Alice Averlong🏳️⚧️oooh, the redbox uses full AES encryption!
and they always use the same key which is embedded in the executable right next to the encrypt() and decrypt() functions. well done, guys
correction: they hardcode two separate keys in the two separate places (that I've found so far) which use AES.
this code is enterprise as hell
you need the url for the base client? well you use Redbox.Rental.Services.KioskClientService.KioskClientServiceBaseUrl which is a property that'll ask the ServiceLocator to find an instance of IConfiguration to get the KioskClientServiceBaseUrl object out of it
they wrote their code as a fuckton of C# services that are always HTTP POSTing at each other
HTTP is, as always, the poor man's IPC
they logged the first six digits and last 4 digits of every credit card transaction.
HAVE YOU EVEN HEARD OF PCI?
Edit: this is technically allowed by PCI.
1234 56## #### 7890
can I buy a vowel?
I'm trying to tar up a redbox install and upload it, but each time the tar gets past 50% we find another file with PII in it
OH HEY BAD NEWS:
when someone opens up the hard drive of a redbox unit, they can pull a file which has a complete list of titles ever rented, and the email addresses of the people who rented them, and where and when
the unit I've got an image for has records going back to at least 2015.
I was able to easily match one of them to a real name
I have 2471 transactions here.
Somebody I'll call Dave Fakename rented The Giver and The Maze Runner in Morganton, NC on 2015-05-23 at 6:43pm
found a THIRD set of encryption code.
this one is 3des instead of AES, and YEP they still hardcode the passkeys
this one is 3des instead of AES, and YEP they still hardcode the passkeys
Redbox.HAL.Configuration
.ConfigurationFileService implements IConfigurationFileService
STOP MAKING SERVICES AND FACTORIES AND INTERFACES AND JUST READ THE FUCKING JSON FILE YOU ENTERPRISE FUCKERS
AND HEY YOU DON'T NEED A SEPARATE C# CLASS FOR EACH XML FILE YOU LOAD
YOU CAN JUST HAVE AN XMLLOADER CLASS AND A GENERIC CONFIG FILE. PLEASE
this is the kind of code you get when you hire 20 new grads who technically know C# but none of them has written any software before
so these people wrote a mostly C# program, with some lua for glue scripting.
and then they implemented their own language. it's some bastardized version of BASIC
it's a compiled (to bytecode? I think?) cooperative-multitasking BASIC.
and god I wish it was the only one of those I'd ever seen
okay by "compiling" they mean "parsing". The output of the compiler is a list of tokens, the input is a text file
example code:
POP START-DECK
POP START-SLOT
POP END-DECK
POP END-SLOT
IF END-SLOT > MAX-SLOT-PER-DECK
SET END-SLOT MAX-SLOT-PER-DECK
ENDIF
Foone's official list of things they never expected to implement their own multitasking programming language, yet found one anyway:
* Redbox vending machine motors
* Wheel of Fortune (2011, Wii)
Redbox.HAL.IPC.Framework.ClientSessionFactory
PLEASE, NO MORE FACTORIES
MY CHILDREN ARE STARVING
oh good they implemented both an internal C# dynamic plugin loading system, as well as the ability to craft arbitrary Invoke()s over TCP/HTTP.
So you can call any C# function from anywhere on the machine, I think?
So, quick summary:
Redbox went bankrupt and the machines are getting in the hands of individuals. The disk image has been dumped. The software is being reverse engineered: they're not currently very useful, since they need to talk to a server that's gone.
But progress is being made
the devices themselves are windows 7 machines talking to the disc library. It's a small group of services talking to each other, mainly over HTTP
it's primarily written in enterprise-as-fuck C#, with some lua scripting, and the "HS" scripting language which seems to be proprietary to redbox machines.
rk: it’s hyphen-minus actuallyOhhh I do love me an embedded scripting language. Do you know if there’s any info on the HS language, or if you have time would you mind posting a sample or two?
@rk there's no info, but there are some samples. I don't have access to the full ones right now, but here's a snippet from the discord:
GRIPPER STATUS
POP GRIPPER-STATUS
IF "FULL" == GRIPPER-STATUS
LOG "The gripper is full - please fix."
APPLOG "The gripper is obstructed - exiting."
RESULT CODE="ItemStuckInGripper" MESSAGE="There is a disc stuck in the picker."
EXIT "Gripper is obstructed."
ENDIF
Jim Spath@foone @rk "Win one for the Gripper."--Knute Rockne, tangentially https://archives.nd.edu/research/texts/rocknespeech.htm