Hacker News Reader

Comment by peddling-brink | Hacker News Reader

Out of the box it supports limited raw rf capture and replay. Your garage door (probably) and your car key fob use rolling codes which change each time the button is pressed. This is not supported, and likely won’t be in the official firmware. I’ve used mine to make copies of all rf and ir remotes in my home. Fans, tv, bidet, AC, etc.

View on HN

TIL some bidets can be controlled remotely. I feel like an ape.

If it's ape-like to not be able to detach from your own ass and walk around, I guess I'm in that group too.

I'm more concerned about why you would need a remote for something that depends on you being there...

It allows a control to be wall mounted without having to run a wire from there to the bidet...

Not necessarily you being there.

There was a toilet in Japan I couldn't for the life of me work out how to flush, I spent ages in this bathroom checking for buttons here and there. Only after I had given up and walked away from the toiled did it flush.

That's been a constant refrain about IR auto-flushing toilets for about 30 years. They were invented in 1988.

From a security point of view, it sure makes for an interesting attack surface

You have to look out for backdooring though.

That's one penetration test that I would not want to participate in.

Story time! Google is (was) famous for having Toto Washlet bidet seats in its restrooms, which have wireless control panels attached to the stalls.

New building opens up, vendor screws up and the control panel in stall #1 is programmed to control the Washlet in stall #2. Cue the predictable (and hilarious) email thread on #<building>-misc, along with a whole lot of memes.

Pootooth.

Slight correction: There are two modes of RF Capture available : "Read RAW" and "Read".

"Read RAW" does exactly what it says on the label: Captures a raw stream, based on the specified frequency and demodulation.

"Read" captures, decodes and attempts to interpret the signal capture. The FlipperZero has a large built in database of brands + models of RF devices, and a database of KeeLoq master keys.

For rolling remotes that are KeeLoq based, with known keys, the Flipper can most definitely decode / decrypt rolling codes, and generate the next in the sequence.

TL;DR: Handles fixed + Rolling codes, via built in database of keys + models.

FWIW I've used mine to duplicate both of our car key fobs (middle 2000's Mazda and middle-2010's Jeep) so it'll probably be very dependent on make/model/age as to whether it uses rolling codes.

Surely these rolling code devices should be started by some kind of seed, otherwise how does one replace a remote ?

I'm not convinced that there is a 'non destructive' method to find that out though.

> otherwise how does one replace a remote

There’s a pairing mode you put the car in and it accepts the new keyfob and probably records it’s seed / counter / etc at that point.

Reply on news.ycombinator.com