OpenSesame - hacking garages in seconds using a Mattel toy

[@motorinmysoup9912]

If you still read the comments I wanted to thank you for the inspiration. After seeing your appsec 2016 talk I began working like a madman for an entire week and managed to make my own. I used rpitx with a raspberry pi 3, low pass filter and antenna to transmit frequencies and made a nifty python script to shoot out codes using the De Bruijn sequence. It takes 30 seconds but all things considered I’m very satisfied with that. Hearing that rusty old door rattle open was the proudest I’ve been in years. I was giddy for days. I’ve never done anything radio frequency or programming outside hello world’s. Maybe one day I can be like you, doing important projects and inspiring others. Thank you.

[@user-ge7ep5sc2d]

Hi can i contact u to further explanation? I've been programming a lot in python and raspberry pi but never with radio things and im lost. It'll be good to have buddy with same aspirations as mine.

[@thefunneyone]

hay u just inspired me

[@Uneke]

You should make a video on this. Because I’ve looked up his code and it’s broken… so not sure how you managed to have his script converted to rpi and work

[@pablowatanabe7929]

@@Uneke have you tried fixing the code with Chat GPT?

[@Uneke]

@@pablowatanabe7929 might work… long shot though considering it could be something as simple as he changed the frequencies.

[@prizedcoffeecup]

"A 2 character password on a website is more secure than a garage door opener...thanks Obama." -Samy 2015 Lmao

[@downtownshark]

Thanks because Obama has blamed Bush for his own mistakes.

[@prizedcoffeecup]

This is not me giving you guys crap or anything, but just a friendly reminder to keep things civil here. Too often have I seen political conversations become political arguments.

[@savage1267]

prizedcoffeecup I LOLd it was worth it.

[@brodierollins7701]

prizedcoffeecup i

Apparently I'm not being able to link the "two-character passwords x garage door openers" with the apparent fact Obama blamed Bush for his own mistakes. Care to explain?

[@chase_like_the_bank]

This guy is friendly, eloquent and brilliant. He makes me want to take more EE classes. You are amazing dude, and keep the awesomeness coming.

[@maxvideodrome4215]

I built something like this when I was 13 years old back in the early 90's using a bunch of relays and binary counters. Got the idea when opened up a universal remote, noticing only a few dip switches. It worked, but too far longer than 10 seconds! Used it only at a friends house (new sub division) because where I lived no one had automated garage doors. Cool seeing new and better ways of doing old things

[@LFCooledWhip]

My god these videos you produce get better and better; content-wise and quality-wise. Keep it up!!

[@samykamkar]

LFCooledWhip Thanks!

[@Centerstagerentals]

I can see your passion in doing this type of cool youth charitable educational content . I see that you currently do work with big brother/sister program. that's pretty awesome man ! I'm enjoy your videos man. I like the clean-up on this one .

[@Determinator21]

​@@samykamkaryou think this information will stop us from giving this device a bad use?

[@random_works]

Just got through assembly/machine org at my university and it's awesome to be able to see how it can be applied. Absolutely incredible - love your work!

[@gotbletu]

1. make universal opener 2. sell on ebay 3. profit 4. evil genius laugh

[@WhoWantsToKnow81]

gotbletu Muah-ah-ah-ah-ahhhh... (Dr. Evil)

[@jfan4reva]

+gotbletu Plan B 1. Buy up a pallet load of IM Me toys. 2. Post how to video on KZbin 3. Sell IM Me toys for $150 each 4. Evil entrepreneur laugh (not that anyone would do this)

[@fusseldieb]

+jfan4reva And suddently someone breaks into your own house with your sold equipment lol xD

[@bahhaziz]

it would be illegal

[@biorpg]

+David .. trollbait, I'm sure.. but you seem to be unaware of the FCC.

[@tmtrainerred9968]

My family's excuse for not changing our wifi password of '00000000' is "Nobody round here is going to hack us!"

[@Nor1MAL]

I have heard that excuse before, but on a buisness email account and not being careful with the password (It was a strong password), saying that nobody would exploit/hack/crack her email. Person was not careful enough and it got taken over by a spammer, which quickly got the email blacklisted and the provider quickly locked down the account after that. How the person got a hold of the account I don't know, but I suspect it was her doing emails over unencrypted wifi, hostile wifi or whatever, and sending the password in plain text instead of at least encrypted while sending the password that I said was the bare minimum. She/her husband failed to do something that easy, because the provider has step by step explanations how to set it up etc, which I told her about (She didn't have said phone with her or she was going home at that point, don't remember which). So no, that excuse is stupid. People will hack/crack wifi for several reasons, and the least worst one is perhaps those doing it do mess with the owner of the wifi, like pranks etc. Even though your family might not be affected directly, it can affect others or indirectly affect your family as well. Even people leeching internet can be annoying, what would it be like if police comes around because a hacker used the wifi for hacking purposes? Depends where you are situated what is likely or not, but being under suspicions of hacking is not a pleasant experience, then up it to suspicions of child pornography downloads! So even with a simple password like a single word or two (which is stupid because of dictionary attacks), it will be more secure than just numerals, which a lot of people try to do first on wifi's because of the WPS exploit. It could even be that the first password tried is actually 00000000, IIRC this correctly about WPS cracking.

[@orangekoalabro999]

Jokes on you guys I don't have a garage XD

[@EMPBossHacks]

ownstar

[@galwion]

same XD

[@comradepeter87]

Jokes on you, you don't have a garage XD

[@markgreen7858]

man I want me one now that's what's up

[@markgreen7858]

I need me one pre installed but 200 $ is a lot of money

[@EscapeWavefold]

These videos are so interesting! They really engage me and make me want to learn further. Thanks Samy, you're my hero.

[@HaraldKubota]

Very interesting video (and the ones about the Master Combo lock too). I kind'a know about IT security, but had no idea how insecure the physical world is. Now I want to open all locks to understand how they work and verify all security related items in my life...

[@error.418]

+Harald Kubota There are a ton of defcon videos about physical security. You would enjoy them.

[@SampathEaty]

For anyone doing their own math and getting confused about the numbers he got at around 10:00 - The de Bruijn is only responsible the reduction to 8.33% of the keyspace, and the removal of wait times reduces that to a half. Together, that gets 4.15%.

[@willh8870]

*Me after five minutes of watch dogs 2*

[@Xeder-uy3vf]

you got me right there

[@zaidalnahar5203]

How did u know?

[@markgreen7858]

Can the smart response xe open garage doors because I got one

[@markgreen7858]

man I wish this one got can do that

[@dontmeetme6325]

Takes a smart guy like Samy to help us understand our own day to day technology

[@MissNebulosity]

I just came across your videos today, and I am seriously going to be here a while, because these videos are amazing.

[@patriciacamposdasilva5822]

Just got here after watching a episode of A Murder At the End of The World, congrats to Brit and Zal research work, can't believe Lee's hack is real

[@MatthewCrumley]

It's bugging me more than it should that this isn't called the Open Ses-IM-me.

[@ghostrider090]

Your videos only keep on getting better and better, awesome stuff!

[@samykamkar]

ghostrider090 Thanks!!

[@markgreen7858]

@@samykamkar man I want me one pre installed

[@markgreen7858]

@@samykamkar now that's the real thing

[@claytonarnall]

Awesome - surprising the manufactures of these systems don't put a little more thought into things. Love to get my hands one of these Mattel units to experiment with but haven't found one yet!

[@EliZazulak]

Your videos are amazing, I've been looking for a KZbin channel like this forever.

[@wbtittle]

I didn't use this to break into my house. I locked myself out by leaving my bump key resistant keys inside my house. My windows were all properly locked so I couldn't sneak in a window. I have a garage door opener in the house, but I don't have the actual opener. We never use our garage that way. I got into my new (to me) minivan which I have not programmed to open my garage door, to drive to my wife's place of work and get her key (30 minutes away). I start backing out and look up at the 3 buttons there. What are the chances it is programmed? I press the first button and my garage door opened. I need to replace my garage door opener...

[@SteamBunneh]

I'm glad youre using your powers for good instead of evil lol. Youre brilliant.. as are your vids.. keep it up! :)

[@ambassadorofpain1]

XSteamBunnyX It's not really about the good or bad... just the beauty of an inquisitive mind.

[@zochbuppet448]

The Aftermath NO but when a inquisitive mind finds some new information, at some point a decision is made of what you will doing with your findings. Do you keep the information secret and use it for your own or some other people/ organizations benefit, or do you inform the public, and make companies making millions /billions of dollars accountable for what they sell. Seems the ultra basic of any form of ethical hacking. Im clueless about hacking, just interested in circuit bending, and what what can be done with what is usually taught benign little toys. This one was meant to interface with the internet, so its a bit more sophisticated.

[@ambassadorofpain1]

Ralph ralphson I agree that a decision is obviously formulated when the topic has potential issues. I just mean to suggest that tinkerers aren't typically doing this because they specifically want to be 'good' or 'evil' per se. It's merely down to the love of taking things apart and learning how they work at a fundamental level, most of the other stuff is an after thought.

[@Ivansky1]

_T_Love_ You Don't Know!!!!!

[@truesurvival4250]

The first time I understand/enjoy math😂. Great video Samy I love them all.

[@legomasterdan1]

*presses button* 8 garages open

[@THEblackHORSEMAN1]

Daniel Briscoe lok

[@simonmaclean7530]

at first i thought it said "banana for sale" and i was like "i will buy that banana"

[@waterskijake]

Simon MacLean SAME

[@TheDutyPaid]

Yes, we have no bananas.

[@WooferCooker]

Simon MacLean same. I thought for sure it said "banana for sale" until reading your comment.

[@sherlockholmes276]

Simon MacLean now i want a banana

[@snowdaysrule]

FOR YEARS I've been trying to think up a way on my own to deliver a large amount of information to a receiver, yet only having to transmit a small fraction of the actual information, and this de bruijn guy really knocked it out of the park! This video was so awesome to see an actual use of the concept. Any other uses you guys know of (like cellular or internet data transmission?) Thanks!

[@pmxi]

De Bruijin sequences certainly do not allow you to store more information in less. In this case, it allows for multiple brute force attempts to be compressed into fewer bits due to the design of the receiver looking at the last n bits. It is impossible to take a greater amount of information and compress it into less. You could never hold say 8 bits of information in 7. Or even a million in a million minus one.

the wait time is for the end of the bit stream so it doesn't fail, basically when it repeats for time the button is held down it would be wrong that's why a wait time is for end of stream!

[@crashweekly7925]

This is the guy that you don't want to be affiliated with... he's to smart for his own good and i'm sure everyone is watching him...

[@samykamkar]

+Crash Weekly Thank you for commenting! We are now officially affiliated. Looking forward to our continued affiliations together.

[@JOHNINCOLUMBUS]

Enlightening and scary at the same time...Thanks!

[@RavindraPawaskar]

I usually dont subscibe people. Man, you are great. I had read about you somewhere few years ago.. And yeah, You are doing exceptionally great. (y)

[@samykamkar]

Ravindra Pawaskar Thanks!

[@tearrificd2786]

Came here because I started learning lock picking and wondered about combination locks. This channel is awesome! FYI, de Bruin is a Dutch family name which translates to the Brown. As for pronunciation, the English don't use ui and thus can't really pronounce it. Your best shot would be saying brune :P

[@savage1267]

"Thanks Obama" perfect placement. I'm new to your videos and was not expecting that

[@DanteTheAbyssalBeing]

Your videos are remarkable. Gives me something to wrap my brain around :)

[@samykamkar]

Dan Bert Awesome, thanks Dan!

[@Haza3137]

Seriously man you should have way more followers ..amazing videos ..please just do me one favor and explain to us how you go about solving a problem or hacking a new device ..like the steps u do ( from idea to r and d ) or the thinking structure ...also if you can tell us about ur education ..

Sammy, I was able to follow you up to around the 7:00 mark. You are way more knowledgeable than me. Thank you for sharing! I doubt you ever need to look hard for work, however I would love to send some 1099 work your way.

[@samykamkar]

+David Schne Hey David, thanks for the comment! Always open to interesting 1099 work! You can reach me at [e-mail]

[@TheXiguazhi]

Man, those IM-me devices are expensive now, thanks a lot Samy

[@marcus.edmondson]

Excellent video! I was testing the key fob for my car and found out that it uses a rolling key that only uses the last 8 bits in the sequence.

[@samykamkar]

+John Smith Crazy! Good find. Can you share any info on the car?

[@marcus.edmondson]

+Samy Kamkar Tested it again today and it was the last 26 bits and then my rtl just stopped working. I'm getting a hackrf so I can double check, to be sure, and be able to transmit. Car is a Hyundai Accent. I'll keep you posted.

[@samykamkar]

+John Smith Awesome! Would love to know more when you find out

[@rentacowisgoogle]

+John Smith The signal can be kind of misleading. It's using more bits than that. Can't remember the details but hak5 talked about it with the YARD stick one.

[@marcus.edmondson]

+rentacow I know but I was focusing on the end of the sequence because the first part is unchanged every time. The only bits that were changing came at the end. Another thing I'm going to try is to catch the signal without the car receiving it and see if I can just reuse that signal.

[@ohmycosh]

The best part about this is the hardware, with this you can be the baddest, most fashionable hacker on the cul-de-sac!

[@aqueouscomputing8153]

This is really cool dude. I've read up quite a bit on the De Bruijn sequence since watching this video, and it's extremely interesting. Do you think you could provide more of a tutorial video on how to create one of these openers?

[@Browningate]

The last garage I saw with a static code was the circa-1990s unit at my grandparents' home. I thought they stopped making these around that time.

[@samykamkar]

Every multi-tenant building I've ever seen uses the fixed code versions, while in single family homes I typically see rolling codes used (which are susceptible to other attacks, such as some described in kzbin.info/www/bejne/i3_Kp4aeg5mIibc)

[@Browningate]

@Sammy - Interesting. I was aware of replay attacks on rolling-code systems, but never even considered the simpler fixed systems because I just figured that they were phased out long ago. It's a curious thing that this might not be the case though.

[@MyBigThing2010]

wow! that's AWESOME! I was thinking of how to create that DB sequence as you were talking and then you brought it up and I didn't feel as smart as I thought I was. haha ...however, I don't think many people in the general population would've thought to look for a simplification like this so I hope I'm still ahead of the curve...which, honestly isn't really saying that much HAHA

[@samykamkar]

Haha, you ARE ahead of the curve!

[@MyBigThing2010]

Samy Kamkar haha, g thanks...but again..it's not saying much lol ...love the videos man...they are like Ted talks but not rushed and actually useful/helpful/informational! thanks for them!

[@samykamkar]

Most people wouldn't have thought to look for an algorithm -- I think that's impressive. You did it while watching the video, when it took me days/weeks (to fully get this project up!) -- glad you enjoy them!

[@MyBigThing2010]

Samy Kamkar THANKS man! ::: blushing::: hahaha ....as you were explaining the bits, the combination limit and that it doesn't recheck a wrong entry, I was thinking "there's got to be a certain set of codes that could be shortened to overlapping repeats or a master set of all possible combos somewhere in the math that could be isolated and just run and because of the no error checking it could just be run and that one sequence would open everything, and do it fast...especially without return communication...hmm, I wonder how I can figure that out?" .... then 48 seconds later you mention it lol

[@HalfLife2Beta]

"In the next video I will show use of RTL SDR" where is that video please ? Thanks in advance.

[@007order007]

I seriously wonder how you manage to even come up with these ideas

[@mikal_1]

007order007 check out pablos holman videos on youtube, he talks about this sort of stuff also.

[@brendanmathews3454]

I think you have earned a new subscriber! Keep it up!

That is awesome. I always wanted to hack the garage opener when I was a kid, being inspired by the movies Home Alone, the robbers used some kind of device to hack the garage opener to a house. I didn't have any neighbors that garage openers though. But I had plenty of fun hacking home wireless phone frequencies to be able to listen to even the neighbors phone calls. I did this by modding some Radio Shack walkie talkies and even did it by modding an am/fm radio. I wouldn't know how it all works, but I was able to do it some how.

[@ixamraxi]

Often times, you could just use a baby monitor or walkie talkie that had the same carrier frequency of the more common wireless phones, such as 900mhz or 2.5ghz, and you would be able to listen to most wireless phone calls in range. It was a common practice by nosy people to use those in apartment complexes where you would often be close enough to receive multiple signals from different neighbors. Whenever I lived in an apartment complex, I used a landline only.

[@savage1267]

Tyee Cambrón He's not hacking the garage door opener. He's hacking a toy and using it to scan through the codes :: that is, literally giving every code possible.

[@MissNebulosity]

A TWO CHARACTER PASSWORD IS MORE SECURE THAN YOUR GARAGE CODE. Mind blown.

[@MultiMegaMaxx]

Love these vids. And im sure this one will be picked up by big tech sites in a couple of hours/days!

[@alexandrepiel4738]

This might work for a very specific type of garage receiver, as you did reverse engineering of your remote. But the RF protocol doesn't have standard and each manufacturer might implement his own protocol, by using different pulse length and bit representation (some even not using binary signal but ternary or...). Also not all remote have the same amount of bits. Your example will work mainly with the door using the same brand as your remote. A much more effective way to hack those door is to sniff the signal of the remote, as you can do as well with old car door. But still cool that you manage to hack yourself ;-)

[@davidbjoern]

You are doing a lot of cool stuff! Thank you for that!

[@LuigiBakker]

Really great video, it's like an initiation to hacking, greatly explained, good job. One of the thing I didn't understand was the "wait" period. Who said there should be a wait period when actually anything in the wait period is still parsed for decoding and can work?

[@LuigiBakker]

Regnoult François Maybe stupid proposition but the rolling code, why not sending "010" and "101" repetitively. The generated code would be "10101010101010101010101..." you can guess that at one point the code will fall on that. If it's harmoniously generated in 4096 try it will one of the code will fall at least once. With 8192 try, chances are quite high.

[@samykamkar]

Regnoult François Every remote sends a wait period, so the assumption is a wait period is necessary.

[@samykamkar]

Regnoult François Not sure what you mean here. The code has to be consecutive bits. So if your code is "111111000000", it would never hit in your example. The idea is to produce every consecutive permutation of bits, while reducing the length as much as possible by using overlap (which De Bruijn sequence does for us)

[@blahorgaslisk7763]

+Regnoult François My guess about the "wait" period is that it is used to mask the vulnerability from anyone who is just tinkering with the sender. The simplest design of the receiver circuit that I can think of would be continuously receiving and testing for the key, and what Samy has shown suggests that this is exactly what happens. The wait period would allow the shift register to empty so that the next time the sender sends the correct key it will be the only data in the register. Without the wait period "dirty" data can be in the shift register when the key is sent. While this at first doesn't sound that bad it would mean that if you do a shift of the key on in the sender (and set the first switch to the same setting that the last switch had before the shift) the receiver would still register a correct key the second time the sender sent the key sequence. It's the dirty data in the register that makes this work. There are several consequences to this such as exposing the vulnerability in a very blatant maner and reducing the available key space from 4096 to 341 (I think, a bit uncertain on the math). Security by obscurity. What a lovely concept...

[@masoumgoudarzi1985]

سلام ، واقعا راست می گن مهندس های برق ایرانی بهترینن ، باعث افتخاری ادامه بده

[@christophermalau5299]

Hi Samy, You mentioned in your DEFCON talk that you would release details for RollJam, is this still going to happen? I'm trying to get a continuous transmission to work on the CC1101 (greater than 61 bytes FIFO supports, FSK key fob has approximately 1000 symbols). I'd love some guidance on the whole serial synchronous mode and using the CC1101 with Arduino in general. Great videos as usual

[@brahimelboudani601]

This guy is cool bro. He gave a presentation at defcon 18.

[@roncho]

very nice.. even you took the time to explain your logic. subscribed!

[@samykamkar]

Helmut Rubio Awesome, thanks!

[@CodeRedPb]

Couldn't you do this with a raspberry pi with an ir transmitter with very simple code?

[@samykamkar]

You would need an RF transmitter, but in that case, yes. I chose this device as (at the time) it was cheaper than an RPi, had a screen, backlight, keyboard, and all the RF functionality needed, so a pretty fun device to be playing with, but any capable microcontroller or machine with proper RF transmitter can perform this attack.

[@CodeRedPb]

Been looking for an excuse to pick up the Pi or Beaglebone, will probably do it now.

[@CodeRedPb]

Is this attack still possible on garages which their opener does not have switches? Looking around for transmitters they all seem to have pretty decent range, am I going to end up opening my neighbors by accident?

[@samykamkar]

Those are rolling code based garages and no, this attack will not open it, however I have developed a new attack that exploits rolling codes of those types of garages (as well as cars) -- details in my DEF CON 2015 talk/slides: samy.pl/defcon2015/

[@RyanQuintanapolymath]

This would be great with the current flipper zero out now since you did this 8 years ago

[@poohbearceren62]

Samy have you ever thought of creating a gun blaster 3D printed to shoot the exploit/attack to the system wireless maybe RF OR something similar to a opensesame device but on a 3D gun blaster with high range frequency

[@mason6662006]

Sadly an im-me costs nearly as much as the hackRF One :( LUCKILY I already have an hackRF one! so I'm firing up Gnuradio! Cheers for the excellentness! :D

[@samykamkar]

+IR Geek Nice!

[@SaltyViper]

Well at least those smart enough to pull this off have no reason to steal because electrical/software engineers make a hell of a lot. Then again if somebody where to sell this to a thief that has no idea how much it costs, they could ALSO make a hell of a lot of money.

[@je6566]

I can't imagine it being very hard to make with some knowledge, it's just most knowledgable people are privileged and have the things necessary to make these, they have the availibility to learn and don't need to hack for malicious purposes

[@DJRECORDSXD]

First of all, I really like your videos. Please keep on making them! I'm currently a first year electrical engineering student, and really want learn more about RF communication. Would you recommend buying a HackRF, or is a yard stick one enough for now?(I hear a lot of good things about the hackrf but it's a bit expensive).

[@AmirrezaNasiri]

Your videos are AWESSSSSSSSSSSSSSSSSSOME!!!

[@CommanderCrash]

@Samy Kamkar have you ever looked in to electronic billboards or advertisement boards?

[@prizedcoffeecup]

One thing I want to ask out of curiosity: Would it be possible to run a custom programmed version of MS-DOS on one of these, or would it be impossible to fit it all on the built in storage?

[@MissNebulosity]

The bit chart you shared reminds me of my linear algebra class.

[@kentlofgren]

I dont get it, why didnt you open a door at the end, or did I browse the video to fast and missed something?

[@uglyhott]

***** Yeh ya did. He opened it before diving into the De Bruijn explanation.

[@samykamkar]

***** I've added an annotation linking to it at 0:26 -- good idea though, I'll add the demo in the end of videos as well!

[@kentlofgren]

Samy Kamkar and ***** thx, mea culpa, it was in there, I just missed it. Cool video with interesting content and great quality. Keep them coming.

[@sven33r]

Awesome. A really big security problem!

[@w9x7cv3vg6]

i got a pre 1991 garage door opener,don;t work anymore...but teh opener works manually..i wonder if that can be hacked for "fun" and my cars...mercury grand marquis...do they all operate on 315 mhz even GMs thanks samy

[@marianobruno7491]

Just Awesome like every each of your videos. I tried to find the IM-ME on ebay and amazon without luck. Jus wanted to flash something :( Thanks and keep up the awesome work!

[@ethanwhalen6270]

Would this work for a four digit door most doors have 4 in my area and does it work on an over head gate

[@MrGollum1996]

I have a garage and i forgot the code, or, to be honest, nobody ever told me. As it is mine it is not illegal to hack-open it. I have a little device that opens it, but when i lose this, im screwed.

[@bloodman098]

MrGollum1996 don't bullshit a bullshitter lmao

[@meade8164]

MrGollum1996 takes u few seconds to go to your garage opener on the back and look at it.

[@melody3741]

MrGollum1996 just go in through your house.

[@cobbledev9045]

Would you be able to use a car door opener connected to an arduino tha is connected to all these pins to brute force into any door with this kind of code?

[@boostedbuiltgarage]

Hey Samy, just wondering if there is an easy way to utilize my android car stereo's gps to actually track the vehicle in the event it was stolen or something... I'm guessing you would need some kind of gsm sender? Might be a good concept for another vid? Anyways keen to see your thoughts on this as this isn't my forte :)

[@samykamkar]

+Boosted & Built Garage Would be cool -- it just depends if the system stores it anywhere. GPS only receives so it would require another system in your car to be accessible remotely somehow. My OwnStar attack (kzbin.info/www/bejne/aaDPiYiYiJKjqLc) also can track cars and at the time applied to GM/Benz/BMW/Chrysler, and Charlie Miller and Chris Valasek's Chrysler exploits also allowed acquiring GPS remotely from an unaltered vehicle (epic)...those would be some interesting areas to investigate. What kind of car?

[@boostedbuiltgarage]

Yeah exactly, that's the only bummer about most GPS because it only receives. I'm in Australia so its a Holden Commodore (GM basically) running a custom installed android 4.4 head unit so not a factory one like in newer cars. So it can obviously run any android app which there may be something out there to assist. I know you can actually plug a 3g network USB dongle (or whatever its called) in for internet so maybe that's the way to access remotely?

[@samykamkar]

+Boosted & Built Garage Sure, as long as you give it some sort of remote/cellular access, you can communicate with it. A 3G/4G dongle would be good and if it's Android, I'm sure there's existing software that would allow it to be accessible (or just keep ssh open and have it automatically reach out to you so you know the IP over time)

[@eschamion]

Samy is there a way to solder in a WiFi module to a device of this sort to use for a DIY WiFi garage door opener? Thanks

[@XenoTravis]

Where is the next video?

[@BaileyHorrigan]

Did any one else notice at 9:20, Sammy asks himself 'where'd you learn to write'? Be nice to yourself sammy! if you can hack you don't need to write!

[@chrisarmstrong1236]

you said that the device you used can send and receive messages I belive. if that is so could it be possible to intercept the code that is being transmitted by the garage door opener when someone uses it, therefore getting the passcode? I realize it is much easier just waiting 10 seconds for the device to run all possible codes. I'm just curious =)

[@lazar2175]

Chris Armstrong Well,you might wait days to get someone to open garage...

[@chrisarmstrong1236]

lol yeah

[@samykamkar]

Chris, great question! You are absolutely correct. You can use the device to simply listen (RX) and obtain the code as soon as the legitimate user uses their own opener (assuming you're in wireless range).

[@NicksGarageDoorService]

While this can still be done, it's not likely if you have a garage door opener made after about 1997. At that point, almost all manufacturers switched to rolling code systems. The only case where fixed code systems are still used are in high-traffic areas, such as an apartment or condo complex that has a lot of tenants, and each tenant needs a remote to enter the parking garage. It is much less of a pain to program 1000 fixed code remotes to the same receiver, than it would be to program 1000 rolling code remotes. There is one company I will throw under the bus, however. If you have a newer garage door opener by Linear, you are vulnerable. They do not use rolling code. Get your Linear machine replaced if you have one.

[@sethmitchell2176]

Wait a second, so your name is Sammy.. Sammy, I need to ask you one thing and I would like you to answer me honestly. Are you my hero?

[@samykamkar]

+Seth Mitchell I was hoping no one would figure it out...but honestly, yes. I am your hero.

[@sethmitchell2176]

Samy Kamkar You have no idea dude xD

[@samykamkar]

+Seth Mitchell

[@teknikal_domain]

Question: Why did you not order the 3-bit codes in ascending order? I know that would mess up the De Bruijn sequence, So how did you determine that particular order of 000, 001, 010, 101, 011, 111, 110, 100, instead of 000, 001, 010, 011, 100, 101, 110, 111?

[@leonardsalt]

Look at your first sequence, 000, 001, 010... Because the garage uses bit shift register, it will read that same string like this: 000, 000, 000, 001, 010, 101, 010... You could see it as it jumping one-by-one, instead of three-by-three. If we use the normal sequence, it would repeat a lot of the codes, making it take longer. That's where the sequence comes into play, it is ordered in such a way that the string contains all the possible combinations without wasting, or repeating, any of them. (or at least repeating it as little as possible)

[@teknikal_domain]

Leonardo Segura what I mean is how did you find that order to use

[@samykamkar]

I wrote a program to do it: github.com/samyk/samytools/blob/master/de_bruijn

[@adubs.]

I wonder if this same concept could be applied to a keyfob for a car.

[@samykamkar]

+ph4nt0m Car keyfobs use rolling codes which are not susceptible to this attack, however are susceptible to my RollJam attack. Some more details on that here: samy.pl/defcon2015/

[@kamilsawicki679]

yo @Samy Kamkar I got some questions about garage doors. Its a bit complicated I own original pilot but I lose permission to the Gate from That I heard someone turned off ability of That remote by PC. Any ideas how to figure it out and open the Gate?

[@DJTrainR3k]

I was looking at the signal from my mother's remote car key fob (it was aftermarket) and I saw that it used a fixed code 0-0. Hopefully when I can afford a HackRF, I want to demonstarte to her the vulnerability of fixed codes by unlocking her car.

[@samykamkar]

Nice! Yard Stick One is cheaper and can probably do everything you need.

[@hueyPneutron]

Where do you start to learn about this stuff? Also bonus question, can you estimate how many gov't lists you're on?

[@marinaumanski7662]

Can you please send me a link for all the parts? Or is there a way for me to get the full hacker completed? Much appreciated, thanks.

[@Polite_Cat]

ahhhh! i had no idea garages used the shift register ...do all garages use that? when i was about 12 or so i tried to make something like this with a microcontroller kit from radioshack, but it would try every code on like a 6 DIP switch opener i connected it to. i had the proof of concept down but i didnt understand the coding well enough to get it to work. this is such a refined version and also lulz because of the girl's mattel toy. this is the perfect stuff for news headlines.. "hacker uses girl's mattel toy to open any garage in 10 seconds"

[@Lavariega-wg3uo]

is it possible to make a 2.4ghz wireless optical mouse for rc toys or other

[@MikeTrieu]

I'm guessing this only works because the receiver doesn't scramble the code every time the transmitter fails the "challenge". Maybe what they is need is some kind of really simple pseudorandom TOTP.

[@Drunk_Engineer]

+Mike Trieu (MegasChara) Well, if the receiver scrambles the code at every attempt, your transmitter would be useless as well. Think about your neighbor unlocking his garage, which changes the code of your remote. What I'd do is that I'd put a "INCOMING CODE" code at the beginning and look for the password. If it fails, wait 5 seconds. This would easily eliminate almost all code cracking devices because It'd take too long time to complete.

[@error.418]

+Batuhan GENÇ Couldn't you still just sniff that signal and reproduce it later?

[@samykamkar]

+Anonymous User I've created a new device (after making this video) called RollJam which can attack rolling code garages and cars, not just fixed code garages like this, meaning *all* garages are susceptible to attack. You can learn more from my recent DEF CON talk (kzbin.info/www/bejne/i3_Kp4aeg5mIibc) or more about it here (www.wired.com/2015/08/hackers-tiny-device-unlocks-cars-opens-garages/)

[@remocrapstuff5414]

Can i reprogramm a nother opener with four pads ?and can i do this with an arduino?

[@MegaAnestecia]

I want to know if you sell this or how can I get one I need for my job

[@mrapexd]

Would it be easy to do this on rasperry pie with a small keyboard and phone as a screen?

[@andrewchristiansen8311]

3:42 Those "special characters" are called meta characters. Something tells me you've never done regular expression on PHP.

[@statusquo3857]

My question is, could the same principal be applied to the Sony PSP 1000, using its built in wireless transmitter, instead of using an IM-ME

[@samykamkar]

StatusQuo Hey there, the Sony PSP's wireless transmitter only transmits to 2.4GHz (2412-2462MHz to be exact, according to the FCC doc: fcc.io/AK8PSP1001B), while most garages will be 300-433MHz, so they will not be compatible in any way.

[@statusquo3857]

Thanks man, good to know. I appreciate your response

[@sparky1570784]

couldnt you essentially do this on a rasberry pi as well with a wireless reciever/ transmitter and a small display? would it be able to transmit through a wireless network card?

[@samykamkar]

+sparky1570784 You would need specifically a sub-GHz chip like the CC11xx, but yes, you could use RasPi.

[@elsamuente9379]

hey samy thats cool, are you sending the same waveform for every garage?

[@EradicateLoL]

Wow, great explanation!

[@hirigone]

In theory, if this is adjusted for higher sequences couldn't this open virtually anything?

[@branislavbeke9754]

So I thougt that you can modify actual door opener by desoldering "open" button and 12pin DIP switch and place instead transistors with some AVR or PIC programmed to try out every possible combination.

[@samykamkar]

Branislav Beke Sure, though now you're performing a brute force attack and are only able to use the method of modulation and frequency that specific garage door employs. OpenSesame works on a number of different frequencies, modulations, and exploits the OpenSesame attack, eliminating the need to brute force and reducing the key space by ~95.8%. However, this is still a great idea if you want to brute force your own 12-pin garage, and it's a great way to hack up some electronics. I suggest you do it to learn how it all works! You could also get around the encoder portion and use your AVR/PIC to bypass the encoder chip and then send your own bit stream. If you wanted to change frequency, it would require you to replace the crystal.

[@branislavbeke9754]

Thanks. Very good explanation. BTW I'm 14 years old and I'm trying to hack and create electronics and PC software for like 2 years now.

[@samykamkar]

Branislav Beke Sweet! Keep me updated on here about your projects and how they go.

[@MrTare05]

Hi Samy! I love your work, and recently saw your defcon talk "Drive it like you hacked it". At the end of the video you talked about your project called RollJam. I want to build a device familiar with that for my thesis, and im curious that you published the source of that project somewhere, because i could learn a lot from it.

[@davidpritchett855]

quick question, what are the ranges on these? I'm tempted to make one of these for myself as insurance against accidentally locking myself out of the house, but I don't want to open all my neighbors garages as well.

[@samykamkar]

+David Pritchett Haha, you could just purchase another garage remote for your own garage

[@davidpritchett855]

wellllllll yeah......... but this way I force myself to learn a bit more about programming and stuff. Though yeah i agree it would be easier and probably cheaper to just get another remote. BTW Props on being one of the fastest youtuber repliers. Less than half an hour is unheard of for most especially on a nearly year old vid. You get my sub for that reason alone!

[@samykamkar]

+David Pritchett Awesome, thanks! If for the programming and hardware experience, then yeah, I definitely recommend building this! In fact, Michael Ossmann's original "opensesame" project that this is based off of would be a great tool to build your opener with as it only sends a single code, so you could program it for your own door without opening a ton of others around you! Here's the link: github.com/mossmann/im-me/tree/master/garage

[@edrutmayer6877]

Wondering if this could be done with a 555 (in place of the DIP block with the applicable circuitry) to count out the 4097 combos

[@samykamkar]

+Ed Rutmayer You could probably use a 555 to brute force but to produce the De Bruijn sequence I think it would be too difficult with just a 555, but I'm sure there are plenty of analog circuitry people who could determine how to produce the sequence with analog.