![Page 1: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/1.jpg)
Who Controls the Controllers?
Hacking Crestron IoT Automation
Systems
![Page 2: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/2.jpg)
Copyright 2017 Trend Micro Inc. 2
Who am I?
• Offensive Security Research on ASR team at Trend
Micro
– Focused mainly on IoT research
– Break things in interesting ways and build cool exploit
demos
– Report vulns to ZDI and work with vendors to fix issues
– 40+ disclosed vulnerabilities
• Conference speaker
– Defcon, Recon, Ruxcon, Toorcon, etc
![Page 3: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/3.jpg)
Copyright 2017 Trend Micro Inc. 3
What is Crestron?
![Page 4: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/4.jpg)
Copyright 2017 Trend Micro Inc. 4
IoT Device Controllers
• Audio/video distribution
• Lighting/shades
• Home automation
• Building management systems (BACNET)
• Access control/security
• Etc…
![Page 5: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/5.jpg)
Copyright 2017 Trend Micro Inc. 5
Fully Programmable/Customizable
• SIMPL
– Symbol Intensive Master Programming Language
– Write programs for UI and device actions
• Device control methods
– IR
– Serial
– TCP/IP
– Relay
– MIDI
– Cresnet
• Interact with and program controllers via Crestron Terminal Protocol (CTP)
• Crestron devices intercommunicate via Crestron Internet Protocol (CIP)
• Programming can be complex, usually handled by professionals
![Page 6: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/6.jpg)
Copyright 2017 Trend Micro Inc. 6
Deployment
• Universities
• Office environments
• Sports arenas
• Airports
• Hotels
• Rich people's houses
![Page 7: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/7.jpg)
Copyright 2017 Trend Micro Inc. 7
Deployment
https://www.crestron.com/getmedia/06b92c9d-c262-4190-bf52-4180d8f77fca/mg_2017_Brochure_Workplace-Tech-Design-Guide
![Page 8: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/8.jpg)
Copyright 2017 Trend Micro Inc. 8
Deployment
• “Microsoft chose Crestron as its exclusive partner to
manage all AV and meeting room resources worldwide.”
– https://support.crestron.com/app/answers/answer_view/a_id
/4818/~/what-kind-of-security-and-encryption-crestron-
deploys
• “Crestron and Microsoft are technology leaders now
working together to develop future digital media
innovations.”
– http://www.crestron.com/getmedia/3321a1e7-f0d6-47b8-
9021-a473981f8983/cs_Microsoft_World_Headquarters
![Page 9: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/9.jpg)
Copyright 2017 Trend Micro Inc. 9
Deployment
• Massachusetts Bay Transit Authority
– https://www.crestron.com/en-US/News/Case-
Studies/Massachusetts-Bay-Transit-Authority
• Chicago Police Department
– https://www.crestron.com/en-US/News/Case-
Studies/Chicago-Police-Department
• American Water Corporate Headquarters
– https://www.crestron.com/en-US/News/Case-
Studies/American-Water-Corporate-Headquarters
![Page 10: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/10.jpg)
Copyright 2017 Trend Micro Inc. 10
Deployment
https://www.crestron.com/en-US/News/Case-Studies/Senate-of-Virginia
![Page 11: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/11.jpg)
Copyright 2017 Trend Micro Inc. 11
Deployment
http://hughsaudiovideo.com/hospitality_showcase.pdf
![Page 12: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/12.jpg)
Copyright 2017 Trend Micro Inc. 12
Products
• 3-Series controllers
– CP3, MC3, PRO3
– DIN rail
• Touch screens
– TSx
– TPCS, TPMC
– “One in every room” type deployments
![Page 13: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/13.jpg)
Copyright 2017 Trend Micro Inc. 13
Products
And more…
![Page 14: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/14.jpg)
Copyright 2017 Trend Micro Inc. 14
Platforms
• Mainly Windows
– Most products run WinCE 6
– Some other embedded Win versions allegedly
• Some Android/Linux
– Touch screens (TSx)
– Video processors and digital media streamers (DGE-100, DMC-
STR, etc)
– More?
• If something is specific to either the Windows or Android
platform, I’ll do my best to call it out
![Page 15: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/15.jpg)
Copyright 2017 Trend Micro Inc. 15
Discovery
• Magic packet to UDP 41794 (broadcast or
unicast)
– "\x14\x00\x00\x00\x01\x04\x00\x03\x00\x00" +
hostname + "\x00" * (256 - hostname.length)
• Response gives:
– Hostname
– Product
– Firmware version
– Build date
![Page 16: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/16.jpg)
Copyright 2017 Trend Micro Inc. 16
Discovery
• Shodan results between 20,000 and 23,000
• Most common product is split between CP3 and MC3
results from 2018/06/11
![Page 17: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/17.jpg)
Copyright 2017 Trend Micro Inc. 17
So What is Crestron?
• A lot of different things
• Running different programs
• On different platforms
• In different environments
But there are a couple universal truths…
![Page 18: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/18.jpg)
Copyright 2017 Trend Micro Inc. 18
Anonymous Admin on CTP Console
![Page 19: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/19.jpg)
Copyright 2017 Trend Micro Inc. 19
CTP Console
• Main programming interface for devices
• Telnet-like console on TCP 41795
• Sandbox file system/commands
• Auth is available
– Different user levels (Administrator, Operator, Programmer, User, etc)
– Active Directory tie-ins
– Encryption
• Auth is disabled by default
– Reliant on programmer/installer to be security conscious
– Adds more complexity to already complex system
– Enabling is a multi-step process
– Never gets turned on
![Page 20: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/20.jpg)
Copyright 2017 Trend Micro Inc. 20
CTP Console
![Page 21: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/21.jpg)
Copyright 2017 Trend Micro Inc. 21
Standard CTP Functionality
• Change system and service settings
– Auth settings
– Web portal settings
– SSH/Telnet/FTP
– Basic SIP settings (Android?)
• Networking info/config
• Arbitrary file upload
– fgetfile/fputfile - HTTP/FTP file transfer
– xgetfile/xputfile - XMODEM file transfer
![Page 22: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/22.jpg)
Copyright 2017 Trend Micro Inc. 22
Standard CTP Functionality
• Firmware updates
• Run and control user programs
• Control output to other devices
– Display messages on OSD
– Play audio/video files
![Page 23: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/23.jpg)
Copyright 2017 Trend Micro Inc. 23
Hidden CTP Functionality
• Running processes: taskstat
![Page 24: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/24.jpg)
Copyright 2017 Trend Micro Inc. 24
Hidden CTP Functionality
• View/modify stored certificates: certificate
![Page 25: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/25.jpg)
Copyright 2017 Trend Micro Inc. 25
Hidden CTP Functionality
• Dr Watson dumps: drwatson (WinCE)
![Page 26: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/26.jpg)
Copyright 2017 Trend Micro Inc. 26
Hidden CTP Functionality
• Direct chip communication: readi2c/writei2c (WinCE?)
![Page 27: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/27.jpg)
Copyright 2017 Trend Micro Inc. 27
Hidden CTP Functionality
• Browser remote control: browseropen/browserclose (Android)
![Page 28: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/28.jpg)
Copyright 2017 Trend Micro Inc. 28
Hidden CTP Functionality
• UI interaction: fakekey/faketouch (Android)
![Page 29: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/29.jpg)
Copyright 2017 Trend Micro Inc. 29
Hidden CTP Functionality
• Record audio via microphone: recwave (Android)
![Page 30: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/30.jpg)
Copyright 2017 Trend Micro Inc. 30
DEMO
![Page 31: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/31.jpg)
Copyright 2017 Trend Micro Inc. 31
A Few RCE Vulns…
![Page 32: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/32.jpg)
Copyright 2017 Trend Micro Inc. 32
Cmd Inj Vulns on Android Platform
• 22 command injection vulns so far in CTP console
– ping (CVE-2018-5553)
• Simultaneously discovered by Cale Black and Jordan Larose of
Rapid7
• https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-
5553-crestron-dge-100-console-command-injection-fixed/
– But also adduser, cd, copyfile, delete, dir, fgetfile,
fputfile, isdir, makedir, movefile, removedir, routeadd,
routedelete, udir, updatepassword, wifipskpassword,
wifissid, wifiwephexpassword, wifiweppassword, and
more…
![Page 33: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/33.jpg)
Copyright 2017 Trend Micro Inc. 33
Cmd Inj Vulns on Android Platform
• Commands implemented programatically on
WinCE platform
• Just punted to shell on Android
• Most were simple to exploit
– EX: isdir `cmd`
![Page 34: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/34.jpg)
Copyright 2017 Trend Micro Inc. 34
Cmd Inj Vulns on Android Platform
![Page 35: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/35.jpg)
Copyright 2017 Trend Micro Inc. 35
routeadd/routedelete Exploitation
• First problem
– Arguments get up-cased before use
– Linux commands are case-sensitive
• Solution
– Create shell script containing desired commands
– Name it “BLAH”
– Upload it with fgetfile command
![Page 36: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/36.jpg)
Copyright 2017 Trend Micro Inc. 36
routeadd/routedelete Exploitation
• Second problem
– Uploaded script doesn’t have exec perms
– $SHELL/$BASH not set
• Solution
– $0 returns name of calling program
– When used in system() call, it returns name of shell
instead
– Final injected string: `$0$IFS./BLAH`
– Could have also used . (as in the command) in place of $0
![Page 37: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/37.jpg)
Copyright 2017 Trend Micro Inc. 37
DEMO
![Page 38: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/38.jpg)
Copyright 2017 Trend Micro Inc. 38
Round 2?
• Kept finding more vulns while root causing
others
• Had to cut myself off due to time constraints
• Pretty positive there is more to find
![Page 39: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/39.jpg)
Copyright 2017 Trend Micro Inc. 39
I Want More!
• Significant amount of control by default
• Can escape CTP sandbox on Android using
vulns
• But what about WinCE?…What about a more “legit” escape on Android?
![Page 40: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/40.jpg)
Copyright 2017 Trend Micro Inc. 40
SUPER SECRET BONUS DEMO
![Page 41: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/41.jpg)
Copyright 2017 Trend Micro Inc. 41
Conclusions
• Potential for good security practice is there
but disabled by default
– Installers/programmers not security conscious or
just concerned with getting everything working
– Normal users unaware of problem
– If security isn't enabled by default, it is probably
not going to be enabled
![Page 42: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/42.jpg)
Copyright 2017 Trend Micro Inc. 42
Conclusions
• Wide deployment, including sensitive
environments
– High potential for abuse by insider threats
• Boardroom spying/corporate espionage
• Messing with building/access control systems
• Hotel guests spying on other guests
– Even “isolated networks” are not good enough
![Page 43: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/43.jpg)
Copyright 2017 Trend Micro Inc. 43
Conclusions
• Android platform seems much less secure
than WinCE platform
– Surprising at first, but makes sense
• Crestron has long history with WinCE
• Microsoft partnerships
• Newer to the Linux/Android world
• Too much product fragmentation?
![Page 44: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/44.jpg)
Copyright 2017 Trend Micro Inc. 44
Huge Amount of Auditing Left
• More CTP attack surface
– More RCE vulns?
– SIMPL and PUF
• Other services
– CIP, HTTP, FTP, SIP, SNMP, SSH, Telnet, etc…
• Other products
– Fusion, Xpanel, AirMedia, XIO Cloud, etc…
• IOAVA
![Page 45: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/45.jpg)
Copyright 2017 Trend Micro Inc. 45
Questions? Hit Me Up
– https://twitter.com/HeadlessZeke
– ricky[underscore]lawshae[at]trendmicro[dot]com
• Github
– https://github.com/headlesszeke
![Page 46: Who Controls the Controllers? - DEF CON Media Server CON 26/DEF CON 26...2018/06/11 · • Interact with and program controllers via Crestron Terminal Protocol (CTP) • Crestron](https://reader033.vdocuments.us/reader033/viewer/2022060822/609be93212e4c01e827101c9/html5/thumbnails/46.jpg)
Copyright 2017 Trend Micro Inc. 46
Thank You