Are there any arduino-based garage door brute forcing projects?
OpenSesame – A device that can open fixed-code garage doors in seconds
11–20 of 111 posts
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#12Might as well post a more direct link: http://samy.pl/opensesame/
The "source code" of http://samy.pl is quite interesting
/*
No source for you!
*//
/.source.replace(/.{7}/g,function(w){document.write(String.fromCharCode(parseInt(w.replace(/ /g,'0').replace(/ /g,'1'),2)))});Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#13Which should I consider more insecure: my garage door, or the deadbolt on my front door? I wonder how commonly lock picking is used in crimes. I've picked a lock before myself, but I have no real idea how effective locks are in stopping people that want to commit house thefts. I expect an automated garage door opener is much easier to use than a lock pick though, and probably easier to produce and distribute than loc…
> Which should I consider more insecure: my garage door, or the deadbolt on my front door?
Your garage. Such attacks can be done remotely, sitting in your car. You can open the garage door; hang around for a while, and then casually saunter in. But an attack on the front door requires physical presence at the door, and hence easier to detect.
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#14Which should I consider more insecure: my garage door, or the deadbolt on my front door? I wonder how commonly lock picking is used in crimes. I've picked a lock before myself, but I have no real idea how effective locks are in stopping people that want to commit house thefts. I expect an automated garage door opener is much easier to use than a lock pick though, and probably easier to produce and distribute than loc…
Criminals use lock picks when you don't want someone to know that they broke in. Most criminals are the "snatch-and-grab" type. They are more likely to look for an unlocked window or just break a window. Oh, and deadbolts are pretty easy to pick.
Or just kick the door down.
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#15Might as well post a more direct link: http://samy.pl/opensesame/
The "source code" of http://samy.pl is quite interesting /* No source for you! *// /.source.replace(/.{7}/g,function(w){document.write(String.fromCharCode(parseInt(w.replace(/ /g,'0').replace(/ /g,'1'),2)))});
[deleted]
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#16Might as well post a more direct link: http://samy.pl/opensesame/
Thanks, we updated the link from https://threatpost.com/using-a-toy-to-open-a-fixed-code-gara....
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#17> It may be time to upgrade your garage door opener. If you're worried about this, make sure your garage door can't be opened with a coat hanger as well: http://lifehacker.com/5549366/how-to-unlock-your-garage-door... Also most of your door locks can probably be opened in a few seconds with the right tools+experience: http://en.wikipedia.org/wiki/Lock_bumping#Use_by_criminals http://www.carkeywholesale.com/wholesale/…
Exactly like computer security, it's not about making it impossible to gain entrance[1], it's about making it both inconvenient enough and require enough skill that it takes longer or is more noticeable, making it more likely the intruder will be noticed, thus raising the likelihood they will be caught. That said, a few seconds is a pretty low bar. Commodity locks should be better than this, for all our sakes. 1: Thi…
Exactly. Lots of people don't realize that most of their door locks are there to keep "normal" people out, because dedicated criminals are typically going to find a way in.
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#18Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal trace going from the MCU to the RF transmitter and hooked it to the FT232. I built a brute-forcer and it works quite well. I do not have my notes at the moment, but IIRC one code takes 25.6 ms to be sent. And my manufacturer (Genie) seems to require the code to be transmitted 4 times consecutively to open the door, that's 102.4 ms. Multiplied by 4096 combinations, this gave me a brute-forcing time of 7 minutes.
I had tried Samy's exact attack to reduce the brute-forcing time but it did not work at the time because I tried it before I discovered the code had to be sent 4 times consecutively (5 times makes it more reliable due to RF interferences). So I am not surprised to see Genie absent from the list of models Samy found vulnerable.
But I should try to find out the longest period of time during which these 4 repetitions of the code need to be sent. Maybe it does not have to be perfectly consecutive, but it could be 4 codes received within an interval of 200 ms or 1000 ms. If so it might still be possible to build a modified De Bruijn sequence that repeats codes 4 times while being only 4 times longer.
By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. These remotes are so easy to reverse engineer, so common (Genie is in the top 3 or top 4 most common openers), and so old (the protocol has existed since 1985), you would think there would be information about it online, but nope.
PS: I wonder if there could be commercial interest in cryptographically secure garage door openers? A $0.50 ARM Cortex-M0 MCU is all you need to implement a HOTP based on HMAC-SHA1. Then a simple learning/pairing system writing the key in EEPROM can even sustain the battery being removed from the remote. But there is probably no interest... which is why most remotes are insecure even the "rolling code" ones.
(Edited to clarify some tech details.)
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#19Earlier quoted context omitted.
Exactly like computer security, it's not about making it impossible to gain entrance[1], it's about making it both inconvenient enough and require enough skill that it takes longer or is more noticeable, making it more likely the intruder will be noticed, thus raising the likelihood they will be caught. That said, a few seconds is a pretty low bar. Commodity locks should be better than this, for all our sakes. 1: Thi…
Exactly. Lots of people don't realize that most of their door locks are there to keep "normal" people out, because dedicated criminals are typically going to find a way in.
Locks keep honest people honest.
Re: OpenSesame – A device that can open fixed-code garage doors in seconds
#20Might as well post a more direct link: http://samy.pl/opensesame/
The "source code" of http://samy.pl is quite interesting /* No source for you! *// /.source.replace(/.{7}/g,function(w){document.write(String.fromCharCode(parseInt(w.replace(/ /g,'0').replace(/ /g,'1'),2)))});
Ah, looks like they have a regex that is just whitespace, get the source of it, and do some replacements to turn it into code. 7 bit binary, with spaces = 0 and tabs = 1