OpenSesame - hacking garages in seconds using a Mattel toy

Concise summary

“OpenSesame” is a hack that reprograms a Mattel Radica iMes toy (which contains a Texas Instruments sub‑GHz RF chip) to transmit radio codes that open garage doors using fixed DIP‑switch codes. By exploiting protocol characteristics (no strict frame boundary / weight period handling and a shift‑register style receiver), the attacker can brute‑force all 12‑bit garage codes in under ~10 seconds.

What the project does

• Reprograms a Mattel Radica iMes toy (TI CC11x family RF chip) to act as a transmitter for common garage‑opener frequencies.
• Exploits weaknesses in many fixed‑DIP‑switch garage openers to brute‑force the full code space rapidly.
• Uses protocol-level optimizations (removing unnecessary pauses, exploiting receiver bit‑shifting) and a de Bruijn sequence to minimize the bits transmitted and the time required.

Key technical concepts and attack steps

1. Keyspace and target weakness
   • Many garage openers use 12 DIP switches → 12 bits → 2^12 = 4,096 possible codes (very small keyspace).
2. Weight period optimization
   • Transmitters normally insert a pause (weight period) after each message.
   • The attacker observed many receivers accept a valid code even when it appears after an invalid one, so the pause can be omitted, effectively halving transmission time.
   • Credit: Mike Ryan suggested removing weight periods.
3. Shift/overlap exploitation
   • Some receivers effectively use a sliding bit window (shift register) rather than strictly framing each message, so overlapping bit sequences are accepted.
   • That allows one long stream to test many codes without sending full separate frames.
4. de Bruijn sequence
   • A de Bruijn sequence for order‑12 over a binary alphabet contains every possible 12‑bit sequence exactly once as a contiguous substring.
   • Using a de Bruijn sequence produces a minimal‑length bit stream that contains all 4,096 codes, drastically reducing transmitted bits (to roughly 4.2% of sending each full framed code separately).
   • Combined with the above optimizations, this enables sweeping the entire keyspace in seconds.

Hardware, software, and tools used

• Hardware
  • Mattel Radica iMes toy containing a TI CC11x‑family RF chip (sub‑GHz transmit/receive).
  • Modified antenna: original ~900 MHz quarter‑wave removed and replaced with a helix antenna tuned around 300–315 MHz (common garage frequencies).
  • Accessible test pads on the toy for reprogramming.
• Reprogramming / firmware tools
  • GoodFET (Travis Goodspeed) used to flash and reprogram the device.
• RF/sniffing and analysis
  • RTL‑SDR mentioned for capturing RF signals.
  • Presenter published code and a write‑up (see resources); posted code has been intentionally altered to prevent criminal misuse.

Product and security takeaways

• Fixed‑DIP‑switch garage openers with a 12‑bit keyspace remain insecure despite decades of awareness.
• The attack uses inexpensive hardware and modest firmware changes — practical for attackers with basic RF/embedded skills.
• Manufacturers often do not disclose such weaknesses; defenders and users should be aware that many legacy systems remain vulnerable.
• The presenter provides follow‑up material (sniffing, signal breakdown, hardware/coding details) but has altered posted code to reduce the risk of misuse.

Guides, tutorials, and resources

• Next video (promised): in‑depth RF sniffing with RTL‑SDR, signal decoding, hardware and code walkthrough.
• Full write‑up and source code: sammy.pl/sesame (source intentionally altered to prevent misuse).
• A separate protection video is referenced for users to check whether their garage opener is vulnerable.

Main speakers and references

• Samy — presenter / researcher; author of the video and write‑up.
• Travis Goodspeed — developer of GoodFET hardware used to reprogram the device.
• Mike Ryan — credited for the idea to remove weight periods.
• Hardware/IC references: Mattel Radica iMes (toy), Texas Instruments CC11x family RF chip.