News
THIS HACKER'S TINY DEVICE UNLOCKS CARS AND OPENS GARAGES
Code grabbe
The next time you press the wireless key fob to unlock the car, if you find that it does not beep before the second attempt, the problem may not be a technical failure. Instead, hackers like Samy Kamkar may be using smart radio hackers to intercept and record your wireless key commands. When a hacker walks into your car in a matter of minutes, hours or days, it won't even press these two buttons into your car.
At the DefCon hacking conference in Las Vegas tomorrow, Kamkar plans to showcase the details of the gadget he developed called "RollJam." Code grabbe radios are designed to break the "rolling code" security not only used in most modern car and truck keyless entry systems, but also in their alarm systems and modern garage door openers. This technology has long been more easily replaced by Kamkar's attacks than ever before, allowing intruders to track cars, turn off alarms and effortlessly enter the garage.
As described by Kamka, RollJam intends to hide on or near the target vehicle or garage, where it waits for an unsuspecting victim to use his or her keychain in the radio range. The victim will only notice that his or her key chain does not work on the first attempt. However, after the second successful press of the button to lock or unlock the car or garage door, the RollJam attacker can return at any time to retrieve the device, press a small button on it, and then replay it from the victim's key card. Code to open the car or garage again and again. “Every garage with a wireless remote can be broken, and almost all cars with wireless keys can be broken,” Kamkar said.
For many years, thieves have used "code capturer" devices to intercept and replay wireless codes for cars and garage doors. However, both industries responded by transferring the key key input signal of the ISM radio signal to the rolling code system, where the code of the key card changes with each use, and if the password is used for the second time, it rejects any Code.
To circumvent this security measure, RollJam used a very embarrassing technique: when the victim pressed their keychain for the first time, RollJam "blocked" the signal with a pair of cheap radios in the car and garage. The noise is stunned on the two common frequencies used by the door. At the same time, the hacker device listens using a third radio, which is finerly tuned to obtain the FOB signal instead of the actual intended receiver - and records the user's wireless code.
When the first signal is stuck and the door cannot be unlocked, the user naturally presses the button again. On the second press, RollJam is programmed to block the signal again and record the second code, while also broadcasting its first code. The first code of the replay unlocked the door and the user immediately forgot that the button failed. But RollJam secretly stores the second code that is still available. "You think everything is working for the second time, you drive home," Kamkar said. "But I have a second code now that I can use to unlock your car."
