Open Sesame - Or How Secure Is Your Stuff In Electronic Lockers
summary
Digilock-style electronic lockers reveal that firmware and keys are extractable from the PCB because several flash blocks remain unprotected, allowing a debugger to dump firmware and EEPROM; key IDs sit as one-wire ID in plaintext and cloning is trivial with a Flipper Zero or Adafruit. Timing differences on the 1‑wire protocol enable a timing side-channel that recovers 3 key bytes in minutes; power‑glitching and logic analyzers automate brute force, and overflowing a 255 counter can create a manager key that opens every locker. Tools: PIC18 chips, ES32, logic analyzer, debugger, screwdriver; attacks work reliably.
AI-written summary · about
chapters (11)
- 0:00Introduction and motivation
- 1:40Lock ecosystem and scope
- 4:33Digilock systems overview
- 9:05Hardware analysis
- 12:16Key types and functionality
- 14:36Microcontroller security
- 19:00Attack methodology
- 20:46Firmware extraction
- 23:56Exploiting pin and key entry
- 27:31Conclusion and key lessons
- 33:02Q&A session
related talks
37mOpen Sesame! The full story behind opening a smart lock
01h 06mBackdoors in Back Doors
26mBrute-Forcing Lockdown Harddrive Pin Codes
14mWarmup - Lockpicking
41mGrand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock
44mBreaking the Security of Physical Devices
45mPoking the S in SD cards
27mLock It and Still Lose It —on the (In)Security of Automotive Remote Keyless