9 ms·

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit c

by mrb 11y ago

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal trace going from the MCU to the RF transmitter and hooked it to the FT232. I built a brute-forcer and it works quite well. I do not have my notes at the moment, but IIRC one code takes 25.6 ms to be sent. And my manufacturer (Genie) seems to require the code to be transmitted 4 times consecutively to open the door, that's 102.4 ms. Multiplied by 4096 combinations, this gave me a brute-forcing time of 7 minutes. I had tried Samy's exact attack to reduce the brute-forcing time but it did not work at the time because I tried it before I discovered the code had to be sent 4 times consecutively (5 times makes it more reliable due to RF interferences). So I am not surprised to see Genie absent from the list of models Samy found vulnerable. But I should try to find out the longest period of time during which these 4 repetitions of the code need to be sent. Maybe it does not have to be perfectly consecutive, but it could be 4 codes received within an interval of 200 ms or 1000 ms. If so it might still be possible to build a modified De Bruijn sequence that repeats codes 4 times while being only 4 times longer. By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. These remotes are so easy to reverse engineer, so common (Genie is in the top 3 or top 4 most common openers), and so old (the protocol has existed since 1985), you would think there would be information about it online, but nope. PS: I wonder if there could be commercial interest in cryptographically secure garage door openers? A $0.50 ARM Cortex-M0 MCU is all you need to implement a HOTP based on HMAC-SHA1. Then a simple learning/pairing system writing the key in EEPROM can even sustain the battery being removed from the remote. But there is probably no interest... which is why most remotes are insecure even the "rolling code" ones. (Edited to clarify some tech details.)

unoti 11y ago
There's information about it online now, thanks to your post! I came here wondering what frequency ranges and encodings are at work, and now I know.
kleiba 11y ago
Well, it seems that from the point of view of Genie, if it's required to send the correct code N times in a row, acceptance should be aborted if that is interspersed by any wrong code. In that case, a De Bruijn sequence wouldn't work.
- LukeShu 11y ago
  Because noise and interference. You don't want the neighbor opening his garage door to abort yours--your code and his would be interspersed, but you both still want your door to open.
at-fates-hands 11y ago
>>> I wonder if there could be commercial interest in cryptographically secure garage door openers? Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.
- throwaway7767 11y ago
  >> I wonder if there could be commercial interest in cryptographically secure garage door openers? >Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster. It's also a lot more likely to attract attention of bystanders. Another concern may be insurance. In my area of the world, insurance companies generally refuse to pay out for burglaries unless there is evidence of a break-in (a broken window, forced door or something like that). This would likely not be covered. If this kind of device became popular with thieves like the car keyless entry hacks have, I can see there being a demand for something like this.
- tadfisher 11y ago
  We're already seeing organized theft rings using devices to unlock car doors without breaking in. I don't think it's outside the realm of possibility for the same thing to occur with garage doors.
- tptacek 11y ago
  Was thinking about making the same comment. People throw cinderblocks here to get garage doors open. Until recently, we deliberately kept ours unlocked (if we're going to get burglarized, at least we'd like to keep the doors on the hinges).
  - marincounty 11y ago
    I had to do that when I worked in San Francisco. I just left it open with a note, "Please take a nap in here, whatever, just don't break anything." I did put a kill switch in that mechanics can't figure out. It wasn't the stupid radio I cared about, it was repairing the windows.
- 746F7475 11y ago
blacksmith_tb 11y ago
Wouldn't it be simplest to refuse more than 4 attempts per minute? I suppose it would sometimes frustrate the owner bungling the code, but stretching out brute-forcing the whole space to hours instead of minutes would make it a lot less appealing to would-be thieves...
- benyami 11y ago
  Would this become a problem if everyone in the neighborhood had the same brand opener?
Cymen 11y ago
Somewhat of a tangent, but I am concerned about the MITM attack on car locks [1]. This kind of attack is being used in my neighborhood in Oakland, California and no doubt other places. I read the reports of "someone is breaking into my car but no windows/locks are broken". Then a couple other people on NextDoor chime in with the same thing and one person reports a woman who is walking around the neighborhood and appears to be the one responsible. A coworker explained a method where one can amplify the signal of the car and/or car key so that the car thinks the key is next to the car and the door unlocks. The cryptographically secure garage door opener is still susceptible to MITM if the MITM attack is being done purely by amplification of signal, right? It's almost like the key needs a handshake with the car by some method that is not using radio frequency. I wonder what options that leaves open? So far, I have not thought of one that is convenient (at some point, it is easier to go back to using a physical key to open a physical lock after all). 1. I think there was a post about it here already but I couldn't find it.
- cmdrfred 11y ago
  I don't think so, as far as I know a garage door opener has to be activated (you press the button) so that exact attack won't work.
- mrb 11y ago
  Yeah, a car's passive entry system can definitely be exploited by relay attacks. Here is an academic group who demonstrated it: https://eprint.iacr.org/2010/332.pdf https://eprint.iacr.org/2010/332.pdf The most obvious way to mitigate is to have the car require the key to send the first bit of the response at most N nanoseconds after the last bit of the challenge is sent over the air. Because of the speed of light this assures the key is within a certain distance of the car. Ideally you want to constrain this to ~2 meters since passive entry requires the driver to touch the door handle. This limit is not to be confused with remote keyless entry which should work up to ~100 meters as it requires the driver to actively press a button so, like garage door openers, this is not vulnerable to relay attacks. However power-constrained MCUs, especially in the key, have a hard time computing a strong cryptographic challenge within N nanoseconds with N low enough, hence the problem... After my little foray into garage door openers I am currently looking into implementing relay attacks on the passive entry / passive go system of my car (2012 Audi). Fascinating stuff.
nickbauman 11y ago
A friend who lives in a wealthy neighborhood here had their garage broken into electronically more than 10 years ago. So clearly some people have known about it for a while. The local police claim the thief probably "listened" to their garage door opener open the door at least once to get in, as opposed to brute forcing it.
- patcheudor 11y ago
  It's not uncommon for thieves to go to open houses in nice neighborhoods when a property is for sale & copy the dip-switch codes. This also happens when homes are under construction. No one ever thinks about changing their garage door opener code.
  - nickbauman 11y ago
    I hadn't even thought about that breach vector! In this case they'd been living there for quite a while.
    - patcheudor 11y ago
      It's also pretty common for garage door installers / builders to either not change the default config or use the same one or pattern for every home. We were amongst the first to build a house in a new sub in our area so we'd go for walks around the neighborhood while the homes were being built and would go through them and of course I'd always look at the codes. The primary builder in the sub set the dip switches to the number address of the house. That provided a nice geeky / awkward way for me to introduce myself to my neighbors by opening their garage doors for them.
mrb 11y ago
I forgot to mention a crucial piece of information why De Bruijn sequences couldn't possibly work against Genie. The packet the remote sends is made of a 4-bit header followed by the 12-bit code, but the header is using a bit encoding (sequence of 10 and 20 kHz pulses) that couldn't possible represent a valid sequence of 0s and 1s in the code. So yeah, unless you can trick a Genie receiver to parse a code without the header, De Bruijn sequences can't work.
saidajigumi 11y ago
> But there is probably no interest... FWIW, this sounds like a hook around building a business for "next-gen" garage door openers. Security, quality of build, and convenience are among the factors that could be pitched to early adopters. Heck, this even feels like something that the right small team could work into a really sharp Kickstarter pitch, if so inclined. One tricky problem is that garage door openers tend to "just work" for a long time. Over and above cost, upgrading is a much larger installation hassle, far larger IMO than e.g. Nest thermostats had to overcome. All of that will limit adoption rates, even for willing early adopters. A retrofit angle would help, akin to the retrofit-smart-deadbolt market. An "interesting" sales objection would be this tech not working with cars that have built-in recording garage door remotes (vaguely similar to home theater smart remotes, for those unfamiliar).
- themartorana 11y ago
  Also, is strong security something people expect out of a garage door remote? It's never been a feature, as far as I can remember. Not that there isn't a market of people who do want for security in their remote, or would but don't yet know it...
  - LukeShu 11y ago
    Absolutely; everyone just assumes it's already secure, or at least as secure as the deadbolt on their front door.
    - CONTRARlAN 11y ago
      Which is only as secure as the door frame it goes into, which usually means: pretty insecure. Still, I agree with the premise that it's about assumptions, and if people can be made to realize that their garage door openers are inherently pretty insecure, and feel that that presents a substantial, then there's a market there. But until it becomes a problem that's common enough for media outlets to scare people about it, there probably isn't a large market yet. (Any marketing plan for an endeavor like that should have a PR budget from day one, since that's exactly how such stories tend to become news segments.)
userbinator 11y ago
By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it. The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).
- mrb 11y ago
  The remotes I reverse-engineered were universal ones with generic MCUs, so their datasheets weren't useful: Skylink model 69 with an EM78P468N, and Skylink model 39 with an HT48R30A-1.
  - userbinator 11y ago
    A bit of a shame that they used an MCU instead of an encoder/decoder ASIC, since they could've implemented something better. The fixed-code remotes I've seen use a standard IC like an HT12E. If those weren't OTP/mask ROM, reflashing them with a different firmware (maybe even a simple rolling code?) could be an interesting exercise...
sitkack 11y ago
Did stuff like this when was a kid, but just used a binary counter hooked into the switches on the replacement remote. What I really wanted as a huge RF amplifier so I could broadcast the signal 5+ miles in all directions.

by mrb 11y ago

unoti 11y ago

There's information about it online now, thanks to your post! I came here wondering what frequency ranges and encodings are at work, and now I know.

kleiba 11y ago

Well, it seems that from the point of view of Genie, if it's required to send the correct code N times in a row, acceptance should be aborted if that is interspersed by any wrong code. In that case, a De Bruijn sequence wouldn't work.

LukeShu 11y ago
Because noise and interference. You don't want the neighbor opening his garage door to abort yours--your code and his would be interspersed, but you both still want your door to open.

at-fates-hands 11y ago

>>> I wonder if there could be commercial interest in cryptographically secure garage door openers? Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.

throwaway7767 11y ago
>> I wonder if there could be commercial interest in cryptographically secure garage door openers? >Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster. It's also a lot more likely to attract attention of bystanders. Another concern may be insurance. In my area of the world, insurance companies generally refuse to pay out for burglaries unless there is evidence of a break-in (a broken window, forced door or something like that). This would likely not be covered. If this kind of device became popular with thieves like the car keyless entry hacks have, I can see there being a demand for something like this.
tadfisher 11y ago
We're already seeing organized theft rings using devices to unlock car doors without breaking in. I don't think it's outside the realm of possibility for the same thing to occur with garage doors.
tptacek 11y ago
Was thinking about making the same comment. People throw cinderblocks here to get garage doors open. Until recently, we deliberately kept ours unlocked (if we're going to get burglarized, at least we'd like to keep the doors on the hinges).
- marincounty 11y ago
  I had to do that when I worked in San Francisco. I just left it open with a note, "Please take a nap in here, whatever, just don't break anything." I did put a kill switch in that mechanics can't figure out. It wasn't the stupid radio I cared about, it was repairing the windows.
746F7475 11y ago

blacksmith_tb 11y ago

Wouldn't it be simplest to refuse more than 4 attempts per minute? I suppose it would sometimes frustrate the owner bungling the code, but stretching out brute-forcing the whole space to hours instead of minutes would make it a lot less appealing to would-be thieves...

benyami 11y ago
Would this become a problem if everyone in the neighborhood had the same brand opener?

Cymen 11y ago

Somewhat of a tangent, but I am concerned about the MITM attack on car locks [1]. This kind of attack is being used in my neighborhood in Oakland, California and no doubt other places. I read the reports of "someone is breaking into my car but no windows/locks are broken". Then a couple other people on NextDoor chime in with the same thing and one person reports a woman who is walking around the neighborhood and appears to be the one responsible. A coworker explained a method where one can amplify the signal of the car and/or car key so that the car thinks the key is next to the car and the door unlocks. The cryptographically secure garage door opener is still susceptible to MITM if the MITM attack is being done purely by amplification of signal, right? It's almost like the key needs a handshake with the car by some method that is not using radio frequency. I wonder what options that leaves open? So far, I have not thought of one that is convenient (at some point, it is easier to go back to using a physical key to open a physical lock after all). 1. I think there was a post about it here already but I couldn't find it.

cmdrfred 11y ago
I don't think so, as far as I know a garage door opener has to be activated (you press the button) so that exact attack won't work.
mrb 11y ago
Yeah, a car's passive entry system can definitely be exploited by relay attacks. Here is an academic group who demonstrated it: https://eprint.iacr.org/2010/332.pdf https://eprint.iacr.org/2010/332.pdf The most obvious way to mitigate is to have the car require the key to send the first bit of the response at most N nanoseconds after the last bit of the challenge is sent over the air. Because of the speed of light this assures the key is within a certain distance of the car. Ideally you want to constrain this to ~2 meters since passive entry requires the driver to touch the door handle. This limit is not to be confused with remote keyless entry which should work up to ~100 meters as it requires the driver to actively press a button so, like garage door openers, this is not vulnerable to relay attacks. However power-constrained MCUs, especially in the key, have a hard time computing a strong cryptographic challenge within N nanoseconds with N low enough, hence the problem... After my little foray into garage door openers I am currently looking into implementing relay attacks on the passive entry / passive go system of my car (2012 Audi). Fascinating stuff.

nickbauman 11y ago

A friend who lives in a wealthy neighborhood here had their garage broken into electronically more than 10 years ago. So clearly some people have known about it for a while. The local police claim the thief probably "listened" to their garage door opener open the door at least once to get in, as opposed to brute forcing it.

patcheudor 11y ago
It's not uncommon for thieves to go to open houses in nice neighborhoods when a property is for sale & copy the dip-switch codes. This also happens when homes are under construction. No one ever thinks about changing their garage door opener code.
- nickbauman 11y ago
  I hadn't even thought about that breach vector! In this case they'd been living there for quite a while.
  - patcheudor 11y ago
    It's also pretty common for garage door installers / builders to either not change the default config or use the same one or pattern for every home. We were amongst the first to build a house in a new sub in our area so we'd go for walks around the neighborhood while the homes were being built and would go through them and of course I'd always look at the codes. The primary builder in the sub set the dip switches to the number address of the house. That provided a nice geeky / awkward way for me to introduce myself to my neighbors by opening their garage doors for them.

mrb 11y ago

I forgot to mention a crucial piece of information why De Bruijn sequences couldn't possibly work against Genie. The packet the remote sends is made of a 4-bit header followed by the 12-bit code, but the header is using a bit encoding (sequence of 10 and 20 kHz pulses) that couldn't possible represent a valid sequence of 0s and 1s in the code. So yeah, unless you can trick a Genie receiver to parse a code without the header, De Bruijn sequences can't work.

saidajigumi 11y ago

> But there is probably no interest... FWIW, this sounds like a hook around building a business for "next-gen" garage door openers. Security, quality of build, and convenience are among the factors that could be pitched to early adopters. Heck, this even feels like something that the right small team could work into a really sharp Kickstarter pitch, if so inclined. One tricky problem is that garage door openers tend to "just work" for a long time. Over and above cost, upgrading is a much larger installation hassle, far larger IMO than e.g. Nest thermostats had to overcome. All of that will limit adoption rates, even for willing early adopters. A retrofit angle would help, akin to the retrofit-smart-deadbolt market. An "interesting" sales objection would be this tech not working with cars that have built-in recording garage door remotes (vaguely similar to home theater smart remotes, for those unfamiliar).

themartorana 11y ago
Also, is strong security something people expect out of a garage door remote? It's never been a feature, as far as I can remember. Not that there isn't a market of people who do want for security in their remote, or would but don't yet know it...
- LukeShu 11y ago
  Absolutely; everyone just assumes it's already secure, or at least as secure as the deadbolt on their front door.
  - CONTRARlAN 11y ago
    Which is only as secure as the door frame it goes into, which usually means: pretty insecure. Still, I agree with the premise that it's about assumptions, and if people can be made to realize that their garage door openers are inherently pretty insecure, and feel that that presents a substantial, then there's a market there. But until it becomes a problem that's common enough for media outlets to scare people about it, there probably isn't a large market yet. (Any marketing plan for an endeavor like that should have a PR budget from day one, since that's exactly how such stories tend to become news segments.)

userbinator 11y ago

By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it. The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).

mrb 11y ago
The remotes I reverse-engineered were universal ones with generic MCUs, so their datasheets weren't useful: Skylink model 69 with an EM78P468N, and Skylink model 39 with an HT48R30A-1.
- userbinator 11y ago
  A bit of a shame that they used an MCU instead of an encoder/decoder ASIC, since they could've implemented something better. The fixed-code remotes I've seen use a standard IC like an HT12E. If those weren't OTP/mask ROM, reflashing them with a different firmware (maybe even a simple rolling code?) could be an interesting exercise...

sitkack 11y ago

Did stuff like this when was a kid, but just used a binary counter hooked into the switches on the replacement remote. What I really wanted as a huge RF amplifier so I could broadcast the signal 5+ miles in all directions.