5 ms·

RTL SDRs are such a great way to get into this (less than $20 on Amazon). I was shocked to see how easy the garage door opened once I'd captured a packet with

RTL SDRs are such a great way to get into this (less than $20 on Amazon). I was shocked to see how easy the garage door opened once I'd captured a packet with the RTL SDR (on 433 Mhz) and then replayed it through the Rasperry Pi bit-banging FM hack with a tiny wire on a pin. I looked at the code and converted it to 0s and 1s, only to find out that it was always the same and also that the middle part matched the 8-bit hard-coded on/off switch every garage tends to have to adjust your coding (so your neighbour doesn't open yours). I then realised it would only take about 256 attempts to open just about any garage door in my neighbourhood (most are bought from one or two vendors). All it takes is a Raspberry PI, a USB power-bank and a script that runs in a loop. Amazing. Shocking also. But fascinating.

op00to 4y ago
My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? I remember reading a text file back in the early 90s downloaded from a bbs that had plans for a master garage door opener. Seemed like magic.
- tyingq 4y ago
  > My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? Samy Kamkar's Rolljam supposedly does well against those, though the owner's fob quits working, so it's not stealthy. https://archive.ph/lHHnQ https://archive.ph/lHHnQ
- garaetjjte 4y ago
  Vulnerabilities happened in rolling code systems too, see for example https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd... (they were able to read manufacturer key and then clone any transmitter just by eavesdropping) or https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
jcrawfordor 4y ago
While rolling code has now been the norm for some time, there are a lot of older garage door openers still in service. More concerning, commercial buildings like apartment complexes often remain vulnerable to these trivial replay attacks because of a "lowest common denominator" effect... they purchase gate controllers, door locks, tokens, etc from different vendors, and the only interoperable protocol may be a very poorly secured one. This is a major problem with door locks where very outdated ProxCard standard remains in wide use due to low price and interoperability.
- mittermayr 4y ago
  Yeah, I think it's the fact that many of the garage doors I see around here are easily 15 to 20 years old or more. My brother approached me recently about his apartment complex garage door, as they only give out one remote unit (but they have two cars), so we duplicated the code hoping it's not a rolling code, and he tried it out and it works. So he duplicated the remote without trouble. It's an ESP32 with a battery.

op00to 4y ago

My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? I remember reading a text file back in the early 90s downloaded from a bbs that had plans for a master garage door opener. Seemed like magic.

tyingq 4y ago
> My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? Samy Kamkar's Rolljam supposedly does well against those, though the owner's fob quits working, so it's not stealthy. https://archive.ph/lHHnQ https://archive.ph/lHHnQ
garaetjjte 4y ago
Vulnerabilities happened in rolling code systems too, see for example https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd... (they were able to read manufacturer key and then clone any transmitter just by eavesdropping) or https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf https://www.usenix.org/system/files/conference/usenixsecurit...

jcrawfordor 4y ago

While rolling code has now been the norm for some time, there are a lot of older garage door openers still in service. More concerning, commercial buildings like apartment complexes often remain vulnerable to these trivial replay attacks because of a "lowest common denominator" effect... they purchase gate controllers, door locks, tokens, etc from different vendors, and the only interoperable protocol may be a very poorly secured one. This is a major problem with door locks where very outdated ProxCard standard remains in wide use due to low price and interoperability.

mittermayr 4y ago
Yeah, I think it's the fact that many of the garage doors I see around here are easily 15 to 20 years old or more. My brother approached me recently about his apartment complex garage door, as they only give out one remote unit (but they have two cars), so we duplicated the code hoping it's not a rolling code, and he tried it out and it works. So he duplicated the remote without trouble. It's an ESP32 with a battery.