Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)
-
Upload
archwisp -
Category
Technology
-
view
345 -
download
5
description
Transcript of Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)
![Page 1: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/1.jpg)
Breaking RF Unlock Codes
They said it couldn’t be done
![Page 2: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/2.jpg)
Bryan C. Geraghty
@archwisp
Security Consultant, Security PS
![Page 3: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/3.jpg)
Over the next 15 minutes…
My Goal
My Prior Knowledge
The Target
Attack Hardware
Attack Software
Signal Analysis
Cracking
LIVE DEMO
What’s Next?
![Page 4: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/4.jpg)
The Goal
Unlock a car by forging a radio frequency signal
A jamming & replay attack has already been published
I will not be talking about that
This attack exploits the predictability of unlock codes
This is not a man-in-the-middle attack
I have not found any published research on this
![Page 5: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/5.jpg)
Disclaimer
I have not completely broken the codes… yet
I will not be releasing any of my code… yet
I will not be disclosing car models… yet
![Page 6: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/6.jpg)
Prior Knowledge
Before starting on this project, I had done:
A lot of programming
No work with RF whatsoever
Some cryptanalysis
A little bit of research on RF signal analysis
I submitted my proposal for this project in June 2014
![Page 7: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/7.jpg)
The Target
Most modern vehicles can be unlocked with a key fob
Sends a code that unlocks the car
Rolling code system mitigates replay attacks
![Page 8: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/8.jpg)
Attack Hardware
Software Defined Radio Receiver RTL2832 w/R820T
Adafruit - $22.50
RF Link Transmitter - 315MHz
WRL-10535
Sparkfun - $3.95
Total: $26.45
![Page 9: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/9.jpg)
Attack Hardware (Alternate)
HackRF One
SDR Transceiver
SparkFun - $299.95
![Page 10: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/10.jpg)
Attack Software
SDRSharp
SDR Tuner
Capture data
FREE!
Custom Code
Frame Dumper
Demodulator
Encoder
Signal Generator
TIME!
![Page 11: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/11.jpg)
Signal Analysis
Find and capture the signal
![Page 12: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/12.jpg)
Signal Analysis
Yay! I captured some funny sounds! Now what?
![Page 13: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/13.jpg)
Signal Analysis
Dump MSB from one channel of WAV frame data
![Page 14: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/14.jpg)
Signal Analysis
Identify threshold value for binary conversion
Threshold:
If the hex value is
greater than 32, it
gets converted to
a 1. Otherwise, it
gets converted to
a 0.
![Page 15: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/15.jpg)
Signal Analysis
Pulse-width demodulate the binary data
Another
Threshold:
If the pulse is longer
than 28 bits, it gets
converted to a 1.
Otherwise, it gets
converted to a 0.
![Page 16: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/16.jpg)
Signal Analysis
Hex encode the binary data for analysis
![Page 17: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/17.jpg)
Signal Analysis
Capture samples!
![Page 18: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/18.jpg)
Signal Analysis
Analyze the samples
![Page 19: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/19.jpg)
Cracking
I identified a bunch of patterns
I wrote some code to:
Identify more patterns
Generate signals using these patterns
Compare them to sample signals
I’ve gotten very close
Let’s see how close…
![Page 20: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/20.jpg)
LIVE DEMO
Let’s hope this works…
![Page 21: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/21.jpg)
Just in case the demo didn’t work…
![Page 22: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/22.jpg)
What’s Next?
Keep trying!
Find a PRF cracking expert
Collect hardware not attached to cars
Collect samples from more vehicles
Remote Start!
![Page 23: Breaking RF Unlock Codes - Presented at TriKC 0x01 (November 2014)](https://reader033.fdocuments.in/reader033/viewer/2022052602/559be02e1a28ab39568b46a8/html5/thumbnails/23.jpg)
Thank you