2. About me
• Security analyst at Defmax
• Full Stack(MERN) & iOS developer
• Part time bug bounty participant
• Beginner in IOT security
• Twitter - @cymtrick
4. Frequency
Frequency : Frequency is the number of occurrences of a repeating event
per unit of time.
The relation between the frequency and the period of a repeating event or
oscillation is given by f=1/T
Frequency is measured in Hz
High Frequencies
Low Frequencies
5. Radio Frequencies
Radio frequency (RF) refers to the rate of oscillation of electromagnetic
radio waves in the range of 3 kHz to 300 GHz, as well as the alternating
currents carrying the radio signals.
10. General RF Communication Basics
• Channel BandWidth
• Modulation
• Bit rate
• Preamble
• Sync word
• CRC?
11. Communication Basics
• Channel BandWidth - Channel is a medium through which information
is transmitted between transmitter and receiver. Channel bandwidth is
the frequency range that constitutes the channel.
• Modulation - Modulation is the process of superimposing the
information of a modulating signal on a carrier signal (which is of high
frequency) by varying the characteristic of carrier signal according to
the modulating signal.
12. Communication Basics
• Bit rate : bit rate (bitrate or as a variable R) is the number of bits
that are conveyed or processed per unit of time. Ex 1M-bps
• Preamble : A preamble is a signal used in network
communications to synchronize transmission timing between two
or more systems.
• Sync word: a syncword, sync character, sync sequence or
preamble is used to synchronize a data transmission by
indicating the end of header.
• CRC : A cyclic redundancy check (CRC) is an error-detecting
code commonly used in digital networks and storage devices to
detect accidental changes to raw data.
14. Warning
• The spectrum is a limited public resource. Playing with illegal radio
might get you arrested.
• It can interfere with critical systems, Marine, Army, etc.
• It is advised to use a Faraday cage (“RF cage”)
15. SDR
• a radio communication system where components that have been
typically implemented in hardware ( mixers, filters, amplifiers,
modulators, etc.) are instead implemented by means of software
• Drag and drop components and create a flow graph!
17. HackRF
• A Software Defined Radio peripheral capable of transmission or
reception of radio signals from 1 MHz to 6 GHz.
• One of the best peripherals that are out there
• Can receive or transmit (half duplex)
• Cost: RS 30000/-
18. RTL-SDR
• RTL-SDR is a very cheap software defined radio that uses a DVB-T
TV tuner dongle based on the RTL2832U chipset.
• Drawback –receive only. But still great for analysis!
31. Modulation
Most of the car remotes use OOK(On off shift keying) part of ASK
ASK(Amplitude shift keying)
FSK(Frequency shift keying)
PSK(Phase shift keying)
32. Capturing the raw data
$ hackrf_transfer -r data.iq -f 433900000 -g 50 -l 24
33. Analysing the raw data in audacity
Preamble and SyncWord
1 0 1 10 10 01 1 1 0 0 00 1 1 0 0 0 1 0 01 1
Payload
37. Dealing with Rolling Codes
• Jamming the key while transmission
• Capture the signal with another receiver
$ git clone https://github.com/furrtek/portapack-havoc.git
38. Dealing with Rolling Codes
• Capture the first signal and replay it
• Keep the second signal for future replay attack
Yard Stick One (<1GHz)
Half duplex mode
TC1111-chipset
rfcat pre built
d = RfCat(idx=0)
d.setMdmModulation(MOD_ASK_OOK) #on of key
d.setFreq(433920000) # frequency
d.setMdmDRate(4800)# how long each bit is transmited for
d.setMdmChanBW(60000)# how wide channel is
d.setMdmChanSpc(24000)
d.setChannel(0)
d.setMaxPower() # max power
d.lowball(1) # need inorder to read data
