Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

23
Breaking RF Unlock Codes They said it couldn’t be done

description

Attacking the rolling code cryptography used in remote entry systems to unlock cars

Transcript of Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Page 1: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Breaking RF Unlock Codes

They said it couldn’t be done

Page 2: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Bryan C. Geraghty

@archwisp

Security Consultant, Security PS

Page 3: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Over the next 15 minutes…

My Goal

My Prior Knowledge

The Target

Attack Hardware

Attack Software

Signal Analysis

Cracking

LIVE DEMO

What’s Next?

Page 4: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

The Goal

Unlock a car by forging a radio frequency signal

A jamming & replay attack has already been published

I will not be talking about that

This attack exploits the predictability of unlock codes

This is not a man-in-the-middle attack

I have not found any published research on this

Page 5: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Disclaimer

I have not completely broken the codes… yet

I will not be releasing any of my code… yet

I will not be disclosing car models… yet

Page 6: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Prior Knowledge

Before starting on this project, I had done:

A lot of programming

No work with RF whatsoever

Some cryptanalysis

A little bit of research on RF signal analysis

I submitted my proposal for this project in June 2014

Page 7: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

The Target

Most modern vehicles can be unlocked with a key fob

Sends a code that unlocks the car

Rolling code system mitigates replay attacks

Page 8: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Attack Hardware

Software Defined Radio Receiver RTL2832 w/R820T

Adafruit - $22.50

RF Link Transmitter - 315MHz

WRL-10535

Sparkfun - $3.95

Total: $26.45

Page 9: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Attack Hardware (Alternate)

HackRF One

SDR Transceiver

SparkFun - $299.95

Page 10: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Attack Software

SDRSharp

SDR Tuner

Capture data

FREE!

Custom Code

Frame Dumper

Demodulator

Encoder

Signal Generator

TIME!

Page 11: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Find and capture the signal

Page 12: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Yay! I captured some funny sounds! Now what?

Page 13: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Dump MSB from one channel of WAV frame data

Page 14: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Identify threshold value for binary conversion

Threshold:

If the hex value is

greater than 32, it

gets converted to

a 1. Otherwise, it

gets converted to

a 0.

Page 15: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Pulse-width demodulate the binary data

Another

Threshold:

If the pulse is longer

than 28 bits, it gets

converted to a 1.

Otherwise, it gets

converted to a 0.

Page 16: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Hex encode the binary data for analysis

Page 17: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Capture samples!

Page 18: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Signal Analysis

Analyze the samples

Page 19: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Cracking

I identified a bunch of patterns

I wrote some code to:

Identify more patterns

Generate signals using these patterns

Compare them to sample signals

I’ve gotten very close

Let’s see how close…

Page 20: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

LIVE DEMO

Let’s hope this works…

Page 21: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Just in case the demo didn’t work…

Page 22: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

What’s Next?

Keep trying!

Find a PRF cracking expert

Collect hardware not attached to cars

Collect samples from more vehicles

Remote Start!

Page 23: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)

Thank you