Hacker News new | ask | show | jobs
by sedatk 616 days ago
> “listening" to the keychain garage door opener with the FZ, and playing back the signal

That would only work with older garage doors that don’t use rolling codes, wouldn’t it?

3 comments

Yep. Non rolling code garage doors seem to be ubiquitous in rental properties here (Sydney Australia).

Rolling codes are better. But if you haven't seen it, Samy Kamkar has a device called Roll Jam, take a look at the last ~5 mins of this Defcon23 talk: https://www.youtube.com/watch?v=UNgvShN4USU

(The TL;DR of the trick there is: Jam the radio signal a key fob sends so a car/garage fairly wide band receiver can't hear it. At the same time listen with a better tuned receiver. Wait for someone to press their key fob and record the code, then wait for them to press it again and record the second code - then stop jamming and replay the 1st code you captured. Door opens and person goes through. But you now have a valid second rolling code that will work. You can do this with a Teensy3 and two CC1101 modules, about $40 worth of hardware.)

> But you now have a valid second rolling code that will work.

Once. Note also that the same technique will work on other OTP schemes that are not time-based.

With a basic rolling code that works and maybe still used in garage doors, but afaik current decent car alarms exchange encrypted keys several times between car and keyfob that you can't just replay. Even simply generating totp based keys and invalidating them in a few minutes is enough to make that kinda useless in practice.
How old that door can be? 30 years old? Even in the EU we installed rolling codes 30 years ago
30 years is new construction in US standards.
The key take-away is "rental property".
Yep! That’s an unfortunately (or fortunately, for the hacker unconcerned with garage theft) the vast bulk of installed garage doors.