Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSesame – A device that can open fixed-code garage doors in seconds

samy.pl

Post reply on HN
Print view View original

61–70 of 111 posts

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#61

Post by 746F7475 »

at-fates-hands wrote: post #41
mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

>>> I wonder if there could be commercial interest in cryptographically secure garage door openers? Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.

But breaking a window and climbing though it takes time and you can cut yourself if you hurry and crowbar makes a lot of unwanted noise.

And not every garage is your basic suburban-attached-to-a-house type. Some little more expensive flats have underground parking where the gate opens with garage opener and thous suckers don't even have windows, they are just metal gate.

With this you could gain access to the cars and with boosting the signal from the cars with the "keyless entry" you could easily swipe clean a lot of cars without the a trace.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#62

Post by logfromblammo »

qbrass wrote: post #55
atmosx wrote: post #52

Earlier quoted context omitted.

Seriously, a dog[1] apparently is a way better security system. [1] Big dogs are not afraid, thus they sleep at night if not properly trained. Small dogs (especially Yorkshires) are the most bad-ass security system I've encountered. They bark on anything alive that comes into 0.5miles circumference.

>They bark on anything alive that comes into 0.5miles circumference. Which means you get so many false positives that you quit taking them seriously.

My parents have two Papillons that bark frantically if a butterfly enters the airspace of their house.

Sit on the couch? Bark.

Stand up from the couch? Bark.

Phone rings? Bark.

Television channel changes? Bark.

Doorbell rings? BARKBARKBARKBARKBARKBARKYOURHEADASPLODE!

In order to gauge the severity of any potential threat, you have to time the barking interval. If it lasts longer than three minutes, there may be armed men outside your door. Or they have to pee. So when you open the door to let them out, the thugs can enter.

Properly calibrating your dog is important.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#63

Post by kbenson »

imaginenore wrote: post #42
kbenson wrote: post #8

Earlier quoted context omitted.

Exactly like computer security, it's not about making it impossible to gain entrance[1], it's about making it both inconvenient enough and require enough skill that it takes longer or is more noticeable, making it more likely the intruder will be noticed, thus raising the likelihood they will be caught. That said, a few seconds is a pretty low bar. Commodity locks should be better than this, for all our sakes. 1: Thi…

That's not exactly like computer security. With computer security you plan for the worst, not the average. That's why even a skilled hacker/coder can't break into banks or major websites on a daily basis.

A bank is not equivalent to your home. You may note that banks generally lock up their physical money behind very sophisticated security systems (relative to other homes/businesses). They deal with a different level of threat, and respond accordingly. Even then, they don't try to safeguard against someone physically demolishing the building, because there's only so much they can do, and at the point someone is willing to go that far, the chance they will complete the theft without being noticed and tracked is virtually non-existent.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#64

Post by runjake »

746F7475 wrote: post #60
zimbu668 wrote: post #3

> It may be time to upgrade your garage door opener. If you're worried about this, make sure your garage door can't be opened with a coat hanger as well: http://lifehacker.com/5549366/how-to-unlock-your-garage-door... Also most of your door locks can probably be opened in a few seconds with the right tools+experience: http://en.wikipedia.org/wiki/Lock_bumping#Use_by_criminals http://www.carkeywholesale.com/wholesale/…

Bumping always mystified me, in a sense that as I've understood it its for pin tumbler locks, so why do people use them? Every place I've lived has had Abloy locks (which no doubt have their own problems), but as far as I know they at least can't be bumped.

Most people in the US have Schlage or Kiwkset deadbolt locks, or something similar to that. Bump keying them is trivial.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#65

Post by logfromblammo »

unoti wrote: post #4

Which should I consider more insecure: my garage door, or the deadbolt on my front door? I wonder how commonly lock picking is used in crimes. I've picked a lock before myself, but I have no real idea how effective locks are in stopping people that want to commit house thefts. I expect an automated garage door opener is much easier to use than a lock pick though, and probably easier to produce and distribute than loc…

No housebreaker with an ounce of brains would use a lock pick before trying a bump key first. The locks on your house are almost certainly bumpable. The locks at your workplace might be more secure.

That's fine, though. If you make the lock on your front door more secure, the weak point is now the latching mechanism, the door frame, or the door itself. Or perhaps it is your sliding patio door, that can be levered. Maybe you left a window unlocked. Or your garage door has a code that can be MITM'ed or brute forced.

The thing that saves most people is that there is really nothing worth stealing in their house. If a fence pays 10% of retail for stolen goods, I'm not certain there is any single thing in my home worth more than $25 to a burglar, other than the emergency cash. Rather than take the TV or any of the decade-old cap-rot Dell computers that have been re-capped, someone would be better off stealing all the meat out of the fridge, because at least they can eat that.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#66

Post by mrb »

Cymen wrote: post #50
mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

Somewhat of a tangent, but I am concerned about the MITM attack on car locks [1]. This kind of attack is being used in my neighborhood in Oakland, California and no doubt other places. I read the reports of "someone is breaking into my car but no windows/locks are broken". Then a couple other people on NextDoor chime in with the same thing and one person reports a woman who is walking around the neighborhood and appe…

Yeah, a car's passive entry system can definitely be exploited by relay attacks. Here is an academic group who demonstrated it: https://eprint.iacr.org/2010/332.pdf

The most obvious way to mitigate is to have the car require the key to send the first bit of the response at most N nanoseconds after the last bit of the challenge is sent over the air. Because of the speed of light this assures the key is within a certain distance of the car. Ideally you want to constrain this to ~2 meters since passive entry requires the driver to touch the door handle. This limit is not to be confused with remote keyless entry which should work up to ~100 meters as it requires the driver to actively press a button so, like garage door openers, this is not vulnerable to relay attacks. However power-constrained MCUs, especially in the key, have a hard time computing a strong cryptographic challenge within N nanoseconds with N low enough, hence the problem...

After my little foray into garage door openers I am currently looking into implementing relay attacks on the passive entry / passive go system of my car (2012 Audi). Fascinating stuff.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#68

Post by davnicwil »

logfromblammo wrote: post #65
unoti wrote: post #4

Which should I consider more insecure: my garage door, or the deadbolt on my front door? I wonder how commonly lock picking is used in crimes. I've picked a lock before myself, but I have no real idea how effective locks are in stopping people that want to commit house thefts. I expect an automated garage door opener is much easier to use than a lock pick though, and probably easier to produce and distribute than loc…

No housebreaker with an ounce of brains would use a lock pick before trying a bump key first. The locks on your house are almost certainly bumpable. The locks at your workplace might be more secure. That's fine, though. If you make the lock on your front door more secure, the weak point is now the latching mechanism, the door frame, or the door itself. Or perhaps it is your sliding patio door, that can be levered. Ma…

> The thing that saves most people is that there is really nothing worth stealing in their house

Agreed. I lived in a houseshare a couple of years ago where the housemates didn't want to chip in for contents insurance.

At first I was shocked, and thought about paying the whole house premium myself, but then I actually thought about it properly for the first time and realised that the sheer difficulty of removing and reselling my mostly quite heavy valuables (things like TV, drumkit, etc) and finding/sorting though even the smaller ones scattered around the place, would mean that any burglar that did get in would probably just decide to leave it. It wouldn't be worth the risk, effort, or arguably even their time.

I've not thought twice about contents insurance since. It's probably a product that makes no sense for a significant proportion of people (when you're renting and damage to furniture/appliances etc is covered by the landlord's insurance, of course!).

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#69

Post by windexh8er »

Very interesting. I used to work with an older gentlemen who did RF comms in the military and back in early 2000s he used to tell me stories about his random RF hacking. One such story was around a garage door opener he modified with a potentiometer so he could test opening frequencies by rotating the dial. Obviously this wouldn't work for the "newer" style openers.

I've recently purchased a HackRF to start to learn about RF technologies in consumer grade "security" products like garage door openers, Z-Wave, wireless home security systems, etc. I've realized that after watching the first (very well done) video by Michael Ossman on HackRF that it's not going to be something easy to learn overnight.

While I'm sure this would be "easy" to do with HackRF given what I've read on Samy's site, does anyone have any input on how/why using this recycled hardware would be better in some regard?

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#70

Post by samyk »

windexh8er wrote: post #69

Very interesting. I used to work with an older gentlemen who did RF comms in the military and back in early 2000s he used to tell me stories about his random RF hacking. One such story was around a garage door opener he modified with a potentiometer so he could test opening frequencies by rotating the dial. Obviously this wouldn't work for the "newer" style openers. I've recently purchased a HackRF to start to learn…

Hi windexh8er, I choose this hardware because it's portable and convenient. It would technically be much easier to carry out this attack with something like rfcat via yardstick one, hackrf, etc, but I didn't want a USB based device and no need to build my own device when something existed with everything I needed! And did I mention it's pink?
Post reply on HN