Possibly the best answer for the public acceptance of Def Con, literally laying out the pathway of how vastly distributed insecure systems can be horrifically exploited because security standards weren't even a consideration. The arc from innocent fooling with your garage door to literally stealing any vehicle anywhere so long as you have cased it earlier is just a solid gradient from happy fun to full GTA superthief. Samy Kamkar did a wonderful job, not just as a sploiter, but as a presenter, this is top level Def Con.
This is a very interesting talk. It gives even a non nerd a great insight into how insecure our world has become. "Just because it's invisible, doesn't mean it's safe" is a very eye opening statement. You have given me a new respect for hackers. Samy is a terrific presenter.
i dont mean to be off topic but does any of you know a tool to get back into an instagram account?? I was dumb forgot the password. I appreciate any help you can give me.
@Patrick Collin thanks for your reply. I got to the site thru google and im waiting for the hacking stuff now. Takes a while so I will get back to you later with my results.
A safe way to lock/unlock a car is, instead of using a rolling key, use RSA with timestamp encryption. The car would send a public key to the key fob, and the key fob would respond with an encrypted and salted hash containing the encrypted pass plus the command. That would by encrypted via a timestamp as well, as part of the public key. The private key would be used to decrypt the (command + pass) hash, but would never be sent via radio. Edit: Just saw the final of the video, and you suggest the same. Nice!
Oh the days of FSK Modulated Bit Shift Keys were sweet..Could open Garage any Garage Door so easy.. Remote gates were easy as well..But my oh my how things have changed... Great Presentation... Thank You
I've been a Ham for over thirty five years and can remember driving around with my dad's car as a teenager with a CB and a 600 watt amplifier and activating bank alarms, opening electric gates and garage doors, and emptying the nightclubs by causing an ear piercing feedback to their sound systems.
True story. My neighbors think I'm a little strange. They locked their keys in their car two months ago. Was walking the dog and talked to them. I told them I can take any sauce pan, put a rock in it, scream loudly in the pan and put the lid on, it will unlock any car. Went inside the house, got the pan and did this. Their jaws hit the floor. They tried for hours after I left. Maybe I should tell them I recorded their keyfob with my LimeSDR previously just in case and my daughter hit the mouse button after I told her to wait for my signal.
that moment he opened the recorded garage door signal modulation waveform in audacity.... genius. Crystal clear! This is the core essence of hacking.... learning and understanding technologies, and use them in ways they weren't designed for.
For those who did not get the concept : there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .
This is a very interesting lecture with a wealth of information. It would have been awesome of you to leave links for everything you are talking about.
One thing I think would be cool to add in the section relating to MITM attacks would be the usage of a deathentication attack or a re-pair attack as its known in Bluetooth. This can help capture that wireless handshake as well as cause a device to connect to your false network.
@@masskiller9206 I would love to see someone transmitting that code with stupidly high transmitting power, just to open random garage doors in a city all at the same time. Just for the lols.
Haha, you've essentially described what motorcycle, moped and bicycle riders do in large cities through metaphors. I've had one motorcycle stolen and another severely damaged in the attempt. That's with tech that has nothing to do with this video.
@@sunyun4425 One of those extremely loud vibration alarms, active GPS, and a WHEEL LOCK is about your best bet and line of security. Other than that, the best security for your motorcycle is a highly reputable insurance company with exceptional theft protection.
TheBreakfastGod you are not wrong. My car has no keys or locks for that matter and starts with a screwdriver. That said, perhaps not so easy to gain access to when at speed on the road 🤣.
Interesting information. This shows that there is nothing quite like a hidden kill switch on your vehicle. Put the switch in line with power to the starter or ignition and make it hard to find easily. Hardware trumps software. The best place might be the power line to the fuel pump. The engine will crank and might start, until it shortly runs out of fuel.
RF are so easy to hack, some time ago spend a day researching them. I found 315 and 433 Mhz are reserved for home automatization and basic security use. I got a Chinese universal remote controller that supports IR and RF on 315 and 433 Mhz and with push of a button I was able to clone and resend the signals for most of the things I have at home like door bell, car unlock and lock smart light switches panic buttons and others. It takes just few seconds to record the signal. But for more detailed knowledge Samy's video is just perfect. It's saves you allot time. Thanks man.
@@DupczacyBawol Correct. But, Samy created the code to successfully capture the signal and do so as mentioned above. He obviously will not release the code due to malicious use. Look at his site/google for the article. RollJam by Samy Kamkar
there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
Interesting! I did something similar to reproduce the remote to an adjustable bed. Found out it used a CC2500. Now I can use my phone or Alexa to control the bed. :)
The problem with rolling codes... They all roll around back to the beginning. In a way, they are exactly as easy to crack as a stationary code of the same length. If you roll... 123, 234, 345, 456, 567... 901, 012, 123... Just broadcasting "123", every single time, you will eventually hit "123", after it rolls-around, as fast as if "901" was the ONLY code, and you had to step-up to "901". As for being a rolling "set" of fake randoms... That makes it even easier, because there are even MORE values that are "true", not "less", in that same range. It will accept "123" OR "567" OR "091", because any of those could be "possible" as your random "next" code that it has to accept as "true".
Rolling codes are very easy to catch, simply create a higher amplitude signal near there garage door and have a receiver where about they would activate it to open it. Sometimes they press it too soon anyway out of range, but as you said exactly repetition but rolling codes themselves are actually *breakable*. If you can capture numerous codes from opens and closes, you can actually use a deductive algorithm to reduce the time to what I calculate could be only a few days as there is no lockout. I call this attack deductive unrolling ;-) as you s aid, might be easier to kick there door in and get the keys. But, I don't like to give too many ideas publicly somewhat reluctant to even post this. Another thing, the rolling codes do have limits on older units so I believe it's usually 65k codes, newer one's have larger bit sequences. Now, WiFi enabled openers are gaining popularity and using pcap and simple wifi security flaws like one in Chamberlain (liftmaster) they leave ports open and you can pull the API cgi page which interfaces with the mobile app and it's easy enough for people like you and me. On car keys such as that on one of my older benz's, it actually uses IR for LoS functions like lowering windows and the IR portion may even have other functions. Again, I may delete this post as I'm a bit nervous over the possibilities and potential attention on this, and I was able to capture that with a learning IR remote and replay it. Worked once assuming I was near the transmitter unlock.
To view wider RF spectrum then use hand held spectrum analyser with small embedded display - they are about $100 up to few thousands dollars in price depending on capabilities. You may get basic hand help SA for $200 or so and view all frequencies say from 15 MHz up to few GHz in freq.
Brilliant!!! VERY Interesting!!! I sure hope the car manufactures whom you shared your discoveries, of the "vulnerabilities in security" offered you more than a handshake, and a thank you. I'm sure this discovery to you was only one of curiosity, and a hacker's delight, although with this information you sir, have helped progress technology as we know it.... not to mention saved alot of peoples cars from getting jacked!!! (LOL) I thank you. keep on hacking brother.
even scarier !!! with technological backdoors like this one can easily perform a terrorist attack or a murder, just take control of his car and slam him offroad or lets say in whitehouse ?! crazy, this guy is like Tony Stark of hacking, good job Samy, you are my new idol ! :)
Agreed. The last 5 minutes, roughly, were useless since we couldn't hear the questions and there weren't enough context clues to figure out what was being asked.
The part where talks about spoofing a ship's gps signal really made me think of the Key bridge incident. I'm not saying it was hacked, but the fact that it's possible is mind boggling.
Buncha cool stuff! google WebSDR if you aren't already familiar to get a taste for sniffing the airwaves. I prefer the one in the Netherlands, I get lost in it for hours sometimes
The scrolling code of clicker is not random but quasi random, meaning the series of passwords repeat after certain number of passwords had elapsed - for example the scrolling codes list repeat after 60 times of using different password codes. Professional thieves attach a receiver to your car without your knowledge to record all the rotating codes of your car and store it in their receiver then copy those codes into their transmitter to have complete control over your car - they use the same scrolling code of your car or garage. You will know that there is something attached to your car when the Bluetooth of your car keeps disconnecting and reconnecting or your mobile gets disrupted at times, then you need to inspect your car for some magnetically attached bug to your car from under your car. Use your camera phone with long stick to pass it all under your car and observe any attached bug. Once you find it present it to the police and have it investigated for finger prints, if any. When the police refuse to cooperate then you know they may have attached it to your car, or were instructed not to cooperate LOL
For time frame of 30:00 today ARM MCU have the capability of securing all communications by HW under supervisory mode, unless you are dealing with older technology then you will be at risk because todays ARM MCU have very strong security and strict supervisory mode preventing unauthorised users to intervene. Old technology did not have the ability to lock supervisory mode and allowed intruders to switch from User Mode to Supervisory Mode wirelessly or via WiFi or even if cable connected.
Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .
In the mid 70’s I had a Genie Alliance remote garage opener. I drove around my neighborhood on my bike with an Allen wrench and turned the adjustable ferrite coil (changing the frequency) and actually got someone’s garage to open.
All well said - how about some suggestions on how to protect yourself from key fob attacks? A simple one is to shield the key fob with a simple faraday cage, such as an aluminum foil, while at home or in the parking lot, if it comes to that.
I thoroughly enjoyed every minute of this video. Superb content, clear and concise. A lot of details all at once lol, but perfect. I hope they pay you well 😆!
I drive old trucks so I can actually repair myself. Lot less electronic and less sensors, the dealerships essentially run on replacing sensors, some service technicians even refer to the check engine light as "the dummy light." My neighbor had to bring his 2018 Ford F250 in to replace a traction control sensor and it ran him $900. With the oldies there is a Lot less to go wrong or haywire on me. I have destined to stick with the simpler, old but good vehicle models. I am mechanically inclined, but a noob when it comes to electronics.
@@dwellner502 nice! Another great feature is the older vehicles are made with much more metal and heavier frames. Thick steel, studf that wont crush like a tin can. Back when they were so concerned with MPG
A friend of mine was parked at Wal-Mart next to a Dodge Charger R/T and when he used his Fob to unlock his car he told me the Chargers doors unlocked. Darn! My favorite car and I wasn't there!
This is a fantastic video. Glad Samy is on the good side of the law. Do you know if auto manufactures are only fixing new car systems or do they also have some kind of hardware upgrade system to improve older cars?
in the old days my dad had a garage door opener that had a roller switch where you could just stand in front of whatever door hold down the button then roll the switch back and forth till it opened it took seconds
Wtf since when do xans help with anxiety that shit just blacks me out meaning I wake up in some unknown spot not knowing how I got there. Valium is the shit for anxiety combined with pregabalin
What's the indicator for a car to know that a code has been used before? Does it have a memory and logs history codes? Or go through a list of possible codes one by one in a random sequence? What if you've maxed out all the possible codes, does it start repeating codes?
You can purchase Dielectric decoders...I have been in the NDT industry for decades...this is how a plane can be remotely controlled when the pilots lose control...
To prevent the jam+replay hack, if the rolling code is just continuing for every keypress, locking the car should invalidate the previously recorded unlock code.
nope, wont work, the reciever misses some of the transmitted rolled codes and thus is out of sync and dous not know what rolledcode it missed in the series excpected codes (in a recieve only setup), to fix this you could use spectrum of possible rolled codes (with reset evry x try`s , but his increases accessibility of brute force.
The good thing about Spectrum Analysers (SA) is they are able to sense not only transmitters but also active receivers as well because of the internal MIXER/Oscillator circuit inside the bug receiver with condition that your SA must be close or near to the suspected bug. I highly recommend that you should use SA instead of the dongle you mentioned.
Possibly the best answer for the public acceptance of Def Con, literally laying out the pathway of how vastly distributed insecure systems can be horrifically exploited because security standards weren't even a consideration. The arc from innocent fooling with your garage door to literally stealing any vehicle anywhere so long as you have cased it earlier is just a solid gradient from happy fun to full GTA superthief. Samy Kamkar did a wonderful job, not just as a sploiter, but as a presenter, this is top level Def Con.
This is a very interesting talk. It gives even a non nerd a great insight into how insecure our world has become. "Just because it's invisible, doesn't mean it's safe" is a very eye opening statement. You have given me a new respect for hackers.
Samy is a terrific presenter.
Yeah he is one of the gang stalkers. That's why he teaches classes on this shit.
A waist of time
Wrong ail and or websight not mine?
Samy Kamkar one of the most brilliant people you'll ever hear !!! Samy is my HERO 😁
GM is the perfect example of listen when someone is speaking to you, and have the respect to, at least somewhat, hear it out.
So how would you defend against this sort of attack
@@foreverhidden0465 A medieval shield
Had my attention the entire time. That is even more impressive than your brute force 4 second average cracking time.
i dont mean to be off topic but does any of you know a tool to get back into an instagram account??
I was dumb forgot the password. I appreciate any help you can give me.
@Vicente Andrew instablaster =)
@Patrick Collin thanks for your reply. I got to the site thru google and im waiting for the hacking stuff now.
Takes a while so I will get back to you later with my results.
@Patrick Collin it did the trick and I actually got access to my account again. I am so happy!
Thank you so much, you saved my ass :D
@Vicente Andrew glad I could help xD
A safe way to lock/unlock a car is, instead of using a rolling key, use RSA with timestamp encryption. The car would send a public key to the key fob, and the key fob would respond with an encrypted and salted hash containing the encrypted pass plus the command. That would by encrypted via a timestamp as well, as part of the public key. The private key would be used to decrypt the (command + pass) hash, but would never be sent via radio.
Edit: Just saw the final of the video, and you suggest the same. Nice!
I feel like as long as the action remains electronic it will always be vulnerable. Hence: the killswitch.
@@j4k3z sure but this is WAAAY harder to hack than regular rolling codes.
Oh the days of FSK Modulated Bit Shift Keys were sweet..Could open Garage any Garage Door so easy.. Remote gates were easy as well..But my oh my how things have changed... Great Presentation... Thank You
I've been a Ham for over thirty five years and can remember driving around with my dad's car as a teenager with a CB and a 600 watt amplifier and activating bank alarms, opening electric gates and garage doors, and emptying the nightclubs by causing an ear piercing feedback to their sound systems.
lol
People in my area use to stop at a red light near a furniture store and turn on the touch lamps at night with their little 100-200 watt amps.
What an explicitive generator you are.
@@jerrygaber6150huh?
True story.
My neighbors think I'm a little strange. They locked their keys in their car two months ago. Was walking the dog and talked to them. I told them I can take any sauce pan, put a rock in it, scream loudly in the pan and put the lid on, it will unlock any car. Went inside the house, got the pan and did this. Their jaws hit the floor. They tried for hours after I left.
Maybe I should tell them I recorded their keyfob with my LimeSDR previously just in case and my daughter hit the mouse button after I told her to wait for my signal.
Just a question: Why do you have the car door codes for your neighbor's car?
@@ovencake523 Just in case...
Great lil story if it's true. Hehehehe
Priceless
Haha that is hilarious! Great thinking by playing a little joke with the sauce pan! I wonder if you ever told them what you really did!?
that moment he opened the recorded garage door signal modulation waveform in audacity.... genius. Crystal clear! This is the core essence of hacking.... learning and understanding technologies, and use them in ways they weren't designed for.
Chris Savage hi there seen your comment and thought you must know what your talking about I’ve got some questions on translating rf into binary
@@dandwrasan2342 Go ahead
For those who did not get the concept :
there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .
This is a very interesting lecture with a wealth of information. It would have been awesome of you to leave links for everything you are talking about.
This is so fascinating. I want to learn more
One thing I think would be cool to add in the section relating to MITM attacks would be the usage of a deathentication attack or a re-pair attack as its known in Bluetooth. This can help capture that wireless handshake as well as cause a device to connect to your false network.
maybe
I like how he is so excited but ham radio operators have been using this equipment for a while. Everything begins with the understanding of RF.
@@maxwellryanryan1839 zq
Am and FM to throw it off.
From half an hour to just eight seconds - This is insanely fast.
now you understand the power of Math ;)
Every garage door on the block opens in an 8-second span
@@masskiller9206 I would love to see someone transmitting that code with stupidly high transmitting power, just to open random garage doors in a city all at the same time. Just for the lols.
@@GODofTimewaste2 regular power, very high gain antenna lol
@John fine, _suburban area of a city_ . I bet there are devices that would react to this even in an urban center though.
Nice lecture, good overview of fun stuff to play with and the hardware/software starter tools.
I now remove my battery and all 4 wheels. It a pain but if they want my car they will have to really work for it. 🤣
They will just vandalise it and strip out anything of value. Does your alarm still work without the battery?
Haha, you've essentially described what motorcycle, moped and bicycle riders do in large cities through metaphors. I've had one motorcycle stolen and another severely damaged in the attempt. That's with tech that has nothing to do with this video.
Wheel lock
@@sunyun4425 One of those extremely loud vibration alarms, active GPS, and a WHEEL LOCK is about your best bet and line of security. Other than that, the best security for your motorcycle is a highly reputable insurance company with exceptional theft protection.
😂😭😭😭😭😭😭
I think this is one of the most interesting videos I've ever seen ! Thank you for all the great information and details 👌👏
Exciting and disturbing in roughly equal measure. I like classic cars all the more now!
lol I hear that one .
but classic cars are much easier to break into
TheBreakfastGod you are not wrong. My car has no keys or locks for that matter and starts with a screwdriver. That said, perhaps not so easy to gain access to when at speed on the road 🤣.
Yep oldies but goodies. Lot less to go haywire, lot less sensors. All this tech in vehicles has amounted to big bucks for the dealerships.
@@yams3954 yes they are, but if a person wants to steal something bad enough they will find a way usually.
Interesting information. This shows that there is nothing quite like a hidden kill switch on your vehicle. Put the switch in line with power to the starter or ignition and make it hard to find easily. Hardware trumps software. The best place might be the power line to the fuel pump. The engine will crank and might start, until it shortly runs out of fuel.
loved this presentation and how you displayed the slides too, very informative and kept it laughable and fun.
RF are so easy to hack, some time ago spend a day researching them. I found 315 and 433 Mhz are reserved for home automatization and basic security use. I got a Chinese universal remote controller that supports IR and RF on 315 and 433 Mhz and with push of a button I was able to clone and resend the signals for most of the things I have at home like door bell, car unlock and lock smart light switches panic buttons and others. It takes just few seconds to record the signal. But for more detailed knowledge Samy's video is just perfect. It's saves you allot time. Thanks man.
SS Suleyman is it so easy like you say to hack these signals ?
The wave the car key sends is encrypted
No, you are wrong regarding digital transmission.
Abdallah Shuaibu that’s true 👍🏻
I think I will 'record' the frequency for my car and keep that data just in case I loose my key.
funniest comment on here ...
good
It is not gonna work. Car key signals are encoded and encrypted using random numbers and algorithms like KeeLoq cipher.
@@DupczacyBawol Correct. But, Samy created the code to successfully capture the signal and do so as mentioned above. He obviously will not release the code due to malicious use. Look at his site/google for the article. RollJam by Samy Kamkar
there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N
Interesting! I did something similar to reproduce the remote to an adjustable bed. Found out it used a CC2500. Now I can use my phone or Alexa to control the bed. :)
Wow incredible you must use sure app!
Samy is still my hero!
My space
@@noson_ is your space
@@Cygnus0lor sorry I do not understand want you are writing me
whizhackz ofoz .com
Good for you kid, living villains are becoming heroes to ppl nowadays. Where the world has come into.
It would have been nice if you had repeated the unheard question. Fascinating video. I only drive old unfobbed vehicles lol
This is a brilliant lecture, natural teacher
Legends without cars are watching ❤❤
Wow, the De Bruijn sequence is amazing! I wonder if vehicle makes now perform validation or hash their pw's.
The problem with rolling codes... They all roll around back to the beginning. In a way, they are exactly as easy to crack as a stationary code of the same length.
If you roll... 123, 234, 345, 456, 567... 901, 012, 123...
Just broadcasting "123", every single time, you will eventually hit "123", after it rolls-around, as fast as if "901" was the ONLY code, and you had to step-up to "901".
As for being a rolling "set" of fake randoms... That makes it even easier, because there are even MORE values that are "true", not "less", in that same range. It will accept "123" OR "567" OR "091", because any of those could be "possible" as your random "next" code that it has to accept as "true".
Samy is likely also an authority on cease-and-desist notifications. Pretty certain he could safely ignore most if not all of those.
Rolling codes are very easy to catch, simply create a higher amplitude signal near there garage door and have a receiver where about they would activate it to open it. Sometimes they press it too soon anyway out of range, but as you said exactly repetition but rolling codes themselves are actually *breakable*. If you can capture numerous codes from opens and closes, you can actually use a deductive algorithm to reduce the time to what I calculate could be only a few days as there is no lockout. I call this attack deductive unrolling ;-) as you s aid, might be easier to kick there door in and get the keys. But, I don't like to give too many ideas publicly somewhat reluctant to even post this. Another thing, the rolling codes do have limits on older units so I believe it's usually 65k codes, newer one's have larger bit sequences. Now, WiFi enabled openers are gaining popularity and using pcap and simple wifi security flaws like one in Chamberlain (liftmaster) they leave ports open and you can pull the API cgi page which interfaces with the mobile app and it's easy enough for people like you and me. On car keys such as that on one of my older benz's, it actually uses IR for LoS functions like lowering windows and the IR portion may even have other functions. Again, I may delete this post as I'm a bit nervous over the possibilities and potential attention on this, and I was able to capture that with a learning IR remote and replay it. Worked once assuming I was near the transmitter unlock.
… near *THEIR* garage…
This was an excellent presentation, well explained! Thank you!
As soon as you started explaining that you were cutting the pauses between the signals I said to myself "we can use superpermutations here"
To view wider RF spectrum then use hand held spectrum analyser with small embedded display - they are about $100 up to few thousands dollars in price depending on capabilities. You may get basic hand help SA for $200 or so and view all frequencies say from 15 MHz up to few GHz in freq.
This dude make things soooo easy, he should make courses
Very good presentation :-) just one thing: please repeat the questions in the Q&A
When you find a video which already you hit like on it but you don't remember it, do you watch it again?
Brilliant!!! VERY Interesting!!!
I sure hope the car manufactures whom you shared your discoveries, of the "vulnerabilities in security" offered you more than a handshake, and a thank you. I'm sure this discovery to you was only one of curiosity, and a hacker's delight, although with this information you sir, have helped progress technology as we know it.... not to mention saved alot of peoples cars from getting jacked!!! (LOL) I thank you. keep on hacking brother.
even scarier !!! with technological backdoors like this one can easily perform a terrorist attack or a murder, just take control of his car and slam him offroad or lets say in whitehouse ?! crazy, this guy is like Tony Stark of hacking, good job Samy, you are my new idol ! :)
Very interesting. One thing I would suggest to improve the recordings is to repeat or summarise the questions before responding.
Agreed. The last 5 minutes, roughly, were useless since we couldn't hear the questions and there weren't enough context clues to figure out what was being asked.
Yup thought the same thing. Someone get that man a microphone, or as you say, just simply repeat the question for us.
The part where talks about spoofing a ship's gps signal really made me think of the Key bridge incident. I'm not saying it was hacked, but the fact that it's possible is mind boggling.
This talk is so damn interesting, loved it :D
This is just amazing ! I'll order a RTL-SDR right next month :) I'm sooo excited what i'll find...
Buncha cool stuff! google WebSDR if you aren't already familiar to get a taste for sniffing the airwaves. I prefer the one in the Netherlands, I get lost in it for hours sometimes
what did you find? :D
@@Wiresgalore That is the best imo.
Did you get one??
Well timed sip at 20:54. Confidence is exuding from this man here lol.
The scrolling code of clicker is not random but quasi random, meaning the series of passwords repeat after certain number of passwords had elapsed - for example the scrolling codes list repeat after 60 times of using different password codes. Professional thieves attach a receiver to your car without your knowledge to record all the rotating codes of your car and store it in their receiver then copy those codes into their transmitter to have complete control over your car - they use the same scrolling code of your car or garage. You will know that there is something attached to your car when the Bluetooth of your car keeps disconnecting and reconnecting or your mobile gets disrupted at times, then you need to inspect your car for some magnetically attached bug to your car from under your car. Use your camera phone with long stick to pass it all under your car and observe any attached bug. Once you find it present it to the police and have it investigated for finger prints, if any. When the police refuse to cooperate then you know they may have attached it to your car, or were instructed not to cooperate LOL
Fascinating. Great job on the presentation. Ten stars
With RTL-SDR you can do much much more, AIS, Weather satellites and more
I can not hear the questions coming from the audience.
Worth every minute😍😍 RF is a very interesting topic. Dude😍😍
For time frame of 30:00 today ARM MCU have the capability of securing all communications by HW under supervisory mode, unless you are dealing with older technology then you will be at risk because todays ARM MCU have very strong security and strict supervisory mode preventing unauthorised users to intervene. Old technology did not have the ability to lock supervisory mode and allowed intruders to switch from User Mode to Supervisory Mode wirelessly or via WiFi or even if cable connected.
Great talk Samy!
Couldn't agree more old sport
im glad your on our side
The more I listen to him the more interesting
I half expected him to say he was Kevin Hart at the end....
I just park on the street with my windows down now
No doubt.
Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .
Garage door openers haven't had DIP switches in a long time. All modern ones are rolling code.
In the mid 70’s I had a Genie Alliance remote garage opener. I drove around my neighborhood on my bike with an Allen wrench and turned the adjustable ferrite coil (changing the frequency) and actually got someone’s garage to open.
I just installed a new garage door opener and it has dip switches…
All well said - how about some suggestions on how to protect yourself from key fob attacks? A simple one is to shield the key fob with a simple faraday cage, such as an aluminum foil, while at home or in the parking lot, if it comes to that.
I thoroughly enjoyed every minute of this video. Superb content, clear and concise. A lot of details all at once lol, but perfect. I hope they pay you well 😆!
I drive old trucks so I can actually repair myself. Lot less electronic and less sensors, the dealerships essentially run on replacing sensors, some service technicians even refer to the check engine light as "the dummy light." My neighbor had to bring his 2018 Ford F250 in to replace a traction control sensor and it ran him $900. With the oldies there is a Lot less to go wrong or haywire on me. I have destined to stick with the simpler, old but good vehicle models. I am mechanically inclined, but a noob when it comes to electronics.
I’m in the same boat. I’ve decided to stick with buying old vehicles as well.
@@dwellner502 nice! Another great feature is the older vehicles are made with much more metal and heavier frames. Thick steel, studf that wont crush like a tin can. Back when they were so concerned with MPG
A friend of mine was parked at Wal-Mart next to a Dodge Charger R/T and when he used his Fob to unlock his car he told me the Chargers doors unlocked. Darn! My favorite car and I wasn't there!
This video is essentially opening gates for new hackers
extremely helpful ,full of interesting information. Thank you
Recently discovered Samy. Great stuff, Man! TY!
That was awesome. I learned 1 new thing so excited.
it was a nice presentation. I am little curious about the questions end of the presentation. bt thanks for the knowledge .
This is a fantastic video. Glad Samy is on the good side of the law. Do you know if auto manufactures are only fixing new car systems or do they also have some kind of hardware upgrade system to improve older cars?
no but can instal
I definitely need to hear about this bc it's been a problem with this in my on life ... thank you so much for this
What would you use to find out if somebody is chipped a frequency detector or a emf detector??
wow this gets intense quick. Around the 20 minute mark I already need to pause frequently. If this stuff is my college final I have no chance lol
Nice to meet you, Samy. I promise to not use this information for evil deeds.
I have no idea what is he talking about, yet i watched almost whole presentation.
Me to 🤯
lmao good opener "we all love nic cage right"
Researching ways to avoid having to call a locksmith. I almost want to loose my car keys now.
I want to see a video covering Bluetooth exploitation using mobile devices
Yeah that's where I thought this talk was going based in the title.
in the old days my dad had a garage door opener that had a roller switch where you could just stand in front of whatever door hold down the button then roll the switch back and forth till it opened it took seconds
Absolutely brilliant lecture!
Glad he's one of the good guys!
but now anyone can do this...
I only had an inkling this was going on. Thanks for sharing.
After 9 years of my graduation, I came to know why this subject was in Computer Science and Engineering in India.
I can't believe this was seven years ago and the only thing that's changed is that some systems are using rolling codes now
Wat about remote neural monitoring can you detect that at ulf ultra low frequency from 0mhz to 70mhz
Im high on mushrooms right now and please someone for the love of crist get that man a xanax so i can stop feeling his anxiety
Wtf since when do xans help with anxiety that shit just blacks me out meaning I wake up in some unknown spot not knowing how I got there. Valium is the shit for anxiety combined with pregabalin
Thank you, Samy!!! For the info...
oh man....this is scary as hell for a TI....
This was great presentation
What's the indicator for a car to know that a code has been used before? Does it have a memory and logs history codes? Or go through a list of possible codes one by one in a random sequence? What if you've maxed out all the possible codes, does it start repeating codes?
You can purchase Dielectric decoders...I have been in the NDT industry for decades...this is how a plane can be remotely controlled when the pilots lose control...
To prevent the jam+replay hack, if the rolling code is just continuing for every keypress, locking the car should invalidate the previously recorded unlock code.
nope, wont work, the reciever misses some of the transmitted rolled codes and thus is out of sync and dous not know what rolledcode it missed in the series excpected codes (in a recieve only setup), to fix this you could use spectrum of possible rolled codes (with reset evry x try`s , but his increases accessibility of brute force.
The good thing about Spectrum Analysers (SA) is they are able to sense not only transmitters but also active receivers as well because of the internal MIXER/Oscillator circuit inside the bug receiver with condition that your SA must be close or near to the suspected bug. I highly recommend that you should use SA instead of the dongle you mentioned.
seeing this guy fumble with the Mac OS interface made me cackle
This was so fun to watch! Thanks
Samy i really like this video but it’s 4 years old have you got an up date?
LOL. You try to bruteforce a garage of your interest, the other 20 garages open too. Nice video.
What's the exact model of the CC1101 thingy? Can anyone tell me.
Those Airplanes circling around are Spraying Heavy Metals and other things into the Sky . Lookup
Why would they do that lol
Factories already do a very good job at that.
Time well spent!
Great presentation, Samy.
So if you take someone's key fob and press unlock 1000 times while it is out of range of the receiver, that key fob would stop working forever?
awesome presentation brother