dinosaur Power come in my enemies
and I'm a security engineer and a
founder of our sentimos we have a
prepared for this tour as much as we can
police carrying get in touch with us
well
I've been the top
much of our works inverse assessing
embedded system security and finding the
lineabilities recently I've been
interested in testing to Bear pie and
The Craze
and while the claim their products
provide security value
probing the that value is difficult or
impossible
Supply is also need more reliable
information about our their products
in these list packs it was it is most
wanted to analyze
proprietary rapper protocols as the RF
world still has much to explore in
security
so as part of the project black and
Europe presented drone at link security
last year
this year at blackhead Asia
we will discuss RFP security use
indoorats
we'll look at the wireless Dora system
in the background and used our previous
research to see if you can attack this
system
explains why existing researched by
Wireless or technical techniques can be
applied at the code level
and here also provides a way to attack
dorads practically
additionally in explaining how to
analyze Wireless signal and
described techniques for rocking rock
picking tools capable of attack actual
Wireless Store apps
technology has gained probability for
iot communication
provide him improved signal quality
spectral efficiency and reduced inter
currents
it is ideal for raw power wireless
communication system making it a great
option
for wireless sensor and other iot device
in Korea device using the
404 7 megahertz frequency band must be
certified by the KCC
it seems though that this circle wrap
using
this prequest band have been listened to
become more popular
resulting in more KCC certification
being issued
or wirelessly Wireless dual system is
security mechanism all right
access to the door
without a physically key
request is sent to the wordpad Via
anti-scc
or Syria
the person in the house checks the
screen
and they open the door around through
the wall path Street
currently the wireless switch is also
into rock inside the oil pan
another method is to use separating
wireless controller
to open the door when the well pad and
wireless controller do not work
opens the door with smartphone is also
supportive
desktop
explores the security of
limited oracs which have become a
popular ultimately ultimate alternative
to Friendship traditional Rock and Key
Systems we analyzed over 20 models from
town vendors in Korea and discovered
vulnerabilities such a rollback and blue
prepare and Rosary attacks additionally
we found that some door apps have been
weak weak encryption algorithm that can
be easily guessed allowing attackers to
gain access
our research also suggests that this
Dora can be exploited for rocking rock
picking purpose
the Dora rocks has a board computer in
several ways to open the door wirelessly
the difference is whether the radio
signal are to open the door is receive
and authenticated by the main MCU or RX
MCU
it is necessary to identify the subject
of analysis to understand
the authentication mechanism in detail
in this study
the TX MCU that generates a wireless
signal is the primary analysis Target
and rxmc or main MCU was analyzed when
this is a complex environment
generally it has been confirmed that the
FSK rfg is mainly used for cost
reduction and transmission cost
reduction indoor app implementation in
this study authentication vulnerability
was analyzed by extracting from TX MCU
if the manufacturer restricted the
debugging connection
the analysis Target was analyzed in
using rxmc or main body MCU and wireless
signal
next the main speaker xinjiang
explain the details.orax vulnerability
analysis technology and the Art of lock
picking tools
hi I then I will continue to talk I will
explain the weakness that exists in
current digital dorax products by
comparing them 2.3 principles of
implementing a secure rolling code
additionally Ira provide demo videos of
real world attacks
to ensure secure rolling trans
transmission is crucial to prevent any
transmission from being repeated
this can be achieved by ensuring that
each transmitted message has different
content and the receiver should ignore
message that have already been sent in
this chapter we will explore previous
studies on road Gem and rollback attacks
and their significance in the context of
the door rocks and we also show our new
attack method the root playback attack
we will examine how these attacks work
and potentially weakness they can
exploit into work system
roaring code is a technique to prevent
the replay attacks and ensure
non-repitability in one way RP system
these techniques are not specific to
Automobiles and can be applied to other
systems that use RF such as garage door
and smart door locks if we had a short a
passcode open sesame anytime we wanted
to unlock our device anybody could
listen and steer our device by repeating
the same password
roaring code is a security system you
see the one-way protocol system that
generates a single use passcode to
prevent colder limitation or reviews
the use of fixed Code system started
declining in the early 2000s as more
secure Alternatives like rolling Code
system became available but they may
still be in use in some Industries as
you can see this storage use has ID
authentication information and the
transmission error Jackson and there is
no counter barrier therefore these doors
are vulnerable to forgery attacks as
well as early prey attacks
the road gem is some variant of Replay
attack in summary the attacker intercept
and store the unused K-pop signals the
attack gems that Force the signal while
capturing it it causing interference
between the key fob and the car they
then repeat the process for the second
signal when the owner used the key for
again
the attacker 4 the first to capture the
stiff signal to unlock the scar Apple
owner leaves the attacker can use a new
second signal to gain access to vehicle
this attack is inhabitable weakness in
one way protocols making it difficult to
avoid because no time stamp
the fact that most doors are located in
the indoors and operate on a very narrow
bandwidth can make them more vulnerable
to jamming attacks TMI but we can check
the 30 kilohertz range not completely
overlapping with the original signal was
most effective but there are two main
drawbacks of row gem fourth is a
Precision of timing so attacker must be
very precise their action carefully
second is attacker can only launch
brunch the attack once so if they want
to access the same door again they have
to start to start over from beginning
roll back all time was this grossed last
year as a new Autumn method this attack
involves exploiting some uncareer
weakness to capture and liberate to
consecutive unlocked signals allowing
authorized access to vehicle rollback
has two critical advantages or overall
gem firstly once the attacker capture
the signal they can launch the road back
at any time in the future secondly if
the attacker only need to capture two
signal ones and they will have unlimited
access to that beaker
it is interesting to note that lower
back attack can also occur in Dora
system we were able to identify the root
cause of the attacks in the binary code
this product always keep track of the
rust accepted counter but the issue here
is the Dora need to save the counter
barrier in memory whenever a buried
message is received eventually if an
article replayer previously used message
the doors come to variable which is used
for comparison will roll back to the
counter barrier of the replay the signal
so the secondary signal does not have to
be strictly consecutive
the article can capture any soft
subsequent online signal that unlocks
the door and use it unlock the door
eventually in either case if the risk of
the singular is buried the counter
battery will increase in packet is
stored in memory and compared to next
value to be transmitted therefore this
can be referred to as lowering back to
ruling back the comparison variable to
the previous counter if the system is
implemented in this way security threat
such as rollback attack can occur
so let me show you a video demo video
over Dora grow back attack
we capture the consecutive two signals
Stars
this time we attempt a new alternate
method inspired by the rollback attack
it can be likened to playing the same
song on the repeat on tape we capture
the three consecutive signals combine
them into one and transmitted them using
Loop playback it works it is working
nothing that the three signal or
industry consecutive although it tooks
about maximum 10 minutes to open the
door at once once an attacker captures
the signals the rollback attack can be
launched at any time in the future in
this presentation we cannot clearly
identify the truth curse but it is
record related to proper ranks of the
buried counter
foreign
takes anywhere from five to ten minutes
so I have prepared the video with
increased playback speed of your
convenience
to prevent barium to replay attacks the
system should adhere to principle that
system keeps track of Rusty unused code
last used code and never accept the
previous previously used counter by
implementing this principle even if
attackers tried to reuse previously use
counter the system state tree rejected
and maintain security
in addition the system must securely
store the recorded counter value in
memory and Implement a careful
comparison mechanism
the evolution on a limited set of dorax
or replay attack is shown in the firing
table
in this chapter we will explore
vulnerabilities in the article inclusion
of the rocks
in a rolling Code system there is
typically a shared secret between the TX
and the RX this share the secrets is
used to generate a synchronization
counters that are unique and
unpredictable for each transmission
another purpose of the shared secret is
to encrypt entire content so that it can
only be read by the intended RX this
make this makes it difficult for article
to predict and replicate the code in
this chapter we are focused on
confidentiality in smart door of RF
communication and we will discuss it
based on real world example
before we dive into the topic let me
explain the three methods for management
of shared secret key in one way or
system
firstly the pre-programmed fixed key is
a simple and cost effective solution it
may not grow by the same level of
security as other methods due to the use
of common key for All Transmission
pre-programmed random key provides
better security as the key or randomly
generated but lost key May prevent new
transmitters from being used if they do
not have a learning mechanism secondly
derive the encryption key from the
received data is another method that can
be effective in generating unique keys
for each transmission but it may be
vulnerable to hacking attempt lastly the
most secure method for enhancing the
security of loading code is transmitting
or seed value during the running time
which are also reasonable to derive the
increasing key from the seed barrier
making it difficult to attack to
predictor gaster key
this block diagram represents constantly
constructed formal code of the
decression scheme for encrypted packet
received by door locks it has been
observed that or currently available to
rock that used as based rolling Code
system
the structure involves taking a
hard-coded Indonesia factor and plain
text as input and using q1 as the first
block key to generate the key for the
text next equation Pro the areas
inclusion of the next block use the
previous blocks encrypted result as
decoration key to integrate the actual
list of message in that sense the
equation key for the current block is
generated using the previous block
ciphertext which is then used to decrypt
the current block the security of this
inclusion scheme is heavily reliant on
the strength of the initial T1 and the
generation method used used for it if
the q1 generation method is weak or if
the hard-coded initial vector and plain
texts are known
the entire encryption scheme become
vulnerable
let's let's take a look at the q1
generation process that we have
uncovered through formula analysis the
key one generation process has some
security concerns the process involved
using the first byte of a list of packet
as seed to generate the decoration key
which is expanded to 16 bytes although
this method can be usable useful for key
synchronization between the transmitter
and receiver it has its drawbacks the
actual number of a key that can be
generated based on the first byte is
limited to
256 Bender also attempted to hide the
sequential nature of the counter by
improving techniques such as bit masking
however this approach is still
relatively easy for hackers to detect
and export
eventually the first bite of transmitted
packet is utilized as the seed for key
generation in this scheme some vendors
prefer to use a simple counter in place
of the packet first byte to generate the
key to consider the sequential nature of
the countersome Bender May improve
attacking such as bit masking this
involves manipulating certain certain
bits of the counter to obscure a
sequential nature and make it appear
more random additionally us certainly
certain doors vendor rely on predefined
table rules for QC degeneration these
tables are typically unique to each
bander customized and preset Bender
anticipated utilizing these tables will
read the to creation of unpredictable
and secure Keys nevertheless because
this table have short lengths and fixed
barrier across across or product line on
firmware they remain vulnerable
as mentioned at beginning of the chapter
this approach is a form of deriving the
increasing key from received data indeed
the issue with this method is
vulnerability to hacking attempts if
their key generation process is
predictable as a result even with change
increasing key on attacker could decrypt
the cycle test at any time interestingly
the key generation C dissolved as a
synchronous counter directory making it
easy for attackers to forge or better
than that next message using the current
sync counter if the specific
implementation inclusion algorithm
including key generation and arbit
transfer mechanism is exposed it could
potentially enable an attacker to
compromise other device with a similar
implementations
now let's shift our Focus to proper
predatory encryption algorithm by
certain vendor if we are being precise
it seems that this method is not to
encrypt the entire contents of the
packet but rather to consider the lower
encounter it users share the secret and
generate the sequence based on that this
method combines substitution and
operator tables to generate the loading
code counter
during the drowning time the secret is
transmitted which can be referred to as
pre-programmed cyber key using running
mechanism as mentioned at the beginning
of the chapter
then it can be seen that the key factor
in the security of this algorithm is
whether is effectively considering the
counter
the analysis of the corrected packet
reveals some interesting findings the
algorithm proced produce of a bytes
rolling code with generally in
significant variation in result values
because it's in constant inconsistent
pattern code may be due to the absence
of permutation in our inclusion
algorithm moreover the by the bytes that
did exhibit noticeable change showed us
clear pattern of increase or decrease
these observations suggests that the
algorithm may have burned on abilities
in terms of its security
the evolution on The Limited set of Dora
for inclusion is shown in the Far Far
table bender using as inclusion in their
products have similar weakness in their
inclusion and the key generation schemes
some vendor using property inclusion
method direct permutation feature in
their inclusion algorithm making a
relatively easy to predict the next code
relating to security weakness
although not covered in the stock Bender
using xkea increasing algorithm have
been found to be hard-coded fixed key
when using on one way article protocol
where a challenge response system is not
possible
the common method for Access
authorization authorization is simple ID
verification each device is assigned a
unique ID by the factory and the
reasonable verify the transmitted ID
together the access to mitigate Brute
Force attacks the assigned ID for
dollars should be unique and don't get
server and non-sequential
the serial number is used to uniquely
identify install each store a product
and it is included in RF message sent to
the Dora it verify the serial number to
confirm that the message was sent from a
buried store product and then
perform an authentication process for
Auto by authorizing process to determine
whether to unlock or
or lock the door
the process of checking the serial
number can be considered as an
authorization step it ensures that only
matched transmitters are able to
communicate with the receiver and
control the wrong or other device
this function is used to confuse the
pattern of input data by applying a
rotation one of three or a space on the
value of the key seed DC has been
observed in some Dora products that you
stay as Cipher although this function is
limited to mapping it out to one of six
16 patterns the selected array is
randomly transformed based on the value
this will make it harder to for
attackers to labels engineer the
original data typically the this
function is implemented as threat
strategy to increase customer confidence
in the product and gain competitive
advantage
but it is important to keep in mind that
this function around in is not
sufficient to ensure the security of the
system
for a month from on our lock picking
attack perspective if the ID or value or
sequential or have limited variation
attacker can easily initiate a Brute
Force attack to guess the target ID
battery
what is interesting if when the same
product is distributed and installed in
larger quantities during the building
interior construction stage there is
possibility that the ID value may become
predictable in such case the ID barrier
of the product may have a certain
pattern which can be easily exploited
predict the next door up values
therefore it is crucial to use the
unique ID barrier to mitigate potential
attack
in this chapter we will briefly
introduce our RF locking tool and
provide guide for its preparation
the two we are we are developing is
aimed at capturing and decoding Dora
signal as well as generating and send
custom package to success free transmit
and receive signal for our tools it is
crucial to gather information
from the RF parameters and the baseband
we'll explore the dorax in the RF domain
and show how easily tool can be created
to export them
to obtain the corrective signal it is
important to know the operator Center
Center frequency and deviation most of
the Rocks use almost the same frequency
band and deviation the frequency band
frequency depth bandwidth used is
generally below 240 kilohertz with
adaptation of less than 2 kilohertz
if we know the accurate percent of
frequency the pre-built tools such as
the urh can use the quadrature demode
method to almost a perfect per factory
remote vfsp signals one thing to note is
that RP signal has a very narrow damage
and frequency this might cause
interference in the iif signal due to
the non-linear mixing process especially
when using the head up head rf1
another way tapping into the connection
between the rfic and the MCU on the
target is good option for obtaining the
base Fender signal this method can
provide the more operator rely on Signal
generally in packing mode the Preamble
and sync world are used for data Handler
of Chip to obtain timing synchronization
between the RX and TX but in the case of
the overall they do not use Preamble and
sync word in other chip data Handler
they can could add unique training
sequence at beginning of the each packet
to Signal start of package to the
receiver this can be seen as a type of
training sequence for sto that may only
provide course timing synchronization
therefore obtain the correct pattern and
timing of the trending symbolic solution
most products use Rotex mode instead of
packing mode and proper proprietary
baseband encoding is often used in this
mode the primary reason for using this
mode seems to be ensure compatibility
between the disparate Arab chips in TX
and RX and to differentiate their
product from other vendors
custom encoding method apply very simple
variable lens in length including based
on duration of low and high signal for
binary representation
this is our simple SD abroad
s this is capable analyzing packet from
or from Arc signal and generating custom
package to send over the signal it is
designed to perform for perform attack
sniper and or not and rocketing without
sniffing
this device our cost effective version
and it is also not equal to print it
near Target property and export in top
poverty
if a battery is connected and the device
is hidden in discrete location another
an article could potentially use this
device attached near the house to snip
or send the signal the device is
equipped with ethereum storage on attack
or lead out the capture the signal from
the device
in this chapter we prepare scenario and
demos
included where are block picking tools
are used to attack layer dorax
the two Master double attack for opening
the someone as home door first three
intersecting a signal to extract ID and
counter information to generate the next
code secondary attempting to generate a
new code without any intersecting the
signal using Brute Force by trying
different IDs however rolling code based
system have a secretive feature that
relies on the rust accepted counter
value to determine the expected counter
this means that even if an attacker can
generate a valid transmission packet the
article May Fail if the article does not
have information on the last accepted
counter value by the Target graph this
is signaling frequent challenge for
Brute Force attack it will talk in rock
picking stories
the Sniff and rock scenario begin with
the attacker installing a sniffing tour
around the apartment or near the door
using the scratches threshold the
attacker can set the physical range for
the packet correction once the signals
are captured the attacker extract the
target device IDs and count value from
the signal based on this value the
attack will generate the next code
packet and send it to the next Target
device
let me show you a demo video of the
Sniff and unlock the door
in our talk on our rapid attack is
manipulating the message of Pandora
without sleeping this attack use a brute
force method where the attacker
sequencially tried possible ID barrier
to find the right one to unlock the door
to successfully execute this attack
there is a crucial requirement the Dora
has to always accept the version message
even if they don't know current counter
value
let me give you an example if attackers
choose the counter that is before last
accepted counter it will be rigid
in most products if the attacker choose
a counter value that is too far in the
future the Dora will reject the message
eventually
ideally choose the counter value that is
as close as possible to the rust
accepted counter but this can be
difficult this means that even if
attacker can generate battery package
the attack May Fair if attacker does not
have information on the last accepted
counter barrier by the Target Target
Dora
but the most outdoor rock shoot designed
to accept code even if the received is
think think counter value or non-stick
three consecutive because they ensure
that the code is accepted even if the
transmitter has been turned on multiple
times however this synchronizes feature
is designed to accept the value within a
specific range of counter barrier for
convenience by limiting the acceptable
range it helps prevent unauthorized
access to Dora although not or product
include this feature
ultimately our Fortune message must be
accepted by the dorax deterministically
in order to for
the attack to be successful fortunately
on the under specific conditions we
discovered that or our design tools
accept counter value outside to outside
the expected range when a series of
strictly consecutive counter is received
by Dora the system undergoes Force
synchronization it means that the first
message would be accepted by the rock
determined deterministically if the
article does not know the last accepted
counter barrier the number of
consecutive counter transformation is
required for Force synchronization may
vary depending on the specific
implementation used by different vendors
this table shows the number of
consecutive counter called transmission
required for synchronization organized
by vendor
informal State consecutive code
transmission requires the article need
to transmit more codes which increase
the overall attack time therefore in the
case case of Bender b double attacker
would need to transmit the three
consecutive code transmission for the
Dora to synchronize and accept
The Rock picking without snipping
scenario begin with the other Korean
storing a code break around the
apartment or near door this attack can
provide the significant window of
opportunity of thief as they can be
carried out without leaving base of the
sign of first entry or triggering arms
although both Dora systems have a
limited receiving capability due to
their low symbol rate in this case it
took it takes about 10 hours to try all
possible barriers starting from zero
however if we can obtain ID correspond
to certain durag in apartment complex we
may have some opportunities to narrow
down the search range to some extent
we can use this obtained ID to set an
initial search ID value and start our
search from that point which could
potentially save us time and effort in
our search next we have prepared a
simple demo video of rock picking attack
search
foreign
system and regular Gem and repair
attacks in more than this third Dora
rock picking attack can be easily
exploited by significant a single signal
if the signal
architecture type is unknown if by the
barrier sequential or have limited
variation attacker can easily initiate
the broforce attack to guess the target
ID value and also first in
synchronization process of counter is
also key factor for Brute Force attack
even an unexpected events dollars should
not accept the larger counter barrier
actually to specific range
rfo security testing is essential for
wireless system and security throw of
security is not solution system must be
designed to be relevant to attacks even
if the attacker knows how they work
all those it may not be the best
approach I believe that assigning unique
key to each product is a better secure
approach in Dora of course using secure
encryption algorithm is essential
thank you very much for listening
thank you