Researching security vulnerabilities in IOT devices, specifically dealing with the issue of home security I decided to look into garage door openers. I came across this article that says there is a man who has developed a way to crack the code of the ordinary garage door. This kind of hack could be disastrous to a homeowner because it lets a malicious user gain access to many houses that have an entrance to their house through the garage. There is not just one garage door opener that is susceptible to this hack, many garage doors are. I personally would not want anyone to be able to open my garage door and gain access to my house and with the knowledge of this research I am going to look into the brand and the garage door opener that I have to make sure that this vulnerability is not able to be done on my garage door. Many people have these garage door openers that are susceptible to this hack and they may need to upgrade their garage door to prevent being a victim of this attack. There are actually two kinds of codes that can be cracked by this security researcher’s method, the first one was discovered earlier than the other because the later is more difficult to hack. These two kinds of codes are called “fixed code” and “rolling code” and there are many garage door openers that use these kinds of codes to allow access to your garage and possibly your house. In this document I will go over what garage door openers are susceptible to this attack, how the attack is implemented, and what a user can do to prevent being a victim of this type of attack.
There are many brands of garage door openers that are susceptible to this hack. Some of them include Nortek, NorthShore, Chamberlain, Liftmaster, Stanley, Delta-3, and Moore-O-Matic (Kamkar). The attack was designed by Samy Kamkar and he states that only garage doors with fixed code entry systems are vulnerable to this attack although he has also developed a hack for garage doors with the rolling code entry systems. Samy Kamkar has presented his rolling code hack for garage doors at DEFCON 23. The difference between fixed code and rolling code is that the fixed code system uses the same two-character code every time to open the door and rolling code changes the two-character code every time the garage door is opened. There are other kinds of systems that use hopping codes, Security+, or Intellicode and Samy Kamkar says that these doors may be safer from this kind of hack but they are not foolproof (Kamkar). Wired.com has requested comment from companies like Nortek and Genie but they didn’t respond at first about the vulnerability and then posted on their website it is stated that they use rolling codes (Greenberg, 2015). Later on, after Kamkar figured out how to hack fixed code systems he also found out how to hack rolling code systems. The owners of the Liftmaster brand of garage door openers stated that they have not used fixed code systems since 1992 but Kamkar looked into a manual from a 2007 version and said he found that it uses a fixed code system (Greenberg, 2015).
Samy Kamkar has posted the code that he used to crack the fixed code systems and the code that he used to crack the rolling code systems, but he intentionally sabotaged the code that he posted so malicious users would have a tough time getting the code to work. To crack the codes Kamkar uses brute force to find the right code for each door. The doors that he tested use at most 12 bits which is 4096 possible combinations (Greenberg, 2015). Using a brute force technique to crack the code for these garage doors would take about 29 minutes but Kamkar improved it by taking out wait periods between trying generated codes, removing redundant transmissions, and optimization that allows transmission of overlapped codes (Greenberg, 2015). With all of the optimizations that Kamkar has put into his code, he reduced the time of using brute force to crack the individual codes from 29 minutes down to 8 seconds (Kamkar). Kamkar says you need to be an expert in RF signals and microcontrollers to be able to fix the code that he has posted on GitHub and use it. Using brute force to crack a code usually takes a very long time to do because the algorithm tries every possible combination to find the right code. I think it is quite the feat that Kamkar got the brute force algorithm down to only 8 seconds to find the code from the original 29 minutes.
Preventing the ability to become victim to this kind of attack would require the user to actually completely change out their garage door opener. Since the time of this discovery by Samy Kamkar, garage door opener manufacturers or designers should have made design decisions to implement greater security measures into their products. This is not an example of poor security design by garage door companies because these garage doors were out for a very long time before the ability to hack into them became present. It is and example of how fast technology is evolving and the need for greater security implementation grows with the technology. These vulnerable garage door openers were tested with this hack using two-character codes, maybe companies will adopt a secure code encryption with like SHA1 or something like that.
To conclude I would like to state that garage doors openers are just one of the many IOT devices in a person’s home today. This number of IOT devices in a user’s home is increasing day by day. More and more people are turning to the convenience of IOT devices. Security vulnerabilities are a common thing with home IOT devices and companies need to ramp up their testing of security. I think it is clear that the companies that allow these vulnerabilities to be present in their devices are going to lose more business and actually the whole business may go bankrupt as a result. I think if a company is going to build an IOT device for use in a person’s home that there should be security testing guidelines and a certification for the product they are building so the end user knows exactly what they can expect from a security standpoint of their product.
Works Cited
Greenberg, A. (2015, June 4). This Hacked Kids’ Toy Opens Garage Doors in Seconds. Retrieved from wired.com: https://www.wired.com/2015/06/hacked-kids-toy-opens-garage-doors-seconds/
Kamkar, S. (n.d.). Open Sesame. Retrieved from samy.pl: http://samy.pl/opensesame/
Author: John Rowan
I am a Senior Android Engineer and I love everything to do with computers. My specialty is Android programming but I actually love to code in any language specifically learning new things.Share this:
