FWIW, this sounds like a hook around building a business for "next-gen" garage door openers. Security, quality of build, and convenience are among the factors that could be pitched to early adopters. Heck, this even feels like something that the right small team could work into a really sharp Kickstarter pitch, if so inclined.
One tricky problem is that garage door openers tend to "just work" for a long time. Over and above cost, upgrading is a much larger installation hassle, far larger IMO than e.g. Nest thermostats had to overcome. All of that will limit adoption rates, even for willing early adopters. A retrofit angle would help, akin to the retrofit-smart-deadbolt market.
An "interesting" sales objection would be this tech not working with cars that have built-in recording garage door remotes (vaguely similar to home theater smart remotes, for those unfamiliar).
Not that there isn't a market of people who do want for security in their remote, or would but don't yet know it...
Still, I agree with the premise that it's about assumptions, and if people can be made to realize that their garage door openers are inherently pretty insecure, and feel that that presents a substantial, then there's a market there. But until it becomes a problem that's common enough for media outlets to scare people about it, there probably isn't a large market yet.
(Any marketing plan for an endeavor like that should have a PR budget from day one, since that's exactly how such stories tend to become news segments.)
But the door frame/deadbolt is still more secure than the remote controlled garage door because abusing the former mode of entry is more likely to draw concern from passers by and leaves a permanent record of your passage.
But another way of looking at it, and one I suspect most non-technical people would, is that it just takes one motivated person of roughly-average strength to break a doorframe. It takes someone with fairly uncommon technical sophistication to make one of these devices.
Once someone mass-produces them and sells them in real volume that perception could flip, but right now I'm far more concerned about a flimsy doorframe–which leads to where I live and sleep–than I am about someone rigging up a way to open my garage door–which only gets them into a detached garage where insured stuff is kept. The odds of a break-in being by force (whether against a door frame or a window) are just vastly higher.
I was able to easily wire-up a replacement receiver to the opener unit that allowed me to update them them to rolling code systems that were more secure and would allow me to control both on one remote. I remember it being a bit clunky, in that I had to plug the receiver into a wall outlet and run a wire back to the opener unit (I think most newer homes put in outlets in the ceiling for the opener to plug into, but this one was directly wired into a ceiling box), but it wasn't very hard to install and was a lot better than having to replace the entire unit!
The cryptographically secure garage door opener is still susceptible to MITM if the MITM attack is being done purely by amplification of signal, right?
It's almost like the key needs a handshake with the car by some method that is not using radio frequency. I wonder what options that leaves open? So far, I have not thought of one that is convenient (at some point, it is easier to go back to using a physical key to open a physical lock after all).
1. I think there was a post about it here already but I couldn't find it.
The most obvious way to mitigate is to have the car require the key to send the first bit of the response at most N nanoseconds after the last bit of the challenge is sent over the air. Because of the speed of light this assures the key is within a certain distance of the car. Ideally you want to constrain this to ~2 meters since passive entry requires the driver to touch the door handle. This limit is not to be confused with remote keyless entry which should work up to ~100 meters as it requires the driver to actively press a button so, like garage door openers, this is not vulnerable to relay attacks. However power-constrained MCUs, especially in the key, have a hard time computing a strong cryptographic challenge within N nanoseconds with N low enough, hence the problem...
After my little foray into garage door openers I am currently looking into implementing relay attacks on the passive entry / passive go system of my car (2012 Audi). Fascinating stuff.
The cryptographic challenge makes it secure, the XORed one-time-pad allows for fast measurement of the round trip time.
Thanks for posting this.
Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.
And not every garage is your basic suburban-attached-to-a-house type. Some little more expensive flats have underground parking where the gate opens with garage opener and thous suckers don't even have windows, they are just metal gate.
With this you could gain access to the cars and with boosting the signal from the cars with the "keyless entry" you could easily swipe clean a lot of cars without the a trace.
>Probably not. Mainly because breaking a window or crowbarring a door is a lot less expensive and a lot faster.
It's also a lot more likely to attract attention of bystanders.
Another concern may be insurance. In my area of the world, insurance companies generally refuse to pay out for burglaries unless there is evidence of a break-in (a broken window, forced door or something like that). This would likely not be covered. If this kind of device became popular with thieves like the car keyless entry hacks have, I can see there being a demand for something like this.
Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it.
The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).
If those weren't OTP/mask ROM, reflashing them with a different firmware (maybe even a simple rolling code?) could be an interesting exercise...
I had tried Samy's exact attack to reduce the brute-forcing time but it did not work at the time because I tried it before I discovered the code had to be sent 4 times consecutively (5 times makes it more reliable due to RF interferences). So I am not surprised to see Genie absent from the list of models Samy found vulnerable.
But I should try to find out the longest period of time during which these 4 repetitions of the code need to be sent. Maybe it does not have to be perfectly consecutive, but it could be 4 codes received within an interval of 200 ms or 1000 ms. If so it might still be possible to build a modified De Bruijn sequence that repeats codes 4 times while being only 4 times longer.
By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online. These remotes are so easy to reverse engineer, so common (Genie is in the top 3 or top 4 most common openers), and so old (the protocol has existed since 1985), you would think there would be information about it online, but nope.
PS: I wonder if there could be commercial interest in cryptographically secure garage door openers? A $0.50 ARM Cortex-M0 MCU is all you need to implement a HOTP based on HMAC-SHA1. Then a simple learning/pairing system writing the key in EEPROM can even sustain the battery being removed from the remote. But there is probably no interest... which is why most remotes are insecure even the "rolling code" ones.
(Edited to clarify some tech details.)