SDR Sniffing Electric Gates

Most wireless OEM hardware traditionally use 433MHz OOK modules to exchange information. The encoding and encryption of this data stream is left as a task for the embedded software designer. In most cases, the system can be hacked using a replay attack where an RF packet is recorded and replayed to emulate a valid user. [Gilad Fride] hacked his parking gate using this technique but decided to go the extra mile of connecting it to the internet.

He used an RTL-SDR dongle and ook-decoder by [jimstudt] to sniff out the gate code and this code was tested using an Arduino. The final implementation was done around an Onion Omega which talks directly to the RF transmitter module using the fast-gpio binary. Internet connectivity was achieved using Onion Cloud API which is used to trigger the execution of code thereby sending the gate opening signal.

[Gilad Fride] uses the IFTTT Do button to provide a GUI and he demonstrates this in action using an iPhone in the video below. The project can be extended to open garage doors or turn off the lights of your room over the internet.

If you are looking to hack your home security system, look no further as SDRs have be used to communicate with wireless products effectively in the past. We are hoping manufacturers take a hint and start using better encryption. 

10 thoughts on “SDR Sniffing Electric Gates

  1. I’ve been meaning to try something like this to control my Hampton Bay ceiling fan in an automated way. I’m surprised that the SDR dongles have become so cheap now.

  2. Why use the SDR dongle at all? The 433mhz modules from China come in at less than a buck for and RX/TX pair. I have used these to tame and control a bunch of 433mhz wall outlets with existing RCSwitch library on a pro-mini. Just curious is there some level of encryption that needs the dongle or something?

    1. This is what I do, both on the transmit and receive side. They’re dirt cheap, and you can sniff out (and transmit) any 433 MHz signal with them pretty easily if you can read or toggle GPIO pins.

      But the reason to use the SDR dongle is when one is already on the shelf and you’re familiar with the toolchain. Or you’re not yet, and you want a good beginner project. Or…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s