Name: This Toy Can Open Any Garage
Uploaded: 2020-03-28T19:00:55.000Z
Duration: 12 min 47 s
Description: Thousands of YouTube videos with English-Chinese subtitles! Now you can learn to understand native speakers, expand your vocabulary, and improve your pronunciation...

Basic passive voice

The point of this video is to show how easy it is to re program a toy to open almost any radio frequency, garage, door or gate in seconds.

You know, the average person these days has about 200 different accounts that require passwords.

And, of course, 200 different passwords is far too much for anyone to remember.

So most of us use the same password across multiple sites, and that is just a terrible idea.

So you really need a password manager and last pass can do that for you can store all of your passwords in the one place, which means you never have to remember them again.

You don't have to have that anxiety about getting locked out of accounts.

You don't have to write them down or you don't have to reset them.

Last pass takes care of all of that hassle.

It has a great number of features, including unlimited numbers of passwords that you can store there also free sink across all of your devices.

And if there is a password breach, you get an alert.

Plus, last pass has multi factor authentication.

And as anyone who knows the Internet knows that is the best way to keep your account's secure.

You should use it on last past and all the other places where you possibly can recently last past teamed up with you, Beaky and Microsoft to support their multi factor authentication.

So to find out more about last pass, check out the link in the description.

And thanks again the last pass for sponsoring this video.

And now let's try to break into my garage.

No wonder you have so many if you treat them like this.

Okay, Well, do you want to see the signals that these produce?

Now, when you're dealing with garage garage, door remote, they're typically in what's known as an I S M.

Basically, they don't need to get really licensed to use those fans.

Anyone can use them within some power rating within the U.

And typically it's gonna be like 300 or 433 megahertz.

All right, so when I hit this button, look to the right.

I can tell just by looking at this is how it's actually a modulating the signal on out sending this is called amplitude Shift.

What's happening is, every time I'm holding on the button, multiple bits are getting sent on a single frequency and it has to do with the time that it's on or off, which means a one or a zero.

Let me ask the obvious question, which is like, How secure is my garage?

12345678 So it looks like you're garage used an eight bit code.

Here we have the dip switches, so obviously see Lo lo lo.

Lo lo long, Long, long, short, Short, Short.

It's not like there's any special message format or anything.

This is kind of the most really the most basic that you could make a transmitter.

Let's just see how long this this, uh, period of data is.

So this is about 32 milliseconds, 32 milliseconds to send a single code.

So if we did 32 milliseconds times the 256 possibilities, it would take 8000 milliseconds, eight seconds to open your garage.

Testing every possible variation of the coat now semi might be overstating how easy it would be to open the garage because presumably you can't send all the codes back to back.

Otherwise, how does the garage receiver know what constitutes one code?

So you probably have to leave a gap between codes.

Let's say we left a gap between codes that was roughly equal in length to the code itself.

Well, that doubles the time out to 16 seconds.

Okay, Still not great, but I guess that reveals the shortcomings of eight bit codes.

But a lot of garages these days air actually 12 bit.

So if you used a 12 bet code, that would give you 4000 and 96 different codes that you would have to try and again adding and gaps between each code that would take around 4.5 minutes.

But then Sammy found something interesting.

I had a data in the beginning and it's still worked.

So essentially, it's like saying, if your password for a B, C D and I just did x a VCD, but it's still opened.

Try putting even more information up front.

Yeah, but I still have the right password.

It's in there, but it's pretended with a bunch of junk, right?

So it seems like the receiver is using a shift register, which means it takes in each string of bits.

And instead of considering 18 bit string and then throwing it out, if it's wrong, it just throws out the first bit and then considers the next eight bits.

And this is pretty profound security implications.

I mean, not only does that mean we can throw out all the gaps between our codes that cover all the combinations, it actually means we can merge some of those combinations together because essentially, we can overlap the codes to make sure we have every combination in there.

A sequence like this is called a de Bruin sequence, and that reduces the number of bits you have to send dramatically.

For example, if we were to send all eight bit combinations, that's 256 different codes.

That would be 2000 and 48 bits altogether.

But the de Bruin sequence that covers all the different combinations could be a short as 263 bits.

That's a reduction of almost 90% which means instead of taking eight seconds to open, the garage would take less than one.

There are 4096 possible codes, which yields 49,152 bits.

You'd have to send if you wanted to try each code individually.

But the de Bruin sequence for 12 bits is only 4107 bits long, so that's just 8% of the total that you would have to send if you wanted to send each code individually and so that reduces the time down from about 4.5 minutes to 10 seconds.

So now we're really looking at the way that you could possibly brute force your way into any fixed code garage or gate using a device like the I Am knee.

But some hackers out there found that it actually has a pretty cool chip inside called the C C 11 10.

It's a micro controller with the transceiver, and the transceiver is really cool because it actually transmits and receives on a really wide range of frequencies down to around 200 megahertz, upto like 9 50 megahertz.

So you talked to a lot of things, including garages, cars, power meters, alarm systems.

All sorts of things are in those bands, and there's actually some contacts underneath the battery in the back, which allows you to flash the board, erase it and install your own software on this device so you can program in the de Bruin sequence and then use this device to play those bits at the frequency you wanna play and basically open any garage, door or gate you like.