Hacker News Reader

Comment by wnevets | Hacker News Reader

I have a passing interest in wireless hacking but I have no idea if I have the skillset to make any use of it. How useful is this for someone with zero pen testing and/or wireless experience?

I'm curious to know what it would take to hack my garage door or key fob for my car

View on HN

Out of the box it supports limited raw rf capture and replay. Your garage door (probably) and your car key fob use rolling codes which change each time the button is pressed. This is not supported, and likely won’t be in the official firmware. I’ve used mine to make copies of all rf and ir remotes in my home. Fans, tv, bidet, AC, etc.

TIL some bidets can be controlled remotely. I feel like an ape.

If it's ape-like to not be able to detach from your own ass and walk around, I guess I'm in that group too.

I'm more concerned about why you would need a remote for something that depends on you being there...

It allows a control to be wall mounted without having to run a wire from there to the bidet...

Not necessarily you being there.

There was a toilet in Japan I couldn't for the life of me work out how to flush, I spent ages in this bathroom checking for buttons here and there. Only after I had given up and walked away from the toiled did it flush.

That's been a constant refrain about IR auto-flushing toilets for about 30 years. They were invented in 1988.

From a security point of view, it sure makes for an interesting attack surface

You have to look out for backdooring though.

That's one penetration test that I would not want to participate in.

Story time! Google is (was) famous for having Toto Washlet bidet seats in its restrooms, which have wireless control panels attached to the stalls.

New building opens up, vendor screws up and the control panel in stall #1 is programmed to control the Washlet in stall #2. Cue the predictable (and hilarious) email thread on #<building>-misc, along with a whole lot of memes.

Pootooth.

FWIW I've used mine to duplicate both of our car key fobs (middle 2000's Mazda and middle-2010's Jeep) so it'll probably be very dependent on make/model/age as to whether it uses rolling codes.

Surely these rolling code devices should be started by some kind of seed, otherwise how does one replace a remote ?

I'm not convinced that there is a 'non destructive' method to find that out though.

> otherwise how does one replace a remote

There’s a pairing mode you put the car in and it accepts the new keyfob and probably records it’s seed / counter / etc at that point.

Slight correction: There are two modes of RF Capture available : "Read RAW" and "Read".

"Read RAW" does exactly what it says on the label: Captures a raw stream, based on the specified frequency and demodulation.

"Read" captures, decodes and attempts to interpret the signal capture. The FlipperZero has a large built in database of brands + models of RF devices, and a database of KeeLoq master keys.

For rolling remotes that are KeeLoq based, with known keys, the Flipper can most definitely decode / decrypt rolling codes, and generate the next in the sequence.

TL;DR: Handles fixed + Rolling codes, via built in database of keys + models.

i have developed firmware for a few ism band products and basically had to create a few scrappy one off tools for testing and debugging. something like this ready to go is totally killer to have from a rf software standpoint too. but yea, rf is everywhere. key fobs. in your tires for tpms, garage doors, crappy bluetooth products whatever. i could see this being useful in many cases

Let's not fool ourselves into thinking that more than 1% of buyers will use this for anything else than changing channels on TVs displayed at Walmart, and feel like Mr Robot for a few minutes.

Reply on news.ycombinator.com