julienfouilhe / automate-gate-opening

Automate gate/garage door opening via 433.92MHz emitter with Raspberry Pi, Home Assistant and Homekit.
56 stars 4 forks source link

Add method for rolling codes #3

Closed jacobburrell closed 1 year ago

jacobburrell commented 1 year ago

From README:

A garage door that can be opened by a 433Mhz remote. **You need it to be a fixed code**. I don't know how to check this, but rolling code will not work since we will be using the replay attack here.

Many controllers are using rolling codes. However it seems that it is possible to program another controller when you already have one controller, so it should be possible to program a Raspberry Pi to also do the same.

Looks like it's not always possible either though.

It seems rolljam attacks could work though

The easier way is instead of figuring out the secret value, to clone the rolling code and replay.

Jam+Listen(1), Jam+Listen(2), Replay (1)

2nd rolling code is still unused and can be replayed later. This is called a roll-jam attack.

It would be annoying, but you could brute force it by say pressing the garage controller 1000 times, having software that confirms each press was recorded successfully, storing the codes, and assuming an average of 1 press per day, which could give you enough codes for nearly 3 years.

Still, assuming 2 seconds per push, that's almost 35 minutes of manual configuration.

Another option would be to try to build an interface to directly control the remote controller from the raspberry pi, but that would be complicated by the several different types of controllers in existence and might not work with a new one, etc.

Perhaps there is a way to physically extract the seed that is on the remote controller? You may break it, but it would also be a permanent solution.

julienfouilhe commented 1 year ago

I would accept a PR that shares details on how to support rolling codes! Unfortunately, I'm not able to do that myself, I know very little about it.