4 ms·

Well I found that my apartment NFC key is hardened against dictionary attacks and I'm not able to copy it. It also helped me learn that my parents' garage door

Well I found that my apartment NFC key is hardened against dictionary attacks and I'm not able to copy it. It also helped me learn that my parents' garage door is pretty secure. I'm able to have the opener learn my flipper like any other remote, but not crack it. This is even with the unleashed firmware that doesn't mind violating FCC regulations (some of the frequencies it hops to are restricted). I was able to copy my work NFC badge, but I'm not really interested in trying it out. It's handy as a pocket spectrum sniffer, but I don't have much day-to-day use for it outside of that. I'm glad it was given to me because I learned a lot. Potential future use for me might be an amiibo emulator, but I've grown out of those sorts of things.

AndrewKemendo 3y ago
All garage doors have rolling keys which are non trivial to deal with unless you have pro stuff.
- dawnerd 3y ago
  Besides easy to open garage doors with a metal shim to pop the emergency latch. Happened to me once before just zip tying the latch.
- willis936 3y ago
  You can sync up on rolling codes with the flipper without too much effort. When there are a few private keys involved it gets more difficult.
- epcoa 3y ago
  More like most garage doors sold in the last 20 years have a rolling code system, a few of which are non trivial to deal with. This is already Western centric, but even here there are a ton of older static and fixed frequency systems still chugging along. Of these rolling code systems most are not difficult to crack, especially those more than a decade old (and which are still sold today)
- tzs 3y ago
  Speaking of garage door rolling codes I've noticed there is some sort of slack in the synchronization, probably so that if you press the remote button a few times while out of range your remote still opens the door. My guess is that the receiver looks not only for next code after the last one used, but also for several codes after that. Question: how many times would you have to press the button on the remote for it to get so far ahead of what the receiver looks for that the remote no longer works without reprogramming the receiver?
  - ec109685 3y ago
    There’s a great answer here that describes a rolling code attack and above it, an answer describing that they have slack regarding where they are in the code sequence. https://crypto.stackexchange.com/a/47440 https://crypto.stackexchange.com/a/47440
  - rft 3y ago
    Years ago I had some insight into the "crypto" behind a garage door opener. It was essentially a rolling code and the controller stored the counter for each paired remote and checked it. The package sent by the remote also included its current counter value. If the controller received a counter that was higher than expected, it just updated the stored value and accepted the request, assuming the actual "ciphertext" is correct ofc. The only constraint was that the sequence number must be larger than the stored value. This also means if you manage to clone a remote, you can just abuse humans. If you opened the door with your clone, the next time the original remote sends its package the sequence number will be too low and the controller will ignore it. But what do you do if your remote didn't work? You press it again, this time the sequence number matches and things work as they should. For cloning you need to reconstruct the initial seed for the PRNG that is used to create the ciphertext based on the sequence number. Based on how little resources these remotes tend to have, more based on cost than battery life etc, and that some vendors design their own crypto, this can actually work. If you know the algorithm and the seed is only 32 bit, you can easily brute force it.
spike021 3y ago
My apartment uses Latch deadlocks. From what I've read the model _should_ support an NFC key, which of course we don't get. I'd love to figure out if I could do it myself. Ideally I'd be able to use my iPhone that way automatically though (the app on iOS apparently can't due to Apple rules but I'm not an expert). When my hands are full with groceries or whatever it can be a chore to pull out my phone, dig for the app, and get it to unlock the door.

AndrewKemendo 3y ago

All garage doors have rolling keys which are non trivial to deal with unless you have pro stuff.

dawnerd 3y ago
Besides easy to open garage doors with a metal shim to pop the emergency latch. Happened to me once before just zip tying the latch.
willis936 3y ago
You can sync up on rolling codes with the flipper without too much effort. When there are a few private keys involved it gets more difficult.
epcoa 3y ago
More like most garage doors sold in the last 20 years have a rolling code system, a few of which are non trivial to deal with. This is already Western centric, but even here there are a ton of older static and fixed frequency systems still chugging along. Of these rolling code systems most are not difficult to crack, especially those more than a decade old (and which are still sold today)
tzs 3y ago
Speaking of garage door rolling codes I've noticed there is some sort of slack in the synchronization, probably so that if you press the remote button a few times while out of range your remote still opens the door. My guess is that the receiver looks not only for next code after the last one used, but also for several codes after that. Question: how many times would you have to press the button on the remote for it to get so far ahead of what the receiver looks for that the remote no longer works without reprogramming the receiver?
- ec109685 3y ago
  There’s a great answer here that describes a rolling code attack and above it, an answer describing that they have slack regarding where they are in the code sequence. https://crypto.stackexchange.com/a/47440 https://crypto.stackexchange.com/a/47440
- rft 3y ago
  Years ago I had some insight into the "crypto" behind a garage door opener. It was essentially a rolling code and the controller stored the counter for each paired remote and checked it. The package sent by the remote also included its current counter value. If the controller received a counter that was higher than expected, it just updated the stored value and accepted the request, assuming the actual "ciphertext" is correct ofc. The only constraint was that the sequence number must be larger than the stored value. This also means if you manage to clone a remote, you can just abuse humans. If you opened the door with your clone, the next time the original remote sends its package the sequence number will be too low and the controller will ignore it. But what do you do if your remote didn't work? You press it again, this time the sequence number matches and things work as they should. For cloning you need to reconstruct the initial seed for the PRNG that is used to create the ciphertext based on the sequence number. Based on how little resources these remotes tend to have, more based on cost than battery life etc, and that some vendors design their own crypto, this can actually work. If you know the algorithm and the seed is only 32 bit, you can easily brute force it.

spike021 3y ago

My apartment uses Latch deadlocks. From what I've read the model _should_ support an NFC key, which of course we don't get. I'd love to figure out if I could do it myself. Ideally I'd be able to use my iPhone that way automatically though (the app on iOS apparently can't due to Apple rules but I'm not an expert). When my hands are full with groceries or whatever it can be a chore to pull out my phone, dig for the app, and get it to unlock the door.