 Hello, okay Hi everybody, so I'm giving a talk about number plates And I actually found for a while it pretty ridiculous that actually somebody asked to Yeah I'm hurrying up because I wasted quite a time off already. So who am I? I'm McFly. I Do security related stuff for a living but most of you possibly know me as the guy with the coins So who have you as a coin? Hands up. That's a noticeable amount. I hope you like it So does it work all this works awesome. So what is a NPR? Hands up for people that know roughly what I'm talking about will be talking about okay This is the UK. You seem to have quite a lot of those I'm from the Netherlands over there. It comes also it also comes to medium security and related points So what is a NPR? NPR is automated number plate recognition So that means it's done without humans it focuses on the number plates and basically nothing else and It tries to recognize something for that and it's an awesome technology what people think so The symbol shows it a bit You usually have a camera that is triggered in Usually with a magnetic coil So your car is made out of metal and if you have a magnetic coil in the ground you drive over it you disturb this magnetic field and you can measure that pretty easily and That then triggers a camera Who of you has ever opened the gate with the fire extinguisher? Hands up Okay, you truly already understood the problem So was it used for? it is very often used and especially in the Netherlands for parking enforcement by the city and by private people So the parking garages have a number plate reader at the entrance that reads your number plate you drive in and You can't excuse yourself that you only have been standing two hours in there but also the city drives around with cars that have number plate readers on the roof and They try to Write down who is parking and when you go and park you put in your number plate in the computer So you're whitelisted there and that's how they enforce that Speed control, I don't know. It's called in the Netherlands and in England in Germany and in the Netherlands. It's Called triac controller. I think section control or something like that And there is Surprisingly use of the law enforcement of that that just looks for your camera who's leaving the city and all this terrorism happens lately So they have to do all of this fancy thing that are completely useless, but anyway, so packing enforcement. That's how it's typically looks You have a small column. There is a window behind. There is a camera that tries to read a number plate from your car This picture is taken at really good visibility and all of the point all of those things which will be a point later on the talk Packing enforcement That's how it looks in Rotterdam. Is he the readers in top? I'm can you understand me? Well Okay And this is how the speed control Looks in the Netherlands. I think it's pretty obvious for most of the nerds how it works You have two points where you try to identify the moving objects over the road You know the distance between those poles and that allows you pretty precisely to calculate the speed of the speed of the object that was traveling over there You have something like that in the UK too, right? What is called? average speed Okay, thank you. I think I saw some of those but yeah So law enforcement In the Netherlands there is very often what they call the milieu zone the environmental zone Your car may go in or not depending on the number plate Because they do a database lookup and look what emission loss your car fulfills and it will directly tell you this means that the car Was the number plate 31 shd2? Mach well in so is allowed to go into the city It directly tells you so you drive there it takes half a second. They do a lookup over there Why do I care? That's the house. I'm living it. It's very fancy looks at least very fancy and it has a guy parking garage and the Architect also wanted to be very fancy. So he put number plate readers in there and I hate them Because like it's the Netherlands. I'm from Germany. I'm used to some things called privacy Because we have laws about those things, but basically I at some point tried to ask, how do you long do you store that? What do you mean? How long do you store that? Yeah, when do you delete it? What do you mean delete? So from the building of the starting of the construction of the building still all of the bookings were still in the computer So and I think that's a pretty average case. So Alone from the privacy standpoint, it's worth looking into those things Does anyone of you know the term GDPR? If you have a parking garage like European Union decided by the way number plates as private data just saying So this is a symbolic pick of this I got annoyed about that and tried to talk to the vendor about that or first my house and basically nobody cared and They said but the vendor said it's like really secure Very secure and I work as a consumer security consultant So that means most times I actually go to other people and smart ass about their security sometimes better sometimes well, you know that And I didn't have an assignment at time and in my company you can just play around with stuff when you don't have an assignment And this is also built in our company parking garage So I had a bit of position to actually talk to the vendor about that and the vendor said this is very secure expert trides believers so Yeah, how the system works you have a car There's a magnetic car on the ground. I'll go through this real quick camera takes a picture That's also a car for the computer just saying and Then the computer decides to get access The technology work that's behind that. It's it's an infrared camera that works with flash the picture gets underexposed So if you do that That's how it looks like this is a symbolic pick of another car from the side with a camera shots in roughly that settings You see very quickly those retro reflective stuff and you see what's standing there So what happens was that? That is a random pick I found in the British people. That's how it looks The system then looks up in database if you're allowed to go in and then you can go in Right clear for everybody till here. So So I thought a number plate faking a number plate. That's really hard, right? Because this is defined fonts and all of the stuff So I tried to get some reflective foil to play around with our garage turns out They don't sell it in the Netherlands like the yellow tone. I didn't know about the infrared at that point So you can't really easily buy it in the Netherlands But the online dealers from Germany where the number plates are white have zero problems selling that to you So Internet I'm buying this this stuff is sold in square meters So I got told the role where you cut them from is 1 meter 22 wide and the minimum they can cut is 1 meters So that's amount the stuff of things you play get with you get from that Yeah, I think that is the point where I wanted to put in the video Yes, so I got bought as I said So This is a very short video Let me play this so you see what's happening there fire extinguisher Wait Yeah, I guess there's something I don't need sound The problems when you have when you suddenly have to deal with the windows So this is yes, I can't see my thing there Okay, wait doesn't this just do this So I'm can't see my display. That's why I'm not putting it easily on full screen I think the it shows basically the general problem is rather short video So the fire extinguisher makes your car Holding a number plates makes you have a number plates and then you have access to the garage So, oh wait, there is still half so I Didn't thought that was like I was just annoyed about that So I made a tweet about that and for my numbers that became very successful in like 50,000 people retweeted that So I Thought I was estimated that so what else I'm very sure every one of you has seen this picture That is that is not for me That is a random picture pulled off the internet and I thought that's a rather stupid idea like it's an awesome idea but it's too many characters and so I Tried this with my car. Can you see that? Because the idea is that you want to get access so dropping the database is not actually helping you very much So if you want to get access you'd rather try to something like I like closing the thing in one or one one equals one, which is always true Yeah, doesn't work in our system But after I posted this video online, I got contacts to well other people that work in this area and Well the earlier system that we had Which is still very common Runs on a Windows 2003 server and it requires Microsoft my SQL for Microsoft version 3 so over there it actually works Speaking from practice. The most difficult part is getting the spaces right so I would encourage you to try that in Other situations because I was told after that was all software doesn't work by the different number so Why is it so much of the problem because it doesn't end here? You remember the automated right in the ASLS are Number plates is not a collision-free namespace and A lot of those software requirements for this kind of software is written by government who always thinks like we're from the Netherlands so Number plates are unique Which is true in the Netherlands, but you can find number plates are totally valid number plates in Germany Like if you just look at the string there Yeah so That is one of the problems next problem is multiple number plates in this case It's actually about multiple number plates in your car Have you ever seen a truck from the front? Like seriously on the highway look for that you will see that they have number plates in their windscreen Do you ever see usually it's their name? But if you talk to them they say yeah, they're awesome half of the speed controls doesn't work anymore so yeah and There's another thing that I left the slide out because it's a bit too explain and it's looking at the time I think I'm nearly through soon Anyway, yes Another thing is This works of a retro reflective So if every one of you wants to play around with that don't do that because license places are legally protected So there is a law at some point that says a license plate is An identifier and then usually it points to somewhere else through technical References where they point this color. So if you ever play around with this to remember This is infrared readers red works fine and that's legally not a number plate Because like some companies have yellows some have whites in your country you have both But in the beginning I was very much in Copying exactly the right tone of the color and trying to mask that and you possibly saw earlier in the slides here this So the beginning I put a lot of effort actually in creating those well not number plates The upper one is made with masking tape pretty exactly the fonts that I need the lower one is with Sharpie And I can meanwhile just draw this like was one stroke with a thick sharpie per number Because if you just think about what does those things do? I just want to find this one picture, which is totally at the beginning So this is good weather, right? But the system is required to also work under shitty weather in snow and If you look how the systems work and if you just think to be where your car, where do your headlights point? Pretty much at this thing So this is every one of uses a photographer who has ever tried in bad weather with snow against the light taking a picture of something That's actually pretty hard So those number plate readers are very very fault tolerant when it comes to writing and Recognizing something so yes your handwriting will if you train a bit most likely be completely fine and They use this to protect I'm just put it in a different way To protect an area with access where They've write the secrets that is required to gain access to this area in clear text on the outside of that object so that anybody of you ever look in like authentication protocols and so and That doesn't sound like a good idea for me So I'd invite you all to play around with that and I'd like to mention one point in there that in my points is From a more security professional person if you want to take this back to your software development Really thing what actually runs wrong here? Is failing to identify user-generated input? Because if you start looking at the point from this automated number plate readers are completely user-generated input because I can glue Patterns of reflective and non-reflective foil in different colors on my car as long as I want as long as it's not a number plate But the computer doesn't know So you're actually dealing with user-generated input There's other things that you do so I did this thing about barcodes So that has the same problem. So just pretty quickly you Think if you want to work with barcodes Also deal with that problem that very often you just have user-generated input That is not properly identified by the software developer to actually Really work with this way so For a lot of those people you work in security the essence of the stock should be about Have you really identified what you're dealing with that machine-generated input because if you take a picture and Throw it through an OCR library and take that to push that against databases or other systems in your System that possibly is not a good idea. So yeah questions You sir, I think I think I'll just three minutes or so Do you know if anybody's done a freedom of information request on their license plates data from like these average speed-checking systems Not there. I only tried the GDPR approach on my house and my company just like find out how it works By the way, it works hilarious But yeah, it's private data which is recorded by the government so over here where you have a stronger information request That might be an interesting thing to ask Hey quick one. What is the yellow reflective stuff called? Do I have it in here? Scotch light from 3m It's like it's it's a default product It's anti-radio refractive foil and like what it's used for is those security things on cars and trucks and all of those things So look at people that sell those people like your average foil or top dealer has no problems getting that It's cheap like the square meter is somewhere around four or five years so you um You showed the picture of the police car with the retro reflective on the front of the does that actually Affect it in the same way as the number plate You mean that it also the system will detect the police car. Yeah For legal reasons, I have not tried the word polizi which is the Netherlands the correct policy police thing on there But I wouldn't be surprised if there is white lists in those security things for like the ambulances and the police But that is speculation, but yes, it gets read everything that's reflective gets read So if you put your company advertisement and a reflective on your car Already quite a problem for those if you look where you legally allowed to put your number plates on your car You're allowed to put it above the screen Like about the windscreen and very much down at the car. You're allowed to move it to the sides So the error they have to look for number plates is actually pretty big that leaves a lot of space for drawing things Like it it would be interesting to have a cup char on your like windscreen and really reflective another question one over there Are there any easy ways of putting an infrared Message on the car that Yes What you can do is make your car retro reflective on area on that like guess white For example, and then you can write on there was white non-retro reflective foil That is really really hard to see. That's actually so hard to see that was I just wasn't able to make a picture from that I have that at home for the loads, but I was recommended to leave all of those Practical examples I have at home because I have to go over this border and your British border guys It really don't understand humor or science More questions Do you know that the window tinting film if you get the very dark stuff let's through infrared So you can see a number plate perfectly well through it, but visible to the eye you can't see it so you can easily hide a number plate that People can't see but the cameras can yes You can do quite a lot of things with that like it's one of those things where in the beginning I just pissed and see like that's a rabbit hole. I Wonder how deep that goes and if you start thinking about that and looking in those details There's so much fun in that like I yesterday It's somebody told me an example where we found an example that we could verify of a number plate that exists in Germany and the Netherlands So automated verifying this over different countries with colliding namespaces That's pretty challenging in automatic, right? I mean a lot of you've read software So any more questions One more question over there This is bordering on hypothetical I Wonder if could you or did you ever try doing the same trick as putting white on white over a Number plate so what you end up with is one big black square that to the visible eye looks like a number plate But the camera looks like a black square For the camera, it looks like a square and for the eyelid looks like a number plate That wouldn't work with so easily because I haven't found any a retro reflective black so far But if we find that possibly because it like an infrared ray for retro reflective might work I'm not these three m's expert on that, but yeah, I guess the biggest problem will be finding a retro reflective black That's Can I get some of that? Yeah, ah nice. Yes, I'd like to have some of that, please Like you'll find me at this millie ways, you know anyway. Yeah, so if you have some of that, I'd like to have that Okay, it's fucking 33. Does anyone else have a question like I would take one more questions if there's one Three two one. Okay. There is one. That was just in time I already had a question ink Maybe I haven't tried like I didn't get my fingers on an ink that is big enough But that might be an interesting approach. Yes Okay. Well, then I say thank you all for coming at this early time of the day I'd hope not too many of you had hangovers and that was horrible because of that Yeah The emf is mostly over but if you ever go to a hacker camp again come over to millie ways and drink some beer whiskey cider whatever there and Enjoy, I hope you all enjoyed this emf camp