Attacking Industrial Remote Controllers
summary
Researchers survey seven vendors, find radio controllers from cranes to drillers that lack crypto and enforceable rolling codes, and release 10 advisories after a six-month disclosure. Demos use BladeRF and Ettus SDRs, GNU Radio and URH, a CC1120 uncovered via SPI and a custom CC1120 + SPI emulation to extract packet formats and CRC behavior. Attacks include record-and-replay, replay-modified command injection that forges e-stop and pairing packets, firmware backdoor via UART reflash, and a 3G-bridged remote dongle for long-range abuse.
AI-written summary · about
chapters (9)
- 0:00Introduction and overview
- 3:35War driving and initial testing
- 8:58Record and replay attacks
- 14:37Reverse engineering radio protocols
- 25:37Payload structure and rolling codes
- 35:49Firmware reprogramming risks
- 40:02Long-range attack vectors
- 47:32Vendor responses and disclosure
- 51:25Q&A session
related talks
44m"Attacking industrial remote controllers for fun and profit"
51mRadio Hacking: Cars, Hardware, and more!
59mWireless security testing with attack
52m"New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier
40mGrand Theft Drone: Reaching Breaking Point in Drone Proprietary RF Link Security
44mBreaking the Security of Physical Devices
01h 00mHacking the Wireless World with Software Defined Radio - 2.0
Lock It and Still Lose It —on the (In)Security of Automotive Remote Keyless