Grand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock
summary
Analyzes over 20+ models and shows rolling‑code implementations that store counters insecurely, enabling rollback and a new “loop playback” exploit that combines three consecutive captures to open in under 10 minutes; some vendors require as few as 3 consecutive captures to force resynchronization. Demonstrates low‑cost RF tools (SDR/URH plus a custom capture/generator tapped at RFIC or MCU) that decode weak key derivation and either replay or brute‑force IDs (worst case ~10 hours), with multiple live demos proving the attacks.
AI-written summary · about
chapters (6)
- 0:00Introduction to RF security
- 15:47Encryption and key management
- 21:25Authorization mechanisms
- 26:14RF tool development
- 29:54Attack scenarios and demos
- 39:22Conclusion and recommendations
related talks
44mBreaking the Security of Physical Devices
01h 01mRapid Radio Reversing
51mRadio Hacking: Cars, Hardware, and more!
30mDemystifying IoT/OT Hacks With SDR
27mLock It and Still Lose It —on the (In)Security of Automotive Remote Keyless
14mWarmup - Lockpicking
41mThe (In)Security of Automotive Remote Keyless Entry Systems...
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers