After the fairly successful ZACon badges I did in 2014, the BSides team in Cape Town (where I now live) asked if I’d like to be involved in building another one. Naturally my response was abso-fscking-lutely not. However with a combination of alcohol, begging and offers of whatever we wanted ( mostly from our marvelous sugar pony ) they did manage convince Mike Davis (@ElasticNinja) and myself to do them for 2016. So we set off with a couple of cynical attitudes and some fantastic hangovers to start some brand new badges.
This is a much longer post than normal and one I’ve split into two separate parts, a brief coverage of the hardware and then a longer explanation of the software. If you are just interested in the code, you can head over to https://github.com/AndrewMohawk/BSidesBadge2016
Recently, I’ve seen a number of posts on Facebook groups for South African communities about people having their car remotes jammed and the contents of their cars cleaned out while they are at petrol stations, malls and other public areas. It seems to be on the rise as an easy way for criminals to gain access to vehicles usually to look for high resale items such as laptops, cameras, wallets and purses. This is just a post on building a really simple, not start of the art way to determine if someone is constantly transmitting (jamming) on the frequency cars commonly use for their remotes.
Car jamming works on a very simple process that you simply block the “lock” signal being sent to your vehicle. People often will walk away from their car and press the lock button assuming it will just work without physically confirming this. Essentially when you press the button on your remote your remote sends out a signal that when your car decodes it and verifies it as from your remote will perform an action. Most remotes for cars (and gates/other consumer devices) work at 433mhz. What a criminal will do is simply hold down the button on another remote (such as a gate remote) and this will stop your car from being able to properly receive that signal. An easy way to think of this is that your remote is shouting out a series of numbers that your car can understand. But when another person also presses their remote its like two people shouting at the same time and the car cannot properly hear the series of numbers.
There are a number of ‘detectors’ available but the prices range from about R500 to over a few thousand! Generally these simply determine if there is a signal being transmitted for an extended period of time, and if there is it will sound an audio or visual (usually LEDs) alarm.
Having worked with 433mhz transmitters and receiver pairs for some of the research I did previously on bypassing car remotes as well as building the zacon badges I thought I would give it a go to build a very cheap passive ‘detector’. I put detector in quotes because it still needs a person to visually see the alert!
Essentially you can buy a very cheap 433mhz receiver ( usually they are sold in pairs of receiver and transmitter ) for about $1-2 (~R20). The additionally components you would need are a 5v voltage regulator, a resistor and an LED. You can then wire up an LED to the data channels of the receiver and everytime there is any activity in the 433mhz (and 434) range the LED will come on. Thus if you are trying to determine if there is jamming around you will see the LED staying on.
The circuit is dead simple and shouldn’t take more than a few minutes to build (and should be easy enough to show your kids how to build it too!):
Here are a couple more pics of the device:
At some time in the next 6 billion years I will complete the writeup for the badges about how they were put together. For now this is just how to get your badge working at home as well as how to unlock all the challenges now that BSides Cape Town is over.
For those of you that missed it here is a picture of em and a potatocam video of it:
As some of you may have noticed (and people have asked), your badges are simply not doing anything once you take them home. This is a quick writeup on how to get your badge going again as well as how to unlock all the challenges and their addons (pong / wifi scanner / etc).
First off, if you want to find out about the badges for now you can go to http://badge.bsidescapetown.co.za:8000/badge/about/ this will describe the screens / options as well as explain the game:
In case you missed the small segment we did at the end of the conference, the badges won’t start up again unless they can connect to a wifi network. You have three options for how to configure this:
The badges are looking for a WiFi network with and SSID of “Highway” and a password of “dangerzone” ( note those are CaSeSeNsiTiVe. If you create this network and reset your badge (there is a reset button on the back), it will simply work.
The badges initially will try connect to the default WiFi network, if that fails they will try reading from the EEPROM (non volatile memory) and if that fails they will drop to a prompt asking the user for their SSID and Password. To view this simply install the CH430 driver so your machine picks up the device. Then you can connect to it at a baud rate of 74880 (this is the baud of the ESP8266’s debug channel).
Personally I’m just using the Arduino application since it was easier to have it connect at the baud rate. Using it you should see the following screens and be able to input your SSID and Password:
In this case I used the SSID “ExampleNetwork” and password “ExamplePassword”, it connected and saved it to the EEPROM, for now on I can just wait for this badge to fail and if that network is available I will be connected.
If you don’t want to wait for it to timeout or run the Highway SSID you can also change the following line in the firmware and then re-upload it via esptool or Arduino
I have updated the page at http://badge.bsidescapetown.co.za:8000/badge/addhash/ that near the bottom you can simply put in your badge number and it will output a series of correct hashes that you can use to unlock all the challenges for your badge.
Keep it punk.
First off let me just say a big thank you to the MWR guys who put this CTF together, usually I don’t partake in CTFs because the skillset required is usually out of my grasp (IANAP).
To have developed this CTF in a manner that allows people who do not work with crypto/hackz0r wizardry to still have a chance of solving the problems is awesome! I didn’t solve all of the problems, but I did spend far too much of my free time and apologise to the many bars I had to let down during that time. After this writeup I shall resume my social responsibilities ;)
Each of the various problems took my many hours of frustrating, wallpunching, facepalming and omgnoobing to complete, however I will just go over the solutions to each of them without the hours of frustration — the tl;dr of each one if you will.
Challenge 1 ( GUASS RIFLE ) — A book cipher requiring you to parse various words from lines in books
Challenge 2 ( RADIATION POISONING ) — An LSB Stego QR code that needed to be decoded and then parsed
Challenge 3 — Not completed
Challenge 4 ( FACSIMILE ) — A audio fax that needed to be decoded
Challenge 5 ( GREEN SKIN ) — A literal jigsaw puzzle representing 4 sides of a puzzle piece with 3 characters
Challenge 6 ( WHIRLPOOL ) — A multiple times rotated image that needed to be ‘unrotated’
Challenge 7 ( SCORCHED EARTH ) — An Office document with a weak password
Challenge 8 ( SMOG AND SMOKE ) — A Modified playfair cipher that needed to be recronstructed based on solar systems
Challenge 9 — Not completed
Challenge 10 — Not completed
If you have the writeup to challenges 3/9/10 please let me know so I can link to them!
All the challenges/instruction text and solutions are available on the following github: https://github.com/AndrewMohawk/HackFu2016
This blog post will discuss the implementation of Codegrabbing / RollJam, just one method of attacking AM/OOK systems that implement rolling codes (such as keeloq) — these systems are commonly found on modern vehicles and entry systems such as gates and garages. This technique has been used and spoken about for a number of years (Marko Wolf describes it in “Security Engineering for Vehicular IT Systems” from 2009).
However the advancement in easy to use and cheap hardware has made this a readily available research path for almost anyone. Samy Kamkar showed it at Defcon 2015, you can read about that and his device at http://www.wired.com/2015/08/hackers-tiny-device-unlocks-cars-opens-garages/. This blog entry will be more discussing the integral parts of how it works and how easy it is to do.
I was optimistic that the 2015 talk @elasticninja and myself did at zacon on this topic would be published so that I could lazily just link to the video instead of having to write it up, but alas, here we are! ;)
Naturally its important to have a spoiler before the long boring text. Here is a video carefully crafted by my friend Roelof Temmingh showing us opening a VW car with two YS1 (YardStick One):
Not the quickest of cats
on the best of days.