Is my car or carport at risk from attacks from a Flipper Zero? #rollingcodes #flipperhacks #carport UPDATE: Watch the Rolling Codes Explaine - Part 2: • Rolling Codes Explaine...
If you're able to Read a signal instead of Read Raw, the FZ has built-in rolling code. But you must pinpoint the exact frequency. Use the Frequency Analyzer to pinpoint the frequency, making sure its the same frequency at least four times and then hold the center button and it automatically take you to Read and then from there you can config and get a more exact reading before saving it to be emulated later.
@@techandfun7723 You're welcome. I saved my garage fob on the flipper as a backup. I will use it sometimes but I have to cycle my original garage fob to an unused code afterwards. My wife hates it ^_^
thanks! you know, even after doing some research on rolling codes, I still never understood how they work. but I get it now! When you press a key fob it creates a "good" code and tries to communicate with the door/car, etc. When it reaches it, the code is now dead and can't be reused. However, if you're able to isolate the keyfob from the car/door whatever, then the codes created and recorded are still good, only until they're used. great video. i was finally able to store a few codes for my garage (one time my keyfob died and I had to pick the door open).
Im not sure about the last part in the video. In a rolling code system, a transmission must be successful for the code to be sent and the expected code to change. When a transmission is successful, the code sequence is updated in both the remote control and the vehicle. This ensures synchronization, and the next time you use the key, a new code is generated based on the updated sequence. This approach prevents unauthorized attempts to capture or reproduce earlier codes, enhancing security.
I know that key fobs can be replaced when lost, and just need to be synced with the car. can the flipper zero sync with the vehicle like a new key fob would?
rolling codes + signal jammer can permanently disable a remote so for example, there is a jammer active and then the remote button doesn't work then if rolling codes does not loop and go on forever than the device will be rendered unusable unless you find a way to reset rolling code to 1
@@techandfun7723 I was going to ask you this. What if I am away from my car garage and I press the open door button 5 times, then go to my garage and press it again, how does the receiver adjust for the code it is receiving, which is out of sequence, or past the expected next code it is listening for?
@@squelchtone Normally there will be a "buffer" so that the receiver will approve the next n-codes. Lets say n=50, then you can press the button 50 times without getting out of sync - but n can also be a smaller number, sp you have to be careful. I usually test by max 10 times before Im syncin' up the remote by pressing it withing the range.
@@squelchtone if you use signal blocker to get a fresh set of say 5 codes, how many times they can be used ? just 5 times to open the garage and then you need to do it all over again ? It can't be permantnently saved 5 sets you can keep using ?
Great video. I have a couple of questions for you to ponder if you care to respond: - How can two remotes work with the one garage opener with rolling codes as it seems to me that only one would keep them in sync? - We recently had the Homelink mirror stop working on one of our vehicles yet it was still programmed (not erased). I had to redo the programming to get it to work again. Could it have gotten out of sync and if so how would that happen?
Look up keeloq for more info, but a simple explanation is that the serial number of each remote is stored in the receiver and they have their own separate rolling codes
@@zheil9152 That isn't applicable here. We are talking about a garage door opener manufactured over 20 years before the vehicle with Homelink in its mirror.
So, is there a two way communication with the FOB and the receiver? or the fob just blindly sends the next one until it runs out, or recycles it's table? It's a great video but leaves me with more questions!
I dont think the receiver sends smth back, I think as soon the transmitter send smth they both update to the next code that was calculated as the example in the video
It's hard due to the end to end encryption between key and receiver. They both share so called Manufacturer Code, which is used to encrypt the Rolling part of the package. The encryption itself is not very strong, but you must obtain the significant amounts of packages to break that. Sometimes flipper gives you false positives using the wrong Manufacturer Code, and, if you are lucky enough, it will be able to produce the valid Rolling package and open the door. But it can desync original key way too much, and make it useless (unless you are ready to press it inadequate number of times outside of the receiver's range)
How does the remote control know which code is next? eg if I press it 5 times and i'm out of range of the receiver, how does it know that the code is used or not. Also, is there a limit to the number of codes in general?
The remote only needs to maintain the data needed to calculate the next code in the series. It doesn’t need to have knowledge of which codes have been accepted by the receiver. The receiver is responsible for maintaining the last known good code that was used so that it can calculate the next X good codes in the series and accept the next highest unused code. Say you signal the open command 5 times out of range of the receiver, but the 6th signal is in range. The receiver sees that signal 6n is unused in the sequence and accepts it. It should also now invalidate receipt of any of those lower unused codes (originally sent out of range), even though they would have been valid before receipt of that 6th code in the series. This minimizes your exposure to replay attacks. Theoretically, you should never run out of codes because you can always seed your algorithm with a higher number (n+1). Side note: in practice, I believe a remote can get too far ahead of the receiver in the code sequence. I have heard of parents having to get their car key fobs re-paired with their car because a child pressed the unlock button 50 times while out of range the the car. The car may only maintain a buffer of the next 20 valid codes, so if your remote goes beyond that, it would always be too far ahead. I don’t have deep knowledge on this subject, but that’s my understanding. It’s also a little hard to explain. Sorry for the long reply, but hopefully it helps.
The receiver have a table of codes extending to the N times, the only thing it's looking at is whether that code has been used or not. It probably recycles old codes after some number of times.
Is the formula shown in the video actually used for rolling codes, or does it vary for different devices and you need to figure out the algorithm first every time you want to remote control like a door or garage?
its all about factorisation of prime nb if you record10x signals you should find coding algo for this key and made script to emulate different one all the time you press it
04:40: What if the key was pressed one or more times out of range? Then the next time it will send "3xPi" or "4xPi" while the receiver expects "2xPi". How the receiver will treat this?
I guess the receiver expects any n*pi with n superior to the last one used, but it seems kind of heavy to calculate enough possiblilities to make sure your remote doesn't stops working just because your child pressed the button too much while you were out of range. Edit : I read a comment saying that the receiver has a buffer of let's say 50, so you can press the button 50x while out of range without getting out of sync. I never heard about a desynchronised remote, even on parking where there are a lot of different remotes, so I guess the buffer is usually kind of big
But how do you figure out what frequency the sender is sending at? I'm trying to replicate my garage door but when I run "read RAW" and configure it to read on all the available frequencies, nothing turns up :(
It does not work with VW recent Remote car ceys: Frequency records rolling code in 434,42Mhz, but sending will not open the car. Maybe because you need to set modulation type correct on the flipper ??? There are 2 AM and to 2 FM modulation settings possible. Which is the correct one for a (VW) car remote ???
Maybe you can record the signal with flipperZero and take it to a computer and find the algorithm and maybe with an addon your flipper can open the gate... I know its a little complicated but hey this thing in the wrong hands and enough time will be very dangerous...
what happens if the key owner pushes one more time without jammer (or in range after being out of range). Does it mean the door is not only waiting the n°1 but also all the possible next ones ?
I believe the receiver has a table of codes and the only thing it's looking at is whether the code has been used or not, and probably will also recycle used code after a certain number of new codes has been used. Otherwise if you just pressing your key randomly outside of range that will mess everything up.
Solution is simple. I use a smart relay to open my garage door connected to Home Assistant. Decrypt a 4G /5G communication with HTTPS using flipper :) Also I can open my garage door from anywhere when a delivery guy has to put a package inside. These remotes are outdated.
A challenge-response mechanism would be just as safe, no need to overkill with cellular modems. Remote prompts for a challenge, door controller provides a challenge, remote signs the challenge and controller verifies signature. No sync procedure necessary. No replay attacks (provided the challenge is random with good entropy). Same principle as used in PIV/smart cards, EMV contactless cards, NFC security keys, etc. Requires controller to have persistent state in the sense of remembering the last issued challenge with a timeout, until a response arrives and is verified. More battery depletion than simple rolling codes but much less than a 4G/5G modem, and lower attack surface as you'd need to be physically near rather than simply being connected to the internet to even attempt an attack.
@@helloslayer666 Relay wired to Home Assistant with NO port forward. HA server reach out to HA cloud. Phone has constant VPN connection and I do not use public Wifi-s at all. HTTPS in a VPN tunnel. I feel safe till quantum computers will get mainstream.
Bro I have a dout if the signal is jammed first time key will move forward but door will not receive the 1 st code so it will expect the 1 st code only right so in that sense we can't open our garage door after once we fail right but that doesn't make sense
Ok but what happens if you have 2 garage door openers and your wife has one at work with her. You use yours to open the garage but when she gets home her controller doesn't know which sequence to send as the next code. Also there needs to be some sort of ACK back from the garage door or the controller won't know that the receiver has received it and then know to use the next code.
Doesn't recording and using one or more rolling codes in the flipper "desync" the key fob? So to use the F0 as a key for a rolling code fob one would have to either store many keys in advance, and then replay them, and then also keep count for the fob itself. To actually replace the fob the flipper would need to know the algorithm. Huh. I learned something here, thanks for the video!
Thank you for the nice comment. The keyfob will not instantly be de-sync'ed, because there is usually a "buffer" of n-codes that is accepted. But if the keyfob is pressed meny times outside the reach of the receiver, it might get de-sync'ed.
@@techandfun7723 what happens if gets de-sync’d? The fob itself won’t work anymore? How does one fix that? Sometimes, when I go see a movie or go to the mall, I get a little OCD and I start hitting the lock button on my car key fob a bunch of times but I’m out of range lol. So I keep pressing it while moving back toward the car til I hear it lock. So you’re saying that technically, pressing the lock button on my fob too many times while out of range of the car could mess it up? And then how would I fix that?
@@MisterK-YT It could (and will if you do it enough) desync. If that happens, you're good to go to a garage and have your centralized closing reset and probably a brand new remote
@@MisterK-YT If you do that enough times in a row outside the range of the car (I've read it's 256) the fob will no longer work until the car is reprogrammed with it again.
I don't understand one thing.. How the remote can know the the first or second code that was jammed didn't work? It is a transmitter, not a reciever.. On Peter Fairlie channel he presented something else.. The codes that were jammed (e.g. #1, #2... #7) can be used ONLY if the remote DIDN'T send next one. Even without the original remote.. if #1 worked, after that with Flipper he used #6 then all previous #2-#5 became useles. So the logic says, that remote sends consecutive codes (out of probably a huge base of codes).. And one use of original remote/keyfob should make all previous ones inactive.. Could you test that too?
So the remote has to know if Sent code has Arrived, in anorher case remote would sent #1 code and its jammed, now remote is about to send #2 code and Door will be expecting #1 code how I’m wrong
I was playing with my key fob and now my fob and car are out of sync. Any idea how to resync them? I'm about to take it to the dealership. Most videos online want you to have 2 working remotes to do anything, the other videos didn't work.
No, I'm sorry - I don't know any workarounds when the remote gets out of sync. But this is afaik a small job for your car dealership. Good luck - hope it sorts out.
No option but to have it reprogrammed. Call a local locksmith to program it. It’ll be hundreds cheaper than the dealership for the same exact working key. Then from there, buy 1 or 2 cheap key/fobs online, and use those 2 working keys to program them yourself (following online instruction), and then never touch those two base remotes for tinkering (they’re your failsafe reset and program new keys baseline) and you can play with and mess around with the extra two cheaper fobs you bought and programmed yourself. Trust me, local locksmith over dealer. Don’t believe me? Call and ask for the price for the key program than call 2 local locksmiths to compare. Can be as much as $200+ cheaper. That’s not including the cost of the upsold $140 key blank they sell you.
Check your car manual if you have it - some cars (at least the older ones, early and mid 2000s) have re-sync procedures which use different codes (which are less likely to go out of sync due to a more complicated trigger condition) for when you change your remote battery, for example.
Back when I was a hardened criminal downloading pirated videogames, many of those games would come with a key generator that I think was essentially that. A hacker found the commonality between a few accepted CD keys for the game and created an algorithm that could generate more unused keys. I don't know any details of how it's done but it seems to be possible.
@@Ninvus2hackers didn’t buy a bunch of codes to figure out the algorithm. They decompiled the software and found the subroutine that verified codes and reverse engineered it.
Remote out of range realistically. Real world this doesn't happen so much. There's replay attacks on keyless cars but criminals just steal keys or break into things physically.
But if the code is already recieved by the intended remote before the flipper can use it, then that saved code is useless when attempted with the flipper
I am not buying the theory in this video on rolling codes. The transmitter does not have a receiver to even know the code was not received when the signal was blocked, so this theory that the transmitter will go back and use an earlier code does not hold water. If you have demonstrative physical evidence to the contrary, let’s see as those facts in operation to support the basis of your claim. One way to prove your point is to hit the transmit button once or more when you are miles away and sniff the codes on the flipper. Then get in range and press the remote and see what codes come out. I believe what you will actually find is that the rolling codes will cycle on to another each time you press the transmit button. If the receiver receives a subsequent rolling code (clearly a gap), that the receiver has a hop back on feature.
Thanks for commenting. I think we are misunderstanding each other. The transmitter does not have a receiver - that is exactly the point. That is why both sender and receiver have to follow a common known algorithm and to be in sync. There are always a little "slack", meaning that they will not get out of sync of you press the sender without being in contact with the receiver. The sender's counter will increase, but the receiver will accept codes within a "range" of counters.
I was a mile from the house, pressed the transmit button once. When I arrived home the button would not activate the overhead door. But when I pushed it a second time it did open the door. I believe the misleading point is the flipper, although it's able to copy live transmissions, but the algorithm advances. The only way I see the flipper working is if the transmitter was pressed outside the receiver range and you copy that transmitter code on the flipper to go and open the door. The flipper is not cloning the transmitters serial number and does not know the algorithm, it's just a copying device. Correct?
It's easy to tell bullshit in the video, you recorded somewhere the garage door keyfob radio signal, not at the door. The FZ records it and simply playback it. You forget to show it can work as a man-in-the-middle attack az the CAR not at the garage door,, simply jam the signal record the signal and replay the recorded signal It was a simple explanation but missed the POC.
@@rabbirt yeap, you cam call as you want, but it's global process. When geeks on one side of planet buy toys the nazi on other side turn this money into bullets. Keep "lmao".
@@xiarno3373 omg, seems people much stupid than i think... It's 21 century, dude, you can register your "Inc" anywere, even on the Mars. This company founded in russia, by russian devs, still consists with russian devs and keep hiring on russia.
Great. Teach future thieves how to enter garages and cars owned by honest hard working folks. I like your vids and knowledge. But some things should stay unknown and inaccessible for many reasons. You have put lives in danger showcasing this video to the world. Their blood is on your hands! 👎reported
Hi - thank you for your comment. I’m sorry to read that you find this video harmful - I think there has been a giant misunderstanding of what I’m trying to say and what you are conceiving. Let me try to clarify: First, my message is that A) you should not believe all the video’s out there showcasing that FZ can open whatever doors, and B) the FZ can replay recorded codes, but thanks to rolling codes, most doors stay safe and secure. Then - I try to explain the principle behind rolling codes, without exposing any specific protocol - I’m even making up my own (remember: n*pi*100) just to show the principle. Finally I’m explaining that even rolling codes can be subject to jamming attacks - this is a well known issue that has been addressed at several security conferences several years ago. Just google “rolljam” or “rollback”. Even if this is a known problem, my video does not explain any devices or methods or any other details for such activities. Remember that “security by obscurity” is not a good idea, so to be aware of this problem is actually a good thing that can prevent you for beeing attacked. If your key-fob doesn’t work, but it works again after a couple of clicks, there might be someone jamming and recording your signal. I hope you will see my video again with new eyes after reading this comment. Thank you and stay safe.
Stupid comment, thieves/criminals have had access to these tools for years, this is a great opportunity for people to actually be aware about threats and how to defend themselves against it.
This is all common knowledge, out there on Google, CZcams, reddit, etc. like videos on lock picking. Your premise that discussion of information that has been available for literally decades is putting lives at risk is idiotic, and that's being charitable. By your 'logic', videos on how a turbocharger works are responsible for deaths when someone modifies their car and loses control at speed. The fault and blame lies squarely and solely with the individual perpetrating the crime. Truthful information is not harmful, and the strong counterargument to your unbelievable claim is that having this information widely available allows people to better understand how to secure themselves and their belongings by having knowledge of security weaknesses and routes of potential attack. Jesus, you must be an absolute blast at parties. 🙄
Flipper just restocked for 169 yesterday…. Still in stock…. Gotta follow their discord to find out when they drop on the official site…. Just got a second one lol I paid 275 for the first one and just got one today for 175 shipped
If you're able to Read a signal instead of Read Raw, the FZ has built-in rolling code. But you must pinpoint the exact frequency. Use the Frequency Analyzer to pinpoint the frequency, making sure its the same frequency at least four times and then hold the center button and it automatically take you to Read and then from there you can config and get a more exact reading before saving it to be emulated later.
That's a good clarification 👌 Thank you 😀
@@techandfun7723 You're welcome. I saved my garage fob on the flipper as a backup. I will use it sometimes but I have to cycle my original garage fob to an unused code afterwards. My wife hates it ^_^
What fw are u using? Official firmware holding center button doesn’t take you to read.
@@Cosmozic looks like rogue
Hey can i ask you how you analyze the exact frequenzy thx
Very well explained, you are good at putting things in simple terms.
thanks! you know, even after doing some research on rolling codes, I still never understood how they work. but I get it now! When you press a key fob it creates a "good" code and tries to communicate with the door/car, etc. When it reaches it, the code is now dead and can't be reused. However, if you're able to isolate the keyfob from the car/door whatever, then the codes created and recorded are still good, only until they're used. great video. i was finally able to store a few codes for my garage (one time my keyfob died and I had to pick the door open).
Im not sure about the last part in the video. In a rolling code system, a transmission must be successful for the code to be sent and the expected code to change. When a transmission is successful, the code sequence is updated in both the remote control and the vehicle. This ensures synchronization, and the next time you use the key, a new code is generated based on the updated sequence. This approach prevents unauthorized attempts to capture or reproduce earlier codes, enhancing security.
Very well made videos, hopefully you keep making them!
Thank you. Oh yes, more videos will come. Just because it's fun 😀
@@techandfun7723DAINEL JURADO
my flipper just shipped..can't friggin wait for it to show up next week.
Great. Hope that you will enjoy it!!
your car garage explanation is so good
Thank you for the motivational feedback!
@@techandfun7723 you have done great work and that appreciation
you earned it for dure
clean vid! good job
You got another subscriber! Watching from Philippines! Keep making more videos, cheers!
Thank you for the nice comment 👍
I know that key fobs can be replaced when lost, and just need to be synced with the car. can the flipper zero sync with the vehicle like a new key fob would?
rolling codes + signal jammer can permanently disable a remote so for example, there is a jammer active and then the remote button doesn't work then if rolling codes does not loop and go on forever than the device will be rendered unusable unless you find a way to reset rolling code to 1
That's true! This may also happen if you press the sender too many times while being outside the reach of the receiver.
@@techandfun7723 I was going to ask you this. What if I am away from my car garage and I press the open door button 5 times, then go to my garage and press it again, how does the receiver adjust for the code it is receiving, which is out of sequence, or past the expected next code it is listening for?
@@squelchtone Normally there will be a "buffer" so that the receiver will approve the next n-codes. Lets say n=50, then you can press the button 50 times without getting out of sync - but n can also be a smaller number, sp you have to be careful. I usually test by max 10 times before Im syncin' up the remote by pressing it withing the range.
@@techandfun7723 Thank you for the explanation, appreciate it, and thanks for the great video!
@@squelchtone if you use signal blocker to get a fresh set of say 5 codes, how many times they can be used ? just 5 times to open the garage and then you need to do it all over again ? It can't be permantnently saved 5 sets you can keep using ?
Take care when reading car remote codes. It is extremely easy to disable the remote....which would require a re-sync with the vehicle.
Great video. I have a couple of questions for you to ponder if you care to respond:
- How can two remotes work with the one garage opener with rolling codes as it seems to me that only one would keep them in sync?
- We recently had the Homelink mirror stop working on one of our vehicles yet it was still programmed (not erased). I had to redo the programming to get it to work again. Could it have gotten out of sync and if so how would that happen?
Look up keeloq for more info, but a simple explanation is that the serial number of each remote is stored in the receiver and they have their own separate rolling codes
@@zheil9152 That isn't applicable here. We are talking about a garage door opener manufactured over 20 years before the vehicle with Homelink in its mirror.
Good explanation
So, is there a two way communication with the FOB and the receiver? or the fob just blindly sends the next one until it runs out, or recycles it's table? It's a great video but leaves me with more questions!
I dont think the receiver sends smth back, I think as soon the transmitter send smth they both update to the next code that was calculated as the example in the video
@@daKnighty I think you're right, I've looked into it a bit further and it is possible to desynch the fob with the car.
@GeneralThargor OK, but what happens when the original car key gets de-synced, does it have to be re authed by the car or does it work again?
easy to understand
So it is not possible to re-record the rolling code on a control and use it normally as there will always be this change in the pin?
Isn't there any way to read multiple signals and get the formula/algorithm at which the rerolling is performed?
It's hard due to the end to end encryption between key and receiver. They both share so called Manufacturer Code, which is used to encrypt the Rolling part of the package. The encryption itself is not very strong, but you must obtain the significant amounts of packages to break that. Sometimes flipper gives you false positives using the wrong Manufacturer Code, and, if you are lucky enough, it will be able to produce the valid Rolling package and open the door. But it can desync original key way too much, and make it useless (unless you are ready to press it inadequate number of times outside of the receiver's range)
How does the remote control know which code is next? eg if I press it 5 times and i'm out of range of the receiver, how does it know that the code is used or not. Also, is there a limit to the number of codes in general?
The remote only needs to maintain the data needed to calculate the next code in the series. It doesn’t need to have knowledge of which codes have been accepted by the receiver.
The receiver is responsible for maintaining the last known good code that was used so that it can calculate the next X good codes in the series and accept the next highest unused code.
Say you signal the open command 5 times out of range of the receiver, but the 6th signal is in range. The receiver sees that signal 6n is unused in the sequence and accepts it. It should also now invalidate receipt of any of those lower unused codes (originally sent out of range), even though they would have been valid before receipt of that 6th code in the series. This minimizes your exposure to replay attacks.
Theoretically, you should never run out of codes because you can always seed your algorithm with a higher number (n+1).
Side note: in practice, I believe a remote can get too far ahead of the receiver in the code sequence. I have heard of parents having to get their car key fobs re-paired with their car because a child pressed the unlock button 50 times while out of range the the car. The car may only maintain a buffer of the next 20 valid codes, so if your remote goes beyond that, it would always be too far ahead.
I don’t have deep knowledge on this subject, but that’s my understanding. It’s also a little hard to explain. Sorry for the long reply, but hopefully it helps.
The receiver have a table of codes extending to the N times, the only thing it's looking at is whether that code has been used or not. It probably recycles old codes after some number of times.
Is the formula shown in the video actually used for rolling codes, or does it vary for different devices and you need to figure out the algorithm first every time you want to remote control like a door or garage?
It varies, and yes, needing to figure out the algorithm is part of what keeps these things secure.
its all about factorisation of prime nb if you record10x signals you should find coding algo for this key and made script to emulate different one all the time you press it
So if you disable the power to the door receiver... and capture the codes from the remote could this work ?
Thanks for sharing
04:40: What if the key was pressed one or more times out of range? Then the next time it will send "3xPi" or "4xPi" while the receiver expects "2xPi". How the receiver will treat this?
I guess the receiver expects any n*pi with n superior to the last one used, but it seems kind of heavy to calculate enough possiblilities to make sure your remote doesn't stops working just because your child pressed the button too much while you were out of range.
Edit : I read a comment saying that the receiver has a buffer of let's say 50, so you can press the button 50x while out of range without getting out of sync. I never heard about a desynchronised remote, even on parking where there are a lot of different remotes, so I guess the buffer is usually kind of big
@@calixte12 thanx for your suggestions.
But how do you figure out what frequency the sender is sending at? I'm trying to replicate my garage door but when I run "read RAW" and configure it to read on all the available frequencies, nothing turns up :(
It does not work with VW recent Remote car ceys:
Frequency records rolling code in 434,42Mhz, but sending will not open the car.
Maybe because you need to set modulation type correct on the flipper ???
There are 2 AM and to 2 FM modulation settings possible.
Which is the correct one for a (VW) car remote ???
Maybe you can record the signal with flipperZero and take it to a computer and find the algorithm and maybe with an addon your flipper can open the gate...
I know its a little complicated but hey this thing in the wrong hands and enough time will be very dangerous...
what happens if the key owner pushes one more time without jammer (or in range after being out of range). Does it mean the door is not only waiting the n°1 but also all the possible next ones ?
I believe the receiver has a table of codes and the only thing it's looking at is whether the code has been used or not, and probably will also recycle used code after a certain number of new codes has been used. Otherwise if you just pressing your key randomly outside of range that will mess everything up.
Solution is simple. I use a smart relay to open my garage door connected to Home Assistant. Decrypt a 4G /5G communication with HTTPS using flipper :) Also I can open my garage door from anywhere when a delivery guy has to put a package inside. These remotes are outdated.
MITM wil beat your 4g\5g with HTTPS
A challenge-response mechanism would be just as safe, no need to overkill with cellular modems. Remote prompts for a challenge, door controller provides a challenge, remote signs the challenge and controller verifies signature. No sync procedure necessary. No replay attacks (provided the challenge is random with good entropy). Same principle as used in PIV/smart cards, EMV contactless cards, NFC security keys, etc. Requires controller to have persistent state in the sense of remembering the last issued challenge with a timeout, until a response arrives and is verified.
More battery depletion than simple rolling codes but much less than a 4G/5G modem, and lower attack surface as you'd need to be physically near rather than simply being connected to the internet to even attempt an attack.
@@helloslayer666 Relay wired to Home Assistant with NO port forward. HA server reach out to HA cloud. Phone has constant VPN connection and I do not use public Wifi-s at all. HTTPS in a VPN tunnel. I feel safe till quantum computers will get mainstream.
I use a key hack that.
not everyone is an electrician who can wire up relays, simple enough for me but not for old joe.
An Excel table would be good to calculate the Keeloq by writing the Key, MF, Synchronism and obtaining the following frame.
how do you mean? Like example pls?
@@J0ll0f3niShit0Do you know how KeeLoq works?
@@J0ll0f3niShit0Do you know how KeeLoq works?
@@J0ll0f3niShit0 The author of the video deleted my message.
@@J0ll0f3niShit0 I already posted several comments and they deleted them, they delete what they think. I explain it to you elsewhere.
Bro I have a dout if the signal is jammed first time key will move forward but door will not receive the 1 st code so it will expect the 1 st code only right so in that sense we can't open our garage door after once we fail right but that doesn't make sense
Ok but what happens if you have 2 garage door openers and your wife has one at work with her. You use yours to open the garage but when she gets home her controller doesn't know which sequence to send as the next code. Also there needs to be some sort of ACK back from the garage door or the controller won't know that the receiver has received it and then know to use the next code.
I did this and it kinda worked, I can now turn the light on and off with the flipper but the door won't open
Doesn't recording and using one or more rolling codes in the flipper "desync" the key fob?
So to use the F0 as a key for a rolling code fob one would have to either store many keys in advance, and then replay them, and then also keep count for the fob itself. To actually replace the fob the flipper would need to know the algorithm. Huh. I learned something here, thanks for the video!
Thank you for the nice comment. The keyfob will not instantly be de-sync'ed, because there is usually a "buffer" of n-codes that is accepted. But if the keyfob is pressed meny times outside the reach of the receiver, it might get de-sync'ed.
@@techandfun7723 what happens if gets de-sync’d? The fob itself won’t work anymore? How does one fix that?
Sometimes, when I go see a movie or go to the mall, I get a little OCD and I start hitting the lock button on my car key fob a bunch of times but I’m out of range lol. So I keep pressing it while moving back toward the car til I hear it lock.
So you’re saying that technically, pressing the lock button on my fob too many times while out of range of the car could mess it up? And then how would I fix that?
@@MisterK-YT
It could (and will if you do it enough) desync. If that happens, you're good to go to a garage and have your centralized closing reset and probably a brand new remote
@@MisterK-YT If you do that enough times in a row outside the range of the car (I've read it's 256) the fob will no longer work until the car is reprogrammed with it again.
@@islandfd3s gotcha
Just tried it on my jeep and works
I don't understand one thing..
How the remote can know the the first or second code that was jammed didn't work? It is a transmitter, not a reciever..
On Peter Fairlie channel he presented something else.. The codes that were jammed (e.g. #1, #2... #7) can be used ONLY if the remote DIDN'T send next one.
Even without the original remote.. if #1 worked, after that with Flipper he used #6 then all previous #2-#5 became useles.
So the logic says, that remote sends consecutive codes (out of probably a huge base of codes).. And one use of original remote/keyfob should make all previous ones inactive..
Could you test that too?
Yes that's how it works.
As soon as you use code #505 then every code before 505 doesn't work.
When does it reset to 1?
how do you know wich frequency to use and modulation? for each dedvice
Scroll down and you’ll see a frequency analyzer. Press the button and you’ll see the frequency. Plug that number into the main page.
So the remote has to know if Sent code has Arrived, in anorher case remote would sent #1 code and its jammed, now remote is about to send #2 code and Door will be expecting #1 code how I’m wrong
The person making this video doesn't know what he's talking about.
Ok and so can I duplicate remote fob than?
Any thoughts what this is doing:
Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 390000000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Security+ 2.0
Bit: 62
Key: 00 00 3D 19 47 3E 47 69
Secplus_packet_1: 00 00 3C 18 49 3D 85 17
90% ur right.. If u got fob then U need to get signal maybe 100 times to see how algorithm changing code then do the same...
I was playing with my key fob and now my fob and car are out of sync. Any idea how to resync them? I'm about to take it to the dealership. Most videos online want you to have 2 working remotes to do anything, the other videos didn't work.
No, I'm sorry - I don't know any workarounds when the remote gets out of sync. But this is afaik a small job for your car dealership. Good luck - hope it sorts out.
No option but to have it reprogrammed. Call a local locksmith to program it. It’ll be hundreds cheaper than the dealership for the same exact working key. Then from there, buy 1 or 2 cheap key/fobs online, and use those 2 working keys to program them yourself (following online instruction), and then never touch those two base remotes for tinkering (they’re your failsafe reset and program new keys baseline) and you can play with and mess around with the extra two cheaper fobs you bought and programmed yourself. Trust me, local locksmith over dealer. Don’t believe me? Call and ask for the price for the key program than call 2 local locksmiths to compare. Can be as much as $200+ cheaper. That’s not including the cost of the upsold $140 key blank they sell you.
Check your car manual if you have it - some cars (at least the older ones, early and mid 2000s) have re-sync procedures which use different codes (which are less likely to go out of sync due to a more complicated trigger condition) for when you change your remote battery, for example.
@@Addlibs thanks I'll check that out.
@@Stopes. thank you.
I just realized that rolling codes and how the Enigma Machine works are slightly similar.
Good point!
This is definitely going to put me on a watch list 🙄
Wouldn't you be able to record enough codes to figure out the algorithm and then just use that to generate new codes?
Back when I was a hardened criminal downloading pirated videogames, many of those games would come with a key generator that I think was essentially that. A hacker found the commonality between a few accepted CD keys for the game and created an algorithm that could generate more unused keys. I don't know any details of how it's done but it seems to be possible.
@@Ninvus2hackers didn’t buy a bunch of codes to figure out the algorithm. They decompiled the software and found the subroutine that verified codes and reverse engineered it.
Depends if they are using a whitelist. If you have more than one, you can guess, but if you have 3 or more, you can verify.
Hi, lets pretend that I pushed the button on my garage opener device couple of times in a different city. Why it still works when I get back home?
If you press it too many times, it will get out of sync, yes -- and stop working
@@techandfun7723 it makes no sense, are you sure pilot is not recording received signal/code? Or perhaps it has only couple codes in a loop.
I understand that the code can be used 1 time, but how to block the signal? (jamming) using which device?
Sorry, but signal jamming is a bit on the side of this video, and is a bit outside my comfort zone ;-)
Remote out of range realistically. Real world this doesn't happen so much. There's replay attacks on keyless cars but criminals just steal keys or break into things physically.
Jamming is illegal in many countries, you should check if it is allowed or not.
Jamming is somewhat illegal.. so you should be careful with it
for a real answer, all you need is a device that puts out a significantly stronger signal on the same frequency
Why is there a Blastoise image appearing on your flipper when saving? How do I get that? 😅
By updating to unofficial firmware
Would a brute force attack also work instead of jammer?
hackrfone from great scott gadgets would work
wait so if rolling code sends different frequencys (with cars for example) how would you use a jammer to stop the original? do i just get lucky?
I need a knock off version flip-flop b a good nAme
I'm buying a flipper for my own BD.
Sir open the phone lock. reply plz
So no one can steal unless they’re jamming and stealing the unused code.
Saving an un-used code is one known voulnerability.
But if the code is already recieved by the intended remote before the flipper can use it, then that saved code is useless when attempted with the flipper
👍 so now I think not to buy it
It gust a TamaGozi😎
😱😱😱😱😱😱😱😱😱😱😱😱😱😱
I am not buying the theory in this video on rolling codes. The transmitter does not have a receiver to even know the code was not received when the signal was blocked, so this theory that the transmitter will go back and use an earlier code does not hold water. If you have demonstrative physical evidence to the contrary, let’s see as those facts in operation to support the basis of your claim.
One way to prove your point is to hit the transmit button once or more when you are miles away and sniff the codes on the flipper. Then get in range and press the remote and see what codes come out. I believe what you will actually find is that the rolling codes will cycle on to another each time you press the transmit button. If the receiver receives a subsequent rolling code (clearly a gap), that the receiver has a hop back on feature.
Thanks for commenting. I think we are misunderstanding each other. The transmitter does not have a receiver - that is exactly the point. That is why both sender and receiver have to follow a common known algorithm and to be in sync. There are always a little "slack", meaning that they will not get out of sync of you press the sender without being in contact with the receiver. The sender's counter will increase, but the receiver will accept codes within a "range" of counters.
I was a mile from the house, pressed the transmit button once. When I arrived home the button would not activate the overhead door. But when I pushed it a second time it did open the door. I believe the misleading point is the flipper, although it's able to copy live transmissions, but the algorithm advances. The only way I see the flipper working is if the transmitter was pressed outside the receiver range and you copy that transmitter code on the flipper to go and open the door. The flipper is not cloning the transmitters serial number and does not know the algorithm, it's just a copying device. Correct?
It's easy to tell bullshit in the video, you recorded somewhere the garage door keyfob radio signal, not at the door. The FZ records it and simply playback it. You forget to show it can work as a man-in-the-middle attack az the CAR not at the garage door,, simply jam the signal record the signal and replay the recorded signal It was a simple explanation but missed the POC.
"cp1" 😰
tech and fun with russian toys to sponsore the war - good choice, dude. If you didn't know - flipper developed by russian team.
lmao politics
@@rabbirt yeap, you cam call as you want, but it's global process. When geeks on one side of planet buy toys the nazi on other side turn this money into bullets. Keep "lmao".
@@arturscherbakov2543 LMAO propaganda
@@rabbirt seems i've spoken to monkey... nevermind.
@@xiarno3373 omg, seems people much stupid than i think... It's 21 century, dude, you can register your "Inc" anywere, even on the Mars. This company founded in russia, by russian devs, still consists with russian devs and keep hiring on russia.
I have a flipper and wifi dev board. I will sell it for $250. This is not a scam.
Something a scammer would say lol. Just kidding. Sell it on ebay dude. Not youtube
They're in stock in the US. Good luck lol.
Great. Teach future thieves how to enter garages and cars owned by honest hard working folks. I like your vids and knowledge. But some things should stay unknown and inaccessible for many reasons. You have put lives in danger showcasing this video to the world. Their blood is on your hands! 👎reported
Hi - thank you for your comment. I’m sorry to read that you find this video harmful - I think there has been a giant misunderstanding of what I’m trying to say and what you are conceiving. Let me try to clarify: First, my message is that A) you should not believe all the video’s out there showcasing that FZ can open whatever doors, and B) the FZ can replay recorded codes, but thanks to rolling codes, most doors stay safe and secure. Then - I try to explain the principle behind rolling codes, without exposing any specific protocol - I’m even making up my own (remember: n*pi*100) just to show the principle. Finally I’m explaining that even rolling codes can be subject to jamming attacks - this is a well known issue that has been addressed at several security conferences several years ago. Just google “rolljam” or “rollback”. Even if this is a known problem, my video does not explain any devices or methods or any other details for such activities. Remember that “security by obscurity” is not a good idea, so to be aware of this problem is actually a good thing that can prevent you for beeing attacked. If your key-fob doesn’t work, but it works again after a couple of clicks, there might be someone jamming and recording your signal. I hope you will see my video again with new eyes after reading this comment. Thank you and stay safe.
Stupid comment, thieves/criminals have had access to these tools for years, this is a great opportunity for people to actually be aware about threats and how to defend themselves against it.
I bet this homer is anti gun too
This is all common knowledge, out there on Google, CZcams, reddit, etc. like videos on lock picking. Your premise that discussion of information that has been available for literally decades is putting lives at risk is idiotic, and that's being charitable. By your 'logic', videos on how a turbocharger works are responsible for deaths when someone modifies their car and loses control at speed. The fault and blame lies squarely and solely with the individual perpetrating the crime. Truthful information is not harmful, and the strong counterargument to your unbelievable claim is that having this information widely available allows people to better understand how to secure themselves and their belongings by having knowledge of security weaknesses and routes of potential attack.
Jesus, you must be an absolute blast at parties. 🙄
Flipper Zero $300 if buying from Australia. Hahahahahaha, what?
Flipper just restocked for 169 yesterday…. Still in stock…. Gotta follow their discord to find out when they drop on the official site…. Just got a second one lol I paid 275 for the first one and just got one today for 175 shipped