OpenSesame – A device that can open fixed-code garage doors in seconds • Hacker News Board

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#71

Post by windexh8er » Thu, Jun 04, 2015, 11:49 PM UTC

samyk wrote: post #70

windexh8er wrote: post #69

Very interesting. I used to work with an older gentlemen who did RF comms in the military and back in early 2000s he used to tell me stories about his random RF hacking. One such story was around a garage door opener he modified with a potentiometer so he could test opening frequencies by rotating the dial. Obviously this wouldn't work for the "newer" style openers. I've recently purchased a HackRF to start to learn…

Hi windexh8er, I choose this hardware because it's portable and convenient. It would technically be much easier to carry out this attack with something like rfcat via yardstick one, hackrf, etc, but I didn't want a USB based device and no need to build my own device when something existed with everything I needed! And did I mention it's pink?

Oh, don't get me wrong - I think it's awesome you're recycling and embrace pink. Thanks for the insight though and, well, I partially answered my question because the 8th video Ossmann actually walks through all of this on HackRF...

http://greatscottgadgets.com/sdr/8/

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#72

Post by marincounty » Thu, Jun 04, 2015, 11:53 PM UTC

tptacek wrote: post #57

at-fates-hands wrote: post #41

Earlier quoted context omitted.

>>> I wonder if there could be commercial interest in cryptographically secure garage door openers? Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.

Was thinking about making the same comment. People throw cinderblocks here to get garage doors open. Until recently, we deliberately kept ours unlocked (if we're going to get burglarized, at least we'd like to keep the doors on the hinges).

I had to do that when I worked in San Francisco. I just left it open with a note, "Please take a nap in here, whatever, just don't break anything." I did put a kill switch in that mechanics can't figure out. It wasn't the stupid radio I cared about, it was repairing the windows.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#73

Post by benyami » Thu, Jun 04, 2015, 11:54 PM UTC

blacksmith_tb wrote: post #44

mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

Wouldn't it be simplest to refuse more than 4 attempts per minute? I suppose it would sometimes frustrate the owner bungling the code, but stretching out brute-forcing the whole space to hours instead of minutes would make it a lot less appealing to would-be thieves...

Would this become a problem if everyone in the neighborhood had the same brand opener?

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#74

Post by mrb » Fri, Jun 05, 2015, 12:05 AM UTC

mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

I forgot to mention a crucial piece of information why De Bruijn sequences couldn't possibly work against Genie. The packet the remote sends is made of a 4-bit header followed by the 12-bit code, but the header is using a bit encoding (sequence of 10 and 20 kHz pulses) that couldn't possible represent a valid sequence of 0s and 1s in the code. So yeah, unless you can trick a Genie receiver to parse a code without the header, De Bruijn sequences can't work.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#75

Post by saidajigumi » Fri, Jun 05, 2015, 12:11 AM UTC

mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

> But there is probably no interest...

FWIW, this sounds like a hook around building a business for "next-gen" garage door openers. Security, quality of build, and convenience are among the factors that could be pitched to early adopters. Heck, this even feels like something that the right small team could work into a really sharp Kickstarter pitch, if so inclined.

One tricky problem is that garage door openers tend to "just work" for a long time. Over and above cost, upgrading is a much larger installation hassle, far larger IMO than e.g. Nest thermostats had to overcome. All of that will limit adoption rates, even for willing early adopters. A retrofit angle would help, akin to the retrofit-smart-deadbolt market.

An "interesting" sales objection would be this tech not working with cars that have built-in recording garage door remotes (vaguely similar to home theater smart remotes, for those unfamiliar).

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#76

Post by userbinator » Fri, Jun 05, 2015, 12:34 AM UTC

mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online.

Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it.

The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#77

Post by mrb » Fri, Jun 05, 2015, 12:41 AM UTC

userbinator wrote: post #76

mrb wrote: post #18

Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal t…

By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it. The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).

The remotes I reverse-engineered were universal ones with generic MCUs, so their datasheets weren't useful: Skylink model 69 with an EM78P468N, and Skylink model 39 with an HT48R30A-1.

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#78

Post by vacri » Fri, Jun 05, 2015, 1:09 AM UTC

mattmaroon wrote: post #38

kbenson wrote: post #8

Earlier quoted context omitted.

Exactly like computer security, it's not about making it impossible to gain entrance[1], it's about making it both inconvenient enough and require enough skill that it takes longer or is more noticeable, making it more likely the intruder will be noticed, thus raising the likelihood they will be caught. That said, a few seconds is a pretty low bar. Commodity locks should be better than this, for all our sakes. 1: Thi…

While locks don't keep skilled criminals out, you'd be shocked how many unskilled ones there are. Meth/crackheads routinely go around twisting doorknobs in apartment complexes or pulling on car handles just hoping to find something unlocked so they can steal whatever is there. They (usually) don't break and enter, but if they happen upon an unlocked door they'll walk in and steal anything.

Not that this is a common attack, but to add to the stew - I knew a guy who left his leather jacket in his car, which was a soft-top convertable. The jacket thief simply sliced open the top and took the jacket.

These days I just tell people to consider the inside of their car a public place, and never to leave anything in there that you wouldn't leave lying on your front fence or similar. There are simply too many ways for people to get into cars to win that game, and ultimately, few things will stop a thief who's willing to damage the car (hammer through a window, or knife through a soft-top, for example).

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#79

Post by vacri » Fri, Jun 05, 2015, 1:11 AM UTC

logfromblammo wrote: post #62

qbrass wrote: post #55

Earlier quoted context omitted.

>They bark on anything alive that comes into 0.5miles circumference. Which means you get so many false positives that you quit taking them seriously.

My parents have two Papillons that bark frantically if a butterfly enters the airspace of their house. Sit on the couch? Bark. Stand up from the couch? Bark. Phone rings? Bark. Television channel changes? Bark. Doorbell rings? BARKBARKBARKBARKBARKBARKYOURHEADASPLODE! In order to gauge the severity of any potential threat, you have to time the barking interval. If it lasts longer than three minutes, there may be armed…

Sounds like the cure is worse than the disease...

Re: OpenSesame – A device that can open fixed-code garage doors in seconds

#80

Post by __z » Fri, Jun 05, 2015, 1:59 AM UTC

mattmaroon wrote: post #38

kbenson wrote: post #8

Earlier quoted context omitted.

Exactly like computer security, it's not about making it impossible to gain entrance[1], it's about making it both inconvenient enough and require enough skill that it takes longer or is more noticeable, making it more likely the intruder will be noticed, thus raising the likelihood they will be caught. That said, a few seconds is a pretty low bar. Commodity locks should be better than this, for all our sakes. 1: Thi…

While locks don't keep skilled criminals out, you'd be shocked how many unskilled ones there are. Meth/crackheads routinely go around twisting doorknobs in apartment complexes or pulling on car handles just hoping to find something unlocked so they can steal whatever is there. They (usually) don't break and enter, but if they happen upon an unlocked door they'll walk in and steal anything.

Most (?) robberies are not sophisticated attacks but are simply crimes of opportunity.