![\"\"](\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/03\/0mattel-2.jpg\")
It is built from a discontinued Mattel toy, called the IM-ME. The IM-ME is a defunct toy and Mattel no longer produces it, but if you are lucky, you can find it on Amazon or eBay with prices varying from $12 to $100.<\/p>\n\n\n\n
How does this work:<\/h3>\n\n\n\n
The issue with fixed code is their limited keyspace. For example, a common garage uses an 8-12 bit code. They are binary and since the password that opens the garage is fixed, there are only 256 to 4096 possible combinations. We can see even the 2-character password is more secure than the 12-bit binary dip switches.<\/p>\n\n\n\n
Kamkar starts with a normal brute-force attack, and it took around 29 minutes. He says that normally a single click sends the same code 5 times. It takes 2ms to send each bit and also a 2ms wait period per bit after the entire code is sent. That is why to break the 12-bit code, we have to send a total of 98304 bits to produce every 12-bit code and wait period. This is not bad, but he felt that there was a need to reduce the time.<\/p>\n\n\n\n
First, he stops retransmitting each code. This of course significantly reduces the amount of time by 5 times. This is a great improvement, however, reducing the time can even be more effective if we can eliminate the waiting period between sent codes. In order to achieve that, the number of codes we send must be as few as possible. In the best scenario, we could send just only one code.<\/p>\n\n\n\n
He realizes that the \u201cfixed code\u201d garage uses a bit shift register to decode the received codes if it works or not. This is actually a weak link of the system since this makes the method above possible. By using a bit shift register method, when encountering an incorrect code, instead of clearing it, the garage will just shift out one bit and pull in one bit of the next code transmitted. Let\u2019s say our garage password is 1010 which is a 4-bit code. If we send a code \u201c11010\u201d, the garage will first test 1101 (incorrect). Then, it removes the first bit and pulls the next one bit which becomes 1010 (correct). That means, instead of sending 12 bits (to test two 4-bits codes and a 4-bits wait period), we just need to send 5 bits. Kamkar uses an algorithm called the De Bruijn sequence<\/em>. The method produces a single code that uses as few bits as possible and includes every possible combination of (in this case) 12-bits code. By using this method, he calculates that a total of bits to send are 4107 bits, only around 4 percents compare to the normal method (98304 bits).<\/p>\n\n\n\n <\/p>\n\n\n\n If one owns a house that is built in 1995 and before, they will most likely have a fixed code garage door opener and face a high risk of security.<\/p>\n\n\n\n Basically, this method only works with garages that use fixed code. To prevent this type of attack or any traditional brute-forcing attack, Kamkar suggests an upgrade to a system that uses rolling codes, hopping codes, etc\u2026\u00a0<\/p>\n\n\n\n https:\/\/samy.pl\/opensesame\/<\/a><\/p>\n\n\n\n https:\/\/hackaday.com\/2015\/06\/08\/hacking-the-im-me-to-open-garages\/<\/a><\/p>\n\n\n\n https:\/\/www.wired.com\/2015\/06\/hacked-kids-toy-opens-garage-doors-seconds\/<\/a><\/p>\n\n\n\n![\"\"](\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/03\/db-1024x735.png\")
How to prevent it:<\/h3>\n\n\n\n
References:<\/h3>\n\n\n\n