How I hacked Learning Codes of the key job of a car assembled in my country

How I hacked Learning Codes of the key job of a car assembled in my country

Speakers: D. Erazo

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=es72oviu0Lg

Overview

This article delves into D. Erazo's compelling research presented at DEF CON 32, where he exposed critical vulnerabilities in the keyless entry systems of thousands of cars assembled in his home country, Ecuador. The talk, titled "How I hacked Learning Codes of the key job of a car assembled in my country," details his journey from discovering a suspicious CAN bus ID to successfully exploiting the underlying learning code radio frequency (RF) system. Erazo, a penetration tester by profession, undertook this research independently due to the nascent state of automotive cybersecurity in South America, highlighting a significant security gap in regional vehicle markets.

The core of Erazo's findings revolves around the widespread use of vulnerable HS2240 learning code chips in vehicle key fobs. Unlike modern, cryptographically secure rolling code systems, learning codes are susceptible to replay attacks and allow for the easy programming of unauthorized keys, effectively creating a "backdoor" into the vehicle. This research is not merely an academic exercise; it demonstrates a practical method for car theft and unauthorized access, underscoring the urgent need for manufacturers to adopt more robust security protocols globally, especially in markets where legacy or cost-optimized systems may still be prevalent.

Erazo's work serves as a stark reminder that physical access controls, even for vehicles, are increasingly reliant on digital security. His presentation meticulously breaks down the hardware and software aspects of the attack, from RF signal analysis to circuit board reverse engineering, providing a comprehensive blueprint for understanding and mitigating these risks. It's a critical contribution to the automotive cybersecurity landscape, urging greater attention to often-overlooked regional vulnerabilities.

Background

▶ Watch: Introduction: unlocking thousands of cars in my country (0:20)

D. Erazo's journey into automotive cybersecurity began out of necessity and personal interest in a region where such expertise is scarce. As a penetration tester in Ecuador, he observed a significant void in specialized automotive security companies. This led him to self-teach car hacking, driven by a curiosity to understand the security posture of vehicles commonly found in his country. His initial foray involved exploring the Controller Area Network (CAN) bus, a standard in-vehicle communication protocol.

His research began by connecting an OBD2 interface to his car's diagnostic port, a common starting point for automotive hacking. During this initial reconnaissance, he identified CAN ID 545, which consistently appeared on the bus whenever the car was locked or unlocked using the key fob. This observation, while not directly exploitable for remote attacks, piqued his interest in the keyless entry system and its underlying radio frequency (RF) communication. Erazo shifted his focus from the internal CAN bus to the external RF signals responsible for remote lock/unlock functionality.

Traditional keyless entry systems broadly fall into three categories: fixed code, rolling code, and the less common learning code. Fixed code systems transmit the same code every time, making them highly vulnerable to simple replay attacks where an attacker records and retransmits the signal. Rolling code systems, considered more secure, use a cryptographic algorithm to generate a unique, non-repeating code for each transmission, making replay attacks ineffective. Erazo's investigation quickly revealed that the target vehicles were not using rolling codes. Instead, his signal analysis showed a repeating, fixed code pattern. This discovery was a critical turning point, leading him to investigate what he later identified as a learning code system, embodied by the HS2240 chip. Learning codes, while offering a slight variation from purely fixed codes by allowing the receiver to "learn" new codes, share the fundamental weakness of not employing cryptographic nonce generation or challenge-response mechanisms, thus remaining susceptible to significant security bypasses. This foundational understanding of the system type set the stage for his subsequent deep dive into its vulnerabilities.

Key Findings

▶ Watch: Identifying fixed code with Universal Radio Hacker (2:40)

D. Erazo's research yielded several critical findings that collectively expose a significant security flaw in keyless entry systems utilizing learning code technology. These discoveries not only confirmed his initial suspicions but also provided a clear methodology for exploitation.

Firstly, the most significant finding was the identification of the HS2240 learning code chip within the vulnerable key fobs. This specific integrated circuit is central to the system's operation and, crucially, to its vulnerabilities. Erazo determined that these learning codes, while distinct from traditional fixed codes in their programming mode, share similar weaknesses. Unlike fixed codes, which are often hard-soldered into a circuit, learning codes are programmed into the chip itself, and the car's receiver microcontroller can be taught to recognize new codes.

A key characteristic of these learning code systems, and a cornerstone for the proposed backdoor attack, is that the vehicle's receiver microcontroller is capable of storing up to four different learning codes in its memory. This multi-code storage capability means that an attacker, once gaining initial access or proximity, can program their own unauthorized key fob without invalidating existing legitimate keys, effectively installing a persistent backdoor.

Through meticulous RF signal analysis, Erazo successfully deciphered the structure of the learning code frame. Each transmission consists of a preamble, followed by a 20-bit code, and finally a 4-bit mode segment. The 20-bit code segment alone offers 1,048,576 (2^20) unique possibilities. While this number might seem large, the lack of cryptographic randomness or rolling code functionality makes it vulnerable. The 4-bit mode segment, corresponding to the four buttons on the key fob (e.g., lock, unlock, trunk, panic), dictates the specific action.

The most impactful practical finding was the successful execution of a replay attack. Erazo demonstrated that by recording a legitimate unlock signal using a Universal Radio Hacker (URH), he could retransmit that identical signal at a later time to unlock his car. This was proven from a considerable distance, specifically from the fifth floor of an abandoned building to his car parked on the first floor, showcasing the range and effectiveness of the attack. He successfully replayed both unlock and lock signals.

Finally, Erazo's research culminated in the development of a tool named Auto RF killer. While the talk does not detail the inner workings of this tool extensively, he states its purpose is to unlock cars using fixed code, learning code, and rolling code (presumably by leveraging known attacks against specific rolling code implementations, though this was not the focus of this talk). The development of such a tool underscores the practical exploitability of these vulnerabilities and aims to automate the process for security researchers.

Technical Deep Dive

▶ Watch: First successful remote replay attack demonstration (3:45)

The technical foundation of D. Erazo's research begins with a detailed analysis of the radio frequency (RF) signals emitted by the vulnerable key fobs. Using a Universal Radio Hacker (URH), a versatile software-defined radio (SDR) tool, Erazo captured the RF transmissions associated with locking and unlocking the vehicle. The signals were identified to operate at a frequency of 370 MHz.

Upon capturing, the signals were subjected to ASK (Amplitude Shift Keying) modulation, a common and relatively simple modulation scheme where the amplitude of the carrier wave is varied to transmit binary data. Erazo configured the URH with a symbol rate of 500 symbols per second for accurate demodulation. The demodulated signals visually revealed a critical pattern: the unlock and lock signals contained a repeating fixed code. This observation immediately indicated that the system was not employing a cryptographically secure rolling code, which would generate a unique code for each transmission. Further analysis showed that the lock signal was very similar to the unlock signal, with only the last three hexadecimal digits changing to differentiate between the two commands. This minimal difference further simplified the understanding and manipulation of the codes.

To understand the source of these fixed/learning codes, Erazo performed hardware reverse engineering on a vulnerable key fob. Disassembling the device, he identified key components:

• An LR370 MHz oscillator responsible for generating the carrier frequency.
• Two batteries providing a combined 6.38 volts to power the circuit. This voltage measurement was noted as important for future mathematical calculations, potentially for brute-force attack feasibility, though the talk focused more on replay and backdoor.
• The central component, the HS2240 integrated circuit (IC), was confirmed as the learning code chip.

The key fob's circuit design revealed how button presses translate into RF signals. The fob has four input buttons (K0, K1, K2, K3). When a button is pressed, it generates a binary input (e.g., 1000 for the first button, 0100 for the second). These signals pass through pull-down resistors before entering the HS2240 IC. The encoded learning code then exits the IC via pin number three. This output signal is then fed into an ASK modulation circuit, composed of capacitors, resistors, and inductors, which prepares the signal for transmission by the RF transmitter LED. The final modulated RF signal is then sent out through the antenna.

The learning code mechanism itself is crucial to understanding the vulnerability. Unlike fixed codes, which are hard-coded or soldered onto the circuit board, learning codes are programmed into the integrated circuit's memory. The key fob acts as a "teacher," transmitting its unique learning code to the car's receiver microcontroller. The receiver, upon hearing a new code via its antenna, saves this code into its internal memory, recognizing it as a legitimate key. A critical design flaw identified by Erazo is that the receiver can store up to four distinct learning codes. This capacity is exploited to create a backdoor.

The structure of the learning code frame is precisely defined:

• Preamble: An initial sequence to synchronize the receiver.
• 20-bit code: This segment carries the primary identification code for the key fob. With 20 bits, there are 2^20 = 1,048,576 possible unique codes. The speaker mentions that each key fob and each car has a different learning code, implying a wide distribution of these codes.
• 4-bit mode: This segment specifies the command (e.g., lock, unlock, trunk, panic). Each of the four buttons on the key fob corresponds to a specific 4-bit mode.

The relative simplicity of the ASK modulation, the fixed nature of the code (despite being "learning" codes), and the lack of cryptographic measures are the fundamental technical weaknesses that enable the demonstrated attacks. The system relies on a basic form of authentication (matching a stored code) without any defense against replay or unauthorized code injection, making it highly susceptible to even unsophisticated RF attacks.

Demo / Proof of Concept

▶ Watch: Concept of setting a backdoor in keyless entry system (4:50)

D. Erazo's presentation included a compelling demonstration of the practical exploits derived from his research, primarily focusing on the replay attack and the concept of a backdoor using programmable learning codes.

The primary proof of concept involved a successful replay attack against his own vehicle. Using the Universal Radio Hacker (URH), a software-defined radio (SDR) tool, Erazo first recorded the legitimate RF signal emitted by his car's key fob when he pressed the "unlock" button. This captured signal, operating at 370 MHz and using ASK modulation, represented the fixed learning code for unlocking his specific vehicle.

The replay attack was then demonstrated under challenging conditions, highlighting the robustness of the vulnerability. Erazo positioned himself on the fifth floor of an abandoned building, while his car was located on the first floor. From this significant distance, he used the URH to retransmit the previously recorded unlock signal. The demonstration showed the car successfully unlocking, confirming that simply replaying the captured fixed code was sufficient to bypass the keyless entry system. He also demonstrated the ability to replay the signal to lock the car, further solidifying the effectiveness of the replay attack for both functions. The speaker specifically noted the audible click of the car unlocking and locking, providing clear evidence of the attack's success.

While not explicitly a live "demo" in the same visual format as the replay attack, Erazo extensively discussed the mechanism for setting a backdoor in the keyless entry system. This concept leverages the critical finding that the vehicle's receiver microcontroller can store up to four different learning codes. By having a recorded legitimate learning code, an attacker could theoretically program a new, unauthorized key fob with a different, attacker-chosen learning code. This new key fob could then be "taught" to the vehicle's receiver. Since the receiver can hold multiple codes, the original legitimate key fobs would continue to function, but the attacker would now possess an additional, unauthorized key that could unlock and lock the car at will. This effectively creates a persistent backdoor, granting long-term access to the vehicle without needing to steal or clone the owner's original key. The speaker emphasized that this capability makes the system particularly dangerous, as it allows for covert, ongoing access.

The overall demonstration provided concrete evidence that the learning code systems, particularly those using the HS2240 chip, are fundamentally flawed and easily exploitable with readily available SDR tools and a basic understanding of RF signals.

Defensive Implications

▶ Watch: Dissecting the learning code frame format (20-bit code) (7:00)

The vulnerabilities identified by D. Erazo in keyless entry systems using learning codes carry significant defensive implications for vehicle owners, manufacturers, and the broader automotive security landscape. Understanding these implications is crucial for mitigating the risks of car theft and unauthorized access.

For vehicle owners, particularly those in regions where these vulnerable systems might be prevalent, awareness is the first line of defense. Owners should be informed about the limitations of their keyless entry systems. Practical steps include:

• Physical Security: Relying more on traditional physical locks, such as steering wheel locks or pedal locks, especially when parking in high-risk areas.
• Aftermarket Security: Considering aftermarket security systems that are independent of the vehicle's built-in keyless entry, or advanced immobilizers.
• Signal Blocking: Using Faraday pouches or signal-blocking containers for key fobs when not in use, to prevent signal capture for replay attacks or relay attacks (though relay attacks were not the focus here, they are a common concern for keyless entry).
• Vigilance: Being aware of suspicious individuals or devices near their parked vehicles.

For automotive manufacturers, the findings demand a fundamental re-evaluation of keyless entry system design, especially for vehicles distributed in markets identified as using these weaker technologies. Key defensive measures include:

• Transition to Rolling Codes: The most critical step is to deprecate fixed and learning code systems entirely. All new keyless entry systems must implement robust rolling code algorithms combined with strong cryptographic protocols to ensure mutual authentication between the key fob and the vehicle. Each transmission should be unique, unpredictable, and resistant to replay.
• Secure Key Programming: The ability to easily "teach" new keys to the vehicle's receiver without strong authentication mechanisms is a major flaw. Manufacturers should implement more secure key programming procedures, such as requiring physical connection to the OBD-II port, multiple-factor authentication, or a challenge-response mechanism that cannot be bypassed by simply replaying a signal. The number of programmable keys should also be strictly limited and auditable.
• Jamming Detection: While not directly discussed as an attack vector in this talk, replay attacks often involve a period of jamming to prevent the legitimate key fob from communicating. Vehicles should incorporate RF jamming detection capabilities that can trigger alerts or prevent locking/unlocking operations if jamming is detected.
• Regional Security Standards: Manufacturers must ensure that security standards are consistent across all global markets, rather than deploying less secure, cost-optimized systems in certain regions. The "thousands of cars" vulnerable in Ecuador highlight a potentially systemic issue.
• Regular Security Audits: Continuous security assessments and penetration testing of keyless entry systems by independent experts are vital to identify and remediate vulnerabilities before they are exploited in the wild.

For governments and regulatory bodies, these findings underscore the need for minimum security standards for vehicle access systems. Mandating the use of cryptographically secure rolling code systems and secure key programming protocols could significantly reduce the risk of vehicle theft. Promoting and funding automotive cybersecurity research, especially in developing regions, can also help identify and address localized vulnerabilities.

In essence, the defensive implications highlight a clear trajectory towards more robust, cryptographically sound, and multi-layered security for vehicle access, moving away from outdated and easily exploitable RF communication protocols.

Key Takeaways

• Many vehicles, particularly those assembled in certain regions like Ecuador, still utilize outdated and insecure learning code keyless entry systems, often based on chips like the HS2240.
• These learning code systems are fundamentally vulnerable to replay attacks, where an attacker can record a legitimate unlock/lock signal (e.g., at 370 MHz using ASK modulation) and retransmit it later to gain unauthorized access.
• A critical vulnerability is the ability of the vehicle's receiver microcontroller to store up to four different learning codes, allowing an attacker to program an unauthorized key fob and effectively install a persistent backdoor without invalidating existing legitimate keys.
• Tools like Universal Radio Hacker (URH) make it relatively easy for attackers to capture, analyze, and replay these vulnerable RF signals, demonstrating the low barrier to entry for exploitation.
• The automotive industry must transition away from fixed and learning code systems to cryptographically secure rolling code mechanisms with robust authentication protocols across all global markets to prevent widespread vehicle theft and unauthorized access.
• Vehicle owners should be aware of these vulnerabilities and consider supplementary physical security measures or signal-blocking key fob pouches, especially if their vehicle uses an older keyless entry system.

About the Speaker(s)

D. Erazo is presented as a dedicated penetration tester by profession. His research into automotive security stems from a unique personal initiative, as he highlights the significant lack of specialized automotive cybersecurity companies in his home country, Ecuador. This environment compelled him to become self-taught in the field of car hacking and hardware security research. At 28 years old, he has already made substantial contributions to understanding vehicle vulnerabilities. Erazo is also the creator of the "Reverse Everything" YouTube channel, where he shares his research and findings, further demonstrating his commitment to the cybersecurity community and knowledge sharing. His work exemplifies the impact that independent researchers can have in identifying critical security flaws, particularly in underserved regions.