prepared to use sheets of lead, dosimeters and protective vests.
The expert published a video PoC of the attack:
Author Biography:Luca Bongiorni is working as Head of Offensive Security. He is also actively involved in InfoSec where his main fields of research are: Radio Networks, Reverse Engineering, Hardware Hacking, Internet of Things, and Physical Security. He also loves to share his knowledge and present some cool projects at security conferences around the globe.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, X-Ray Machine)
[adrotate banner=”5″]
[adrotate banner=”13″]
