Reverse engineering an ancient wireless security keypad using RTL-SDR
1–10 of 23 posts
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#2Remarkably simple example of using the RTL-SDR for something. Thank you old school electronics :D
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#3That is some brutal power sag going on. Those waveforms would probably look a good bit different with the capacitors replaced. Thirty years is a long time for electrolitic caps, and the tantalums are probably not much better.
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#4i hope the author is not going to use this panel as-is because it send everything in clear. i would keep the front panel but retrofit a microcontroller in there to encrypt keypresses before it is sent.
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#5Awesome article! I just got an SDR and now I'm hunting for old RF things to interrogate - thanks for the ideas!
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#6You can use a similar technique to clone a garage door remote control. You simply have to record the transmission using the techniques mentioned in this post, then rebroadcast it on the same frequency.
Broadcasting FM is as simple as loading a Raspberry Pi up with PiFM[0]. Or, if you don't have the original remote (but are a bit more technical), you can just brute force the combination; most remotes only use a 12-bit DIP switch (4096 combinations)[1].
[0] https://github.com/CodyJHeiser/PiStation [1] http://samy.pl/opensesame/
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#7i hope the author is not going to use this panel as-is because it send everything in clear. i would keep the front panel but retrofit a microcontroller in there to encrypt keypresses before it is sent.
Technically you're right, but this is a problem that comes up a lot in wireless home automation. Thing is, what is the attack vector you want to protect against? How many burglars are going to be sitting outside your house (I'm imagining: in a black van with 'Bob's plumbing' written on the outside) analyzing RF patterns when someone comes in, reverse engineer it, then burglarize you home? My estimate is 0, even when not weighed against the alternative: if someone really thinks your house is so interesting so as to warrant several hours of waiting/observation, they'll just put a knife to your wife's throat and say 'turn off the alarm and show us the valuables'.
The vast majority of garage door openers out there use unencoded RF tech, and it's very seldom a problem. And the other side: there was a recent string of thefts of BMW and VW cars in my area. Reason? They had an inside man at the main office who slipped them copies of the remotes.
The tech is very, very rarely the weak link.
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#8Awesome article! I just got an SDR and now I'm hunting for old RF things to interrogate - thanks for the ideas!
I recommend scanning your 300-440 MHz range - there's an amazing number of devices working in it. Garage remotes, car remotes, smart power meters, ACs, weather stations, tire pressure monitors, I can see 3 periodic signals at home and I don't even know what 2 of them are. (maybe picking up something from neighbours)
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#9"I’d envisaged the former owner being some sort of back-woods buck-toothed survivalist who spent his life protecting his family from the oppressive government until he got sick and had to sell his house, guns and alarm system to pay for his medical bills."
Because he had guns? Do all your opinions come from Reddit? I have a Master's in engineering and my teeth are very straight. I own a gun.
Re: Reverse engineering an ancient wireless security keypad using RTL-SDR
#10i hope the author is not going to use this panel as-is because it send everything in clear. i would keep the front panel but retrofit a microcontroller in there to encrypt keypresses before it is sent.
Technically you're right, but this is a problem that comes up a lot in wireless home automation. Thing is, what is the attack vector you want to protect against? How many burglars are going to be sitting outside your house (I'm imagining: in a black van with 'Bob's plumbing' written on the outside) analyzing RF patterns when someone comes in, reverse engineer it, then burglarize you home? My estimate is 0, even when…
Except for the keyless car openers. A simple amplifying transceiver seems to be enough to let your car be stolen. https://news.ycombinator.com/item?id=9381792