Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/413 Thanks!
Welcome to Talk Megacorp to Facility
Gates, and in this talk,
I will simply present what
I did with this remote, um,
it will be about electronics,
about microcontrollers, about software,
defined radio.
But I won't go into details
also because they are not a lot of
details. It's just a simple level.
So everyone should be able to understand
it. And even if you didn't do any
hardware hacking yet, this talk
should emphasize you to do it because
it doesn't have to be hard.
Also, it's not a new attack.
I will spoil it from beginning on.
The remote is sending a fixed code
and I just replay this code.
So no new attack on there.
But the way to achieve it, this
was quite fun.
So whenever if you ever wanted
to make some electronics and
you find that it is boring
but you don't know what to do or if you
wanted to play with software defined
radio, but you think that software
defined radio or radio transmission
are complicated, which they are,
then this is a perfect job for you.
There is one woman who is happy, that's
good, good one, happy people.
So I looked at this remote.
I was in the US for a
couple of month and they gave me this
remote to access my building.
They gave it to everyone.
And I wanted to know how secure
is this access gates, the access
gate to the building. So this remote is
used for the garage in the US.
You're almost forced to have a car
because of public transport is not that
good. So they give it to access to the
garage, but also they give it to access
the main entry.
Nobody uses it, but it's still there.
And what's important to give you
to access to pool area?
Don't ask me why it's fenced.
I also find it a bit stupid, but it's
fenced. You have the remote, you can
access it and we will see that the
hot step will play a very important part
in it. The reason why I
looked at it simply because there is this
gate, you can jump over it, but it's
a lot more fun to it, isn't it?
So they provide you
one remote, which is only
for one part of the building, and you
shouldn't have access to the other
buildings. And as you can see, this
complex, this facility complex has
a lot of buildings.
And this remote is not only used in this
complex, it's used
in a lot of complexes in California,
or at least just by driving by.
I could recognize some of the things.
And if you have seen this remote
and it's exactly the same system,
but before starting to
already disassemble the remote,
it's important to find information,
particularly if you're a beginner.
If you already have done
a lot of hardware hacking, then you can
already disassemble it, look at it,
figure out what component is what, what
it does. If you already are software
defined radio, you will probably find
out which kind of modulation it uses in
the beginning. But if you've never done
it, it's pretty hard.
So finding some documents about
the remote will help you to indicate,
OK, this is how it works, this is how
it modulates and so on.
And I can only infer that it will save a
lot of time.
Um, so we need to identify the remote.
We can see on the front there's not
a lot of information on the back, nothing
written. There's even a sticker missing.
And if you open it, you see
that it doesn't have the electronic is
pretty simple. It doesn't have a lot of
components, but it doesn't tell you who
is the vendor or what the product
is on the back to.
It doesn't tell you there even to stick
with. I think it's the code which is
transmitted, but they're never really
figured out how they're encoded
it, how they transmitted it.
It's not too important, though, but
we didn't find any information.
Whenever there was a transmitter,
there is a receiver.
So you just run around the building and
try to find the receivers to know if they
have markings on the garage gate.
The receiver is on top.
It's just a black box.
It doesn't tell you a lot on the
pool.
It's also just aluminum box, no markings
on it. We still don't know at the main
entry.
This is where you find our fancy dial pad
to contact the residence.
And we see on the top it says it's
from linnear.
So at least we know the vendor probably.
And after such hard work and running
around the building, you enjoy the hot
tub.
And this is where you use the second
skill, your social skills, simply
because every resident has a remote.
So you make the acquaintance, you're
making friends, and you ask, please,
can I have a look at your remote?
And this one had the sticker.
And it's particularly useful from the
sticker we find the vendor is linnear
and the product is 34
certifiable.
On the website we can find it so the
product still exists.
We know it operates on 318
megahertz. It can send 1000000 codes,
but the manual doesn't tell a lot and.
We already know what frequency transmit,
but we want to continue and find more
information.
Again, if we look at the remote on the
top, you will see there is an FCC
I.D. And this is one thing I know of in
the US is that
whenever a manufacturer
wants to produce something which
transmits radio, they have
to comply to some regulations and
they send test reports to the Regulation
Authority FCC to show, OK,
I transmit that power and it complies
to FCC Part 15 for radio
transmission.
And the FCC shows you
these documents and compared to the
manual, the technical documents.
So this is where we find I really
need information and we can
see that they provide a lot of
data, although they don't have to provide
so many so further the test reports
to tell you what kind of transmission
it uses. And he will see its
amplitude modulation, something
which is very simple.
So to signal if it's strong or not,
gives you the level.
It's also a wendie.
And if you look in Wikipedia in one
instance for amplitude, one
is just one channel, 318 megahertz defo
digital, I think.
So there's only two levels either
on or off.
Very simple transmission.
And the data is probably
call it in. Postposition
even provides you some information about
how the mega code code is sent.
You have 24 frames,
24 frames, each bit frames.
It's six milliseconds long between each
other and within each frame you
have a one millisecond pulse.
So you have a the remote goes on and just
transmit very loud at this at this
frequency.
And there were so kind to provide with a
timing diagram and everything just
because after we found everything to
the FCC and we almost already know
it's encoded.
So we spend a lot of time
and as we can see, we have a snippet.
So the remote, the receiver knows
there's a signal like we recorded
to twenty three twenty
system code with the three data bits
and then there's a blank cell before you
next to send the next code.
And as a written it,
each bit frame is six milliseconds long,
each pulse is one millisecond long.
Now we know it transmits its data
to play with software, defined radio and
even for entry level, you have this chip
out Celestia, which everyone speaks
about only twenty dollars software
defined radio.
You look at the frequency here
use as the range of your tuned to the
frequency and this is on the left
of frequency. On the top you can see a
fast transformation which will
tell you at which frequency.
There is a strong signal and we see there
is a peak at 380 megahertz.
On the bottom you see a waterfall
diagram.
It's almost the same that on the top.
But you have the timing component.
So you can see over time how the signal
is and you can clearly see the pulses
every time on and off.
Whenever there's a yellow peak, it's a
it's a pulse.
It seems to correspond to the to the
specification. And that's that's good
software. Defined radio can be
complicated and no radio is complicated.
And I don't I'm not a
fan of it. Oh, I don't know how to use
it. It's probably very good. But we want
to keep things very easy and
we know it's a modulation.
So I just use a tool called RCL
FM, which
can do it for
listening to audio using the software
defined radio. So you tuned to the
frequency. You tell it's a frequency,
it's a modulation.
You put it in a file and then
you open the file using any audio editing
tool. And here we can see again
two times twenty four pulses.
If we look at the details, we find of
pulses are one milliseconds long and
you have groups, you have bursts
and you have big frames of six
milliseconds.
And we know the information.
It's pulse position is quite useful
because it's a bit frame.
So there's only one frame and
then there's a position.
And if you look at it, if the verse is in
the first half, it's zero.
If it's a second half, it's a one.
This is not the written in the
documentation, but you figure it out
pretty easily and
we know it's encoded.
So we wrote a program which just takes
this demodulator
data and finds out
the code. It's pretty short.
One hundred seven lines of code.
It detects the address in groups to
adjusting to pulses of one milliseconds,
then it knows it groups
to one millisecond processing group of
twenty four and then it decodes it.
And here we can see on the left the
value which are recorded, the twenty four
bits, the three bytes
and we immediately see it's
exactly the same code all the time.
It's individual per remote but it's
actually the same. So we have a replay
attack if we can record it and we
can send it.
We have a clone of the remote
only using this documentation
which we have.
Um so we have.
We want to send it look again at
the FCC, can we reflect on
remote using our own code
in electronics? You have a
board layout which tells you which
component is where.
This was also provided you can see who
footprints for putting a switch as
one. And every component has a
preference as one is for switched.
You want is for the microcontroller and
so on basics.
So you will learn how to read printed
circuit boards.
They also schematic schematics a bit more
abstract way before you
do your circuit board.
You want to trust to know
which component is connected to which
other, where they are placed and how
they're connected. You don't really care.
You just want to find out how they're
connected. This is what schematics are
for.
And if you get if you
learn a bit how how they work, you will
find out they are the switches on the
left, a microcontroller in the middle,
the clock just just behind it for 318
megahertz and then the antenna.
This is also what we see on the identify
again on the board because we have the
reference which tells us
you one is the microcontroller
look for you are on the board.
You will find a microcontroller and you
will find the plug to switch the antenna
and on passive components.
And even if you didn't do electronics,
you already pretty much know how to read
schematics, how to read boards and how to
identify components.
The problem with that one is that it uses
a microchip to see microcontroller
and this one is only
one time programable.
So you can look at the
I know this because of the schematic.
The schematic told me it uses this chip.
And if you look for a microchip, which is
a big microcontroller,
very known for hobby projects, you'll
find is only one time programable.
So I cannot reflash to call on it.
It also has code protection, so I cannot
read the Fumo on it
this way. I cannot flechette it.
That's that's a bit of a shame.
But the simple is so easy that
probably somebody already did a
compatible device.
So you look, you use you Amazon
and eBay skills, you look for a linear
meerkat compatible remote and you
find one which is not by the same vendor,
it's by transmitter solutions.
It's the monarch.
Thirty one thirty eight
twenty eight
thousand three hundred eighty megahertz
effect the same frequency.
It's compatible with the linear activity.
Mondi That's what we have and
it's programable.
That's interesting. The other one was not
programable.
The manual doesn't tell you how to
program it.
There's a small section telephone contact
your manufacturer, but there's the FTTH
on the right and we've seen the FCC
is pretty interesting.
So you
look at if you don't find
as much information as the previous one,
but at least you have a picture of the
interior and you will almost
immediately see that on the top, there
are some Pineta, which is on Soldat,
and this indicates that this is the
programing header which you should
connect to program it to.
We bided the programing it had is the
same. We can read from the top markings
on the chip with kind of microcontroller.
It is. And this one is flushable.
It's again a microchip pick
microcontroller from but it's based on
Flash and I can program.
It's the next
kill will be soldiering.
Even if you never did any hardware, you
just have to shoulder the pins on the
right side so you can connect
your programmer and program the chip
for entry level.
It's altering.
It's pretty good.
It's pretty easy to make.
We also want to know how
the things are connected this time, they
didn't provide the schematic, but we
learn a bit how to read polls.
We can find a of Motorola the clock when
Ali went straight to programing header.
And if you check with the multimeter how
they're connected, you find the schematic
again and you can write your own
schematic this time, microcontroller
clocks, which pretty simple, actually
even simpler than any Arduino
or things like that.
So even if you didn't use Arduino,
you can use this as an entry programing.
We figured out how everything is
connected. We know how the signal is
modulated, how you have to send it.
So it's time to write our own firmware
and just enabled the clock and
the transmission at one one
millisecond long every six milliseconds.
And we know the pattern.
And if you could switch to to the camera.
So so you wrote the program.
It's pretty simple.
Five lines of code and this way I can
flash my code on it.
But
this.
Where is my terminal?
Oh, he doesn't.
Can you show the camera OK?
They will. Well, they do it.
I will just start the software defined
radio so we can really see the
transmission
and which terminal is its software
as the original. So here we have the
software defined with the remote,
with the antenna.
The remote is here.
Now we enable
it. And if I press on it,
you see the the
transmission which is made and you see
it's on or you don't see it anymore.
This is the this is a civil talk about
later, and if you see on the side,
whenever the code is transmitted, the
light stays on.
So it means this transmitter
will react to this court normally to
blink blue. So I will do it by hand.
It's somehow broken, like always demo.
So it will be.
It only works
with this remote.
It does not work with this remote.
As you can see, it doesn't do anything
for now.
Oh yeah. That's.
Um, so we
identify the frequency.
Well, just quit it and
then we just use the decoder, which we
had.
Press on the remote.
A couple of times
you exit and here we see the value which
we recorded on the left side,
we know which value it uses.
And if we look at the other remote, which
is here
at home, I think you have to
enable it.
Yeah, make
on operation succeeded.
If I transmit this one
so he can see that it transmits
using the energy.
I will find that it uses another code
now, I will simply
edit the EPROM
with this code, which is
21 eight A.
Flush it on its so
you use a standard, I use a big chip
to program.
This is generally what you use to flush
this, Michael.
This these microcontrollers.
Please, first, please.
No picture to
try to turn the USB here
connected directly here.
That's not your speed.
This is your speed.
Fleshy.
Flush
it from.
Make on.
So now the thing is
open and if we look
here again and if we send a code.
Then we say that it should open
the gate and this is our remote,
we cloned called.
Back to the presentation in front of you.
I didn't stop it and I didn't stop at
just cloning the remotes.
I we have one called for one
remote. We want to have even more.
How about getting quotes from other
remotes?
You can do it with software defined radio
again, but it gets
so the stimulator which you have is
very central frequency and the bandwidth
is not is very narrow.
So we're using software defined radio is
quite complicated to record far away
one signal you have to play with and
to gain and so on.
I'm not sure the software defined radio.
I'm a bit better electronics.
So when there's a center, there's a
receiver, just a receiver
online. Formerly Demnig, I could look
at the receiver, open it.
You see again, not a lot of components
and we already learned how to identify
them. You have microcontroller the
antenna, radio filter the voltage,
then some memory, which memory where
you can store codes. And generally this
is the memory which is used to read out
which code is allowed or not.
It's a single area design.
So on the back you will see all the
connections to all the other pins.
You can read them visually and
using you the components which you can
identify in the path.
You can already figure out who is
connected to what.
Huey created the schematics again.
It uses a pick which is only
one time programable.
We don't want that.
So we ansaldo the chip.
That's your skill, which you will learn
not to vacuum, just vacuum
the week. And they're pretty resistant
this trip. It's hard to break.
You put your own chip, which is
the same, but just flushable.
The name is the same.
You program everything.
You once you already know how the
modulation works and your reward code
for demonstrating.
You already wrote code for the
microcontroller, so you do exactly
the same. But just on a microcontroller,
on this microcontroller and
then you put it just next to a government
store and you power to a USB
and you wait until lots of people go home
and go and go back and record lots
of codes so you can impersonate
anyone you want.
Just because you have the call and they
are fixed, but another problem is
that, you know, when they leave home
and you know, when they come back, it's
individual code.
So you probably could go home
and stand still everything and have
enough time to to leave back.
The pool, again, this is the last piece
of information,
very important, simply because
the pool fence at 10:00, they kick you
out so they have a security guard which
comes in at 10:00, triggers
his remotes.
I wait with my recorder, I record
the security code and
I have the security code and enjoyed
the hot water.
And with the security code, I can access
the pool. After 10 o'clock, I can access
every building and you could access
the security room with all the
other TV.
And if you don't want to wait for
security, you
take one more thing, could you flip the
bit, you flush it, you test if Target
still opens and this is where you find
which is important, which isn't
which pieces are relevant.
And from the 24 bits, you have only
15 bits which are relevant.
So you could read exact you could write a
framework on this remote which
just starts brute force the code and
you don't have to find one code.
You have thousands of residents.
So with 15 bits of thousands of
residents, it's pretty easy to find the
right codes to to enter the same
building.
But because we are not evil hackers, we
tell the vendor and as always, the vendor
just doesn't care even if they provide
security products.
And I also
don't I'm not
I also show stock because solutions
to this are quite easy, called Rawling
Codes, where the code sends all the time,
but you have a fixed seed.
If you do such a system, you should use
rolling code at all.
It's their fault if they don't do.
It's what we've learned
is that it's
not hard to do hardware hacking.
We reverse engineer a real device used
for security for Gates.
We improved how we serve, search
for documents, FCC.
We can make new friends and Hattab,
we know how to program a microcontroller.
There are lots of code examples which
will help you to program this one.
It's really very well
documented.
We use software defined radio.
It's at this level, it's not voodoo.
It works. We know how to solve this,
although we had fun.
And if you want more info, there's a
wiki. There are two videos which go
more into details and the source code is
also available and that's open
for questions.
Thank you very much for this great talk.
So any questions, please line
up behind the microphones.
Oh, yeah. Number four, please.
Hello. I work at a research
facility at accelerator
facility, and I've got access to my
laboratory rooms with this stuff.
And there are really expensive
equipment behind the doors.
So the first thing I'm going to find out
is if this works and
if it doesn't, what what
you mentioned is rolling codes.
So if it doesn't work like that, what
does rolling code, and that is it for
Brogo is no
solution for not cloning remotes.
And this is partly important, for
example, if you have a car
because you don't want everyone to to
steal a car and you have cars on remotes
to car industry, use a lot
of time rolling cords.
And how it works is that you have one
seat in the in
the remote and every time you press the
button it generates and it calculates
a hash, some kind of a hash of the seat.
And every time it changes because the
counter increments and
on the in the car, it has exactly
the same seat. It knows this remote
has this seat.
So I know which code will be next
and every time will be completely random.
So you don't know for which come from you
don't know the seat and see if you have a
central building, then you have a central
remote system which which knows where
which knows which code is transmitted.
So you should they should use rolling
codes if they have a central system.
If they don't have a central system, it's
a bit harder because you need to
synchronize the two.
But yeah, try to find one with building
codes and you can using software, you
find radio, you can see easily if it's
uses ruling or not.
OK, thank you.
The Internet has a question.
OK, yeah, well, the Internet wants
to know or somebody on the Internet
wants to know why you didn't get
in to or if you did, to get
into any kind of trouble because of
you breaking into the top are
like, well,
being able to open any of them doors.
I've I haven't been
to the security room because I'm not
interested in the security room.
I'm interested in relaxing.
And also in this building,
it's not really important to have a
remote and to have all this hassle of
reverse engineering because you seem to
hot party pretty low.
So jump over it.
And around the building you will always
find the door which is open.
So you can always come in the building.
And I had no problem even with the
security. I mean, they don't see if it's
a closed remote or not.
One more question from the Internet,
please.
Yeah, somebody wants to know
about if it's possible to open
cars with this.
No, not not new cars.
New cars use rolling codes and still have
strong, stronger encryption.
So if your car uses
this, you should sue them.
But generally, courts have ruled
out ruling cords and you can use not use
this technique. So it's a lot more
advanced in cars.
Try to use something which is
less attacked.
OK, thank you.
So I guess we have time for one more
question from the Internet once more.
Um, well, um,
OK. I was going to say that there
is none, but there is one now, um,
and that is what other stuff
can I help with your method.
Well, we did it for one
gawad from Auto and General Electric.
Motors are not very easy to try to
find another one. This is just one one
product from one company, which is in
California.
In Europe, they probably will use for
something completely differently.
So look at to go at
your garage door or the garage of your
neighbor, things like that.
OK, so very, very simple devices
when they are cheap, generally, they are
simple. So look at that.
OK, thank you.
Thank you very much.
Thank you.