Warshopping: Phreaking Smart Shopping Cart Wheels Through RF Sniffing
Reverse engineers electronic shopping cart containment wheels, capturing ultra-low-frequency and 2.4 GHz RF signals to unlock wheel braking mechanisms.
Summary
Containment Systems in Smart Shopping Carts
Retailers deploy electronic cart wheels with integrated mechanical brakes to prevent cart theft, triggering locking mechanisms via subterranean low-frequency perimeter coils.
Sniffing Ultra-Low-Frequency and 2.4 GHz Signals
Joseph Gabay analyzes the Rocateq smart wheel system, capturing perimeter boundary signals and 2.4 GHz register checkout broadcasts using software-defined radio.
Hardware Teardown and Firmware Extraction
Soldering test leads onto the wheel's internal PCB enables logic analyzer tracing of chip-to-chip serial buses, while a PICkit programmer dumps firmware for Ghidra analysis.
Simulating Control Codes via Audio Transducers
Because the wheel coils respond to low-frequency magnetic modulation, Gabay demonstrates triggering and disarming cart wheel locks directly from a smartphone speaker.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·40 min
Jiska Classen · Alexander Heinrich
SEEMOO researchers reverse engineer Apple's proprietary U1 Ultra-Wideband (UWB) chip, analyzing its operating system, cryptographic ranging protocols, and security.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.