Slashdot Mirror
Opening Fixed-Code Garage Doors With a Toy In 10 Seconds
Trailrunner7 writes: It may be time to upgrade your garage door opener. Security researcher Samy Kamkar has developed a new technique that enables him to open almost any garage door that uses a fixed code–and he implemented it on a $12 child's toy. The attack Kamkar devised, known as OpenSesame, reduces the amount of time it takes to guess the fixed code for a garage door from several minutes down to less than 10 seconds. Most openers in commercially available garage door openers have a set of 12 dip switches, which are binary, and provide a total of 4,096 possible code combinations. This is a highly limited keyspace and is open to brute-force attacks. But even on such a small keyspace, those attacks take some time.
With a simple brute-force attack, that would take 29 minutes, Kamkar said. To begin reducing that time, he eliminated the retransmission of each code, bringing the time down to about six minutes. He then removed the wait period after each code is sent, which reduced the time even further, to about three minutes. Looking to further reduce the time, Kamkar discovered that many garage door openers use a technique known as a bit shift register. This means that when the opener receives a 12-bit code, it will test that code, and if it's incorrect, the opener will then shift out one bit and pull in one bit of the next code transmitted.
Kamkar implemented an algorithm known as the De Bruijn sequence to automate this process and then loaded his code onto a now-discontinued toy called the Mattel IM-ME. The toy was designed as a short-range texting device for kids, but Kamkar reprogrammed it using the GoodFET adapter built by Travis Goodspeed. Once that was done, Kamkar tested the device against a variety of garage door openers and discovered that the technique worked on systems manufactured by several companies, including Nortek and NSCD. It also works on older systems made by Chamberlain, Liftmaster, Stanley, Delta-3, and Moore-O-Matic.
With a simple brute-force attack, that would take 29 minutes, Kamkar said. To begin reducing that time, he eliminated the retransmission of each code, bringing the time down to about six minutes. He then removed the wait period after each code is sent, which reduced the time even further, to about three minutes. Looking to further reduce the time, Kamkar discovered that many garage door openers use a technique known as a bit shift register. This means that when the opener receives a 12-bit code, it will test that code, and if it's incorrect, the opener will then shift out one bit and pull in one bit of the next code transmitted.
Kamkar implemented an algorithm known as the De Bruijn sequence to automate this process and then loaded his code onto a now-discontinued toy called the Mattel IM-ME. The toy was designed as a short-range texting device for kids, but Kamkar reprogrammed it using the GoodFET adapter built by Travis Goodspeed. Once that was done, Kamkar tested the device against a variety of garage door openers and discovered that the technique worked on systems manufactured by several companies, including Nortek and NSCD. It also works on older systems made by Chamberlain, Liftmaster, Stanley, Delta-3, and Moore-O-Matic.
and an app on your phone that you can turn on/off via wifi. Not foolproof, but certainly better.
It's been several years since I bought an opener...and even then I can't remember seeing a major brand that wasn't a paired-system remote.
Is it just my observation, or are there way too many stupid people in the world?
Let's be honest, just check all on, all off, and alternating starting at 0 and 1.
The algorithm work is a good insight. The use of the toy is probably just for press coverage purposes, which may be a good strategy to get the word out and nudge social pressure to improve the industry.
All the hackers already know he probably could have build a transmitter with Sparkfun parts faster and for less money, so we should try to understand his methods rather than just dismissing them.
Not every security researcher is a PR genius, but the odds are much better than a Slashdot AC.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I remember the garage door opening and closing with every damn airliner flying overhead on finals.
“He’s not deformed, he’s just drunk!”
Unless that dog is my sister's fucking malamute. It thinks everyone that shows up is there to feed it or let it out to play.
Time to offend someone
Because in 10 years, I can't be sure that a "hack-resistant" car lock on the 2015 car buy today will be any stronger than these garage-door openers are now.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Why does it matter? The garage probably has a dozen different tools and garden or sports implements hanging on the wall that would make opening the door a trivial exercise whether locked or not. A person willing to break into the house once would certainly have no problem doing it twice.
Wrong. You drive down any street with your toy and find a door that opens, you now know for sure you have access without ever leaving the getaway vehicle. Most people don't lock their inside garage door and the bad guys know this.
No one even knows you opened the garage door, for all they know someone inside the house did.
Once you go over the backyard fence, you've committed a crime, and you still don't know if you can actually get inside.
Getting the garage door code minimizes your risk.
I know to think this way because I used to live in a neighborhood destroyed by the housing bubble, crime, including drive by shootings, went off the charts, we had to start a block watch, and the local PD rep told us lots of scary stuff.
He did say most, not all. Even then I doubt that it's most but I'd bet that it's a significant amount. Even if it's only 10 percent that's one out of 10. Not bad for quick and easy.