DEFCON 16: Toying with Barcodes

Speaker: "FX" Felix Lindner, Head of Recurity Labs

The talk focuses on 1D and 2D barcode applications with interference possibilities for the ordinary citizen. Ever wondered what is in these blocks of squares on postal packages, letters and tickets? Playing with them might have interesting effects, reaching from good old fun to theft and severe impact.

Barcodes have been around for ages, but most of the time were used as simple tags with a number. The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous. The talk gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world. This is going to be fun, tool release included.

For more information visit: http://bit.ly/defcon16_information
To download the video visit: http://bit.ly/defcon16_videos

---

Closed Caption:

so yeah what are we going to do quick
into a bar codes are going to talk about
encoding decoding Skinner's some simple
tricks
the more simple tricks some second stuff
and someone soft cases and stuff so this
is actually all not really hard
so relax you don't need your brain or at
least like to the left side of it
what about history of barcodes like they
got developed in 1948 by two people and
the first usage attempt and that's
actually really funny was the American
railroad people that try to barcode all
armed all the cars that they have it
took them 17 years to label all the cars
and then the system didn't work
like it never did at that point in time
people figured barcodes are useless
however 9066 the National Association of
food chains started to require having
barcodes on products to speed up to
checkout process so they could make more
money and that usually tends to be a
really good driver for technology either
making more money or . so in 69 arm the
same requested a industry standard which
later became the UPC code that you all
have on your grocery products and stuff
here in the states and since 81 the US
Department of Defense required a coat 39
barcode on all products that are sold to
the military and you will see why that
is a bad idea
so in barcode speech
the little x bar codes that the thing
that we just call barcodes are called
symbologies and we have one dimensional
symbologies and two-dimensional
symbologies on here you see a few
samples and the smarter ones of you will
actually start to notice that are
there are in the samples and it's
probably just how to read some of the
samples contain only numbers some of the
samples likely contain letters so we can
actually have letters in bar codes
there's some more symbologies we will
talk about a few of those in more detail
in the talk
this is just an overview so there's a
bunch of different symbology standards
out there and they differ
mostly an error correction and they
differ also in what resolution you can
print them in and all kinds of other
stuff so it's really like what protocols
like everyone in Vince's own then you
have like really weird
bar codes by this the upper one you've
probably seen on envelopes and this is
actually a postulate barcode this is
actually a routing information for
letters
the brothers always been there
separative island folks
of course had to invent their own posts
a bar code that roughly looks the same
but it's the british one and then we
have two dimensional barcodes now if you
look at this graphic and then you look
at your batch
who can tell me what type of bar code
you have on your batch data metrics that
is right and you like and probably
notice that this data matrix here looks
a bit different
it actually helps like a cross in the
middle this is because you can cluster
them so you can actually extend the
amount of information that goes into the
data matrix code that is true for most
two-dimensional barcodes you often see
at stake barcodes on UPS possible
I've rarely seen maxi code except for on
stuff that cisco sent me once in the
mail in PDF barcodes are widely used in
europe for ticketing systems in we're
going to go go into those later
now when you see a barcode and you need
to decode it
like how many people raise your hands if
you actually decoded the bar code on
your batch
yeah you kind of like we're sitting next
to me ok cool so some people actually
did it now
are you interested in knowing what's on
there it's a URL and I'm not telling you
which he
yeah it seems to be part of it like a
scavenger hunt kind of thing
so essentially if you want to decode a
bar code
there are two ways one is you just take
a scanner and go like people and and see
what on your computer screen and the
other one is decoding software
this is what i use some decoding
software is free
other decoding software comes for the
cost of like a few hundred dollars were
a modification of two bites and I'm like
really lazy so i went to capitalist way
and actually bought one
that was really expensive but it's
really good
most scanners actually output this stuff
directly into your keyboard you
that's the older skin as you also have
USB so they're actually seen as input
devices by the computer and that makes
it really easy you don't need any
special software so it's you
we want to generate barcodes how do we
do that then there is very good for
one-dimensional barcodes is a very very
good generator which is surprising
because it is called gnu and it's
actually good and like it even compiled
so this
gnu bar code is actually decent and you
can like generate a lot of our coats
with it you can online generate barcodes
there are many PHP scripts and stuff to
do that
they're uncountable commercial solution
many of them actually ship as truetype
phones which I find kind of weird but
you can do that you can write your own
generator really easily
the fun part is
you need this backs and the specs
actually come in a very very fucked up
for him like I was actually buying the
specs for the at state code and the way
you get them is you get a skin in our
print out that was written on a
typewriter way back that has like hand
corrections in it in this is what you
pay 20 US dollars for so go figure
but it's really easy generation it's
really easy as with everything
so in general
bar codes are used for it like three
different things and I have to excuse
the German in the slide but there's just
no other way to say it either in there
are used as tax and ID's so you're just
putting a number on something and taggat
or the two-dimensional ones are actually
used to come as virtual data transport
or virtual to physical because barcodes
have this unique property that you can
send them by email and print them out
and you get a physical data carrier in
your hand that you called email and this
is what people actually use in Europe a
lot i don't know how much its use here
the third application there are used for
is utter bullshit and we will cover some
of that as well so now we're coming to
the first interesting thing about bar
coats the scanners the scanner state
like face outside to a potentially
hostile barcode are actually configured
by bar codes so you have a scanner to
one side faces to an attacker and the
other one is connected to a computer and
you actually configure it from the
attacker site which is really stupid
so what happens is this you have a
special like enter configuration mode
barcode that ships with every scanner to
scan this center configuration bar code
thingy and then he goes in conflict mode
and then you can scan other bar codes
that like change the configuration like
the output character's head to japanese
or something and then you send a new
skin and end of configuration bar code
and it gets safe to the scanner
this is really not a good idea
I mean you really change how this device
words I've actually seen a scanner that
offered software update / bar code which
was scary
what L so this is essentially what you
do you go to the vendors page and you're
like you
many vendors actually post the
configuration bar codes on the web page
you can just like call up the dealer
that like sells those barcode scanners
and then you reconfigure it you can
change to support of our co types which
means that the system that formerly
thought it's only accepting let's say
UPC bar codes now suddenly has helped
all types of barcodes because one thing
that you need to know is all the
scanners support all the barco types
like you don't buy a separate scanner
for you pc or something
the chipsets became so easy and cheap
that like all the scanners support all
the barcodes and you have to actually
configure them away
so the system that used to only accept
you pc with a single similar simple
configuration more beer will suddenly is
have pretty much everything you feed it
not good some scanners actually support
special key codes this is cool when you
have a cash register system that still
runs on its stars for example there are
many of those because they're really
stable in contrast to modern operating
systems
the thing is with the special barcode
that like has a special key code you can
actually go and skin and escape key and
since it's looped into the keyboard
it actually has the same effect as
someone hitting escape on the keyboard
which means it's going to exit the cash
register application quite nicely
you can pretty much shut down the entire
shopping centers
yeah
so the easiest hack and roads with
barcodes is in most cases actually just
copying them if the if the bar code
actually transports the information that
you want already get a good camera or
get up and get a printer make a picture
printed out have a copy of the bar code
and use that one as well
happens so there's some stand-up come on
there is this person who actually like
at ph neutral we have those benches and
some of those benches rd alcoholic
badges like you can actually get free
beer with them and this guy didn't want
to pay beer but get free beers so he
actually took a picture
thank you actually took a picture of
someone's get free beer batch and then
went to the copy shop and got a printed
out and lemonade it and like got free
beer which is why we now have chip cards
another thing
um like I don't know how coming that is
here much of this is a European centric
so many parking systems like parking
garage payment systems actually use
barcodes nowadays in in our areas in
four different for the residents they
have like special barcodes and so I
ended up in a hotel and they gave me for
a parking place in in a city in Germany
they gave me a long-term hats because i
was staying at the hotel and so I didn't
have to pay for the parking now this
long-term past is just a simple encoded
number and I don't need to actually know
what this number means because like can
just copy it and then like this tribute
around like free parking passes for the
city centre which I actually did so you
guys don't do any of that recycling
bullshit now it's really really bad in
Europe so they make you actually come
back like bring back your empty bottles
and then they make you stand in front of
a machine and feed them individually
into this machine until you are done the
whole process actually takes longer than
drinking the beer
so this is really retarded it and they
are using bar codes that come out of the
machine they get printed out of the
machine and you walk up to the register
and get your refund for the recycling
right
so getting paid for drinking beer
the thing is in those systems they
actually have no connection between the
recycling machine at the cash register
that means all the information has to be
on the barcode like there is no other
way to transport the information in the
vouchers that they used to come out of
the machine
re a and 13 which is like our version of
UPC it's just a bit longer and this
yeah and 13 is actually doing the super
standard that UBC is under in your you
pc is actually missing a leading digit
is 0
that's what why it's not printed all
other countries have a leading digit
that says from which country this
product comes and there are special use
digits -
for example is used for store internal
use now what idea was like I'm actually
went actually I didn't do that
so let's do that for me went to the
store and gave back two bottles and so
you see i'm getting back like 55 cents
euro which is about two dollars and
and when you're when you're checking
down here now
those are all 60 i cannot walk around
when you're checking down at the bar
code
it actually ends with 0555 now if you
happen to know that the last digit is
actually a checksum so it's not part of
the transport of data it suspiciously
looks like the amount of money that you
get back
now we got it the second bottle checked
in and that was 25 cents and it
exhibited the same pattern
so you can actually like pounded and see
that you can get up to 999 euros in
refund for like returning stuff which is
actually pretty decent
the thing is a billion is full of people
that don't like to work but to drink a
lot of alcohol and so when they
introduced the system's people imagine
Lee realized that this is cool because
they didn't even read the bar code but
they did what I was told you earlier
they just copied them in masses in like
went into stores and got money and to
prevent this
the store is actually started to use
like special paper so it would recognize
their own paper but the thing is if you
stick the bar code under your six pack
which is heavy and the lady at the cash
register it doesn't like to like lift it
up so he just scan it over
so if you stick something under this and
you're not too greedy you actually get
paid for drinking beer
another thing that people use bar codes
for is excess control
more often than you would actually
expect the access control system only
very feisty at the structure of the data
is nice
which means that it can read a barcode
like it will not look at the content
not at all it's really easy test like
when you have a nexus system that uses
barcode just take your pack of
cigarettes or whatever you currently
have on you with a UPC and just scan it
and see if the door opens
don't be too surprised if it does
because that's like
the irregular case other than that you
can just like get the right number of
digits on your barcode and scan it and
it will open the door that frequently
works
so in a attack and clothes because
that's all really silly stuff that I
used machine is this
so the synchronization the thing is
people do not realize that the barcode
and the numbers that are the digits that
are actually printed below the barcode
do not have anything to do with each
other except for your assumption that
this number is what the market is like
this is an assumption and many people
have to edit some ship which can be
exploited
so what you do is you can just change it
like you can change the number or the
barcode and leave the other one intact
and then
yeah do stuff with it other people do
that as well
like this is we had a company trip to
the zoo
don't even ask so this is the tickets we
got and of course I collected them all
and scan the barcodes and this is what
they do as well
the numbers that they show next to the
bar code are the shorter ones and when
you decode the barcodes you see the
longer numbers there and the leading
digit actually says if you need to pay
or not
everything else is pretty much useless
so these synchronization can be used for
property tracking now let us assume you
work as a contractor at this company and
your fellow co contractor working next
to you has his knights laptop so what
let's assume you have a mac and you're
like really finally understanding at
their crap and you want his IBM
this is what you do in this company that
I'm contracting their home they actually
do property checking by you go and you
get a bar coat em and stick it on your
laptop and then no se this barcode
belongs to this guy
so this is FX laptop
and when you check out they scan the
barcode and see if that's yours
so what you do is you replace the bar
code on your batch just a barcode not
the number temporarily with the bar code
on the edge of the legitimate owner
now how do you know - well you well it's
printed below so you can just generate a
bar code
you don't need any magic now you stick
that conducted on go out check it out
like check your IBM laptop out go back
in because right now he's not at work
but he's about to leave so that does not
it is not good right
so you have to go back in change you and
fix your batch again and then like
remove it and then check out and go home
and have two laptops easy as that
you can also use that for changing the
identity of your laptop like many
companies like to use the bar codes that
are below your machine that actually
contain a mac address
they use that for partek security for
example so you bring your laptop that
you scan the barcode and then they know
your mega dress and stuff
of course you can put a different
matters in there
so one of the ideas i have was like
putting the broadcast make a dress in
there like all f
and so when they put it into the network
access control soon it's going to like
fuck up the network
the thing about barcodes it's a really
simple technology but you actually have
to get your procedure right so that's
this is what happens like when you're
really lucky said this is actually a
picture of the place the apartment
building a living and they put in a
store a automated DVD rental system like
unattended right there
it had a barcode scanner at the door and
I walked right in there and like ask him
for an account and like figured out that
they're actually using biometric
authentication like they wanted my
fingerprint and I'm like yeah you're
going to get my finger print this side
so I only go for the pin and
now this is really cool because it's
like an attendant and it's in my house
and so I can like go at night and like
play with their systems and so
ok here's this here's the rental
procedure and to pick up procedure so
the range of procedure is you go in you
swipe your card to enter your PIN just
like to move you want your lockout
I'm you can do the same thing on their
website
now the pickup procedure to actually get
to the physical data carrier the DVD is
use wipe your card you get the DVD from
the machine is anyone seeing a issue
here
well the second doesn't ask for a pin
so the current did you get actually has
a bar code on it
the bar code is actually highly
complicated there
yeah over there like the the top
it actually has like four digits and one
character
now the one character is actually pretty
much static it is done it is the first
letter of your last name and then the
digits just like the numbers just
increase which means you can just guess
who just rented a movie and then print a
bar code with this number
swipe it and if they ordered it or over
the web
you get it their problem is they cannot
prove that data on habit so they have to
pay for it and you get to watch dvds and
even keep them
so um yeah this is this is why i did
also what's really funny
so on this website where you can like
pre-ordered this stuff they will
actually tell you if its range it out or
not
and it will actually look a little bit
different if it's already taken out or
just reserved
so you already know what movies are
rendered and are pre-ordered
so you're not picking up like I don't
know Disney crap
yeah it's get
so the next class that we're have is
injections and multi multi coding so
most barcode readers as i mentioned
actually read everything like every
possible type of bar code and they're
using left and their factory setting
because nobody cares
and even if they're not we have learned
already we have configured barcodes we
can make them so again the second
application however will in many cases
only expected archetype it's written for
how surprised
ever hear of people for getting input
validation it is the same deal
so using a very powerful barcode like
code hundred and twenty-eight you can
inject arbitrary characters that brings
us to actually having secret injections
and format string attacks in bar codes
you will be surprised how good this
words the really interesting part of
that is the older the application to
less likely that you actually succeed
because people back in the day is called
actually code and the later the
application like the latest PHP written
shit is going to fail all over you
if you have a sequel injection bark hurt
this is actually i had the pleasure of
professionally like playing with bar
codes as well so this is actually from a
medical system which is really important
because the test your blood for HIV and
you can actually like you see barcodes
over there
I found an injection in that system so
that you could actually make like test
results go away
this is scary you don't want to do that
ok I i mentioned that people use bar
codes for utter bullshit
it's called QR codes so the idea is this
you have a newspaper like a paper
newspaper like for us hackers we
probably don't have seen those in like
years but late in physical RSS
ok so
and and what the idea is they print
barcodes on the newspaper and it is a
two-dimensional barcode and then there
is commercial Dakota software for your
mobile phone
ok I tea ships with one I think the
later that will scan the barcode
decodable code automatically and point
your browser right at the URL this is
pointing to this is actually a really
really bad idea
now we are here is some more of them the
German newspapers they actually started
off with using them and said everyone
else is using them now
now the thing is there's we took one of
those commercial software thingies and
like looked at it and realize that it's
actually not even going to the
newspapers website but it's just going
to some web to do marketing budget
company and when you decode light and
when you brute force the numbers you can
see who else is using the service which
is kind of nice but it's not really
barcode related the problem is there's
people can H ePrint arbitrary content in
newspapers
we call this advertisement like this is
how the newspapers actually make their
money
so most people especially most suit and
tie wearing people do actually trust
their physical newspaper like not only
do they believe what they read in there
but they also do not think it could be
evil content
so you're pointing your browser to a not
to you known your l automatically with
your newspaper is that potentially a bad
idea anyone like have you ever hear of a
vulnerable browser before in you opened
you get to cross-site scripting people
with your newspaper like you put a
cross-site scripting attack in the
newspaper
he's locked in to gmail he's against
this shit you delete all his email
this is like no it's a no brainer it's
like cross-site scripting one-on-one
like how about just renting like very
little advertisement space and pointing
it to it to an eye
i spec or impact site were like whatever
exploitation framework you use against
browsers and like owning mass owning
managers now great we have now to tell
our CEO spatial not click on images in
the fucking morning newspaper
thank you there is another great
property of barcodes
this is the density thing
the markets are actually designed to
have a variety of density
the thing is some of them are arbitrary
length so you can print as much as you
want if you have a really long reader
that's not a problem but the the
program's the software is going to
handle the barcode that you're just like
giving it is actually written for this
fixed amount of digits that it was
expecting
so even in the same space physical space
that you probably need like when you
print it on a card or on a slip here in
Vegas
you can actually print a lot more digits
every here to buffer overflows before
like have you noticed that putting more
stuff into something that it was
expecting is actually something that
hackers really like
so yes it does happen like we did find
buffer overflows with barcodes simply by
just like printing more
it is a lot less count in common then
the injection attacks but your tool of
choice here is the code 128 because it's
full 7-bit ascii character set and you
can change them together like you print
multiple of them and they end with the
control called fc4 and that says what um
there's more coming in the bar code
reader is actually catching that
so the bar code reader is actually like
buffering all the barcodes you're
skinning and then you sent the final one
say go and then you finally skin like a
1k big barkman 1k big bar code which is
kind of cool
I mean really breaks shit warning
it is I have to warn you it is a pain to
develop shellcode on bar codes
I can tell you from experience
yeah and coming back to this QR thing
like taking pictures in your newspaper
and then rooting your out and browser to
it
yeah you put it into a disassembler
right away you find a place where they
have a person to ask us that they later
on passed to a double use printf you
also find like some phone number that is
undocumented and play funny statements
and you find their username and your
password for like some HP openview
looking glass in their software i don't
actually know what that is but they it
was too cool to pass on it has nothing
to do with barcodes badly if you want to
own some some fucked up with two door
company there does and we actually
tested a lot of stuff that didn't break
so this is something we have in in
Germany it's called the pack station
you get a bar code in your mail it's a
yen 13 and then you walk up to the
station and then your skin it and it
spits out the the delivery that you got
because the UPS guy again didn't find
the door or something
so what is it
so what I'm spending my weekends with
sometimes is like going to public bar
code scanners and then causing them
and this is how it looks like so you
have a few numbers you have a few more
numbers more numbers then you end up at
some point I would like very dense
barcodes and sequin jection should be in
here as well
yeah you have like special characters
sets and you just go there and skin them
and see what happens
so this thing actually didn't crash
quite disappointing
i also tried ikea because they use
interleaf 2 of 5 which is a bit more
powerful you get more digits in and all
their scanners except almost all
one-dimensional bar codes but their
applications actually well-written it's
one of these ms das written programs and
it actually didn't crash so and then we
have what i call recreation attacks
which means
can I predict what the bar code is going
to contain for a specific scenario that
i want
if so i can just print it out it's that
simple
so the most obvious target is postal
codes now postal codes are used instead
of stamps right so they're actually
worth money so they use two-dimensional
barcodes now because they can automate
the process like they don't have to have
an intern like licking stamps and like
placing them on letters but they print
the barcodes on the letters and it goes
a lot faster
some of the postal systems as we've been
seen any into actually use different
systems but most like to use data matrix
and so I got just simple letters from
from companies that right me on like
invoices and stuff and decoded them and
checked out like what's in there so what
can you actually very fly
so this is one thing that I got it has
the Australian post bar code over there
and i decoded it and it is literally
this line of zeros
like that's it so how do you actually
very fine that someone paid for this
letter with a bunch of zeros
like how do you do that probably not at
all
so if you want to send mail in Austria
get like a bunch of zeros and put them
in a bar code
they also had like real bar codes but
those where postal system barcodes and
interleaf and they just like had nothing
to do with the payment and then we have
the US postal system this is probably
going to get me in trouble so they have
this labeling system that's called
intelligent mail and I assume it got
this name because the compared to the
author or the system was actually
written they're not getting there
so it uses current hundred twenty-eight
lay boards and i actually found the
specs on the Internet
no literally like the doc file specs on
the internet on how does work so here
you see like the how big this thing has
to be and stuff
so what's in our code they have to speak
in a bar code so it says here's this zip
code they're kind of makes sense here
where should this go
oh and you mind you this only works for
crates and and big stuff
not for small letters so we have to zip
code where it goes
you have a CIA and you have a label
source so it says like where it came
from or what type you have a mailer ID
which is unique and I'm coming to that
in a minute and a unique identifier for
the shipment and you have a label type
and it is about it
I don't see any authentication like I
don't see any way you can prove that is
this is your mail where this wasn't your
mail
now this unique identifier called be a
problem because we're not able to
predict it but then in the same specs it
says to maintain the uniqueness of the
barcode that
data for these labor types must be
unique for 30 to 45 days
males are asked to check with the postal
service marketing representative to
confirm the requirement for uniqueness
hmm so it's absolutely random like it
doesn't really care
now on the other hand trying to get on
the other hand i compared that to
another speck that at first sight has
nothing to do that with it
this is the Pentagon building security
emergency the procedures guide that also
has a guide on how to handle mail and
recognized letter bombs
so it has all those things like it is
for in mayo were excessive postage or it
actually has / tuning wires and tin foil
whoever wrote that probably never build
a bond
it does not contain you get a large
shipment of a crate that has a center
idea of the Pentagon and then in that is
actually the bomb like you can send
pretty much everything anywhere for free
and it will be trusted because the
sender ID says like this is the
Department of Defense do you guys use
bar codes for boarding tickets airline
boarding tickets here in the states
yeah okay you're gonna love this so this
is the latest trend
so the security on our biggest hop
frankford mine airport of course our
capital doesn't have a large effort
realize on the boarding tickets they
don't actually have anything anymore
except for the scanner that goes red or
green and if it goes green you can go in
and if it's red and know the security
checkpoint is central therefore it's not
Alan specific right now on the other
hand the security like this implies that
the security checkpoint may not know
everyone who's already checked in
because that would mean everything else
was rewired with each other and I don't
think that is the case to develop
identity
must be in a bar code I fly a lot
so this is like bar codes from from
trips all over the place and some more
so I got all those and then i decoded
them and this is a to live wrote myself
for this market research so i can like
color hex thumbs and stuff so this is
what I found in the bar code that has a
passenger on it has a last name first
name booking code from where you're
flying to where you're flying of which
flight number
the day of the year in which class
you're flying interesting important
what's eating you have what you take a
number is and a security check number
however like the last row and the last
column here is the security check number
do we notice a pattern
yes we do everything else changes
security check number stays the same bad
turns out that thing is static now
what's really scary is the two red ones
that i have in there r XG online
check-in boarding passes
so you check in on the website instead
of at the counter and they don't have
anything in the second column the second
column is what is called the passenger
record number and everything like
literally everything in airline security
routing and whatnot
depends on a PNR being there and correct
and unique like all the airlines offer
everything works with PNR now they don't
have a PNR which means we don't have any
piece of information we cannot predict
so we can say from where to where we
want to fly
what our name is what flight we want to
be on what class we want to be on and
we're going to be like left checked in
and a world like bring us to the gate on
the other hand luggage tagging actually
works biologically attaching a
one-dimensional bar code to your trip
and to you so baggage is actually routed
in the airport
every system depending on this barcode
and with online boarding you can
actually connect any piece of luggage
that you have to your boring paths
simply by dropping it off at the counter
like when you're online check in right
you check in online then you got a bad
and like big trolley you go like me
drop it at the counter show them your
online checking boarding pass and
they're connected logically to your trip
which may not necessarily be yours
so here's the scenario we have this
person that is considered a potential
terrorist because just he wears blankets
and then we have his boarding pass
we have this other person who's
strangely looks like a government
official in our country who actually has
an agent in wants to make this innocent
blanket wearing person will look like a
real terrorists
so he XG creates recreate a boarding
pass on the name of the other fellow and
drop some luggage in with some extras
gets xr8 evil security find a terrorist
this is how it works you can totally do
that so recommendation
I mean they made water illegal in flight
they can actually make luggage illegal
as well for security and anti-terror
reasons because like the same concept as
with the water is going to apply here
you buy a bunch on you buy a bottle of
water before you go to the airport it's
like one dollar you buy at the airport
it's like five dollars they can do that
with luggage -
like I don't see why we why we should be
allowed to have luggage for security
reasons
there are some unsolved cases like one
thing that I find really interesting is
this year's visit immigration thing that
they used to have it kind of like no
longer is in
use so from for a period of time you
actually got like this huge bar code
over there that looks like an entire
when you check out of the united states
like literally when you left the country
and i decoded those and they're like
entirely crypto and so i decoded those
and they're entirely crypto and i
decoded by a few train tickets in
Germany and they're actually done right
they actually have a crypto certificate
in the 2d barcode
this is how you do it like considered
your barcode like a browser cookie
whoever you give it to is going to fuck
with it
I if if you give it to me i'm gonna fuck
with it uh-huh let's put it this way and
so everything that people will do to
their cookies they would potentially
also due to their bar codes if you can
only use one dimensional barcodes make
really sure it is like one time pad like
you to draw a random number out of a non
debian random number generator and then
you posted on whatever you want to tag
and then you have a central database
where you put this stuff together and
you don't tell anyone
do not try to put information into one
dimension of our codes if you have a
two-dimensional use we encrypt or like
the the German systems like the railway
system and everything they have done it
right they have actual Krypton the bar
code in it may actually provide for
non-repudiation in both ways anyway and
make sure your process work so i do not
what my video stored it make really sure
that like the people cannot do something
with the barcode and just because you're
implicitly trusted do not trust a
printed number i hope that was somewhat
entertaining if you have barcodes that
you want to play with generate bar codes
or scan barcodes and decode them
we have on this funny URL we have set up
a vicky that contains all the all the
decoding software that we know and all
the free decoding software and
everything else
has some war stories of people I'm like
what went wrong with barcodes and hatred
people contributing content there so
it's actually pretty cool
yeah thank you right on time any
questions any bar codes
no actually the slides are not on a disk
because i was like getting myself into
this talk to say something then but i
will post them up there and they shall
be up to finally website
now this is really funny you're gonna
love this if you have seen the report
bunny talk that I gave together with
pops
this system is actually like that the
second is the other side like the victim
system that he tested his firewall
detection packet storms hit against so
the system is actually broken right now
because Fox killed it
it's going to be back up in a few to hit
okay thank you very much see you at the
next party