Hacking

Steal That Car in Sixty Seconds

Introduction

Cars are everywhere and they are being upgraded with new technology as often as any other device we use. Taking some inspiration from the movie Knight and Day, let's talk about how to communicate with the remote device used to open and start a newer car.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Car

While cars still use the normal manual keys, we are finding that increasingly people are using a smart key that will both open and start the car.

Car Remote, Picture 1

Car Remote Breakdown(Chip SMC918-4), Picture 2

Problem

For this problem, we will discuss how we can capture data delivered from a car remote, and use that to open a car. We can accomplish this using some inexpensive hardware.

Attack

1. Receive the Data

To attack, there is some hardware that serves to receive the signal, and software used to analyze the signal sent by the car remote. Here we are using DVB hardware with an Elonics chip E4000 and using application SDRsharp to see its spectrum.

DVB with chip Elonics E4000 , Picture 3

After we prepared the hardware and software set with SDRsharp installed, we found that the the datasheet located on a chip car remote is hard to find on the internet. As a workaround, I tried to find the signal that transmitted by remote to the car manually using the Spectrum.

SDRsharp spectrum (Push Lock Button) , Picture 4

Pictured above is a form of spectrum when I pressed the lock button on the car remote.

SDRsharp spectrum (Push Unlock Button) , Picture 5

Pictured above is the image of the spectrum when I pressed the unlock button on the car remote.

Both pictures above have a different spectrum. This is because when the lock button is pressed, the remote sends a signal at 415.098.612khz or 415.098612Mhz frequency, When the unlock button is pressed, the remote sends a signal at 415.094.805khz or 415.094805Mhz frequency. The raw data that is sent roughly as shown below.

Raw Data Transmit, Picture 6

Illustration Receive Data , Picture 7

1. Car remote sending data to unlock, lock, and etc

2. Car responding and following the orders from remote to unlock , lock , and etc.

3. DVB sniffs the data sent by the remote to the car.

Note: If anyone wants to try to decode the transmitted data can be downloaded its soundwave here:

[download]

2. Sending fake data (Idea)

After getting information data that is sent from the car remote, we had the idea to create a device that sends data. But our problem is that it is hard to find a chip with frequencies that is used by that remote.

Components or devices to generate the carrier signal with the frequency used by the remote (410-433 MHz) and documentation on how to encode / decode the data.

Illustration Sending Fake Data , Picture 7

1. Car remote sending data to unlock, lock, and etc

2. Car responding and follow the orders from remote to unlock , lock , and etc

3. DVB sniffs raw data sent by the remote to the car

4. DVB Sending fake data to car

5. Car responding and follow the orders from DVB to unlock , lock , and etc.

Conclusion

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

The conclusion from the above explanation is that communication data that is sent using the frequencies can be captured and translated using inexpensive hardware. Even if we have skill in the Microcontroller, we can design and duplicate the remote with ease.