Possibly the best answer for the public acceptance of Def Con, literally laying out the pathway of how vastly distributed insecure systems can be horrifically exploited because security standards weren't even a consideration. The arc from innocent fooling with your garage door to literally stealing any vehicle anywhere so long as you have cased it earlier is just a solid gradient from happy fun to full GTA superthief. Samy Kamkar did a wonderful job, not just as a sploiter, but as a presenter, this is top level Def Con.

This is a very interesting talk. It gives even a non nerd a great insight into how insecure our world has become. "Just because it's invisible, doesn't mean it's safe" is a very eye opening statement. You have given me a new respect for hackers. Samy is a terrific presenter.

@nobodyimportant7655

Жыл бұрын

Yeah he is one of the gang stalkers. That's why he teaches classes on this shit.

@pambrunner5716

Жыл бұрын

A waist of time

@pambrunner5716

Жыл бұрын

Wrong ail and or websight not mine?

@ITILII

Жыл бұрын

Samy Kamkar one of the most brilliant people you'll ever hear !!! Samy is my HERO 😁

Thanks to Samy, you can’t buy an IM-ME, now, for under $800. Believe me, I’ve been watching for one. My wife and I also go to antique malls, thrift stores, flea markets, etc, and I always look through the toys, hoping to find one of these. I haven’t seen a single one, in six years of looking. Thanks Samy! 😂

@russellm7530

Жыл бұрын

I just looked on ebay and there's a few for around two hundred dollars.

@aramic1989

Жыл бұрын

yeah man, i literally sold one like a week ago for 140 bucks....whats silly though is all you need is an arduino, a TI CC1110 sub-GHz RF chip and a few more things, some programming and you have your 200 IM-ME

@edschissel9109

Жыл бұрын

90 bucks through Walmart online

@omegadroidzero

5 ай бұрын

@@Willam_J You don't need a laptop to use a HackRF. Look up the portapack H2.

Sammy this video is so good man. Never heard such an interesting talk with such technical details and so much knowledge. Memes were on point too.you da man .

GM is the perfect example of listen when someone is speaking to you, and have the respect to, at least somewhat, hear it out.

@foreverhidden0465

2 жыл бұрын

So how would you defend against this sort of attack

@kipchickensout

21 күн бұрын

@@foreverhidden0465 A medieval shield

loved this presentation and how you displayed the slides too, very informative and kept it laughable and fun.

Nice lecture, good overview of fun stuff to play with and the hardware/software starter tools.

I think this is one of the most interesting videos I've ever seen ! Thank you for all the great information and details 👌👏

This was an excellent presentation, well explained! Thank you!

This is so fascinating. I want to learn more

This is a very interesting lecture with a wealth of information. It would have been awesome of you to leave links for everything you are talking about.

extremely helpful ,full of interesting information. Thank you

A safe way to lock/unlock a car is, instead of using a rolling key, use RSA with timestamp encryption. The car would send a public key to the key fob, and the key fob would respond with an encrypted and salted hash containing the encrypted pass plus the command. That would by encrypted via a timestamp as well, as part of the public key. The private key would be used to decrypt the (command + pass) hash, but would never be sent via radio. Edit: Just saw the final of the video, and you suggest the same. Nice!

@j4k3z

2 жыл бұрын

I feel like as long as the action remains electronic it will always be vulnerable. Hence: the killswitch.

@TheCinderDude

Жыл бұрын

@@j4k3z sure but this is WAAAY harder to hack than regular rolling codes.

Oh the days of FSK Modulated Bit Shift Keys were sweet..Could open Garage any Garage Door so easy.. Remote gates were easy as well..But my oh my how things have changed... Great Presentation... Thank You

Absolutely brilliant lecture!

True story. My neighbors think I'm a little strange. They locked their keys in their car two months ago. Was walking the dog and talked to them. I told them I can take any sauce pan, put a rock in it, scream loudly in the pan and put the lid on, it will unlock any car. Went inside the house, got the pan and did this. Their jaws hit the floor. They tried for hours after I left. Maybe I should tell them I recorded their keyfob with my LimeSDR previously just in case and my daughter hit the mouse button after I told her to wait for my signal.

@ovencake523

3 жыл бұрын

Just a question: Why do you have the car door codes for your neighbor's car?

@tanithrosenbaum

3 жыл бұрын

@@ovencake523 Just in case...

@irishmick1156

3 жыл бұрын

Great lil story if it's true. Hehehehe

@ruhnet

3 жыл бұрын

Priceless

@atmosrepair

3 жыл бұрын

Haha that is hilarious! Great thinking by playing a little joke with the sauce pan! I wonder if you ever told them what you really did!?

Had my attention the entire time. That is even more impressive than your brute force 4 second average cracking time.

@vicenteandrew4393

2 жыл бұрын

i dont mean to be off topic but does any of you know a tool to get back into an instagram account?? I was dumb forgot the password. I appreciate any help you can give me.

@patrickcollin2949

2 жыл бұрын

@Vicente Andrew instablaster =)

@vicenteandrew4393

2 жыл бұрын

@Patrick Collin thanks for your reply. I got to the site thru google and im waiting for the hacking stuff now. Takes a while so I will get back to you later with my results.

@vicenteandrew4393

2 жыл бұрын

@Patrick Collin it did the trick and I actually got access to my account again. I am so happy! Thank you so much, you saved my ass :D

@patrickcollin2949

2 жыл бұрын

@Vicente Andrew glad I could help xD

Recently discovered Samy. Great stuff, Man! TY!

This is a brilliant lecture, natural teacher

Fascinating. Great job on the presentation. Ten stars

This talk is so damn interesting, loved it :D

that moment he opened the recorded garage door signal modulation waveform in audacity.... genius. Crystal clear! This is the core essence of hacking.... learning and understanding technologies, and use them in ways they weren't designed for.

@dandwrasan2342

5 жыл бұрын

Chris Savage hi there seen your comment and thought you must know what your talking about I’ve got some questions on translating rf into binary

@SinanAkkoyun

4 жыл бұрын

@@dandwrasan2342 Go ahead

Worth every minute😍😍 RF is a very interesting topic. Dude😍😍

I've been a Ham for over thirty five years and can remember driving around with my dad's car as a teenager with a CB and a 600 watt amplifier and activating bank alarms, opening electric gates and garage doors, and emptying the nightclubs by causing an ear piercing feedback to their sound systems.

@bargans3949

4 жыл бұрын

lol

@billyjoejimbob75

4 жыл бұрын

People in my area use to stop at a red light near a furniture store and turn on the touch lamps at night with their little 100-200 watt amps.

@jerrygaber6150

2 жыл бұрын

What an explicitive generator you are.

@cvspvr

8 ай бұрын

​@@jerrygaber6150huh?

I like how he is so excited but ham radio operators have been using this equipment for a while. Everything begins with the understanding of RF.

@sonyamcneil9719

2 жыл бұрын

@@maxwellryanryan1839 zq

@myemail5457

2 жыл бұрын

Am and FM to throw it off.

One thing I think would be cool to add in the section relating to MITM attacks would be the usage of a deathentication attack or a re-pair attack as its known in Bluetooth. This can help capture that wireless handshake as well as cause a device to connect to your false network.

@allcopsarenogood

2 жыл бұрын

maybe

Great talk Samy!

@giannisimeridis

3 жыл бұрын

Couldn't agree more old sport

That was awesome. I learned 1 new thing so excited.

Interesting information. This shows that there is nothing quite like a hidden kill switch on your vehicle. Put the switch in line with power to the starter or ignition and make it hard to find easily. Hardware trumps software. The best place might be the power line to the fuel pump. The engine will crank and might start, until it shortly runs out of fuel.

For those who did not get the concept : there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N

I definitely need to hear about this bc it's been a problem with this in my on life ... thank you so much for this

I thoroughly enjoyed every minute of this video. Superb content, clear and concise. A lot of details all at once lol, but perfect. I hope they pay you well 😆!

This is just amazing ! I'll order a RTL-SDR right next month :) I'm sooo excited what i'll find...

@Wiresgalore

4 жыл бұрын

Buncha cool stuff! google WebSDR if you aren't already familiar to get a taste for sniffing the airwaves. I prefer the one in the Netherlands, I get lost in it for hours sometimes

@TheHellRay

4 жыл бұрын

what did you find? :D

@stein1885

3 жыл бұрын

@@Wiresgalore That is the best imo.

@mattmurphy7030

3 ай бұрын

Did you get one??

From half an hour to just eight seconds - This is insanely fast.

@mkcvx

7 жыл бұрын

now you understand the power of Math ;)

@masskiller9206

4 жыл бұрын

Every garage door on the block opens in an 8-second span

@GODofTimewaste2

4 жыл бұрын

@@masskiller9206 I would love to see someone transmitting that code with stupidly high transmitting power, just to open random garage doors in a city all at the same time. Just for the lols.

@masskiller9206

4 жыл бұрын

@@GODofTimewaste2 regular power, very high gain antenna lol

@GODofTimewaste2

3 жыл бұрын

@John fine, _suburban area of a city_ . I bet there are devices that would react to this even in an urban center though.

To view wider RF spectrum then use hand held spectrum analyser with small embedded display - they are about $100 up to few thousands dollars in price depending on capabilities. You may get basic hand help SA for $200 or so and view all frequencies say from 15 MHz up to few GHz in freq.

This is a fantastic video. Glad Samy is on the good side of the law. Do you know if auto manufactures are only fixing new car systems or do they also have some kind of hardware upgrade system to improve older cars?

I only had an inkling this was going on. Thanks for sharing.

Great presentation, Samy.

Brilliant!!! VERY Interesting!!! I sure hope the car manufactures whom you shared your discoveries, of the "vulnerabilities in security" offered you more than a handshake, and a thank you. I'm sure this discovery to you was only one of curiosity, and a hacker's delight, although with this information you sir, have helped progress technology as we know it.... not to mention saved alot of peoples cars from getting jacked!!! (LOL) I thank you. keep on hacking brother.

@MrBademy

5 жыл бұрын

even scarier !!! with technological backdoors like this one can easily perform a terrorist attack or a murder, just take control of his car and slam him offroad or lets say in whitehouse ?! crazy, this guy is like Tony Stark of hacking, good job Samy, you are my new idol ! :)

This was great presentation

For time frame of 30:00 today ARM MCU have the capability of securing all communications by HW under supervisory mode, unless you are dealing with older technology then you will be at risk because todays ARM MCU have very strong security and strict supervisory mode preventing unauthorised users to intervene. Old technology did not have the ability to lock supervisory mode and allowed intruders to switch from User Mode to Supervisory Mode wirelessly or via WiFi or even if cable connected.

thank you for this video!

Thank you, Samy!!! For the info...

I think I will 'record' the frequency for my car and keep that data just in case I loose my key.

@chewysplace3542

6 жыл бұрын

funniest comment on here ...

@fadyserhan9537

6 жыл бұрын

good

@DupczacyBawol

5 жыл бұрын

It is not gonna work. Car key signals are encoded and encrypted using random numbers and algorithms like KeeLoq cipher.

@aroberts269

5 жыл бұрын

@@DupczacyBawol Correct. But, Samy created the code to successfully capture the signal and do so as mentioned above. He obviously will not release the code due to malicious use. Look at his site/google for the article. RollJam by Samy Kamkar

@SecureYourHacks

5 жыл бұрын

there is a synchronization counter C which gets incremented each time you press the key (of transmitter). Same way the receiver also stores the most recent validated synchronization counter it has received (N). Now when ever you press the key and send the pseudo-random number to the transmitter the transmitter also takes the synchronization counter C from transmitter (and to update itself will overwrite N with C). Now receiver will also produce the Cth code (corresponding to C i mean) and match with the code send by transmitter. There is also rolling window of acceptance for rolling codes say 100 or 1000 or whatever (depending upon which system you using for your Garage or Car keys). Now also note that C-N

Interesting! I did something similar to reproduce the remote to an adjustable bed. Found out it used a CC2500. Now I can use my phone or Alexa to control the bed. :)

@publicmail2

5 жыл бұрын

Wow incredible you must use sure app!

Wow, the De Bruijn sequence is amazing! I wonder if vehicle makes now perform validation or hash their pw's.

im glad your on our side

Exciting and disturbing in roughly equal measure. I like classic cars all the more now!

@gazzacroy

4 жыл бұрын

lol I hear that one .

@yams3954

4 жыл бұрын

but classic cars are much easier to break into

@robinwells8879

4 жыл бұрын

TheBreakfastGod you are not wrong. My car has no keys or locks for that matter and starts with a screwdriver. That said, perhaps not so easy to gain access to when at speed on the road 🤣.

@atmosrepair

3 жыл бұрын

Yep oldies but goodies. Lot less to go haywire, lot less sensors. All this tech in vehicles has amounted to big bucks for the dealerships.

@atmosrepair

3 жыл бұрын

@@yams3954 yes they are, but if a person wants to steal something bad enough they will find a way usually.

What's the indicator for a car to know that a code has been used before? Does it have a memory and logs history codes? Or go through a list of possible codes one by one in a random sequence? What if you've maxed out all the possible codes, does it start repeating codes?

it was a nice presentation. I am little curious about the questions end of the presentation. bt thanks for the knowledge .

Samy is still my hero!

@noson_

5 жыл бұрын

My space

@Cygnus0lor

5 жыл бұрын

@@noson_ is your space

@noson_

5 жыл бұрын

@@Cygnus0lor sorry I do not understand want you are writing me

@Thekimfowler

4 жыл бұрын

whizhackz ofoz .com

@RogBearD

4 жыл бұрын

Good for you kid, living villains are becoming heroes to ppl nowadays. Where the world has come into.

Great presentation 👍

Hey Samy, do you know is it possible (in theory) to duplicate car remote key (it’s features) onto a different device with remote capabilities? - If using my own key, there is an option to duplicate it to other digital device with remote options.

What would you use to find out if somebody is chipped a frequency detector or a emf detector??

This was so fun to watch! Thanks

Time well spent!

As soon as you started explaining that you were cutting the pauses between the signals I said to myself "we can use superpermutations here"

this video was so informative thank you

The problem with rolling codes... They all roll around back to the beginning. In a way, they are exactly as easy to crack as a stationary code of the same length. If you roll... 123, 234, 345, 456, 567... 901, 012, 123... Just broadcasting "123", every single time, you will eventually hit "123", after it rolls-around, as fast as if "901" was the ONLY code, and you had to step-up to "901". As for being a rolling "set" of fake randoms... That makes it even easier, because there are even MORE values that are "true", not "less", in that same range. It will accept "123" OR "567" OR "091", because any of those could be "possible" as your random "next" code that it has to accept as "true".

Well timed sip at 20:54. Confidence is exuding from this man here lol.

awesome presentation brother

Rolling codes are very easy to catch, simply create a higher amplitude signal near there garage door and have a receiver where about they would activate it to open it. Sometimes they press it too soon anyway out of range, but as you said exactly repetition but rolling codes themselves are actually *breakable*. If you can capture numerous codes from opens and closes, you can actually use a deductive algorithm to reduce the time to what I calculate could be only a few days as there is no lockout. I call this attack deductive unrolling ;-) as you s aid, might be easier to kick there door in and get the keys. But, I don't like to give too many ideas publicly somewhat reluctant to even post this. Another thing, the rolling codes do have limits on older units so I believe it's usually 65k codes, newer one's have larger bit sequences. Now, WiFi enabled openers are gaining popularity and using pcap and simple wifi security flaws like one in Chamberlain (liftmaster) they leave ports open and you can pull the API cgi page which interfaces with the mobile app and it's easy enough for people like you and me. On car keys such as that on one of my older benz's, it actually uses IR for LoS functions like lowering windows and the IR portion may even have other functions. Again, I may delete this post as I'm a bit nervous over the possibilities and potential attention on this, and I was able to capture that with a learning IR remote and replay it. Worked once assuming I was near the transmitter unlock.

@BitSmythe

6 ай бұрын

… near *THEIR* garage…

RF are so easy to hack, some time ago spend a day researching them. I found 315 and 433 Mhz are reserved for home automatization and basic security use. I got a Chinese universal remote controller that supports IR and RF on 315 and 433 Mhz and with push of a button I was able to clone and resend the signals for most of the things I have at home like door bell, car unlock and lock smart light switches panic buttons and others. It takes just few seconds to record the signal. But for more detailed knowledge Samy's video is just perfect. It's saves you allot time. Thanks man.

@dandwrasan2342

6 жыл бұрын

SS Suleyman is it so easy like you say to hack these signals ?

@abdallahshuaibu2149

5 жыл бұрын

The wave the car key sends is encrypted

@DupczacyBawol

5 жыл бұрын

No, you are wrong regarding digital transmission.

@dandwrasan2342

5 жыл бұрын

Abdallah Shuaibu that’s true 👍🏻

The scrolling code of clicker is not random but quasi random, meaning the series of passwords repeat after certain number of passwords had elapsed - for example the scrolling codes list repeat after 60 times of using different password codes. Professional thieves attach a receiver to your car without your knowledge to record all the rotating codes of your car and store it in their receiver then copy those codes into their transmitter to have complete control over your car - they use the same scrolling code of your car or garage. You will know that there is something attached to your car when the Bluetooth of your car keeps disconnecting and reconnecting or your mobile gets disrupted at times, then you need to inspect your car for some magnetically attached bug to your car from under your car. Use your camera phone with long stick to pass it all under your car and observe any attached bug. Once you find it present it to the police and have it investigated for finger prints, if any. When the police refuse to cooperate then you know they may have attached it to your car, or were instructed not to cooperate LOL

Wat about remote neural monitoring can you detect that at ulf ultra low frequency from 0mhz to 70mhz

@8:30 .....isn't that what they do when they climb for altitude?

So if you take someone's key fob and press unlock 1000 times while it is out of range of the receiver, that key fob would stop working forever?

All well said - how about some suggestions on how to protect yourself from key fob attacks? A simple one is to shield the key fob with a simple faraday cage, such as an aluminum foil, while at home or in the parking lot, if it comes to that.

Great vid man! Thanks bro! Any spare kit would be awesome!

The more I listen to him the more interesting

I now remove my battery and all 4 wheels. It a pain but if they want my car they will have to really work for it. 🤣

@RWBHere

4 жыл бұрын

They will just vandalise it and strip out anything of value. Does your alarm still work without the battery?

@omegachaos32

3 жыл бұрын

Haha, you've essentially described what motorcycle, moped and bicycle riders do in large cities through metaphors. I've had one motorcycle stolen and another severely damaged in the attempt. That's with tech that has nothing to do with this video.

@sunyun4425

3 жыл бұрын

Wheel lock

@codywhitlock8793

3 жыл бұрын

@@sunyun4425 One of those extremely loud vibration alarms, active GPS, and a WHEEL LOCK is about your best bet and line of security. Other than that, the best security for your motorcycle is a highly reputable insurance company with exceptional theft protection.

@Max-ji4im

2 жыл бұрын

😂😭😭😭😭😭😭

With RTL-SDR you can do much much more, AIS, Weather satellites and more

Glad he's one of the good guys!

@paulmilsom1092

4 жыл бұрын

but now anyone can do this...

lmao good opener "we all love nic cage right"

Does this video talk about hackers listening in on your car convos??

To prevent the jam+replay hack, if the rolling code is just continuing for every keypress, locking the car should invalidate the previously recorded unlock code.

@blauwzakjecrack

4 жыл бұрын

nope, wont work, the reciever misses some of the transmitted rolled codes and thus is out of sync and dous not know what rolledcode it missed in the series excpected codes (in a recieve only setup), to fix this you could use spectrum of possible rolled codes (with reset evry x try`s , but his increases accessibility of brute force.

Very interesting. One thing I would suggest to improve the recordings is to repeat or summarise the questions before responding.

@omegachaos32

3 жыл бұрын

Agreed. The last 5 minutes, roughly, were useless since we couldn't hear the questions and there weren't enough context clues to figure out what was being asked.

@atmosrepair

3 жыл бұрын

Yup thought the same thing. Someone get that man a microphone, or as you say, just simply repeat the question for us.

Wow! Thanks for doing this. Are you saying that we don't need to use an expensive spectrum analyzers to find signals? Signet Intelligence has that capability. Id like to find out who is bombarding v2k technology to my head. Noticed sonar rays hitting my head while wearing a tight head wrap. Can hear a tracking sound.

i like samys style to make us understand all this bs.....thanks man

Thanks Samy.

in the old days my dad had a garage door opener that had a roller switch where you could just stand in front of whatever door hold down the button then roll the switch back and forth till it opened it took seconds

I can not hear the questions coming from the audience.

Awesome content

Very good presentation :-) just one thing: please repeat the questions in the Q&A

what if remote just send a password+ current datetime and its encrypted into jwt for example and receiver decrypt this data and reading the password and checks id the date\time he got is not expired? I believe this solution should work, so if a hacked will replay the signal then car will not be unlocked because the date\time passed in the signal already expired, what do u think?

Really good one, thanks.

Great vid and a highly intelligent man

samy is my hero!

How would it work if there are 2 keys? Does that mean they aren’t using riling code? I have a 2011 car with 2 keys.

very interesting and existing presentation :-)

45:50 “does Chrysler also have...” best part of video :) dyed laughing

When you find a video which already you hit like on it but you don't remember it, do you watch it again?

Is there anything to detect the frequency of high speed lead?

Great Job !!! Love it !

Revert back to key only. Could cc TV recordings be compromise by external player's . What's safe !

I am trying to setup RTL-SDR and one of the challenges seem to be an antennae that scans all GPS frequencies. Does anyone know how to contact Sammy? My understanding is there are 5 frequencies, and I wonder if I can do this with two antennae.

This dude make things soooo easy, he should make courses

Samy i really like this video but it’s 4 years old have you got an up date?

The part where talks about spoofing a ship's gps signal really made me think of the Key bridge incident. I'm not saying it was hacked, but the fact that it's possible is mind boggling.

some one just hacked my key fob yesterday and remote started my vehicle. 2 hours later they also unlocked the doors while i was inside a restaurant. How do I protect against this?