Bypassing Rolling Code Systems – CodeGrabbing/RollJam

A while back we posted about Samy Kamkars popular “RollJam” device, which was a $32 home made device that was able to defeat rolling code based wireless security systems such as those used on modern cars.

Wireless security researcher Andrew Macpherson became interested in RollJam and has now written up a post showing how to create a similar device using the YardStickOne and RFcat wireless tools. In his post Andrew shows how he automates the replay attack side of things using a Python script and two RFcat devices. He also fully explains how rolling codes work and how to attack them using the CodeGrabbing/RollJam technique. Andrew explains the RollJam technique as follows:

1. Target parks their car, gets out the carAttacker launches a jammer that prevents the car from receiving the code from the remote
2. Target presses the remote, car does NOT lock and the attacker obtains the first keypress
3. Target presses the remote a second time and the attacker obtains the second keypress
4. Attacker then sends the first key press to lock the car, car locks as per normal
5. Target assumes all is well and carries on about their day
6. Attacker then sends the second keypress to the car, unlocking it
7. Profit.
8. Target returns to the vehicle and remote works as per normal

In the video below Andrew uses an SDR to help demonstrate the RollJam attack.

Showing how the RollJam attack works.