AI Enhanced Hacks

The talk opens with background on Skyscan, an earlier aircraft-recognition project that used aircraft transponder signals to label camera images for training a model. The speakers explain that this session uses a simpler setup: a basic man-in-the-middle position on the same local network, with an image-serving camera as the target. Only the image request is rerouted, while other traffic, such as camera control commands, passes through unchanged, so the operator sees nothing unusual. The main precondition is that attacker and victim share a layer-2 broadcast domain.

The middle section covers model choice. A pretrained object detector trained on a large public dataset handles common classes and runs fast enough on a CPU, which matters because the rig had to be portable and run unattended. A second, older model was deliberately left imperfect, producing occasional misses and false positives that make the manipulation harder to spot. In the live demo, detected cars, animals and other objects in captured frames are replaced with substitute images, and the confidence threshold acts as a tunable parameter for how often and how precisely the change is applied.

The closing part weighs trade-offs between accuracy, inference speed and model sophistication, and frames the technique as an augmentation of a classic attack pattern rather than a new one. Suggested mitigations are the familiar ARP defenses: segmenting the network, encrypting traffic where possible, and monitoring ARP activity. The speakers also raise open questions about detecting subtle pixel-level tampering and responding to it, and they say they plan to release the tooling.