OpenSesame – A device that can open fixed-code garage doors in seconds
Three weeks ago I reverse-engineered my garage door opener wireless protocol. I probed the remote's PCB with a Saleae logic analyzer and found it was a 12-bit code ASK-modulated at 390 MHz with bits encoded as sequences of 10 kHz and 20 kHz pulses. I bought a $13 spare remote to hack it and control the RF transmitter section from my computer through an FT232 sending the ASK signal. I just cut off the digital signal trace going from the MCU to the RF transmitter and hooked it to the FT232. I built a brute-forcer and it works quite well. I do not have my notes at the moment, but IIRC one code takes 25.6 ms to be sent. And my manufacturer (Genie) seems to require the code to be transmitted 4 times consecutively to open the door, that's 102.4 ms. Multiplied by 4096 combinations, this gave me a brute-forcing time of 7 minutes.I had tried Samy's exact attack to reduce the brute-forcing time but it did not work at the time because I tried it before I discovered the code had to be sent 4 times consecutively (5 times makes it more reliable due to RF interferences). So I am not surprised to see Genie absent from the list of models Samy found vulnerable.But I should try to find out the longest period of time during which these 4 repetitions of the code need to be sent. Maybe it does not have to be perfectly consecutive, but it could be 4 codes received within an interval of 200 ms or 1000 ms. If so it might still be possible to build a modified De Bruijn sequence that repeats codes 4 times while being only 4 times longer.By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. These remotes are so easy to reverse engineer, so common (Genie is in the top 3 or top 4 most common openers), and so old (the protocol has existed since 1985), you would think there would be information about it online, but nope.PS: I wonder if there could be commercial interest in cryptographically secure garage door openers? A $0.50 ARM Cortex-M0 MCU is all you need to implement a HOTP based on HMAC-SHA1. Then a simple learning/pairing system writing the key in EEPROM can even sustain the battery being removed from the remote. But there is probably no interest... which is why most remotes are insecure even the "rolling code" ones.(Edited to clarify some tech details.)