Priceless: Hacking Electronic Shelf Labels​

### Overview In this talk, students Jakob, Marios, and Conrad from the University of Darmstadt present their security evaluation and reverse engineering of Electronic Shelf Labels (ESLs). Motivated by curiosity about digital price tags in grocery stores and the potential to alter prices, the researchers examined systems from two Chinese IoT vendors: Pixsmart and a vendor referred to as Sanico. Their analysis evaluated Bluetooth Low Energy (BLE) tags, custom 2.4 GHz proprietary protocols, backend web platforms, and dedicated supermarket access points.

### Key Topics - **Pixsmart ESL Security**: Investigation of BLE communication and backend APIs used by Pixsmart. - **Sanico ESL Architecture**: Analysis of BLE price tags, proprietary 2.4 GHz RF tags, and an associated access point. - **Mobile and Cloud Weaknesses**: Reverse engineering Flutter/Dart mobile apps and auditing web management consoles. - **Access Point Hardware and Firmware Analysis**: Deconstructing an embedded Linux/Rockchip access point exposing ADB, root execution, and remote RF broadcast capabilities.

### Technical Details - **Pixsmart Analysis**: Decompiling the Android companion app using Jadx revealed Java classes controlling BLE communication alongside Flutter assets. The BLE protocol lacked authentication entirely, allowing arbitrary image and price data to be sent within Bluetooth range (~20 meters). Examination of backend HTTP APIs uncovered missing access controls: an attacker could perform substring searches on MAC addresses, extract current shelf contents, overwrite database entries, and delete label templates. - **Sanico BLE & Web Platform**: Sanico's Flutter application was analyzed using `blutter` to extract Dart runtime intermediate structures and function names. The BLE implementation included a challenge-response mechanism, but it relied on a hardcoded static secret key across the app and tags, negating security. Furthermore, prolonged LED blink commands could be issued to cause battery drainage. On the web management platform, default predictable credentials (incremental usernames with date-based passwords) enabled account takeovers. An insecure direct object reference (IDOR) via the `storeId` parameter allowed settings manipulation and API reactivation. Private API keys were shared across all stores and leaked in public documentation. Additionally, an arbitrary file upload vulnerability allowed attackers to upload HTML or JavaScript files by providing image magic bytes. - **Sanico Access Point & 2.4 GHz Subsystem**: The access point (identified as an Eastation AP04 or newer) ran embedded Linux and an exposed Android Debug Bridge (ADB) service, granting instant unauthenticated root shells over the local network. Decompiling its `.NET` runtime binary with `dnSpy` exposed MQTT command handling and serial communications to internal radio transceivers. Command settings passed to bash allowed root Remote Code Execution (RCE). The BLE setup interface was non-functional, and MQTT used default credentials (`admin`/`admin`). - **RF & Hardware Reversal**: The 2.4 GHz tag broadcast protocol included nonce and key fields, but the key was completely unverified by the tag and the nonce only checked against immediate identical repetitions, allowing replay attacks. Physical teardown revealed a Rockchip processor, a multiplexer, and six antenna transceiver modules. Although hardware debug ports (UART/JTAG) were disabled, the team captured RF bursts with a HackRF software-defined radio (SDR) and attempted to craft a GNU Radio module to transmit without the vendor access point.

### Takeaways Every evaluated layer—mobile apps, BLE protocols, cloud web services, and access point hardware—contained severe flaws, granting unauthenticated arbitrary display overwrites. The tags also lack firmware update mechanisms, meaning deployed hardware cannot be patched. Ultimately, the speakers noted that changing an electronic shelf label in a German store does not alter the checkout price, as register systems operate independently.