Software-defined radio (SDR): Relay Attacks - Revision history

NKirnbauer: NKirnbauer moved page SDR-RelayAttacks to Software-defined radio (SDR): Relay Attacks

2024-10-23T10:06:23Z

NKirnbauer moved page SDR-RelayAttacks to Software-defined radio (SDR): Relay Attacks

← Older revision	Revision as of 10:06, 23 October 2024
(No difference)

NKirnbauer: gendering

2024-10-03T06:55:04Z

gendering

← Older revision		Revision as of 06:55, 3 October 2024
Line 31:		Line 31:
	===Rolling Codes vs. Fixed Codes===		===Rolling Codes vs. Fixed Codes===

	Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.		Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, they need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

	=== Pentesting with PandwaRF ===		=== Pentesting with PandwaRF ===

Ikramer at 18:40, 12 March 2024

2024-03-12T18:40:49Z

← Older revision		Revision as of 18:40, 12 March 2024
Line 127:		Line 127:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Pentesting]]

AAmmann: /* Pentesting with HackRF One */

2022-07-14T09:10:50Z

Pentesting with HackRF One

← Older revision		Revision as of 09:10, 14 July 2022
Line 57:		Line 57:

	#Set up a laptop with native kali linux		#Set up a laptop with native kali linux
	#If you want dual boot on your local machine use these instructions		#If you want dual boot on your local machine use these instructions. With dual boot you will be able to use Windows and Kali Linux native simultaneously.

	* Dualboot on windows machine		* Dualboot on windows machine

AAmmann: /* Introduction */

2022-07-14T09:08:26Z

Introduction

← Older revision		Revision as of 09:08, 14 July 2022
Line 8:		Line 8:
	''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''		''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
	# The car is sending permanent wake up signals.		# The car is sending permanent wake up signals.
	# If a “keyless entry key” is in the ~~near of~~, an “Acknowledgement” is transmitted to the car.		# If a “keyless entry key” is near a car which has the keyless entry technology, an “Acknowledgement” will be transmitted to the car.
	# If the key and car fits together, an ID check ~~is going to start~~.		# If the key and car fits together, an ID check between the car and the key will begin.
	# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.		# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
	'''2. The car sends a LF signal with a car ID. '''		'''2. The car sends a LF signal with a car ID. '''
	# Periodically a LF signal is transmitted by the car.		# Periodically a LF signal is transmitted by the car.
	# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.		# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits to the car key code, the car is going to open.

	== Summary ==		== Summary ==

AAmmann: /* Pentesting with HackRF one */

2022-07-14T08:55:04Z

Pentesting with HackRF one

← Older revision		Revision as of 08:55, 14 July 2022
Line 52:		Line 52:
	Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.		Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

	=== Pentesting with HackRF ~~one~~ ===		=== Pentesting with HackRF One ===
			*Warning: The HackRF One will not be able to transmit on windows
	''' Step 1 '''		''' Step 1 '''

AAmmann: /* Pentesting with HackRF one */

2022-07-14T08:51:35Z

Pentesting with HackRF one

← Older revision		Revision as of 08:51, 14 July 2022
Line 68:		Line 68:

	''' Step 2 '''		''' Step 2 '''
	** Driver Installation on HackRF One		* Driver Installation on HackRF One
	#Download Zadig https://zadig.akeo.ie/		#Download Zadig https://zadig.akeo.ie/
	#Only compatible with Windows		#Only compatible with Windows

AAmmann: /* Description */

2022-07-14T08:50:18Z

Description

← Older revision		Revision as of 08:50, 14 July 2022
Line 28:		Line 28:

	== Description ==		== Description ==

			===Rolling Codes vs. Fixed Codes===

			Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

	=== Pentesting with PandwaRF ===		=== Pentesting with PandwaRF ===

AAmmann: /* Pentesting with PandwaRF */

2022-07-14T08:42:59Z

Pentesting with PandwaRF

← Older revision		Revision as of 08:42, 14 July 2022
Line 38:		Line 38:
	#Connect the PandwaRF via USB-C to your phone.		#Connect the PandwaRF via USB-C to your phone.
	#Open the application.		#Open the application.


	''' Step 2 '''		''' Step 2 '''

AAmmann: /* Pentesting with PandwaRF */

2022-07-14T08:42:03Z

Pentesting with PandwaRF

← Older revision		Revision as of 08:42, 14 July 2022
Line 45:		Line 45:
	#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.		#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
	#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.		#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
	#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.		#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

			Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

	=== Pentesting with HackRF one ===		=== Pentesting with HackRF one ===