3 ms·

I just connected my garage door opener to Home Assistant by taking apart the remote and wiring the button to a Zigbee relay. They can't stop me, no part of this

by dheera 3y ago

I just connected my garage door opener to Home Assistant by taking apart the remote and wiring the button to a Zigbee relay. They can't stop me, no part of this is connected to their cloud. In any case, smart home stuff should never rely on the cloud. https://i.imgur.com/lNOXdhe.jpg https://i.imgur.com/lNOXdhe.jpg

CamperBob2 3y ago
Funny you should mention that. I stayed at an AirBnB a while back that I selected precisely because the listing mentioned that a garage was available. It turned out that yes, you could use the garage, but the remote was not provided by the host. So I had to disengage the door and lift it manually, then close it behind me when I left every morning. "Fuck that," I said to myself, as any self-respecting hacker would. "I'll just hook a $20 remote key fob switch from Home Depot up to the button on the garage wall." That's when I found that they actually DRM'ed the button. The usual pair of wires was there, but I couldn't open the door by simply shorting them together. There were several ICs on a PC board inside the button housing doing Woz knows what. So, back to lifting the door manually. This is only going to get worse. It will get worse because we let them go this far.
- publicmail 3y ago
  I don’t really think it’s DRM. I think it’s because a lot of garage door buttons have a few functionalities, like controlling the lights as well as the door, but it works over two wires. So it probably necessitates some more complicated logic.
  - ArchOversight 3y ago
    It's Security+ or Security+ 2.0, it is literally obfuscated serial traffic over two wires. It is DRM. You can't just get any random button to open/close the garage.
  - CamperBob2 3y ago
    This one didn't. It was literally just a featureless button, engineered with intelligence it couldn't possibly need except as a means of locking out third-party hardware.
    - ssl-3 3y ago
      Even the "dumb" buttons are on a common serial bus with Security+. I agree that it is annoying in a "It's just a momentary switch! How hard can it be!" sort of way, but it be that way anyhow.
  - josephcsible 3y ago
    No, it's DRM. On older models, control over auxiliary functions worked by the buttons connecting capacitors of different capacitances across the two wires (the door control itself was still a direct short). This works fine; DRM is indeed the only reason newer models changed it.
- ska 3y ago
  > This is only going to get worse. Manual operation seems perfectly understandable in this context. Odds of some AirBnB driving off accidentally with the remote approach 100%.
  - dheera 3y ago
    If that really happens you can factory reset a garage door opener which will unpair all existing remotes. Re-keying the front door is arguably a bigger pain in the ass, and many Airbnbs just lend you the front door keys.
    - ska 3y ago
      Right but then you have to buy a new remote, lather rinse repeat. I can see why an AirBnB host wouldn't bother after 1st or 2nd time, is all I'm saying. Agree the front door key is a bigger pain, but less likely to accidentally happen. I mean, I would have a slight preference to have a functioning remote but it's not going to ruin a stay. In the same way that if I went to a place that didn't have an automatic opener at all I wouldn't find it odd.
  - Kirby64 3y ago
    Honestly, a bigger worry imo is cars that have something like homelink. You can copy a garage door opener, and basically give yourself a garage door opener access whenever you want. I did this accidentally to an old rental house I lived in. When I moved out later I drove by one time and … turns out the homelink still worked. For a criminal, it’d be a very easy way to get back in without any trace.
    - dheera 3y ago
      Yeah but in reality former tenants are statistically unlikely to be criminals -- you probably ran a background check on them prior to them moving in, didn't you? Former tenants could have copied front door keys after all, and probably did for noble reasons like SOs, etc. The garage door remote I modified with the Zigbee relay is a remote I purchased and paired with my rental unit's garage door opener, and then took apart for modification. I don't own the property or the garage door opener, I just looked up which model of remote it used, bought one, and paired it. I also have the landlord-provided remote as a backup. I don't think HomeLink is particularly dangerous in this regard; anyone can purchase additional remotes and pair them, they don't need a car with HomeLink. If you're really worried as a landlord, reset your garage door openers for every new tenant re-pair the remotes they presumably returned to you, and re-key your front door locks while you're at it. Microscopic cost compared to what the tenant probably paid you.
- dheera 3y ago
  > That's when I found that they actually DRM'ed the button. The usual pair of wires was there, but I couldn't open the door by simply shorting them together. Oof. That's awful, but put a servo above the button that physically hits the button. Analog loopholes are immune to DRM.
  - elzbardico 3y ago
    As the DRM arms race continue, in the next model the button will be a fingerprint reader. To make sure you're not cheating, you can only use the reader in the precise moment an ad you have to watch will tell you so. Of course, even then you will have to watch the ad till completion before the button really does anything.
    - TeMPOraL 3y ago
      Oh, and before you think you are smart and could just replace the fingerprint reader with an Arduino - everything will be using cryptographic hardware attestation, oh so nicely pioneered by Apple so many years before, to make sure all hardware components are authorized to work together.
    - lazide 3y ago
      Haha, silicone case of my finger on the end of the button! taps forehead The arms race continues I guess.
      - elzbardico 3y ago
        You asked for it. what about a captcha challenge to open your garage? Who is laughing now?
        dheera 3y ago
        I got rid of my Nest camera for this reason. Gave me a Captcha. To view my own damn camera. Who are they gatekeeping? I'll use robots if I want, it's my apartment and my camera.
        3y ago
- reactordev 3y ago
  Probably I2C interface. If shorting it wouldn’t work this would be my second guess.
- mike503 3y ago
  "Doing Woz knows what" is both an awesome phrase and probably factually correct.
rasz 3y ago
Thats cool, how do you monitor status of the door? Open/Closed/Jammed/Overloaded?
- dheera 3y ago
  Currently I just have a wifi security camera in the garage, but at some point when I'm feeling less lazy I'll install some sort of Zigbee door sensor.
asielen 3y ago
There is also https://opengarage.io/ https://opengarage.io/ For anyone who wants an out of the box, and open source, solution.

by dheera 3y ago

CamperBob2 3y ago

Funny you should mention that. I stayed at an AirBnB a while back that I selected precisely because the listing mentioned that a garage was available. It turned out that yes, you could use the garage, but the remote was not provided by the host. So I had to disengage the door and lift it manually, then close it behind me when I left every morning. "Fuck that," I said to myself, as any self-respecting hacker would. "I'll just hook a $20 remote key fob switch from Home Depot up to the button on the garage wall." That's when I found that they actually DRM'ed the button. The usual pair of wires was there, but I couldn't open the door by simply shorting them together. There were several ICs on a PC board inside the button housing doing Woz knows what. So, back to lifting the door manually. This is only going to get worse. It will get worse because we let them go this far.

publicmail 3y ago
I don’t really think it’s DRM. I think it’s because a lot of garage door buttons have a few functionalities, like controlling the lights as well as the door, but it works over two wires. So it probably necessitates some more complicated logic.
- ArchOversight 3y ago
  It's Security+ or Security+ 2.0, it is literally obfuscated serial traffic over two wires. It is DRM. You can't just get any random button to open/close the garage.
- CamperBob2 3y ago
  This one didn't. It was literally just a featureless button, engineered with intelligence it couldn't possibly need except as a means of locking out third-party hardware.
  - ssl-3 3y ago
    Even the "dumb" buttons are on a common serial bus with Security+. I agree that it is annoying in a "It's just a momentary switch! How hard can it be!" sort of way, but it be that way anyhow.
- josephcsible 3y ago
  No, it's DRM. On older models, control over auxiliary functions worked by the buttons connecting capacitors of different capacitances across the two wires (the door control itself was still a direct short). This works fine; DRM is indeed the only reason newer models changed it.
ska 3y ago
> This is only going to get worse. Manual operation seems perfectly understandable in this context. Odds of some AirBnB driving off accidentally with the remote approach 100%.
- dheera 3y ago
  If that really happens you can factory reset a garage door opener which will unpair all existing remotes. Re-keying the front door is arguably a bigger pain in the ass, and many Airbnbs just lend you the front door keys.
  - ska 3y ago
    Right but then you have to buy a new remote, lather rinse repeat. I can see why an AirBnB host wouldn't bother after 1st or 2nd time, is all I'm saying. Agree the front door key is a bigger pain, but less likely to accidentally happen. I mean, I would have a slight preference to have a functioning remote but it's not going to ruin a stay. In the same way that if I went to a place that didn't have an automatic opener at all I wouldn't find it odd.
- Kirby64 3y ago
  Honestly, a bigger worry imo is cars that have something like homelink. You can copy a garage door opener, and basically give yourself a garage door opener access whenever you want. I did this accidentally to an old rental house I lived in. When I moved out later I drove by one time and … turns out the homelink still worked. For a criminal, it’d be a very easy way to get back in without any trace.
  - dheera 3y ago
    Yeah but in reality former tenants are statistically unlikely to be criminals -- you probably ran a background check on them prior to them moving in, didn't you? Former tenants could have copied front door keys after all, and probably did for noble reasons like SOs, etc. The garage door remote I modified with the Zigbee relay is a remote I purchased and paired with my rental unit's garage door opener, and then took apart for modification. I don't own the property or the garage door opener, I just looked up which model of remote it used, bought one, and paired it. I also have the landlord-provided remote as a backup. I don't think HomeLink is particularly dangerous in this regard; anyone can purchase additional remotes and pair them, they don't need a car with HomeLink. If you're really worried as a landlord, reset your garage door openers for every new tenant re-pair the remotes they presumably returned to you, and re-key your front door locks while you're at it. Microscopic cost compared to what the tenant probably paid you.
dheera 3y ago
> That's when I found that they actually DRM'ed the button. The usual pair of wires was there, but I couldn't open the door by simply shorting them together. Oof. That's awful, but put a servo above the button that physically hits the button. Analog loopholes are immune to DRM.
- elzbardico 3y ago
  As the DRM arms race continue, in the next model the button will be a fingerprint reader. To make sure you're not cheating, you can only use the reader in the precise moment an ad you have to watch will tell you so. Of course, even then you will have to watch the ad till completion before the button really does anything.
  - TeMPOraL 3y ago
    Oh, and before you think you are smart and could just replace the fingerprint reader with an Arduino - everything will be using cryptographic hardware attestation, oh so nicely pioneered by Apple so many years before, to make sure all hardware components are authorized to work together.
  - lazide 3y ago
    Haha, silicone case of my finger on the end of the button! taps forehead The arms race continues I guess.
    - elzbardico 3y ago
      You asked for it. what about a captcha challenge to open your garage? Who is laughing now?
      - dheera 3y ago
        I got rid of my Nest camera for this reason. Gave me a Captcha. To view my own damn camera. Who are they gatekeeping? I'll use robots if I want, it's my apartment and my camera.
      - 3y ago
reactordev 3y ago
Probably I2C interface. If shorting it wouldn’t work this would be my second guess.
mike503 3y ago
"Doing Woz knows what" is both an awesome phrase and probably factually correct.

rasz 3y ago

Thats cool, how do you monitor status of the door? Open/Closed/Jammed/Overloaded?

dheera 3y ago
Currently I just have a wifi security camera in the garage, but at some point when I'm feeling less lazy I'll install some sort of Zigbee door sensor.

asielen 3y ago

There is also https://opengarage.io/ https://opengarage.io/ For anyone who wants an out of the box, and open source, solution.