Sub-GHz replay attacks: why your gate remote might open for a stranger

TL;DR

When you press your garage remote or your car key, no secret travels down a wire. You broadcast a short radio message into the open air, and anything nearby can hear it. Whether that is a problem comes down to a single question: does the message change every time, or is it always the same? If it is always the same, a fixed code, then anyone who recorded it once can play it back later and your gate will open for them exactly as happily as it opens for you.

That is a sub-GHz replay attack, and it is old, simple, and still working on a surprising amount of the gear around us. I build the sub-GHz tools into the Evil-M5Project so you can hold a remote up to a reader and learn in about thirty seconds whether it is the easy kind. One thing up front, because it matters to me: this is about recording and understanding signals, not jamming, which is not something I do.

The button that broadcasts

It is easy to think of a remote control as sending a private command, something that goes from the button in your hand to the gate and nowhere else. It does not. Every time you press it, the remote shouts a little radio message out into the world, and the gate simply happens to be listening for it. So is everything else in range, including, if someone wants, a cheap recorder in a parked car.

Whether that matters is the whole story of this episode, and it hinges entirely on one design choice the manufacturer made years ago. Below I will walk through how these little radios actually talk, which ones are safe and which are not, what a capture looks like on an Evil-M5Project, and how to check that your own remotes are not the easy kind, the kind that is really just a recording waiting to be made.

How your remotes actually talk

Garage doors, gates, car fobs, tire-pressure sensors, cheap home gadgets: a huge number of them talk on the sub-GHz radio bands. « Sub-GHz » just means radio frequencies below one gigahertz, the low, long-reaching band that a lot of inexpensive remotes sit in, mostly around 315 MHz (common in the US), 433 MHz (common in Europe), and 868 or 915 MHz. These frequencies travel well and pass through walls, which is exactly why cheap remotes love them.

The messages themselves are tiny and simple, usually just a pattern of the signal flicking on and off, or nudging its frequency up and down a little. At the radio level the conversation is one-way: the remote says its piece, and the receiver, if it recognises the message, acts on it. On the simplest remotes there is nothing in that message proving who sent it, which is the crack the whole attack slips through. Better remotes, as we will see, fold a shared secret into every press so that a recording is worthless.

Fixed codes: the easy kind

The oldest and cheapest remotes send a fixed code. The button always transmits the exact same message, like a doorbell that only knows one note. That is convenient and dirt cheap to build, and it is also the entire weakness in one sentence: record the message once and you can send it again later, and the receiver cannot tell your copy from the real button, because there is nothing in the message that was ever meant to be unique.

This is not a rare, museum-piece problem either. Old garage openers, plenty of gate and barrier remotes, some alarm sensors, and a huge amount of no-brand gadgetry still work exactly this way today, because a fixed-code chip costs almost nothing and nobody upgrades a gate that still opens. If a remote you own is a fixed code, it is a recording waiting to happen, and no amount of being careful with it changes that.

Rolling codes: why your car key resists

This is why your modern car key is not in that bucket. Decent remotes use a rolling code, sometimes called a hopping code: the fob and the car share a secret and a counter, so every single press produces a fresh message that is only valid once. Record one and play it back, and the car rejects it outright, because that code’s counter is one it has already used and moved past. A plain replay simply does not work. That counter-and-secret design is the real fix, and it is why the only question that actually matters for any remote is « fixed, or rolling? »

Rolling codes are not magic, to be fair, and it is worth being honest about the edges. The receiver has to accept a small window of upcoming codes it has not seen yet, so the fob stays in sync even if you press it a few times out of range, which means a code from a press the car never actually received can still be replayed afterward, and that is one of the things researchers poke at. A few systems have also turned out to have weak or guessable secrets. But that is slow, product-specific research, a world away from the broad, easy, works-right-now attack, which is plain replay against fixed codes.

Technical deep dive: on-off keying, the fixed code, and the rolling counter

This is the part worth slowing down on, and you can skim it if you only want the practical check. At the physical level most of these remotes use on-off keying (OOK), which is about as simple as radio gets: the transmitter either emits a carrier or it does not, and a pattern of those on and off pulses spells out the message, a bit like very fast Morse. A fixed-code remote is then just a fixed pattern of pulses, often set by a little bank of switches or soldered links inside, and because the pattern never changes, capturing it once is the same as having the remote forever.

A rolling code changes what fills those pulses. Instead of a constant value, each press carries an encrypted block built from the shared secret and the ever-incrementing counter, so the on-air message looks completely different every time even though the button and the gate are the same. The receiver decrypts it, checks that the counter is ahead of the last one it accepted but within its resync window, and only then opens. Replaying an old capture fails the counter check; that is the whole defense in one rule. The famous families here (KeeLoq and its descendants) are what put rolling codes in millions of gates and cars, and the attacks against them are not replay at all but the slower, product-specific work of recovering a weak secret or abusing that resync window. For the everyday gate, none of that is needed, because the everyday gate is still fixed-code, and fixed-code falls to a plain recording.

Where it shows up

The installs that matter are the everyday fixed-code ones, the gear that was fitted years ago and quietly never touched again: gated communities and car-park barriers, old garage doors, roller shutters on small businesses, and gate remotes handed out a decade ago. None of it feels like a security device the way a lock on a door does, so none of it ever gets audited, and that neglect is exactly what keeps it exposed.

It rarely makes the news, and that is part of why it persists. A replayed gate leaves no broken lock, no forced door, no obvious sign at all, just a shutter that opened for the wrong person at the wrong time. When the stock is gone in the morning, a copied remote is not the first thing, or even the tenth thing, most people think to suspect.

The van across the street

Say you are Karim, and you run a small warehouse with an electric roller shutter that you open from a remote in your van. It was installed a decade ago and it has worked flawlessly ever since, so you have genuinely never given it a second thought, any more than you think about the light switch by the door. One afternoon someone parks across the street while you open up, and their pocket-sized recorder quietly catches the exact radio message your remote sends. There is nothing to notice, nothing to hear. Your shutter rolls up like it always has.

That night, the same message gets transmitted straight back, the shutter rolls open on its own in an empty street, and your stock walks out the door. Nobody picked the lock, nobody forced anything, and in the morning there is no damage to point at, which is the cruel part. The lock was never beaten. It was simply copied, once, from across the street, while everything looked completely normal.

Why it works

Karim’s shutter did exactly what it was built to do, and that is the point rather than a flaw in that one unit. These radios were designed for convenience, in an era when nobody was listening for them and the gear to record and resend a signal did not sit in a hobbyist’s pocket. Trust-by-broadcast made perfect sense when the broadcast was effectively private by obscurity.

The deeper reason they stay exposed today is plain cost. A fixed-code remote never changes its message, the chip to build one is almost free, and the hardware to record and replay that message now costs about as much as the remote itself. A shortcut that was reasonable decades ago has quietly become a live problem, held in place by the fact that nothing about a working gate ever prompts anyone to replace it.

How to protect yourself

The fix here is refreshingly concrete, because it reduces to a single question you can actually answer about your own gear, and then one decision based on the answer.

If you own the gear

• Find out whether your remotes are fixed or rolling code. If a gate, garage, or barrier still uses fixed codes, that is the thing to replace, and any modern rolling-code system removes the easy attack outright. When you buy or install, ask specifically for rolling-code (hopping-code) remotes.
• For gates and shutters, prefer controls where the remote and receiver prove themselves to each other on every use, instead of just repeating a code.
• Treat your remote like a key. Do not press it needlessly in front of strangers, and do not leave spare fixed-code remotes sitting in an unlocked car where they can be lifted or copied.
• For car keys, the rolling code already handles replay, so the separate worry on keyless-entry cars is a relay attack, where the car is fooled into thinking the key is right next to it. A signal-blocking pouch (a Faraday pouch) shuts that down, but only while the key is actually in it. The usual mistake is leaving the fob by the front door, where it can still be relayed through the wall.

If you are buying for a business

• Roller shutters, barriers, and access gates belong on rolling-code or properly encrypted controls, and old installs are genuinely worth auditing. An upgrade costs far less than one night of stolen stock, and it is the rare security fix that pays for itself the first time it would have mattered.

Doing it with the Evil-M5Project

Evil-M5Project, the firmware I build, pairs with a small CC1101 radio add-on (a plug-on radio board) to work across the common sub-GHz bands, and the Sub-GHz menu is built for understanding signals on gear you own, not for mischief against anyone else’s.

• Read (decode) listens and identifies the protocol automatically, and it reports whether what it is hearing is a fixed or a rolling code. That is the « fixed or rolling? » question answered in about thirty seconds, on your own remote, which is usually the whole point of the demo.
• Read RAW records any signal to the SD card and Saved replays it. The files use the .sub format the Flipper Zero uses, so they move cleanly between tools.
• The Spectrum Analyzer and Waterfall give you a visual view of what is transmitting around you, which is genuinely handy for spotting interference or an unknown transmitter.
• Gates is read-only: it identifies common gate and shutter remotes without transmitting anything at all. OpenSesame brute-forces simple fixed-code garage remotes, which works only because a fixed code is a tiny space, a handful of switch positions, and every combination can be crammed into one short transmission. It is a blunt way to show, on your own door, how little a fixed code actually protects.

There are also research decoders for things like tire-pressure sensors and a few car-key families, and those are for analysis, not casual use. There is a Tesla-code sender built on the RFunit too, but I will be straight about it: it is a proof of concept, and in practice it does not seem to actually do anything, so I only mention it so you do not go in expecting a party trick. The honest limits are simple. Replay beats fixed codes and nothing else, so against a rolling-code remote a recorded message is dead on arrival. A Faraday pouch protects a car key but does nothing for a fixed-code gate, which needs replacing, not shielding. And transmitting on these bands is usually only legal on your own equipment, so keep it there.

Evil-M5Project is for ethical and educational use only. Only capture or transmit on gear and frequencies you own or are clearly authorized to test, never jam, and stay inside the law where you are.

Firmware and docs: https://github.com/7h30th3r0n3/Evil-M5Project.

Fixed, or rolling?

Almost everything in this episode comes down to one question you can put to any remote you own, and it is worth internalising because it is so much simpler than the attack it defeats. The fixed kind is a recording waiting to happen, and the fix has existed for years in the shape of rolling codes. If you have an old gate or roller shutter from before rolling codes were standard, that is the one to replace, and it is not a close call.

I build the sub-GHz tools into Evil-M5Project so you can hold a remote up to a reader and get the answer in half a minute, and see for yourself what a fixed code is actually worth. Once you have watched your own ten-year-old shutter remote get captured and replayed on a bench, in a controlled test, the words « rolling code » stop being jargon and start being the only spec you care about the next time you buy a gate.