Radio Hacking: Cars, Hardware, and more! - Samy Kamkar - AppSec California 2016
HTML-код
- Опубликовано: 20 мар 2016
- Watch Samy most recent talk on Browser Manipulation • AppSecCali 2020 Closin...
In this talk I'll introduce radio hacking, and take it a few levels into hacking real world devices like wirelessly controlled gates, garages, and cars. Many vehicles are now controlled from mobile devices over GSM and the web, while even more can be unlocked and ignitions started from wireless keyfobs over RF. All of these are subject to attack with low-cost tools (such as RTL-SDR, GNU Radio, HackRF, Arduino, and even a Mattel toy).
We'll investigate how these features work, and of course, how they can be exploited. I'll be going from start to finish on new tools and vulnerabilities in this area, such as key-space reduction attacks on fixed-codes, advanced "code grabbers" using RF attacks on encrypted and rolling codes, exploiting mobile devices and poor SSL implementations, and how to protect yourself against such issues.
By the end of this talk you’ll understand not only how vehicles and the wirelessly-controlled physical access protecting them can be exploited and secured, but also learn about various tools for hardware, car and RF research, as well as how to use and build your own inexpensive devices for such investigation!
Samy Kamkar
Samy Kamkar is an independent security researcher, best known for creating The MySpace worm, one of the fastest spreading viruses of all time. His open source software and research highlights the insecurities and privacy implications in every day technologies, from the Evercookie which produces virtually immutable respawning cookies, SkyJack, the drone that wirelessly hijacks other drones, and KeySweeper, a wireless keyboard sniffer camouflaged as a USB wall charger. He continues to release new tools and hardware, for examples most recently the ProxyGambit, OpenSesame and ComboBreaker tools.
-
Managed by the official OWASP Media Project www.owasp.org/index.php/OWASP... 
Наука
Possibly the best answer for the public acceptance of Def Con, literally laying out the pathway of how vastly distributed insecure systems can be horrifically exploited because security standards weren't even a consideration. The arc from innocent fooling with your garage door to literally stealing any vehicle anywhere so long as you have cased it earlier is just a solid gradient from happy fun to full GTA superthief. Samy Kamkar did a wonderful job, not just as a sploiter, but as a presenter, this is top level Def Con.
This is a very interesting talk. It gives even a non nerd a great insight into how insecure our world has become. "Just because it's invisible, doesn't mean it's safe" is a very eye opening statement. You have given me a new respect for hackers.
Samy is a terrific presenter.
Yeah he is one of the gang stalkers. That's why he teaches classes on this shit.
A waist of time
Wrong ail and or websight not mine?
Samy Kamkar one of the most brilliant people you'll ever hear !!! Samy is my HERO 😁
GM is the perfect example of listen when someone is speaking to you, and have the respect to, at least somewhat, hear it out.
So how would you defend against this sort of attack
@@foreverhidden0465 A medieval shield
Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .
Thanks to Samy, you can’t buy an IM-ME, now, for under $800. Believe me, I’ve been watching for one. My wife and I also go to antique malls, thrift stores, flea markets, etc, and I always look through the toys, hoping to find one of these. I haven’t seen a single one, in six years of looking. Thanks Samy! 😂
I just looked on ebay and there's a few for around two hundred dollars.
yeah man, i literally sold one like a week ago for 140 bucks....whats silly though is all you need is an arduino, a TI CC1110 sub-GHz RF chip and a few more things, some programming and you have your 200 IM-ME
90 bucks through Walmart online
@@Willam_J You don't need a laptop to use a HackRF. Look up the portapack H2.
loved this presentation and how you displayed the slides too, very informative and kept it laughable and fun.
This is a very interesting lecture with a wealth of information. It would have been awesome of you to leave links for everything you are talking about.
Nice lecture, good overview of fun stuff to play with and the hardware/software starter tools.
I think this is one of the most interesting videos I've ever seen ! Thank you for all the great information and details 👌👏
This is so fascinating. I want to learn more
Oh the days of FSK Modulated Bit Shift Keys were sweet..Could open Garage any Garage Door so easy.. Remote gates were easy as well..But my oh my how things have changed... Great Presentation... Thank You
A safe way to lock/unlock a car is, instead of using a rolling key, use RSA with timestamp encryption. The car would send a public key to the key fob, and the key fob would respond with an encrypted and salted hash containing the encrypted pass plus the command. That would by encrypted via a timestamp as well, as part of the public key. The private key would be used to decrypt the (command + pass) hash, but would never be sent via radio.
Edit: Just saw the final of the video, and you suggest the same. Nice!
I feel like as long as the action remains electronic it will always be vulnerable. Hence: the killswitch.
@@j4k3z sure but this is WAAAY harder to hack than regular rolling codes.
This was an excellent presentation, well explained! Thank you!
Had my attention the entire time. That is even more impressive than your brute force 4 second average cracking time.
i dont mean to be off topic but does any of you know a tool to get back into an instagram account??
I was dumb forgot the password. I appreciate any help you can give me.
@Vicente Andrew instablaster =)
@Patrick Collin thanks for your reply. I got to the site thru google and im waiting for the hacking stuff now.
Takes a while so I will get back to you later with my results.
@Patrick Collin it did the trick and I actually got access to my account again. I am so happy!
Thank you so much, you saved my ass :D
@Vicente Andrew glad I could help xD
True story.
My neighbors think I'm a little strange. They locked their keys in their car two months ago. Was walking the dog and talked to them. I told them I can take any sauce pan, put a rock in it, scream loudly in the pan and put the lid on, it will unlock any car. Went inside the house, got the pan and did this. Their jaws hit the floor. They tried for hours after I left.
Maybe I should tell them I recorded their keyfob with my LimeSDR previously just in case and my daughter hit the mouse button after I told her to wait for my signal.
Just a question: Why do you have the car door codes for your neighbor's car?
@@ovencake523 Just in case...
Great lil story if it's true. Hehehehe
Priceless
Haha that is hilarious! Great thinking by playing a little joke with the sauce pan! I wonder if you ever told them what you really did!?
Recently discovered Samy. Great stuff, Man! TY!
I've been a Ham for over thirty five years and can remember driving around with my dad's car as a teenager with a CB and a 600 watt amplifier and activating bank alarms, opening electric gates and garage doors, and emptying the nightclubs by causing an ear piercing feedback to their sound systems.
lol
People in my area use to stop at a red light near a furniture store and turn on the touch lamps at night with their little 100-200 watt amps.
What an explicitive generator you are.
@@jerrygaber6150huh?
This talk is so damn interesting, loved it :D
One thing I think would be cool to add in the section relating to MITM attacks would be the usage of a deathentication attack or a re-pair attack as its known in Bluetooth. This can help capture that wireless handshake as well as cause a device to connect to your false network.
maybe
that moment he opened the recorded garage door signal modulation waveform in audacity.... genius. Crystal clear! This is the core essence of hacking.... learning and understanding technologies, and use them in ways they weren't designed for.
Chris Savage hi there seen your comment and thought you must know what your talking about I’ve got some questions on translating rf into binary
@@dandwrasan2342 Go ahead
Fascinating. Great job on the presentation. Ten stars
I thoroughly enjoyed every minute of this video. Superb content, clear and concise. A lot of details all at once lol, but perfect. I hope they pay you well 😆!
This is a brilliant lecture, natural teacher
extremely helpful ,full of interesting information. Thank you
Absolutely brilliant lecture!
Worth every minute😍😍 RF is a very interesting topic. Dude😍😍
I like how he is so excited but ham radio operators have been using this equipment for a while. Everything begins with the understanding of RF.
@@maxwellryanryan1839 zq
Am and FM to throw it off.
Great talk Samy!
Couldn't agree more old sport
From half an hour to just eight seconds - This is insanely fast.
now you understand the power of Math ;)
Every garage door on the block opens in an 8-second span
@@masskiller9206 I would love to see someone transmitting that code with stupidly high transmitting power, just to open random garage doors in a city all at the same time. Just for the lols.
@@GODofTimewaste2 regular power, very high gain antenna lol
@John fine, _suburban area of a city_ . I bet there are devices that would react to this even in an urban center though.
This is just amazing ! I'll order a RTL-SDR right next month :) I'm sooo excited what i'll find...
Buncha cool stuff! google WebSDR if you aren't already familiar to get a taste for sniffing the airwaves. I prefer the one in the Netherlands, I get lost in it for hours sometimes
what did you find? :D
@@Wiresgalore That is the best imo.
Did you get one??
This is a fantastic video. Glad Samy is on the good side of the law. Do you know if auto manufactures are only fixing new car systems or do they also have some kind of hardware upgrade system to improve older cars?
I definitely need to hear about this bc it's been a problem with this in my on life ... thank you so much for this
That was awesome. I learned 1 new thing so excited.
I think I will 'record' the frequency for my car and keep that data just in case I loose my key.
funniest comment on here ...
good
It is not gonna work. Car key signals are encoded and encrypted using random numbers and algorithms like KeeLoq cipher.
@@DupczacyBawol Correct. But, Samy created the code to successfully capture the signal and do so as mentioned above. He obviously will not release the code due to malicious use. Look at his site/google for the article. RollJam by Samy Kamkar
there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
Wow, the De Bruijn sequence is amazing! I wonder if vehicle makes now perform validation or hash their pw's.
To view wider RF spectrum then use hand held spectrum analyser with small embedded display - they are about $100 up to few thousands dollars in price depending on capabilities. You may get basic hand help SA for $200 or so and view all frequencies say from 15 MHz up to few GHz in freq.
Great presentation, Samy.
Interesting information. This shows that there is nothing quite like a hidden kill switch on your vehicle. Put the switch in line with power to the starter or ignition and make it hard to find easily. Hardware trumps software. The best place might be the power line to the fuel pump. The engine will crank and might start, until it shortly runs out of fuel.
Interesting! I did something similar to reproduce the remote to an adjustable bed. Found out it used a CC2500. Now I can use my phone or Alexa to control the bed. :)
Wow incredible you must use sure app!
For those who did not get the concept :
there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
I only had an inkling this was going on. Thanks for sharing.
Brilliant!!! VERY Interesting!!!
I sure hope the car manufactures whom you shared your discoveries, of the "vulnerabilities in security" offered you more than a handshake, and a thank you. I'm sure this discovery to you was only one of curiosity, and a hacker's delight, although with this information you sir, have helped progress technology as we know it.... not to mention saved alot of peoples cars from getting jacked!!! (LOL) I thank you. keep on hacking brother.
even scarier !!! with technological backdoors like this one can easily perform a terrorist attack or a murder, just take control of his car and slam him offroad or lets say in whitehouse ?! crazy, this guy is like Tony Stark of hacking, good job Samy, you are my new idol ! :)
it was a nice presentation. I am little curious about the questions end of the presentation. bt thanks for the knowledge .
Samy is still my hero!
My space
@@noson_ is your space
@@Cygnus0lor sorry I do not understand want you are writing me
whizhackz ofoz .com
Good for you kid, living villains are becoming heroes to ppl nowadays. Where the world has come into.
This was great presentation
I now remove my battery and all 4 wheels. It a pain but if they want my car they will have to really work for it. 🤣
They will just vandalise it and strip out anything of value. Does your alarm still work without the battery?
Haha, you've essentially described what motorcycle, moped and bicycle riders do in large cities through metaphors. I've had one motorcycle stolen and another severely damaged in the attempt. That's with tech that has nothing to do with this video.
Wheel lock
@@sunyun4425 One of those extremely loud vibration alarms, active GPS, and a WHEEL LOCK is about your best bet and line of security. Other than that, the best security for your motorcycle is a highly reputable insurance company with exceptional theft protection.
😂😭😭😭😭😭😭
Thank you, Samy!!! For the info...
Hey Samy, do you know is it possible (in theory) to duplicate car remote key (it’s features) onto a different device with remote capabilities? - If using my own key, there is an option to duplicate it to other digital device with remote options.
This was so fun to watch! Thanks
As soon as you started explaining that you were cutting the pauses between the signals I said to myself "we can use superpermutations here"
For time frame of 30:00 today ARM MCU have the capability of securing all communications by HW under supervisory mode, unless you are dealing with older technology then you will be at risk because todays ARM MCU have very strong security and strict supervisory mode preventing unauthorised users to intervene. Old technology did not have the ability to lock supervisory mode and allowed intruders to switch from User Mode to Supervisory Mode wirelessly or via WiFi or even if cable connected.
Exciting and disturbing in roughly equal measure. I like classic cars all the more now!
lol I hear that one .
but classic cars are much easier to break into
TheBreakfastGod you are not wrong. My car has no keys or locks for that matter and starts with a screwdriver. That said, perhaps not so easy to gain access to when at speed on the road 🤣.
Yep oldies but goodies. Lot less to go haywire, lot less sensors. All this tech in vehicles has amounted to big bucks for the dealerships.
@@yams3954 yes they are, but if a person wants to steal something bad enough they will find a way usually.
im glad your on our side
RF are so easy to hack, some time ago spend a day researching them. I found 315 and 433 Mhz are reserved for home automatization and basic security use. I got a Chinese universal remote controller that supports IR and RF on 315 and 433 Mhz and with push of a button I was able to clone and resend the signals for most of the things I have at home like door bell, car unlock and lock smart light switches panic buttons and others. It takes just few seconds to record the signal. But for more detailed knowledge Samy's video is just perfect. It's saves you allot time. Thanks man.
SS Suleyman is it so easy like you say to hack these signals ?
The wave the car key sends is encrypted
No, you are wrong regarding digital transmission.
Abdallah Shuaibu that’s true 👍🏻
Well timed sip at 20:54. Confidence is exuding from this man here lol.
Great presentation 👍
Very interesting. One thing I would suggest to improve the recordings is to repeat or summarise the questions before responding.
Agreed. The last 5 minutes, roughly, were useless since we couldn't hear the questions and there weren't enough context clues to figure out what was being asked.
Yup thought the same thing. Someone get that man a microphone, or as you say, just simply repeat the question for us.
All well said - how about some suggestions on how to protect yourself from key fob attacks? A simple one is to shield the key fob with a simple faraday cage, such as an aluminum foil, while at home or in the parking lot, if it comes to that.
Legends without cars are watching ❤❤
Great vid man! Thanks bro! Any spare kit would be awesome!
thank you for this video!
lmao good opener "we all love nic cage right"
What would you use to find out if somebody is chipped a frequency detector or a emf detector??
With RTL-SDR you can do much much more, AIS, Weather satellites and more
awesome presentation brother
this video was so informative thank you
What's the indicator for a car to know that a code has been used before? Does it have a memory and logs history codes? Or go through a list of possible codes one by one in a random sequence? What if you've maxed out all the possible codes, does it start repeating codes?
Rolling codes are very easy to catch, simply create a higher amplitude signal near there garage door and have a receiver where about they would activate it to open it. Sometimes they press it too soon anyway out of range, but as you said exactly repetition but rolling codes themselves are actually *breakable*. If you can capture numerous codes from opens and closes, you can actually use a deductive algorithm to reduce the time to what I calculate could be only a few days as there is no lockout. I call this attack deductive unrolling ;-) as you s aid, might be easier to kick there door in and get the keys. But, I don't like to give too many ideas publicly somewhat reluctant to even post this. Another thing, the rolling codes do have limits on older units so I believe it's usually 65k codes, newer one's have larger bit sequences. Now, WiFi enabled openers are gaining popularity and using pcap and simple wifi security flaws like one in Chamberlain (liftmaster) they leave ports open and you can pull the API cgi page which interfaces with the mobile app and it's easy enough for people like you and me. On car keys such as that on one of my older benz's, it actually uses IR for LoS functions like lowering windows and the IR portion may even have other functions. Again, I may delete this post as I'm a bit nervous over the possibilities and potential attention on this, and I was able to capture that with a learning IR remote and replay it. Worked once assuming I was near the transmitter unlock.
… near *THEIR* garage…
The part where talks about spoofing a ship's gps signal really made me think of the Key bridge incident. I'm not saying it was hacked, but the fact that it's possible is mind boggling.
Time well spent!
The more I listen to him the more interesting
Very good presentation :-) just one thing: please repeat the questions in the Q&A
The problem with rolling codes... They all roll around back to the beginning. In a way, they are exactly as easy to crack as a stationary code of the same length.
If you roll... 123, 234, 345, 456, 567... 901, 012, 123...
Just broadcasting "123", every single time, you will eventually hit "123", after it rolls-around, as fast as if "901" was the ONLY code, and you had to step-up to "901".
As for being a rolling "set" of fake randoms... That makes it even easier, because there are even MORE values that are "true", not "less", in that same range. It will accept "123" OR "567" OR "091", because any of those could be "possible" as your random "next" code that it has to accept as "true".
Does this video talk about hackers listening in on your car convos??
@8:30
.....isn't that what they do when they climb for altitude?
I can not hear the questions coming from the audience.
To prevent the jam+replay hack, if the rolling code is just continuing for every keypress, locking the car should invalidate the previously recorded unlock code.
nope, wont work, the reciever misses some of the transmitted rolled codes and thus is out of sync and dous not know what rolledcode it missed in the series excpected codes (in a recieve only setup), to fix this you could use spectrum of possible rolled codes (with reset evry x try`s , but his increases accessibility of brute force.
samy is my hero!
So if you take someone's key fob and press unlock 1000 times while it is out of range of the receiver, that key fob would stop working forever?
Wat about remote neural monitoring can you detect that at ulf ultra low frequency from 0mhz to 70mhz
Wow! Thanks for doing this. Are you saying that we don't need to use an expensive spectrum analyzers to find signals? Signet Intelligence has that capability. Id like to find out who is bombarding v2k technology to my head. Noticed sonar rays hitting my head while wearing a tight head wrap. Can hear a tracking sound.
i like samys style to make us understand all this bs.....thanks man
in the old days my dad had a garage door opener that had a roller switch where you could just stand in front of whatever door hold down the button then roll the switch back and forth till it opened it took seconds
When you find a video which already you hit like on it but you don't remember it, do you watch it again?
This dude make things soooo easy, he should make courses
The scrolling code of clicker is not random but quasi random, meaning the series of passwords repeat after certain number of passwords had elapsed - for example the scrolling codes list repeat after 60 times of using different password codes. Professional thieves attach a receiver to your car without your knowledge to record all the rotating codes of your car and store it in their receiver then copy those codes into their transmitter to have complete control over your car - they use the same scrolling code of your car or garage. You will know that there is something attached to your car when the Bluetooth of your car keeps disconnecting and reconnecting or your mobile gets disrupted at times, then you need to inspect your car for some magnetically attached bug to your car from under your car. Use your camera phone with long stick to pass it all under your car and observe any attached bug. Once you find it present it to the police and have it investigated for finger prints, if any. When the police refuse to cooperate then you know they may have attached it to your car, or were instructed not to cooperate LOL
very interesting and existing presentation :-)
Glad he's one of the good guys!
but now anyone can do this...
Really good one, thanks.
My guess is that PSK (phase shift keying) is harder to decode. Your device would see a single, fixed frequency, continuous signal.
PSK is very easy to decode. SDR software has it built in.
It would have been nice if you had repeated the unheard question. Fascinating video. I only drive old unfobbed vehicles lol
Great vid and a highly intelligent man
Samy i really like this video but it’s 4 years old have you got an up date?
Were can I buy THIS GADGET? 👍
Garage door openers haven't had DIP switches in a long time. All modern ones are rolling code.
In the mid 70’s I had a Genie Alliance remote garage opener. I drove around my neighborhood on my bike with an Allen wrench and turned the adjustable ferrite coil (changing the frequency) and actually got someone’s garage to open.
I just installed a new garage door opener and it has dip switches…
Awesome content
45:50 “does Chrysler also have...” best part of video :) dyed laughing
This video is essentially opening gates for new hackers
Samy is likely also an authority on cease-and-desist notifications. Pretty certain he could safely ignore most if not all of those.
Great Job !!! Love it !