Flipper Zero: Bruteforcing Linear Multicode Wireless Door Controls

The Flipper zero is capable of grabbing certain signals out of the air and replaying them with ease but what if you don't even need to grab the signal in the first place hello everyone what I have for you today is a demo on brute forcing linear multi-code series door controls using a flipper zero originally multicode was owned by Stanley Electronics but it was purchased by linear access after Stanley stopped selling garage door openers these controls were quite commonly used in commercial and residential applications barrier-free door operators Gates stuff like that the technology is now extremely dated but its use is ongoing to this day you can still purchase these products from linear and other door control suppliers these Wireless door control receivers are powered by 24 volts and they operate in the 300 MHz band generally sometimes 3 10 they use 10 dip switches to set the activation code here is is the dip switches on the receiver and the dip switches on a transmitter multicode units were made with this style of connector so that they could be mounted directly to a garage door opener's power terminal but they can be connected using just some Spade connect c s and multicore wire like I've done for this bench setup here the remotes for these receivers have pretty poor transmission range the fact that the receivers are generally mounted inside of a metal enclosure of some sort doesn't help either for example the aluminum cases used by automatic door openers they're pretty good at blocking the signal from reaching the receiver this is usually circumvented by drilling a small hole into the case so that the antenna is able to be pulled through and there's receiver is actually able to get the transmission on that note in my experience the antenna found on these multicode units is always black being able to remember what color antenna certain door control receivers use can be quite helpful and quickly determining what Brute Force protocol to use that's if the antenna is visible anyways so that aside let's discuss brute forcing these the reason this product can be brute forced is due to the use of the binary dip switches there are 10 switches and each switch only has two possible positions on or off meaning there are only 1,24 possible codes now 1,24 seems like a fairly large number but using the flipper to transmit every single one of those codes five times in a row will only take about 3 minutes and 50 seconds or so so we'll navigate to The Brute Force app and scroll down till we find the linear listings and as I said earlier there can be 310 or 300 MHz we're going to go with the 300 MHz as the 310 is a little bit rare now once you hit start it's going to move pretty fast through the sequences of numbers by the time you've noticed that the correct code has been received which can be realized in a number of voice the gate or door opening hearing the relay fire Etc the correct code could possibly be a few numbers back now the good thing is after hitting stop you can move backwards or forwards one combination at a time this lets you navigate through all the potentially correct codes and hit send until you locate the one that opened the door so we're going to hit resend nothing go back one resend back one resend back another one resend and there was the relay firing so we can go ahead and save and backing out and going to the saved sub gigahertz signals When selecting the emulate screen it will actually display the dip switch settings which is pretty handy because then you could purchase a compatible remote and program that to work as well so that's all I have for you today I hope this uh educated you at least a little bit in the process of brute forcing a receiver like this if you have any questions about the content of this video or have any requests for other flipper zero content please let me know in the comment section that's all I got thanks for watching

Channel: Nic M.

Views: 13,020

Keywords: Bruteforcing, Bruteforce, Flipper Zero, Flipper, Flipper Bruteforce, Hack the Planet, SubGhz, Sub-Ghz, Sub Ghz, Hacking, Wireless Controls, Door Controls

Id: 7jR0jANDq4Y

Length: 5min 10sec (310 seconds)

Published: Sat Jan 27 2024