Upgrading Rollback Agnostic Replay Attacks

Upgrading Rollback Agnostic Replay Attacks

Speakers: Carlos Gomez, Picnic Technologies

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=unr6k9a_9ls

Overview

In this compelling talk at HITB Amsterdam, Carlos Gomez from Picnic Technologies unveiled a significant advancement in car hacking techniques: the Rollback Agnostic Replay Attack. This research builds upon previously disclosed vulnerabilities in Remote Keyless Entry (RKE) systems, demonstrating how modern vehicles remain susceptible to sophisticated attacks that bypass standard security measures like rolling codes. Gomez's work highlights a critical flaw in how vehicle RKE systems manage internal clock synchronization and validate incoming signals, enabling attackers to gain unauthorized access to cars without the owner's knowledge or interaction.

The core of the presentation focused on two primary attack vectors: the well-known RollJam attack and the more advanced Rollback attack, with Gomez introducing his novel "agnostic" enhancements. He illustrated how these techniques, particularly his upgraded Rollback method, eliminate the need for real-time jamming or precise timing, making them significantly stealthier and more potent than their predecessors. The implications are far-reaching, as even vehicles manufactured as recently as 2019 and 2022 from major brands like Nissan and Toyota were demonstrated to be vulnerable.

This research serves as a stark reminder that despite advancements in automotive security, fundamental design flaws can leave vehicles exposed to persistent threats. Gomez's work underscores the urgent need for car manufacturers to re-evaluate their RKE system architectures, particularly concerning rolling code management and internal clock synchronization, to safeguard against these evolving attack methodologies. For car owners, it emphasizes the importance of understanding these risks and considering supplementary security measures.

Background

▶ Watch: Introduction and live car unlocking demo (0:00)

The evolution of vehicle security, particularly Remote Keyless Entry (RKE) systems, has seen a continuous cat-and-mouse game between manufacturers and attackers. Early RKE systems, prevalent in the 1980s, relied on fixed codes. These systems were inherently insecure; an attacker could simply sniff the radio signal transmitted by a key fob, record the fixed code, and then replay it later to unlock the car. This straightforward replay attack made vehicles extremely vulnerable.

To counter this, manufacturers introduced rolling codes (also known as "hashing codes"). The principle behind rolling codes is elegant: each time the key fob button is pressed, it transmits a unique, one-time code. Both the key fob and the car maintain a synchronized counter or algorithm. When the car receives a code, it compares it against its own internally generated expected code. If they match, the action (lock/unlock) is performed, and the car's internal counter advances. Crucially, a used code becomes invalid immediately, preventing simple replay attacks. This mechanism was a significant leap forward in RKE security.

From a hardware perspective, radio technologies have also evolved. Traditional radio systems are primarily controlled by dedicated hardware components. However, the advent of Software Defined Radio (SDR) has revolutionized signal processing. SDRs, such as the HackRF One or Ubertooth, utilize hardware for basic signal reception and transmission but offload most of the processing and control to software. This software-centric approach makes SDRs incredibly versatile and powerful tools for researchers and attackers alike, allowing for flexible manipulation, analysis, and generation of radio signals. Gomez notes that while expensive SDRs exist (like USRP), devices like the HackRF One are perfectly suitable for RKE research.

RKE systems typically operate on specific radio frequencies, which vary by region. European and British cars commonly use 433 MHz, while American and Japanese cars often operate on 315 MHz. The information transmitted by the key fob is encoded using various digital modulation techniques, such as Amplitude Shift Keying (ASK), Frequency Shift Keying (FSK), and Phase Shift Keying (PSK). These modulations convert digital data (0s and 1s) into radio waves that can be transmitted over the air. Understanding the specific modulation used by a key fob is a critical step in reverse engineering and exploiting RKE systems. Gomez highlighted that Universal Radio Hacker (URH) is a valuable tool for identifying modulation types and performing bit-level analysis.

Prior work laid the groundwork for Gomez's research. One notable precursor is the RollJam attack, first publicly disclosed by Sami at Defcon 23. This attack targets rolling code systems by combining radio jamming with signal capture. The attacker uses a jamming device to block the key fob's signal while simultaneously capturing the rolling code. When the car owner presses their key fob button (e.g., to lock the car), the signal is jammed, preventing the car from receiving it. The owner, assuming the car didn't lock, presses the button again. The jamming device continues to block this second signal while the attacker captures it. At this point, the attacker stops jamming and immediately replays the first captured code. The car, now no longer jammed, receives the first code, validates it, and performs the intended action (e.g., locks). The crucial part is that the attacker still holds the second captured code, which is now a valid, unused rolling code for future exploitation. The primary disadvantages of RollJam are its reliance on precise timing, the need for the owner to press the button multiple times (a form of social engineering), and the use of a jamming device, which can be detected.

Another pivotal piece of prior research is the original Rollback attack, disclosed at Black Hat. This attack exploited a different vulnerability: the way certain RKE chips handle synchronization. Instead of jamming, the Rollback attack focuses on sending a sequence of old, already-used rolling codes. Under specific conditions, sending 2-3 of these invalid codes can cause the car's internal counter or clock to "roll back" or resynchronize to an earlier state. This effectively re-validates a subsequent old code, allowing the attacker to open the car. This attack is more stealthy as it doesn't require jamming or direct interaction with the car owner. Gomez's work builds directly on this Rollback principle, refining and expanding its capabilities to make it "agnostic" to time and sequence.

Key Findings

▶ Watch: Explained: The RollJam attack mechanism (11:59)

Carlos Gomez's research significantly upgrades the Rollback attack, introducing several critical findings that enhance its potency and stealth. These discoveries demonstrate a persistent and evolving threat to automotive security, even for modern vehicles.

The most striking finding is the vulnerability of modern vehicles to these advanced replay attacks. Gomez explicitly stated that he tested and confirmed the Rollback Agnostic Replay Attack on three new vehicles, including models built in 2019 and 2022, from manufacturers such as Nissan and Toyota. This contradicts the common assumption that newer cars are inherently more secure against such fundamental radio-based exploits.

Gomez's primary contribution is the development of the Rollback Agnostic Replay Attack, which dramatically expands the feasibility and effectiveness of the original Rollback concept. The "agnostic" nature refers to several key improvements:

• Time Agnostic: Unlike the RollJam attack, which requires immediate execution or a very narrow time window, Gomez's enhanced Rollback attack can be performed days, weeks, or even months after the initial codes are captured. The attacker can passively collect signals over an extended period and then execute the attack at their leisure. This eliminates the urgency and risk associated with real-time operations.
• Scope Agnostic / Non-Sequential Codes: The attack does not require the captured rolling codes to be sequential. An attacker can collect a large pool of signals (e.g., 50 distinct codes) and then select specific, non-sequential codes from that pool (e.g., the 1st, 7th, and 19th codes captured) to trigger the rollback and open the vehicle. This flexibility makes the attack much harder to detect and mitigate, as the pattern of "valid" codes is not predictable from a simple sequence.
• No Jamming Required: A significant advantage over RollJam, the Agnostic Rollback attack completely bypasses the need for a jamming device. This makes the attack significantly stealthier, as it avoids generating radio interference that could alert the owner or be detected by anti-jamming systems. It also simplifies the attacker's toolkit and operational complexity. The attacker only needs to plant a listening device near the vehicle to passively capture signals over time.
• Mechanism of Agnosticism: The core mechanism remains the exploitation of a synchronization flaw. Sending a specific sequence of "old" (previously used and thus supposedly invalid) rolling codes causes the car's internal clock or counter to resynchronize to an earlier state. Once the car's internal state is "rolled back," a subsequent old code, which would normally be rejected, becomes valid, allowing the car to be unlocked. This vulnerability persists over time and across non-sequential code sets because the car's internal logic is susceptible to being reset by a particular pattern of invalid inputs.

A crucial and highly technical finding by Gomez relates to bit-level analysis and signal characteristics. He discovered that for some manufacturers, successful rollback attacks depend on the specific characteristics of the captured signals, particularly their modulation peaks. He observed a distinction between "even" and "odd" signals:

• Even signals showed a peak on the left side of the modulation.
• Odd signals showed a peak on the right side of the modulation.

The critical implication is that a successful rollback sequence often requires sending a consistent type of signal—either a sequence composed entirely of "odd" signals or entirely of "even" signals. Attempting to mix "odd" and "even" signals within the rollback sequence would cause the attack to fail. This suggests a more nuanced internal validation logic within the car's RKE chip, where not only the rolling code value but also certain signal characteristics are considered during synchronization. This finding is vital for attackers to craft effective rollback sequences and for defenders to understand the precise nature of the vulnerability.

In summary, Gomez's key findings reveal that modern vehicle RKE systems are still susceptible to sophisticated replay attacks that circumvent rolling codes. The "agnostic" nature of his Rollback attack—requiring no jamming, no immediate execution, and tolerating non-sequential code capture—makes it an extremely potent and difficult-to-detect threat. The detailed analysis of signal characteristics further refines the attack methodology, providing deeper insight into the underlying vulnerabilities.

Technical Deep Dive

▶ Watch: Introduction to the Rollback attack with a demo (17:59)

To fully grasp the "Upgrading Rollback Agnostic Replay Attacks," it's essential to understand the technical underpinnings of RKE systems and the evolution of attack methodologies.

RKE System Fundamentals Revisited:

As mentioned, RKE systems rely on radio frequencies (e.g., 433 MHz, 315 MHz) and digital modulation techniques (ASK, FSK, PSK) to transmit data. The core security mechanism, rolling codes, generates a unique, one-time use code for each key fob press. This is typically achieved by applying a cryptographic hash or a pseudo-random number generator to a base code, along with a synchronized counter shared between the key fob and the car. The car expects the next code in the sequence; if it receives an older code, it should reject it.

Analysis Methodology for Attackers:

Gomez outlined a systematic approach for analyzing RKE systems to identify vulnerabilities:

1. Identify the Coding Algorithm: Determine how the bits are encoded, e.g., Manchester encoding, Goaldian 2-1. This translates the raw radio signal into a sequence of 0s and 1s.
2. Identify the Modulation Type: Use tools like Universal Radio Hacker (URH) to automatically detect whether the signal uses ASK, FSK, or PSK. URH also helps visualize the signal's characteristics.
3. Bit-Level Qualification: Understand how the physical signal translates to logical 0s and 1s. For instance, a high peak might represent a '1' and a low peak a '0'. This granular analysis is crucial for identifying subtle differences between signals.

The RollJam Attack (Technical Recap):

The RollJam attack, while superseded by the Agnostic Rollback in stealth, provides important context. It leverages a simultaneous jamming-and-listening capability, often implemented using SDRs like the HackRF One.

1. Jamming Phase 1: The attacker's SDR transmits noise on the RKE frequency (e.g., 433 MHz), preventing the car from receiving the key fob's signal.
2. Capture Phase 1: While jamming, the SDR simultaneously listens and captures the first rolling code (e.g., Unlock_Code_A) sent by the owner.
3. Jamming Phase 2 & Capture Phase 2: The owner, seeing the car didn't respond, presses the button again. The SDR continues jamming, preventing the car from receiving Unlock_Code_B, which is also captured by the attacker.
4. Replay Phase: The attacker immediately stops jamming and replays Unlock_Code_A. The car receives this code, validates it (as it hasn't seen it yet), and unlocks.
5. Future Exploitation: The attacker retains Unlock_Code_B, which is still a valid, unused rolling code, for later unauthorized access.

The technical challenge here lies in the SDR's ability to jam and listen on the same frequency simultaneously or to quickly hop between frequencies. Gomez demonstrated this using GNU Radio, a powerful open-source toolkit for SDR, configured to operate on 433.95 MHz, and a Python script for automated frequency hopping every three seconds.

The Rollback Agnostic Replay Attack (Detailed Mechanism):

This is where Gomez's research shines. It eliminates the need for jamming and strict timing, making the attack far more insidious.

1. Passive Signal Capture: An attacker plants a small, inconspicuous SDR device near the target vehicle. This device passively listens and records a large number of rolling codes over an extended period (e.g., 50 codes over several days or weeks). This is done without any interaction with the car owner.
2. Exploiting Synchronization Flaws: The core vulnerability lies in how some RKE chips handle out-of-sequence or "old" rolling codes. Instead of simply rejecting an old code, certain chips attempt to resynchronize their internal counter if they receive a specific pattern of these old codes.
3. The "Rollback" Sequence: Gomez found that sending a sequence of 2-3 old, previously used rolling codes can trick the car's internal clock into reverting to an earlier state. For example, if the car's current expected code is Code_N, and the attacker sends Code_X, Code_Y, and then Code_Z (where X, Y, and Z are all codes that were used and invalidated long ago), the car's internal counter might reset to a state where Code_Z (or a subsequent code in the sequence) is now considered valid.
4. Agnosticism through Non-Sequentiality and Time: Gomez's key finding is that these rollback sequences don't need to be sequential (e.g., Code_1, Code_2, Code_3). An attacker can pick codes from a large pool of passively collected signals, such as Code_1, Code_7, and Code_19 (where these represent the 1st, 7th, and 19th unique codes captured, not necessarily sequential values). Furthermore, the time elapsed between capturing these codes and executing the attack is irrelevant. The car's internal synchronization logic is vulnerable regardless of when the codes were originally used.
5. The Odd/Even Signal Distinction: This is a critical technical detail for successful exploitation. Gomez's deep analysis revealed that the physical characteristics of the radio signal itself—specifically the position of the modulation peak (left for "even" signals, right for "odd" signals)—play a role in the car's validation process. If an attacker attempts to send a rollback sequence that mixes "odd" and "even" signals, the attack will likely fail. The sequence must be consistent: either all "odd" signals or all "even" signals. This implies an internal state machine or parsing logic within the RKE chip that differentiates between these signal types, adding a layer of complexity for both attackers and defenders.

The hardware required for the Agnostic Rollback attack is minimal: a low-cost SDR capable of receiving and transmitting on the target frequency. The software primarily involves signal analysis tools like URH for initial reverse engineering and custom scripts (often built on GNU Radio or similar SDR frameworks) for capturing and replaying the specific rollback sequences. The power of this attack lies in its simplicity of execution from the attacker's perspective (once the initial analysis and code capture are complete) and its stealth, making it a severe threat to vehicle security.

Demo / Proof of Concept

▶ Watch: Understanding odd and even signal requirements for Rollback (25:59)

Carlos Gomez provided live demonstrations and video evidence for both the RollJam and his upgraded Rollback Agnostic Replay Attacks, substantiating his claims of vulnerability in modern vehicles.

For the RollJam Attack, Gomez showcased a practical setup using GNU Radio. He configured GNU Radio to operate as a jamming device on 433.95 MHz, a common frequency for European key fobs. To automate the jamming and listening process, which is critical for RollJam's precise timing requirements, he employed a small Python program. This script facilitated frequency hopping, allowing the device to switch between jamming and listening modes every three seconds. A video segment illustrated this setup in action, demonstrating how the coordinated jamming and capturing process could lead to a successful car unlock. This part of the demo highlighted the operational complexity and timing sensitivity of RollJam, setting the stage for the advantages of his new Rollback approach.

The core of the presentation, however, focused on the Rollback Agnostic Replay Attack. Gomez demonstrated this by showing a vehicle that was initially confirmed to be closed and locked. He then proceeded to replay a "bunch of signals"—a carefully selected sequence of old, previously used rolling codes captured over time. Crucially, the car opened without any interaction from the key fob or the owner, and without any jamming. This live demonstration underscored the key features of the agnostic attack: no jamming, no real-time interaction, and successful exploitation using codes that should theoretically be invalid.

Gomez further elaborated on his test cases, confirming the attack's effectiveness on modern vehicles. He explicitly stated that he successfully tested the attack on three new vehicles, including models built in 2019 and 2022, from manufacturers like Nissan and Toyota. This provides concrete evidence that the vulnerability is not limited to older or obscure models but affects contemporary automotive security.

The demo also touched upon the nuances of the attack, such as the non-sequential code selection and the time-agnostic nature. He showed how a sequence like the 1st, 7th, and 19th codes out of 20 captured could open a car. Another scenario involved codes captured with a significant time frame between them, such as the 1st, 26th, and 50th codes from a batch of 50 collected over four different days, still successfully opening the vehicle. These demonstrations visually reinforced the "agnostic" aspects of the attack, proving that the timing of capture and the sequential order of codes are not strict prerequisites for exploitation.

A particularly insightful part of the demo indirectly showcased the "odd" and "even" signal distinction. While not a direct visual demonstration of the bit-level analysis, Gomez explained why certain sequences failed and others succeeded based on this characteristic. He noted that if a sequence mixed "odd" and "even" signals (e.g., 1st, 7th, and 14th), the car would not open, whereas a sequence of all "odd" signals (e.g., 1st, 7th, and 19th) would be successful. This explanation, backed by the demo's outcomes, provided strong evidence for the technical depth of his findings.

In essence, the demonstrations provided compelling proof of concept for the Rollback Agnostic Replay Attack, highlighting its ease of execution (once codes are captured), its stealth, and its broad applicability to a range of modern vehicles.

Defensive Implications

▶ Watch: Mitigations and defense strategies against these attacks (29:59)

The "Upgrading Rollback Agnostic Replay Attacks" talk presents significant defensive implications for both car manufacturers and owners, necessitating a re-evaluation of current security postures for Remote Keyless Entry (RKE) systems.

For Car Manufacturers:

1. Robust Rolling Code Management: The fundamental vulnerability lies in the car's ability to resynchronize its internal clock to an earlier state by accepting old, supposedly invalid rolling codes. Manufacturers must implement more stringent validation and discard mechanisms for rolling codes. Old codes should be unequivocally invalidated and never capable of resynchronizing the system or becoming valid again, regardless of the sequence or timing of subsequent inputs.
2. Enhanced Synchronization Protocols: The internal clock synchronization logic within RKE chips needs to be thoroughly audited and hardened. The current implementations appear vulnerable to a "rollback" state. This might involve:

• Strict Monotonic Counter Advancement: Ensure the car's internal counter only ever moves forward, with robust checks to prevent resets or backward adjustments based on anomalous inputs.
• Secure Desynchronization Handling: If a key fob and car genuinely desynchronize (e.g., due to many button presses out of range), the resynchronization process should be cryptographically secure and not exploitable via replay of old codes. Modern vehicles often lack overt manual resynchronization procedures, implying that this process is expected to be handled internally and securely, which is clearly not always the case.

1. Address Signal Characteristics in Validation: Gomez's discovery of "odd" and "even" signal distinctions (based on modulation peaks) highlights a nuanced aspect of RKE chip validation. Manufacturers must investigate why mixing these signal types causes failure and ensure that the core vulnerability is addressed, rather than simply relying on this implicit filtering. This suggests a need for deeper analysis of the physical layer security.
2. Firmware Updates and Secure Development Lifecycle: Given that even 2019 and 2022 vehicles are affected, manufacturers must prioritize over-the-air (OTA) or dealer-installed firmware updates to patch these vulnerabilities. A robust Secure Development Lifecycle (SDL) is crucial, incorporating extensive threat modeling, security testing (including advanced replay attack simulations), and code audits specifically targeting RKE system logic.
3. Anti-Jamming Technology (for RollJam mitigation): While the Agnostic Rollback attack doesn't use jamming, the RollJam attack remains a threat. For high-value or expensive vehicles, investing in advanced anti-jamming technologies that can detect and counteract malicious radio interference is a valuable defensive measure. This could involve frequency hopping, spread spectrum techniques, or active jamming detection and alert systems.

For Car Owners:

1. Awareness is Key: Owners of modern vehicles should be aware that their cars are not immune to sophisticated replay attacks, even if they have rolling codes.
2. Physical Verification: If a key fob press doesn't immediately lock or unlock the car, it could be a sign of a RollJam attack. Instead of pressing the button again, physically check the car doors to confirm their status. Repeatedly pressing the button could provide an attacker with multiple valid codes.
3. Consider Supplementary Security: Relying solely on the RKE system for security may be insufficient. Owners should consider additional physical security measures, such as:

• Steering Wheel Locks: A visible deterrent that makes theft more difficult and time-consuming.
• Aftermarket Alarm Systems: Especially those with independent power sources and different communication protocols.
• GPS Tracking Devices: To aid in recovery if theft occurs.

1. Secure Parking: Park vehicles in well-lit, high-traffic areas, or secure garages whenever possible, reducing opportunities for attackers to plant listening devices or execute attacks undisturbed.
2. Key Fob Protection: Keep key fobs in Faraday pouches when not in use, especially at home, to prevent signal amplification (relay attacks, though not the focus here, are also a concern) and passive signal capture if the attacker is in close proximity.

In conclusion, the research highlights that the fundamental security of RKE systems needs a paradigm shift. Manufacturers must move beyond relying on rolling codes as a standalone solution and instead implement a layered security approach that addresses the intricate vulnerabilities at the physical, protocol, and logical levels. For owners, vigilance and supplementary security measures are increasingly vital in a world where even "secure" systems can be silently bypassed.

Key Takeaways

• Modern Vehicles Remain Vulnerable: Even recently manufactured vehicles (e.g., 2019, 2022 models from Nissan, Toyota) are susceptible to advanced replay attacks that bypass rolling code security.
• Rollback Agnostic Replay Attack is Stealthy and Potent: This new attack requires no jamming, no real-time interaction with the car owner, and can be executed days or months after initial signal capture.
• Exploits RKE Synchronization Flaws: The attack leverages a vulnerability where a specific sequence of old, previously used rolling codes can cause the car's internal clock to "roll back" and re-validate subsequent old codes.
• Non-Sequential Code Usage: Attackers can pick and choose non-sequential codes from a large pool of passively collected signals, making the attack highly flexible and difficult to detect.
• Signal Characteristics Matter: Successful attacks can depend on subtle physical characteristics of the radio signals, such as the position of modulation peaks ("odd" vs. "even" signals), requiring consistent signal types in the rollback sequence.
• Urgent Call for Manufacturer Action: Car manufacturers must implement more robust rolling code validation, strengthen internal clock synchronization protocols, and provide firmware updates to patch these critical RKE vulnerabilities.

About the Speaker(s)

Carlos Gomez is a cybersecurity researcher with a passion for hacking cars. At the time of this talk at HITB Amsterdam, he was in his final year of software engineering studies and was 23 years old. He is currently employed at Picnic Technologies, where he is paid to delve into automotive security. This presentation marked his first time giving such a talk at a major conference, an experience he openly admitted made him a "little bit nervous." His research demonstrates a keen analytical mind and a practical approach to uncovering complex vulnerabilities in real-world systems.