Add to Watchlist

Uncovering vulnerabilities in Hoermann BiSecur


Citation of segment
Embed Code
Purchasing a DVD Cite video

Automated Media Analysis

Recognized Entities
Speech transcript
to that
and that it and uh and the
the the far-right let's get started then so we really do love our conveniences um in today's nowadays inserting a visibility interlock is just too much work I our lights have to can regulate themselves it's way too much effort you could hit the switch all the time um we forget this automation comes at a price and that prices are security and privacy and I spears day mothers men and Marcus and commissioned and I'm are gonna talk about a a device that actually had a lot of promise and was basically brought down by a very simple and implementation problems and um this actually can be demos we see the hardware here this is awesome we're going it would have a demo here everybody else is not made it to the stock is gonna are going to until regretted so give up for markers and markers FIL yeah thank you everybody for coming i'm still waiting for the flights OK it's awesome so minus mom skirmished editor with me and stages my colleague Marcus Miller and 2 other colleagues who have been involved with the project also here sitting over there and Chris include the Einstein in Boolean and altogether we from the security consulting company trust-risk so I which 1st start out
by giving you any idea who we actually are so as I mentioned we a security consulting companies so we focus on security consulting engineering and security research company was founded in 2012 but the security consulting work actually reaches back to 2005 and so today what we do is we do security audits we do security orders of Weber applications soft applications so this is pretty much with everybody else is doing as well but we have a strong focus also on embedded devices and with hardware security like that we can even go down to the microchip level the so just to give you an idea what we do in addition to that we do and better than security engineering and high-speed cryptography the 2nd flight this is the lab that
we have so we can really go down deep but even to the chip level with a focused ion beam workstation a scanning electron microscope to do this kind of work and typical work we do in the lab is like elation of against side-channel attacks all fold injection attacks and then we can even go to a microchip but doing fully invasive attacks and our general idea here is that if more sophisticated equipment in the lab and so we can make up the analysis time so we can do an analysis in a short amount of time there is a normal attacker who wouldn't have all these of tools has to become the more time to conduct attack the OK so now the question how in the
hell did we get to together stores right so as you might know many of the Garrett stores systems that are out in the fields that are really known to be insecure the insecure because they're mostly use static or very simple rolling cold schemes there's often no encryption at all and for this reason you can mount very easy replay attacks book going attacks so this is pretty much known and in contrast to that there is this uh there's the Herman be secure system so it uses their well known AES encryption algorithm is and high and secured the established system in the field and if you compare that to the classical systems that are really easy to break is a big security improvements and you have to answer the question how we actually got to this system is the tool of our security analysis now boasts a sitting here and they have the system at home the and sales so
they they're asking the question and is the system really secure so if the system implementation secure in practice thus the system really used the ASR algorithm and this algorithm used in a secure how is the key material generated how is it used and is the key material individual Morrison may be shared key material among different systems what do the messages look like on the RF interfaces and last but not least the question thus the system adhered to the chemical principle so if an attacker really knows exactly how the system operates and the only thing he doesn't have is the key material that the system should still be secure the this was the point where we decided to conduct a security audit
so how do you start a security audit on a system like this on a wireless system with all these hand transmitters and the receiver that's a becoming a garage the and so we started off with the hand transmitters so we already had a few of them we also obtain new ones and so what we have is we have different models we had different men effect bring dates so some of the although hand transmitters that we had already bought in 2015 whereas the newer ones were boarding 2017 and so in general we can say that our analysis then will also cover a broader range in terms of 2 different models and the manufacturing dates so to start out what we did is we
conducted an RF signal analysis from the system man well we already knew that the system operates somewhere in 868 make about strange so we used to softer defined radio when played graph in this case and our goals at this point but just to find out what is the exact frequency of the system operates then what is the modulation scheme that the system uses so transferred the the what is the channel coding and after we have found that all these questions hopefully undercoat RS frames so
if you have 1 of those systems and what can you do to find the frequency that tube radii pretty easy so you can just use the CMU radio tools you with all did that we perform the spectral analysis so we tuned also offer the framed front radio to this 868 merits with enough bandwidth so that you can really see a signal and then you just do a waterfall plot and what you will see
there is if you press on the hand transmitter you will see something like this but this is just a normal waterfall our diagram it shows the spectrum over time and here we can see that there's a signal and was sent the frequency of 868 . 3 3 0 megahertz so we have now already identified the frequency that's good the but what we also see is on the left and on the right side you can see those peaks so when the signal is transmitted it uses a actually tool frequencies and it switches between them and there's a very strong indication that frequency-shift keying is used so the idea of that is that if you have a 0 bits you transmit the bit of lower frequency and even have a 1 b to transmit the bill of a higher frequency a pretty simple the so we already know that at this came motivation was used but the next
that this and we want to know the channel coding so if we the mall late the signal and we have that the the bits the date of bits are still in a channel coding scheme and we need to find out which uh scheme is used and so what we did is we had a look at the signal and in the 1st step it was necessary but to get to the far to the right symbol right and the typical signal starts with a synchronizing block so this is just a very simple way form I was an alternating high and then and low signal all the time and allows the receiver to synchronize its symbol to the transmitter and we did just the same so it allowed us to synchronize on
the signal there's a picture of where can see that and so on the left side here you can see the synchronization block and after that the city the block and once again here we are in the time domain and here can also easily see that FSK Malaysian feels so we have this long periods and we have signals with the short periods so this is airforce came operation and if
you do a Google search for CNO radial FSK Malaysian and there's a lot of examples of the relating blocks and so but we have a look there what how the holder typical Malaysian scheme looks like and then we added a few more blocks the specific to our system and we once the blocks to our system so after all we wanted to analyze to be secure system so also the blocks have to be the secured specific and yet so we came up with this block and what we already cut the weight this initial synchronization block so that we just end up with that the more latent data bits and once we have those we can hopefully analyze them and find out what the channel coding it's yeah we
just did that we analyze the captured some find and in the rest of the what we could find in various there were always hours sequences of symbols but was always as 0 followed by 1 or 1 followed by 0 and this indicates that mentions the coding is used I have here a very simple picture from of the pedia so it actually takes tool symbols to transmit 1 bit of it and if you have for instance uh 1st as a symbol of 1 and then a symbol of 0 the the the biggest 1 and vice versa if you our 1st half a symbol of 0 and then a symbol of 1 and 2 data B. this is 0 so pretty easy the and at
that point it allowed us already to to try decoding there are afraid that are used in the system so we wrote a Python script we used CMU radio framework once again the on our assumption was all that to become the at the end of an hour a frame the has to be some kind of check some after all the receiver has to know all of the the receivers to know whether the transmission was correct so whether there were any heroes or not and it can determine that by of computing the checksum and and comparing it to the detect some in the packet yeah what we came up with this can be seen in this table so we noticed that we had like of 9 different hand transmitters at the end and we repress the different hand transmitters and we just have a look at what of a holiday horror frames look like and so at this point we could see that the phrase always started with you and all week 70 on oics 50 after that there was the serial number so it was a 4 bytes value that was individual pair transmit and it didn't change at all but transmitter after that there was the encrypted state the field so we knew that the system uses AES encryption and this there was this very large block that changed each time so obviously there has to be the encrypted data and we also assume about really weren't sure at that point of time that the last bite is probably around the check somewhere OK now so we have managed to decode the are afraid we have a pretty good assumption of what this signal looks like but still our main question is how does the system operates how how those the how best
encryption scheme work the and so on next step was to as a hobby analysis the we just opened up a transmitter the and here you can see designer pictures or it's just on I think it's from from 1 of those transmitter very pretty small and if you open that up you have to PCB you can find of different ships on their and you can also see that there are a lot of test sets and in fact the and the chip with too little sticker on it is a migrant from 4 find generally we have a look at the chips at the tube markings on we could find
out that there is uh transmit ICT in on the PCB there as 6 of 20 0 at 12 30 radio chip so there's a public beta sheet for that so we knew what kind of trip is however more
interestingly was the microcontroller after all the microcontroller contains the actual system implementation the so if we are able to analyze the from we will also find out precisely polis system works and whether it contains security what abilities and in our case we had a look at the micro controller and what we could see there is the microchip local so the logo of the manufacturer of microchip the and so we assumed that it is probably a pick my control but unfortunately the model type of the chips they exit uh microcontroller type was not written on the chip package is that there was a very long manufacturer cold the so you might notice that if you if you buy microcontrollers in large quantities sometimes you get your own markings and obviously we have something like this so we really didn't know what kind of controller we have we only knew that probably there's a PIC microcontroller the but what else did we know we knew that the chip has 28 patients the we knew that the chip is in that you offend package the we also knew that the chip is probably older than 3 years since the system has to be secure system has been on the market for a long time and so only recently microchip acquired at now so it could be possible that in the future might be at Mill chips that now have a microchip lowered it on them but in our case this cannot be the case and from the PCB we knew that ground this on pins 5 and 16 and as you saw in the picture before we saw all these tests pins and so we also assumed that the test points on the PCB probably also goal to the programming pins of the microcontroller the so to identified
a control of on the 1st thing we came up with is just doing a simple search at the component this triple toe so we searched for the manufacture microchips research for chips with 28 pence and ships that available in the queue event package the and the results only for of 4 different models so the pick 16 of 18 F 24 if 32 F is 0 at that point from those 4 candidates of series we started to look into the into the data sheets and as it turns out that pick 24 and peaks 32 is not only a pretty large microcontroller and ARM but it would also needs the ground and pin 24 and this is something that was not on our PCB so and we assume that the peak might a microcontroller must in fact be you're picked 16 or pick 18 F series the so what we do next is and to identify the programming paints so if you want to call the tool to program a big Michael control of you need so you need that the programming pins not and a P G D P G C and then a supply voltage so Didion grant and I also after picked 16 series and the peak 18 F series in this 28 pin package that after programming pins at the same location so it's easy and at that point you can just connect the and the picket 3 of program onto to the device so that's like a very low low-cost programming tool that everybody is using the program picked Michael so the
this is the picture of the PCB and now are you can also see in red erupt marked in red the the test points on the PCB and in the table on the right so we can see that in fact the programming pins have been connected to those test that's the yeah so we need a
little break bought a breakout board to connect the pig it programmer and um yeah we wanted to know what
Michael controller we're dealing with and the book tool and reported to us that in fact is a peak 18 F about 26 K 20 microcontroller OK so much for that but we also told us that we
already assumed that and that all the flash blocks unlocked so there called protection bits and we cannot just read the firm there the farmers locked down it cannot be read out what we also saw as to the problem at this point is not locked so we could just dump the prom at this point but unfortunately it doesn't contain the firmware
yes so we want to do a farm analysis because in the firmware IST entire system implementation and only by conducting a family analysis we will know how the system operates and whether the system is secure and yet from locked the logging pits on the on the PIC microcontroller typically implemented in the form of a security fuse but yeah we were in the situation that we could not bump the firmware on the issue of would be more or less that we cannot get the from out and so we would have to go back to security by obscurity we would have to trust the manufacturer that the system is really secure because we can have some different yeah
so what we did is we have how the security lapse so we have a lot of methods that we can apply to to even conduct a security audit in this case the 1st question was how is the security fuse logic implemented on the peak 18 F Michael control how does it look like what are we up against what do we need to get around to be able to extract the from and our approach in this case was to do when I see the cancelation so to open up the chip and then do a rough microscopic analysis so here are
some pictures the red at easy process so are you just the solo the chip and then all we follow a wet chemical encapsulation process and in the last picture you can see that the the chip has been opened up it would still be functional at that point but but we can we see we see that I know when the next step I
I'm here we use the chip and of we we had a look at it in in all microscope and
this is what we could see but this is a picture 18 F microcontroller it has a very large fresh area as from has and the Brown and on the sites on on the right side is the area where we suspect that the security fuses are we question why do we suspect
that there are the security fuses yeah I'm on today's microcontrollers it's often very easy to spot them because of those little metal shields old days there was no there was an attack where could just reset their security fuses by using UV light so you could you raise the security fuses with UV light and after that you could just dump the chip and I am as a countermeasure manufacturers came up with those little she's so it now you can use those little fused to spot the potential areas of 2 security fuses the OK so we knew on at this point what we are up against what we need to do and I we were sitting in the lap and exploring different options that we could do and um so the 1st
method that came to our mind is the chips already been but we could do an invasive 5th circuit at so we have a flip already and the approach would work uh in the following that we that we would have to identify the security fuels logic so we already know that the secured if are we would have to do to look a bit deeper into that to find out how the logic works and then we could bypass the security fused by using not by applying a 5th 2nd edit OK so that's a method are meant to be question was what would be the advantage of it and what would be the disadvantage that by that she is the odd if you can do it at home you have a high success rate disadvantages we didn't do an analysis of the peak have before so we didn't have a recipe at hand and so it would have taken us a long time to figure out how the security fuse logic works the yeah
so to give you an idea how hard it how that method would have worked this is our that machine and this is what you can
do with it so it's like a soul the ring irony for ChIP on this picture you see an example of another chip where did a fit target added in general the machine allows you to cut traces and also to to deposits new traces so in the case of to pick 18 F control of the could have just cut the output of rain laughter security fuse and then connected Edo to round and so we would have a fixed output and bypass diffuse yeah next option we
explored so we did a bit of more research and there is the well-known bunny attack so I told you before that now there's this countermeasure but a manufacturer puts those little metal shields in order to avoid UV light getting down to diffuse and um funny 1 and he he wanted to do this on a different type of picture uh controller and what he found out is that if you use the UV light at the very steep angle it can actually go below the yields bunch up again bunch down again at the field and on and so force and there will be enough UV light in order and to erase diffuse OK that's nice so the advantage of that would be object is already open and it's it's it's rather easy to conduct so we could just right this advantage is that some barney did that attack on on a different ship model so we'll really not new at this point we are not sure whether we had the same fuse type so there's not a fuse type is called an tie fuse and instead of getting clearer by UV light it's getting set by UV light the and and what you also have to do is you have to cover the flash memory for instance was a permanent marker of with a little electrical tape otherwise you will also erase the flash memory and so I'm at that point we were a bit more it's that we could then match the chip and and it was still unclear to us whether approach worked next thing is on the
cover today in a few talks is well that's so we have a voltage Klich amplifier where we can we can conduct pitch on a text but that very was very short pulses and high current so we could try to clench the chip in order to extract a from at find that would be it's easier to conduct disadvantages we have really no idea if this approach works I'm on the pick 18 F and we would have to find the pitch bar at the 1st yeah so these are the methods so far did we explored and to doing more
research we also found in the way so the easy way that really everybody with the technical knowledge can conduct at home I without all these fancy tools the so there is really a trivial design issue in the peak 18 F security fuse logic and a design issue is that the peak 18 F control it has of 5 memory blocks and each of those memory blocks has a seperate security upbeat so a seperate locking B and what it can do is you can erase a locking bit of 1 block therefore you will also erase the content of the block but the remaining blocks of granting will stay intact so you can just like Apple to a damp cold to this block and then by using this stump called Dunkeld will expect the remaining blocks that are still locked and this is in fact even being presented that the CCC at at 2073 in 2010 already by area can talk Heart of Darkness exploring down to about a quarter of the Tigers security yeah so
in order to do this and we implemented a very simple PickForm extraction tools so it was just a little brat board set up used FC DI boards so 1 of those you speak to serial converters and they wrote a bit of of of of software tools so that was just a small script so our set up then allowed us to directly talk uh with the PIC microcontroller programming pits so this
is what it looks like on this 18 F when you start out yeah 5 memory blocks so on the 1st block is to boot block after that you have to fiscal block it's a bit smaller because of decisive to boot block and after that you have the additional called blocks and all of them are locked right now
and so what you do is you remove the deadlock that for instance in this case here of the book block and therefore you all their race to boot block as mentioned the other and blocks remain intact
then we create a little dump cults we program it to the gold to the boot block
and once and the cheapest powered on our dump block will execute and it will just happily dump the remaining 4 called blocks and and after that we
will have a partial dump off the microcontroller even so it is locked however the only thing we don't have his book block because we go world it and the content obviously steerable complete lost OK so we do what do we do at that point how do we even get that yeah
it's easy just take another pick might of of all of with the same programming so start over again and repeat the process so this is what we did
but this time of course we have to erase another called block the and use the down cold again and now the
damn code can be used to also help down the build block the however keep in mind that the execution starts at the boot block so we don't know exactly on the way out at at what point in our block and would there is the destination from of from afar jump instruction so we don't know x exactly where execution jumps into all block and so what we can what you can do there is you just use a not flight the like from from buffer overflows see very well known there and at the end of 2 not slide you have yet on coat that if the only difference and after that time you have to
partial dumps of the peaks you combine those stamps then you have the the the full from a dump and then you can refresh goes to pick Michael controls again and uh they will have to original programming so at this
point we had extracted a amount and we could start doing a firm analysis so for this we used the well-known IDA Pro tool it's uh it supports a peak architecture and the and this way we analyze the firm to find out how the
system operates so the from analysis provided us with a very deep implementation insight so we could of we could confirm how the checksum is computed and that in fact the last byte is a checksum of we knew how they are as protocol works and we could also obtain and how the encryption methodology in the system rocks so to give you are not feel this
is the result of our analysis this is the cryptographic scheme and key generation that's used in the Herman the secure system show on the left you start out of with the serial number 2 serial number use individual hand transmitter and at the heart of some of the encryption algorithm you have AES 128 algorithm and around that there's a bit of magic happening which we believe is a countermeasure widening approach against side-channel attacks and on the left you have an a random seeds and stand trial blocked just generates a new random seed however on the right there is a static value that is shared among all the hundreds with us the random seed is used as a key and it outputs the long-term collocation key and subsequently this keys always used to encrypt and decrypt wireless frames so if we combine
that with what we discovered by doing the RF signal analysis is of yeah this is what we receive and we know the serial number
the serial number is transmitted in the clear so we have 2 inputs to this to this scheme the serial number input next thing is our we
also noticed that at value static values contained in the former and this shared among all the hand transmitters what we all them always of course hold encryption with the ESA written and it's hard to know how it works because it's implemented in the former and what we found out this
on the other we have the initial random seeds and of course the initial random seed has to be a hindrance transmitter unfortunately what we found out is that the very same initial random seat is used on all the hand transmit those are that we analyzed so in other words we had all necessary data to compute communication key from a serial number now how can we
detect this what abilities you have to do an attack you can for instance use of local self-defined radial such as the CCC radial with them or that of men and in a few minutes or the heck RF and in our case the up like you mentioned we use this this is the radial we were wizarding the CCC camp to thousands of 15 and it was available for Frida and as a conference batch so
what you do want to perform the attack is unduly quantity RF transmission from and the secure hand transmitter 1 time so only
to you you only need to do it 1 time and so you receive a wireless frame so by now you should know how the frame looks like and in the next step
to use the information that you have obtained from the from the analysis and from the RF frame but look like this so we really know everything I did we need and to compute the communication key this
is what we do in the next step we compute the communication key can be that the candidate is correct if we the group the encrypted packet and it has been known plaintext structure otherwise 3 even repeat the process why do we have to repeat the process at all have repeating the process is necessary if the user has to manually generated a new key so the system offers this functionality and if a user has done that maybe we have to repeat the process for 1 of 2 types and after that we
know the long-term communication key the 2 can crypt the arming cryptic message from the wireless frame we can increase the contains
count up so I'm just by 1 and then encrypt the message again with the long-term communication p and in the
last step we use the CCC radio for instance and to transmit the frames yeah and for that and we have prepared to life the more the hopefully work and I would ask that we do you guys to switch over to market so thank you far today's demonstration we build a little set up on this is actually the reign of a carriage open so this would be mounted on the ceiling of the carriage and it goes up and down this like over there down here is the operator which is 1 which has the built-in receiver further radio and we can actually operated with the remote so soon if you like and they the so said it was about OK to start with that I think we have business or
which listens for and the radio packets and they are so I have a remote that's not sent to the dollar so it won't open but we can see like it's coming so if any 1 of you has the receiver he could present now and we would see the packets yeah there's some uh so thanks for sharing your keys it's very nice so this come the Florida thought today to stop when we get the signal from the um and transmitter is the correct answer 0 number so as much as presses the button again that in the dollar opened and we get the detected we need for our calculations so this would be the packet and now we have a script that
calculates everything we need so appears to pick can't we get that as input for
our script Ahmad shows us the serial number and it calculates their communication key uh it degrades the packets on which we do not show because we agreed to not chose the structure of the context packet so it just showed the countermeasure the current countervalue that we increase it by 1 then we can and credits to pick it again with the key and we are frame it and put it into frame so it's all ready to be transmitted so with another script and we can transmit the packet was on the radio yeah so is this about the dead guy should open with data much as doing anything so let's see if that works
thank you and now we can again and start the business world and see what happens as much as
persist about love remote the yeah the
so we actually get the packet and it's exactly the same as we calculated and in addition to that the dog didn't move because it's just got the target and it doesn't like to be played at so at the counter has to be counted up 1 more time so as presses the but again the w again a the that's a good thing OK that's a demo and markets will continue with our impact assessment thank you thank you switch or once again yeah I think you OK so after we found out
of the the 1 ability we wanted to to an impact assessment as well so what we did is we we we did an observation and we we saw that the serial numbers of the of the of the same model hand transmitters that got bored at the same time we're close to each other so we made the assumption that there are sequential securing a few in numbers and by have a look at those he remembers Our assumption is that there are probably millions of devices in the fields but of course this is only our assumption how this serial number of scheme works and we're really not sure if dollar guess is correct next the question
is how can we fix the 1 ability yards actually rather easy method mentioned right now all the hand transmitters to share the very same initial random seed and solution the security fix is just that eats hand hand transmit the would need to have its own individual random seed value and since this random seed value is in this case no longer than shared between all hand transmit an attacker will also on longer and all the initial random seeds and he would need to start to uh like something like a brute force attack on this random seed yeah what did
we do when we found out the 1 ability and as it says here in case affordability disclose responsibly so we did this I'm way for the
responsible disclosure process at the beginning of October we involved Austrian national search team as a coordinator and reported to security 1 ability to them including our security advisory and including the suggested security fixed so that the manufacturer can fix the issue and at the end of the Cold War witchery received the confirmation from the National sir team that the manufacturer has received are the information and in fact he is also understood the security problems the after
that we had barriers e-mail and phone call exchanges with the manufacturer and at the end of the November bills of we that us and all that and I we presented the 1 ability once again and also the suggested security fix and in December we also received information from them that that that they have now implemented of security fix and they they are currently in the testing phase yes To conclude the talk and we presented a viable methodology that can be used if you want to analyze a wireless RF system our something like similar to this 1 that for instance all the users microcontrollers and of course we believe that if you are a manufacturer and an and you create something like like this so you want really want to have a secure system we believe that it's important to do independent security audits and so they can be really an essential tool to achieve a high level security and because then you know what you have to 6 all viewpoint and if for abilities can be found you can then fix them at an early point the at besides if it comes to heart on and how the security it's also pretty good if you have a hard security lap can't so as you saw you have a lot of methods that can be used so it's not that you have a system in front of you and you want to do a security audit and then you say OK and now I'm stuck I cannot reach the from I can add to or from a security audit and so if you have more options it's it's it's just easier now yeah and you also saw that we follow responsible disclosure process so in addition to following the process we also try to support the manufacturer our in in in understanding and also and fixing the ability the and last but not least we will also published as Security Advisory today after this talk we already have 1st see the ID and the cvss score and in this case the CV as a score is pretty high I meant we believe it is also significant other 1 ability OK so that
was for all talk on health I hope you enjoyed it and if you have any questions few have yet so here any questions we have 4 microphones as 1 2 3 and 4 line up behind those questions just to define what a question actually is is like 1 used wanted to sentences that actually ends with question mark is not your life story I am and with that and then go to the microphone 1 please the thing for sharing his inside you said that so the manufacturer has announced a fix for that does that mean customers are supposed to buy a new devices or will they be able to update them our have them we changed we really don't know what they have plants but which has received a feedback that there's a security fixed now so I think it will be really up to the manufacturer on hold the whole year how we will interact with the customers so the internet has a question for us and yes and the 1st question is 1 that could be a leader in your talk and regarding your reverse engineering work because as to end user noted that it looked pretty expensive from a monetary and timely point of view and you want to know who paid for it yeah this is this this work was actually done that's a fun project so most of the of the of the work that we do is paid work and typically it's under non-disclosure agreements so in this case I I couldn't stand here and and and and to a torque on that so this was just a fun work and it was not paid for so microphone 1 the great taller but how many of the a garish dog knows actually use some form of encryption is something exceptional forest is the standard I think we are it is you uh that that that the Harmon system since it uses A. s it's it's really an exception so the typical systems that we saw so a few other guys and all they all have God stores at home and of course we looked at them with a softer defined radio and yeah really to typically you can find like uh static messages there there's a steady cold you just to a replay attack and there's nothing the door goes up and so this is something that we really don't have here so I would really say that in general the majority of the systems is probably rather weak Michael onto so much the question is how the broke into the systems maybe you play out with the count of them so that you can look at the top dollar for ever may be lots of the continent to low when you are much higher yeah yeah infects on you can do that so and there is uh there's that this except counter well you and of course that the receiver in order to avoid replay attacks it has to move this discount window forwards and if you do that by performing and and attack you can move it uh forwards way too much and then you can place for like hundreds of times on the hand transmitter nothing will happen we had the right a right before the way we did a stage 2 your I pressed the hand transmitter and the 1st since the frame had been used already in the counter where you had been used already the luck so microphone 1 the rework the solid are misunderstand but so the fixed principle used to change these globally static initialization vector random see the first 1 from a static value to a herd device and thus the kind of per purchasing um fair how does that stop the targeted attacks where the attacker just listens for a specific individual and waits for that particular initialization vector the attacker would know is initially saved make the where where did you get uh where would you get this so that the initial random seeds so I mean if the the manufacturer would know the initial random seeding Casey and the the seed would be stored there then yeah maybe you can you can get to see there but if if if this see this is stored only in the hand transmitter then nobody would know the initial random seed so you would have to like tool of a from extraction on it and then you need it but since it then that would have physical access and there mn so if I was to purchase the product and maybe had backup key so to 2 transmitters and 1 of them went missing that sort of thing you know that they will they will have individual random uh random seed and not not the same 1 thank you from the Internet had a question and yes D and you want to know that however on if the seed this random uh does that mean that you can forgive stand new key hops into an existing systems since the receiver know the random seed I know you could you could a register then that would work out just fine I we didn't have a look at how the how the actual the pairing process works because it is only done 1 time but uh yeah in in in in general but regardless of the CD in there there has to be some kind of exchange there the key is paired to the uh to the receiver so that would be a problem microphone 1 M me the promise the not random seed if you get random seats you point out that the only thing that would be left to practice system was to brute force is 80 bit key any goes to the matter at hand home and how much time it would take to do so I'm the 80 bit is pretty long so or even now for instance we have fun we have an FPGA class to explore some of these questions and we did some some some some some similar algorithms on it and yeah so 80 bits would still takes at least a few months or so so we are at least in the Michael run 1 again I think you for work actually on the thing is when you Chairman than standards for all of them as the our transmitter and like I'm just we can't code that was carried code from the transmitter and then transferred and adjust them to replenish would work or just on the from throwing culture doesn't work the if there so if you want to press the button on use another valid frame and if this frame never reaches the receiver you could use this frame at a later point of time and open up the door thanks but 1 thing is when they're on like when the frame is induced by the new frame was sent with the old friend still be active or not in this case the frame would become in the late because you have uh a new account of value them and all colander when used before in the lead thanks so the internet and yes a rather popular question and you noted that there will be fixes and that the devices will be updated and and do the other devices updated automatically or do they do just of commonly you have to go to the Garrett stores and the updated automatically other characters connected to the Internet no I was so that that that needed the doors lauded transmitters are connected to the internet so we really don't know what the manufacturer has in mind here but they cannot be updated automatic Kelly online microphone 1 of their and are there any other findings in the cold that you have done for example a synchronization code or something like that updating firmware or something like that you know we do we just have a look at that the scheme that is used and since we we we already found disorder ability and in in in in this scheme how it is like uh how it is found on on the systems in the field we stopped at this point it thank you the the I and I think we don't have any more questions and less a Mies really really quick so I'm really glad that my garage does not have an automated system and go with that I would like you to help me in thanking markers and markers for this and has a target make this really can't be too few tests B was
that the the the and the it the the the the at


Formal Metadata

Title Uncovering vulnerabilities in Hoermann BiSecur
Subtitle An AES encrypted radio system
Title of Series 34th Chaos Communication Congress
Author Muellner, Markus
Kammerstetter, Markus
License CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
DOI 10.5446/34843
Publisher Chaos Computer Club e.V.
Release Date 2017
Language English

Content Metadata

Subject Area Information technology
Abstract Hoermann BiSecur is a bi-directional wireless access control system “for the convenient and secure operation of garage and entrance gate operators, door operators, lights […]” and smart home devices. The radio signal is AES-128 encrypted and the system is marketed to be “as secure as online banking”. In comparison to conventional and often trivial to break wireless access control systems, the system should thus make it practically infeasible to clone a genuine transmitter so that attackers can get unauthorized access. We used the low-cost CCC rad1o software defined radio (SDR) platform to intercept and analyze the wireless radio signal. We took apart several Hoermann BiSecur hand transmitters and subsequently utilized a vulnerability in the microcontroller to successfully extract the firmware. In order to conduct a security audit, the extracted firmware was disassembled and analyzed so that the encryption mechanism, the key material, the cryptographic operations as well as the RF interface could be reverse engineered. Our security analysis shows that the overall security design is sound, but the manufacturer failed to properly initialize the random seed of the transmitters. As a result, an attacker can intercept an arbitrary radio frame and trivially compute the utilized encryption key within less than a second. Once the key is known to the attacker, a genuine transmitter can be cloned with an SDR platform such as the CCC rad1o. In addition to unauthorized operation of gates and doors, there is a likely (although currently untested) impact on Smart Home appliances that use the BiSecur system. We tested a total of 7 hand transmitters from 3 different model series and with manufacturing dates between 2015 and 2017. All analyzed hand transmitters shared the same static random seed and were found to be vulnerable to our attack. The vulnerability can easily be fixed so that future hand transmitters and radio transmission are protected from our attack.
Keywords Security

Related Material

The following resource is accompanying material for the video
Video is cited by the following resource


AV-Portal 3.5.0 (cb7a58240982536f976b3fae0db2d7d34ae7e46b)


  615 ms - page object