Comcast TV Remote “WarezTheRemote” Vulnerability can Turn into a Listening Device

The XR11 remote uses RF4CE (Radio Frequency for Consumer Electronics) protocol that is a subnet to the Zigbee protocol that uses power-saving RF (Radio Frequency) to communicate with the TV’s set-top box. RF4CE protocol contains a security feature that should encrypt the contents of RF4CE packets to prevent attackers from being able to apply malicious packet injection in the connection. In the security encryption feature there are “flags” within each packet being sent, if the bite is set  to 1 the contents are encrypted, however, if the bite is not set then the packet contents will be sent in plaintext [1]. The “WarezTheRemote” Vulnerability was not verifying the responses whether the packet was encrypted. Which meant if an attacker is within RF range, they can respond to the outgoing encrypted requests from the remote in plaintext because the device was accepting any false responses. Becoming the man-in-the-middle attack through the RF (Radio Frequency) with the set-top box and over-the-air firmware upgrade [2].