Here’s another great reason to lock your doors, hide under some sheets, and never leave your home again. Samy Kamkar, already well known for cracking Master combination locks, has built a $32 wireless device that can intercept and steal the wireless codes used to open keyless car doors and garages.
At DefCon in Las Vegas, Kamkar revealed his RollJam device, hacked together from off-the-shelf components, that can defeat the rolling codes used in keyless entry systems for cars and garage doors. A wireless fob or remote that generates a new code every time a button is pressed is supposedly more secure than one that uses the same code every time, which can easily be compromised. But Kamkar has found a way around that.
The RollJam is designed to be used in the near vicinity of a targeted vehicle or home, but the device is so small it can be easily hidden while it autonomously does its thing. When a victim presses the door unlock button on their vehicle’s fob, it mysteriously won’t work on the first try, but it does on the second. And that’s because the RollJam uses a pair of radios to broadcast noise and temporarily block the signals from actually reaching the car, while a third radio captures and records the code. The same thing happens on the second button press, except the RollJam then sends the original code to the door to open it, while retaining the second fresh code which can be replayed from the device at any time.
This way the RollJam can be left running for hours, even days at a time, and when an attacker retrieves it they’ll always have a fresh code to open a door. It’s scary, but mostly because of how simple the device works. There’s no code cracking going on, no brute-force decryption, just a tiny bit of electronic deception.
The device has been tested with vehicles from Ford, Toyota, Volkswagen, Chrysler, Nissan, and Lotus, as well as popular after-market security systems from Cobra and Viper, and they’re all vulnerable to the attack. However, newer Cadillacs are not, because the codes generated by their fobs actually time out after a short while. It’s a more secure system, and one that Kamkar hopes that other manufacturers will adopt sooner rather than later now that he’s revealed just how unsecure older vehicles actually are.