Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering a car key fob signal

0x44.cc

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Reverse engineering a car key fob signal

#71

Post by bigiain »

tzs wrote: post #52
tivert wrote: post #7

> These keys are generated and tracked using a counter which has to stay in sync between the remote and the car. This ensures that the car doesn’t reuse an old key, and that the remote always generates fresh keys. Something I've always wondered about is, how do learning remotes defeat this? My car has a couple of built-in garage door buttons, and I'm pretty sure I programmed it by just hitting the remote button in th…

Let's start with fixed code systems. In those the remote sends the same signal every time. There will usually be some way to customize this signal, such as a set of DIP switches in the remote and in the head unit so that you can set your system to a different fixed signal than you neighbor's fixed signal. A learning remote for such a system could work by simply replaying whatever it heard when it recorded during lear…

Samy Kumar did a project about 10 years back, where he worked out how to brute force a 12 bit garage door code in under 10 seconds, using a childs toy: http://samy.pl/opensesame/

My garage door opener uses a 12 but dip switch config (and my last place used an 8 dip switch config, and I'm pretty sure still does).

Re reading that OpenSesame post was fun. It reminded me of a few names I need to go find out what they're up to these days (Travis Goodspeed and Michael Ossmann are names I remember seeing doing/writing-up some really cool stuff), and that the Mattel IM-ME toy he was using uses that same CC1110 "sub gHz"

Re: Reverse engineering a car key fob signal

#72

Post by hnick »

orra wrote: post #17
elif wrote: post #12

Why bother intercepting, decoding, and encoding your own signal when you can just use a big antenna and MITM the fob and the vehicle and convince them they are closer than they really are?

I find it wild how pervasive passive keyless entry is. Completely form over (security) function.

Ultimately, if it were a severe problem, wouldn't insurance premiums reflect this?

Re: Reverse engineering a car key fob signal

#73

Post by paledot »

swamp40 wrote: post #64

He decoded everything, but he didn't actually open a car door. He still has to defeat the rolling code. It's not like you can add 1 to it and resend it. From the outside world, the next rolling code should appear random.

That's right there in the lede, "not as insecure as you think".

Re: Reverse engineering a car key fob signal

#74

Post by ff7c11 »

swamp40 wrote: post #64

He decoded everything, but he didn't actually open a car door. He still has to defeat the rolling code. It's not like you can add 1 to it and resend it. From the outside world, the next rolling code should appear random.

Is it hard to brute force? If so, it is still something that can be sniffed, though you can't unlock the car without first recording a genuine button press.

Re: Reverse engineering a car key fob signal

#75

Post by EasyMark »

MikeTheGreat wrote: post #55
bongodongobob wrote: post #39

Earlier quoted context omitted.

Realest comment here. I have a few drawers full of these kind of toys I used once and forgot about. Right next to my serial cables and bits of wire.

Your post inspired a random but genuine question: Does anyone have a good use for obsolete cables? Like, I've got some serial cables, some co-ax, a bunch of old TV cables, some audio cables. I tell myself I'm keeping them because if I ever need them I'll never be able to (or want to) buy them again. Moreover it feels like such a waste to throw them away. Maybe a makerspace could make use of them?

I have a box in my garage and if cables start overflowing I go through and toss anything that makes it overflow that seems the least useful or likely to be used. It keeps me from starting a new box. :) . I have another box of old gadgets in static bags but I still have a ton of room left in that :)

Re: Reverse engineering a car key fob signal

#76

Post by oarsinsync »

hnick wrote: post #72
orra wrote: post #17

Earlier quoted context omitted.

I find it wild how pervasive passive keyless entry is. Completely form over (security) function.

Ultimately, if it were a severe problem, wouldn't insurance premiums reflect this?

They do. Try to get a Range Rover insured in the UK. You’ll struggle.

Re: Reverse engineering a car key fob signal

#77

Post by bdavbdav »

orra wrote: post #17
elif wrote: post #12

Why bother intercepting, decoding, and encoding your own signal when you can just use a big antenna and MITM the fob and the vehicle and convince them they are closer than they really are?

I find it wild how pervasive passive keyless entry is. Completely form over (security) function.

Having had it on my last few cars, I wouldn’t go back.

Re: Reverse engineering a car key fob signal

#79

Post by 0x457 »

sebk wrote: post #68
0x457 wrote: post #65

Earlier quoted context omitted.

Yes. However, I'm only aware of a Tesla that actually turns your phone/watch into an actual proximity key fob. Not to be confused with what others do: - open an app - login again because devs can't figure out persistence between updates - wait for thing to connect and load slow af UI - click on unlock button in the app - wait - wait - wait - wait - give up - do not renew service after 1 year trial expired because it…

There's a standard for this using NFC and UWB, Digital Car Key; BMW has support for either 2.0 (NFC) or 3.0 (UWB) across their entire range. The Hyundai Motor Company group (Hyundai/Kia/Genesis) is starting to add support as well. See [1] for exact models (look for the little key icon). Several other makes are members of the Car Connectivity Consortium that standardized this protocol so it's reasonable to expect wide…

Glad to see it's getting adoption.

Re: Reverse engineering a car key fob signal

#80

Post by jonah »

abakker wrote: post #58
aareet wrote: post #57

Earlier quoted context omitted.

You could make some sort of art - in the climbing community old ropes often become chalk bags or carpets etc.

You've made me imagine a doormat made out of old cat5 and usb cables, and I'm horrified in an amused kind of way.

My local search and rescue team made door mats for their station with old 1/2" ropes. They came out really nicely.

Doing so with serial or coax cables seems like an invitation for bits of the plastic sheath breaking off in a few months and polluting the ground around your door though...

Post reply on HN