I’ve seen more and more of these LED License Plate Frames around town lately. While I do think that they’re pretty dumb looking and merely used by owners to distract away from their inadequate physical and psychological characteristics, I have been wanting to find out how these device function and how they are programmed. More importantly though, I’ve been wondering if they could be compromised. Security and privacy have always been a strong interest of mine, and like previous instances of people taking advantage of inadequately protected systems, these scrolling message displays just seem begging to be messed with.
A little research confirms what I was hoping: They’re updated via an infrared remote control! A little more research, and I’m practically drooling – no form of authentication is needed to update messages!
Imagine pulling up behind a car at a stoplight and you notice one of these displays on his back license. And with a push of a button, a quick automated series of infrared pulses are emitted from a dashboard device and before the driver pulls away, his license is advertising something of your choosing. The possibilities are endless.
Infrared (IR) communication has been a special interest of mine as it’s often a very simple to understand protocol and security is so often neglected in its implementation. I’ve owned an IRTrans USB for years, and more recently purchased an Infrared Toy from Dangerous Prototypes. Their stuff is awesome; I highly recommend them!
The first step is to get a hold of one of these units (or at least the remote) and start sampling the remote signals. I put out a call to friends and family, but no one close to me has been lame enough to buy one. I’ve noticed that they’ve been on sale at a local retailer, but they’re $30, but I’m not sure if it’s worth it just to mess around with…
Edit: That didn’t take long… I decided it was worth the investment for “knowledge’s sake” and figured, worst case scenario, I could just Ebay it after I was done. Check out my initial tests in Part 2.