Hacking the IKEA Rothult lock with a Proxmark

[@dcripps]

Thanks for the prompt to support Iceman. There are many people who spent a lot of time and effort producing open source S/W, that we are happy to use (and occasional gripe about) who are never recognised. I have now supported Iceman on Patreon.

[@seb5689]

love the quality my dude!

[@artineogda]

Wow, awesome. Thank You

[@timmehwimmy]

Have you covered the docker containers at all for the pm3 software?

[@QuentynTaylor]

I haven't yet as I haven't seen the need, I may have a look to see if I can't create a custom image - does docker handle host usb ok ?

[@timmehwimmy]

@@QuentynTaylor the way my image dealt with it was just to pass /dev through to docker. If the os works ok, the docker should too.

[@QuentynTaylor]

@@timmehwimmy i will have a play, i worry about things like modem manager breaking flashing

[@nickmachan6223]

LF standalone modes could be awesome!

[@benjaminkubo9092]

Hi Quentin, great Videos here on your Channel!!! Have you tried copying one of the mastercards on to another card? Would love to see a Video on this. Just got started on the PM3 and would to update my skills. Unfortunately I like being practical, as this serves my memory best ;) Keep up the good work!

[@QuentynTaylor]

well i would need an ST blank card and I am not sure if anyone has one ? if you mean copying a Mifare that can be set to open the lock thats straightforward

[@benjaminkubo9092]

@@QuentynTaylor Yes, something like that! I purchased an Rothult und would like to give away multiple cards, that can open the lock.

[@NathanielMcHugh]

Hi Quentin, great video. I was watching and playing along when I discovered some unexpected behavior. I wanted to see what happened when the uid was wrong so I changed the last number. To my surprise I didn't get back the password or an error but the lock opened. In fact if I simulate any st card uid apart from the 2 master cards that came with the lock it opens. e.g. `hf st sim -u 1234567890abcd`. Does anyone else see this behavior?

[@QuentynTaylor]

Hmm that's interesting - what you are saying is that any uid that isn't the correct one will open it ?

[@NathanielMcHugh]

@@QuentynTaylorabsolutely that. Don’t know if you still have the lock to see if you see the same thing.

[@QuentynTaylor]

@@NathanielMcHugh i have just tested and you are right.... it doesnt work with all number patters but with loads of them it does

[@NathanielMcHugh]

@@QuentynTaylor thanks for confirming that. Bit of a security hole being able to open them with virtually any id.