Lighting Up ShmooCon: Interactive Light Wands for an Epic Opening

Lighting Up ShmooCon: Interactive Light Wands for an Epic Opening

Speakers: Rob Joyce

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=wXbnUm88IJw

Overview

In "Lighting Up ShmooCon: Interactive Light Wands for an Epic Opening," Rob Joyce, a well-known figure in the security community, takes attendees on an unexpected journey into his passion for elaborate, interactive Christmas light displays. This talk, delivered at ShmooCon, transcends typical security topics to explore the fascinating blend of consumer electronics, radio frequency (RF) communication, and community engagement. Joyce reveals the underlying technology of the interactive light wands distributed at the conference, demonstrating how readily available, inexpensive hardware can be orchestrated for large-scale, dynamic visual effects.

The presentation serves as both a technical dissection and an invitation to the vibrant world of hobbyist lighting. Joyce delves into the reverse engineering efforts that uncovered the internal components and communication protocols of these Chinese-manufactured devices. More than just a show-and-tell, the talk highlights the practical challenges and surprising side effects of deploying widespread RF-controlled gadgets, such as unintended interference with other common RF devices. It underscores how curiosity-driven exploration can reveal intricate systems even in seemingly simple consumer products, offering valuable lessons in hardware analysis and RF communication.

The significance of this talk extends beyond its immediate subject matter. It exemplifies the hacker ethos of understanding how things work, even when those "things" are festive light wands rather than exploit targets. By open-sourcing his findings and issuing challenges to the community, Joyce fosters collaborative reverse engineering and innovation, particularly with tools like the Flipper Zero. This not only enhances the ShmooCon experience but also educates attendees on the ubiquity and potential implications of low-power RF devices in our daily lives, demonstrating that security-minded inquiry can be applied to any domain.

Background

▶ Watch: Introduction to interactive light wands (0:00)

Rob Joyce's journey into interactive light displays began with a personal passion for creating "outrageous absurd Christmas light displays" at his home. This hobby evolved from static light arrangements to dynamic, interactive experiences designed to draw in visitors, especially children. Initially, Joyce experimented with interactive bracelets, commonly used in concert venues. While effective, these bracelets proved cumbersome for visitors to wear and remove, leading him to seek a more user-friendly alternative.

This quest led him to discover RF-controlled light wands, which offered a more engaging and accessible interactive element. These wands, akin to "lightsabers," not only provided immediate visual feedback but also had built-in modes that allowed them to function independently after leaving the display, enhancing their appeal. The wands are mass-produced by a Chinese company, Great Favoian Electronic Company, out of Shenzhen, China, primarily sourced through their website, ledgiftsupplier.com. The challenge for hobbyists lies in purchasing these devices at scale, as the manufacturer typically requires bulk orders. However, Joyce noted that options exist through annual group buys within the Christmas light aficionado community or directly from suppliers like Wally's Lights, albeit at a higher cost for smaller quantities. For conference-level volumes, direct engagement with the manufacturer allows for custom branding and competitive pricing, with unit costs falling under $2 apiece for orders of 2,500 units.

The broader context for controlling these devices stems from the established Christmas light hobbyist community, which extensively uses the DMX 512 digital lighting control standard. DMX 512, originally designed for controlling light dimmers in theatrical and concert settings, has become the de facto standard for complex light displays, offering 512 control channels per "universe" and scalability for larger installations. Software like xLights, an open-source project, serves as the primary tool for designing and sequencing these elaborate light shows, providing a robust ecosystem for hobbyists to share and adapt display configurations. Joyce's integration of the light wands into this existing framework leverages a mature control standard and a supportive community, transforming simple consumer gadgets into components of a sophisticated, interactive spectacle.

Key Findings

▶ Watch: Origin and affordability of the light wands (4:10)

The technical exploration of the interactive light wands revealed several key findings regarding their internal architecture and communication protocols. Each light wand contains five visible LEDs, though internally, these are actually 15 individual LEDs (five sets of red, green, and blue components), which combine to form a single controllable "pixel." This allows for a full spectrum of additive colors to be generated. Power is supplied by three standard AAA batteries, and a small internal microcontroller enables built-in modes (e.g., flashing, color cycling) even when no external RF signal is present, enhancing their utility beyond the immediate display environment.

The core of the wand's remote control capability lies in its RF receiver. The device incorporates an On-Off Keying (OOK) receiver that operates at either 315 MHz or 433.92 MHz. A crystal on the printed circuit board (PCB) specifically configures the wands to operate at 433.92 MHz, a frequency commonly used for low-power RF devices in the U.S., including car key fobs and remote control weather stations. Further analysis uncovered an unlabeled 8-pin one-time programmable microcontroller responsible for processing received signals and controlling the LEDs via Pulse Width Modulation (PWM). Pinouts were identified, including VCC, ground, a pin to enable the OOK receiver, a data input pin, a button input for local mode changes, a power switch, and dedicated lines for red, green, and blue PWM signals to the LEDs.

The control signal itself is based on the DMX 512 standard, a well-established digital lighting control protocol. Joyce's custom transmitter translates DMX 512 commands into RF transmissions, capable of controlling the wands from distances up to 1.5 miles. The specific DMX addressing scheme involves sending hex 55 in channel 1 to "get the attention" of the devices. A subsequent channel allows for grouping (e.g., hats, bracelets, wands), with a value of 0 targeting all listening devices. Following this, values from 0 to 255 are sent for the intensity of red, green, and blue channels, enabling full-color control. A notable real-world issue discovered by prior users and experienced by Joyce's son is the unintentional "dosing" or interference with car key fobs operating on the same 433.92 MHz frequency due to the transmitter's significant range and power. This highlights a practical challenge of widespread, high-power RF deployment in shared spectrum bands.

Technical Deep Dive

▶ Watch: Where to buy the light wands (6:50)

The interactive light wands are a testament to efficient, low-cost hardware design, centered around RF communication and a dedicated microcontroller. At their heart, each wand integrates 15 individual RGB LEDs (arranged as five tri-color packages), which are treated as a single pixel for control purposes. These are diffused by an internal tube to create a smooth, continuous glow rather than direct points of light. Powering the system are three AAA batteries, which feed into a voltage regulator that supplies the necessary 3.3-volt logic to the control circuitry.

The RF reception is managed by an On-Off Keying (OOK) receiver, a simple and cost-effective modulation scheme where data is encoded by the presence or absence of a carrier wave. The specific operating frequency of 433.92 MHz is selected by a crystal oscillator on the PCB, positioning the wands within a spectrum band widely used for consumer and industrial low-power RF applications in the United States. This frequency choice, while common, is also the source of the observed interference with car key fobs.

The "brain" of the wand is an unlabeled 8-pin one-time programmable microcontroller. Reverse engineering efforts by Joyce and his collaborators identified the critical pin assignments:

• VCC and Ground: Standard power and reference lines.
• Receiver Enable: A pin that activates the OOK receiver to listen for incoming RF signals, likely to conserve battery power when not actively receiving.
• Data In: The input pin for the decoded OOK signal from the receiver.
• Button Input: Connected to the physical button on the wand, allowing users to cycle through local, pre-programmed modes.
• Power Switch: Input for the physical power switch.
• RGB PWM Outputs: Three distinct pins providing Pulse Width Modulated (PWM) signals to control the intensity of the red, green, and blue LEDs. By varying the duty cycle of these PWM signals, the microcontroller can achieve a full spectrum of colors.

The external control system leverages the industry-standard DMX 512 protocol. DMX 512 is a digital communication network standard used to control stage lighting and effects. It operates by defining 512 control channels, each capable of a value from 0 to 255. Joyce's setup uses a custom transmitter that converts these DMX signals into wireless RF packets on the 433.92 MHz band. The protocol for controlling the wands via DMX is structured as follows:

1. Attention Code: hex 55 is sent in DMX channel 1 to signal all listening devices to prepare for commands.
2. Grouping Channel: A subsequent DMX channel is used for device grouping. Sending 0 in this channel targets all light wands (and potentially other interactive devices like hats or bracelets) that are listening.
3. Color Control: Following the attention and grouping, three consecutive DMX channels are used to send the intensity values (0-255) for Red, Green, and Blue components, respectively. These values are then translated by the microcontroller into the appropriate PWM signals for the LEDs.

The speaker's setup, which includes the custom DMX-to-RF transmitter, boasts an impressive range of approximately 1.5 miles. This power level is assumed to be FCC compliant, enabling broad coverage for large-scale displays. However, the use of a common frequency at such power and range inevitably leads to the "dosing" effect on other 433.92 MHz devices. This unintended consequence underscores the challenges of deploying powerful RF systems in shared, unlicensed spectrums.

Joyce concluded the technical section by issuing two challenges to the community:

1. RF Protocol Reverse Engineering: A comprehensive explanation of the specific RF protocol carrying the DMX 512 data over the 433.92 MHz link.
2. Flipper Zero App Development: A native Flipper Zero application capable of generating the required RF control codes (not just replaying captured signals) to control the wands, providing a portable, push-button solution for hobbyists. These challenges highlight the ongoing potential for further community-driven exploration and development around these simple yet effective devices.

Demo / Proof of Concept

▶ Watch: Technical deep dive into wand electronics (8:00)

During the talk, Rob Joyce provided a compelling demonstration of the interactive light wands and the software used to orchestrate his elaborate Christmas light displays. The core of his demonstration involved showcasing the xLights software, an open-source platform widely adopted by the Christmas light hobbyist community for designing and sequencing complex light shows.

Joyce displayed a virtual representation of his house within xLights, complete with various lighting elements he uses in his personal display. Crucially, this virtual model included the light wands, allowing the audience to visualize how they integrate into a larger, synchronized spectacle. He explained how xLights enables users to map sequences and songs onto their specific house layouts, facilitating sharing and adaptation within the community.

The most direct and impactful part of the demonstration was the live, interactive control of the light wands held by the audience members. Joyce remotely activated and changed the colors of the wands, illustrating the real-time responsiveness of the RF control system. This immediate feedback loop vividly brought the technical explanation to life, showcasing how the DMX 512 commands, translated into RF signals, could instantly alter the visual output of hundreds of devices simultaneously. He also playfully mentioned the "epic lightsaber battles" that frequently erupt outside his house, a testament to the engaging nature of the wand's form factor and interactivity. While no dedicated, separate proof-of-concept exploit was demonstrated, the live interaction with the audience's wands served as a powerful and effective proof of the described control mechanism and its practical application.

Defensive Implications

▶ Watch: Real-world issue: inadvertently jamming car key fobs (12:00)

While Rob Joyce's talk focuses on a hobbyist application, the technical insights into the interactive light wands carry several defensive implications, particularly regarding the broader landscape of low-cost, mass-produced RF devices. The primary takeaway for defenders is the inherent vulnerability of simple On-Off Keying (OOK) protocols operating in shared, unlicensed spectrums. The choice of 433.92 MHz for the wands is significant because it's a common frequency for critical short-range devices like car key fobs, garage door openers, and even some home alarm systems.

The demonstrated range of 1.5 miles for the control signal, coupled with the "dosing key fobs" issue, highlights the potential for unintentional RF interference on a large scale. While Joyce's intent is benign, this scenario illustrates how a powerful transmitter on a shared frequency can disrupt legitimate operations. In a malicious context, an adversary could leverage similar techniques to jam or spoof signals for other OOK-based devices, leading to denial of service (e.g., preventing car owners from locking/unlocking their vehicles) or potentially even unauthorized access if the protocol is simple enough for replay attacks.

Furthermore, the speaker's challenge to the community to reverse engineer the full RF protocol and develop a Flipper Zero app underscores the low barrier to entry for analyzing and manipulating these devices. The Flipper Zero, a portable multi-tool for hackers, is specifically designed to interact with such RF systems. If the protocol for the wands (or similar OOK devices) lacks any form of cryptographic authentication or encryption, it becomes trivial for anyone with the right tools and knowledge to impersonate the legitimate controller or inject arbitrary commands. This applies not just to light wands but to a myriad of consumer IoT devices that prioritize cost and simplicity over robust security.

For defenders, this talk serves as a reminder to:

• Assess the RF environment: Understand what frequencies are in use within their operational space and what devices rely on them.
• Evaluate low-cost RF devices: Recognize that widespread, inexpensive RF gadgets often employ basic, insecure protocols that can be easily analyzed and exploited.
• Consider interference vectors: Account for both intentional and unintentional RF interference as a potential threat vector against critical infrastructure or personnel.
• Promote secure design principles: Advocate for the inclusion of cryptographic measures (authentication, encryption) even in seemingly innocuous devices, especially those that might operate on shared frequencies or at significant power levels.

The "Lighting Up ShmooCon" talk, therefore, subtly warns against the complacency surrounding simple RF technologies, demonstrating how a festive light show can inadvertently expose fundamental vulnerabilities in our interconnected, radio-frequency-laden world.

Key Takeaways

• Interactive light wands provide an engaging, low-cost method for audience participation and large-scale visual displays, costing under $2 per unit at scale.
• The wands operate using a simple On-Off Keying (OOK) RF protocol on the 433.92 MHz frequency, controlled by an internal one-time programmable microcontroller.
• Control commands are based on the DMX 512 digital lighting standard, translated wirelessly, using specific DMX channels for attention, grouping, and RGB intensity (0-255 values).
• The high transmission power and 1.5-mile range of the control system can cause unintentional interference with other devices operating on the 433.92 MHz band, such as car key fobs.
• The talk encourages community engagement in reverse engineering the specific RF link protocol and developing tools like a native Flipper Zero application for generating control codes.
• The underlying technology exemplifies how readily available, inexpensive consumer electronics can be adapted for complex, synchronized displays, supported by open-source software like xLights and a vibrant hobbyist community.

About the Speaker(s)

Rob Joyce is a distinguished figure known for his extensive contributions to the cybersecurity community, often associated with the National Security Agency (NSA), where he humorously admitted to knowing "how to keep a secret" when asked about his light show's cost. Beyond his professional achievements, Joyce is celebrated for his passionate and elaborate hobby of creating "outrageous absurd Christmas light displays" at his home. This talk at ShmooCon perfectly encapsulates his blend of technical curiosity and a desire to share knowledge and inspire others. He actively engages with the community, openly discussing his reverse engineering efforts on the light wands and crediting various individuals like Kate Kuhn, Bob Ackerman, Wasabi, Kiwi, Kyle Skay, and David Manner for their assistance in dissecting the technology. Joyce's presentation style is both confident and analytical, reflecting his deep understanding of technology while maintaining an accessible and engaging approach for a diverse audience.