Film and Television: My Cheat Code is AI

It was raining heavily; it hadn't rained like this in a long time.

Tian Rui went out with a letter of complaint.

Seeing Zhang Yang's confusion, Ji Jie explained, "The case from a few days ago was transferred from downstairs. An elderly person died from falling into the elevator. Yesterday, we received a tip-off letter at the entrance saying that the elevator's operating procedure had been tampered with; it wasn't a malfunction, but a murder. Tian Rui took the letter to the tip-off writer to ask about the situation."

Zhang Yang sat at his workstation and repeated, "Run the program?"

Ji Jie looked at him: "Oh, by the way, you're pretty good with computers. From a technical perspective, is it possible to tamper with the elevator's operating program?"

Zhang Yang thought for a moment and said, "It depends on how you want to do it. If you only need to control the opening and closing of the doors, or shut down all the elevators at a certain time and leave only one open, it's not that difficult."

Deep Blue spoke in my mind.

[Analyzing vulnerabilities in the elevator control system.]

[Target model: OTIS Elevonic 411, main control board based on Intel 80186 processor, running iRMX real-time operating system. Back then, the serial interface of these elevator control cabinets typically lacked encryption and authentication. As long as physical contact with the control cabinet's RS-232 maintenance port was possible, or access was gained through the shared bus of the Building Automation System (BAS), dispatch commands could be sent directly. The drawback was that it left logs, but many property management companies at that time simply didn't check them, let alone back them up. Another method, if the elevator's floor call signals used a CAN bus, was to connect a node to the bus to simulate floor button signals, which could also fool the main control unit.]

[Conclusion: The timeframe of 2003 was technically feasible.]

Ji Jie asked again, "Can you find out?"

Zhang Yang nodded: "We can just check the computer logs. These days, a lot of people don't read logs. We can check and find out when the program was started, which will help us determine the exact time of the incident. If it is indeed murder, we need a search warrant."

Just then, Tian Rui returned, slammed the complaint letter on the table angrily, and said, "Sister Ji, this story is purely fictional!"

Looking at her like that, Ji Jie couldn't help but say, "I said you flew back? I timed it for you, and your conversation with that computer geek didn't last more than five minutes."

Tian Rui took a sip of water and, after catching her breath, said, "I would like to ask more detailed questions, but his attitude... made it impossible to have a conversation."

Ji Jie picked up her bag and stood up: "Come with me. Zhang Yang, you come too, let's test our idea."

Zhang Yang replied, "Okay."

Tian Rui was still muttering in her seat, "Going again? Who would kill a powerless, penniless, womanless, blind, and toothless retired old man?"

Ji Jie didn't turn her head, but pointed upstairs: "If you don't want to go, see? Go upstairs and turn the corner, Zhou's office is over there."

Tian Rui had nothing to say, so she grabbed her bag and followed.

The three drove to the residential complex and found the property management staff. Upon seeing that it was the police again, the staff member's face was full of reluctance: "Hey, didn't the police already rule it an accidental death? Why are you still investigating?"

Ji Jie ignored his question and instead asked, "How much property management fee do you collect from them each year?"

The property management staff member was taken aback and said awkwardly, "The elevator in Tower 13 has always been malfunctioning, but it's not a big problem. Who knew such a big thing would happen that day?"

Tian Rui, standing nearby, said, "If you lived in Building 13, wouldn't you remember right away?"

The property management staff argued, "We reported the problem a little late, but the elevator company didn't send anyone for several days. We also took precautionary measures during this time."

Ji Jie asked, "What measures?"

The property management staff quickly said, "We posted notices at the elevator entrance on every floor and notified each floor, but who would have thought this would still happen?"

As the group approached the elevator, Ji Jie noticed a note on the door that read: "Please confirm the location of the elevator car before entering."

Just then, the elevator doors suddenly opened, and a very beautiful woman stepped out. The property staff greeted her with a smile: "Xiao Liao, you're going out? We've reserved a parking space for you, number 88."

Xiao Liao simply nodded, said nothing, and walked away.

The property management staff member muttered awkwardly, "Hey, why aren't you thanking me?"

The elevator doors were still open. Ji Jie went in first to investigate, but Zhang Yang didn't follow. He turned to the property management staff and asked, "I'd like to go to your property management office to see if the elevator's operation is controlled by the computer there?"

The property manager scratched his head: "Well... I don't really know either, but it seems to be over there."

Upon arriving at the property management office, an old desktop computer sat in the corner, its gray-white case fitted with one of those bulky CRT monitors. Zhang Yang's chair creaked as he sat down, but he ignored it, glancing at the desktop first. It was a Windows 2000 system, the icons arranged haphazardly. In the lower right corner of the taskbar hung an icon for elevator monitoring software called "OTIS Elevonic Supervision," version 1.2.3.

Zhang Yang first opened the software interface and checked it. The main window displayed the operating status of the six elevators in the community, with the one in Building 13 marked in red as "locked for maintenance". He pressed Alt+Tab to switch to the command line and pinged the elevator control cabinet's IP address—192.168.1.41—and it connected.

"Deep Blue, take a look at this for me."

Deep Blue's voice echoed in his mind. Zhang Yang's fingers flew across the keyboard, first bringing up the system process list, finding the process name of the elevator monitoring software, "OTISsv.exe," and then opening a hexadecimal editor to examine the dynamic link libraries called by this program. Deep Blue scanned synchronously in the background, and the analysis results came out about three minutes later.

The software sends elevator lock/unlock commands via TCP port 4001. The protocol is unencrypted, and the command format is "LOCK [elevator number][duration]" and "UNLOCK [elevator number]". More importantly, the password verification for logging into the management backend is done locally—the password hash is written in plaintext in the config.ini file in the installation directory.

Zhang Yang went into the installation directory, C:\Program Files\OTIS\Supervision, and sure enough, there was a config.ini file. He opened it with Notepad, flipped to the [Admin] section, and saw a string of hexadecimal characters after the password. He took out a 128MB USB drive, copied a hash cracking tool he had written into it, and in less than thirty seconds, the password was revealed: admin123.

"This is so careless," Zhang Yang muttered, and logged into the management backend using this password.

The backend interface was very basic, with white background and black text, a menu bar on the left, and operation logs on the right. Zhang Yang didn't rush to look at the logs. He first found the "Elevator Status Control" section in the menu, clicked on it, and saw that the lock command for Building 13 was indeed active, but the source IP was not this property management computer, but 192.168.1.200, an address not within the property management office's local area network.

"Someone has come in from the outside."

Zhang Yang's fingers didn't stop; he switched back to the command line and started writing a Python script. This was back in the Python 2.3 era, and he was still using the IDLE editor, the code popping up line by line. After the script finished running, only the elevator in building 13 was locked; the rest were all working normally. He closed the script and then pulled out the system logs. Although the log functions of that era were rudimentary, they had everything you needed: timestamp, operation type, source IP, and execution result. He pressed Ctrl+F to search for the date of the incident, scrolling down the screen line by line.

Starting at midnight, the logs showed normal scheduled inspection commands every fifteen minutes, with the source IP always being the local machine's 127.0.0.1. Zhang Yang continued scrolling down, his brow twitching slightly. At 12:17 AM, the first abnormal record appeared, with the source IP being 192.168.1.200 and the operation type being "LOGIN".

Someone has logged in.

Next came a "QUERY 13-1 STATUS," querying the elevator status of Unit 1, Building 13. Then came a series of configuration commands, which Zhang Yang read through one by one, muttering, "First check the status, then change the timing parameters... set it to trigger at 1:00 AM sharp, locking a specific floor in Building 13." He tapped his finger on the screen, "Timing device."

Scrolling further back, at 1:02 AM, the same IP address sent another command, deleting the scheduled task and then logging out. The entire process took less than twenty minutes, clean and efficient.

Zhang Yang stood up and turned the screen towards Ji Jie: "Sister Ji, let's apply for an investigation. At 12:17 on the night of the incident, an unknown ID remotely logged into the elevator control system. First, it checked the status of the elevator in Building 13, and then used a timer to lock the elevator door on a certain floor at 1:00 AM. After completing the operation, it even deleted the timed task. If it weren't for the record in the log, we wouldn't have been able to find out at all."

Ji Jie bent down to look at the screen; the log entries were clearly displayed, including the time, IP address, and operation details. She straightened up, her tone changing: "Can this IP be traced?"

Zhang Yang sat down again, typed a command in the command line to check the MAC address of 192.168.1.200, and said, "It can be traced. This IP is not in the property management's fixed allocation table, which means someone has temporarily accessed the community's local area network. I'll check the switch logs; I should be able to find out which network port and which building this MAC address corresponds to."

He typed a few more commands, and lines of data scrolled down the screen. The property manager standing next to him was stunned, completely unexpected that this old computer could reveal so much.

The location was quickly determined. Zhang Yang said, "It's an external network connection." He then turned to the property management staff and asked, "Does your building have an external network cable connection port?"

The property management staff shook their heads: "I don't know, but there's a telecommunications box on the twelfth floor."

Zhang Yang looked at Ji Jie: "Sister Ji, it should be that box. He brought his laptop there, connected it to the internet, set a timer, and then went back to delete the program after he was done committing the crime."

Ji Jie made a quick decision: "Go back to the team."

Back at the team, I saw Lao He sitting there happily.

Zhang Yang asked, "Old He, what's wrong? Why are you so happy?"

Old He said with a grin, "Someone turned themselves in just now from the case that Yang Zhen and his team took on this morning."

Zhang Yang also said with a smile, "Brother Yang and his team are lucky; they solved the case so quickly."

"That's right."