Enhancing security of PT2272/SC2272 based remote control 315MHz/433MHz modules - Page 1
Forum section: electronics / projects

author: eneuro
author_rank: Super Contributor
timestamp: June 09, 2015, 09:25:23 pm
content: Hello,I've in hands those cheapy PT2272/SC2272based remote control315MHz/433MHz modules amrked sometimes asIC2262/2272 4 Channel Wireless Remote Control KitsBefore turning them on, made of course quick teardown of transmiter and receiver, while after watching a few YT video I sensedstatements like that... those 4 channel modules can't be used to control different things using the same buttons on two similiar transmitersIt was worth to see datascheets of those PT2262-M4/SC2262-M4 remote control transmiter ICs and receiver PT2272-M4/SC2272-M4 shown in teardown below:Why? Because of now we know, that those sold remote control modules comes with... fixed code but... THIS CODE IS THE SAME since those floating 8 pins marked gold below means there is the same code unless... someone makes teardown like me and... eg. solder random pins and pull up/pull down to VCC/GND those floating pins, which tri-state address pins providing amaximum of 531441addres codes, but those crappy sold modules comes probably ALL with the same codeUpdate: Address/data 4 pins A8..A11/D3..D0 are connected to four switches in PT2262-M4 and four data pins in receiver SC2272-M4, so we can define 3^8=6561 possible fixed device addresses.However, another thing I've noticed is that I was not able send at the same time let ssay pressed buttons AB,AC,AD, etc... and trying to figure out why, while it looks like it should be simply different address, since those 4 switches are connected to addres pins A8..A11.It is a little bit disapointing... not chance to press two, three or four buttons ABCD at the same time?That is why arduino fanatics shields folks on some videos was trapped and they believe that... it is not possible use the same button A,B,C,D of two different devices to different actions-of course not when they have the same 8 floating adress pins I've got too (I guess) hopefully made teardown of this thingTransmiter address pins matches....... receiver and are all floating which means those folks uses those dongles woth the same addressNow, reason why I'd like enhance security of those dongles is clear I thinkWe can pull down/up those floating address pins to some addres, but I'd like to use it to control car garage doors, etc, so even it is ~half a milion combinations and difficult to guess, there is of course problem that, someone might try scan RF signal and findout this fixed code without guesssingSo, my idea is simply create something like one time passwords with tokens based on MPU and RTC to... change this adress lets say each 1 minute, so code someone sniff listening to RF will not be valid next time when any control key will be pressedHowever, what do you think are there any traps in such one time address codes and this can be made maybe smarter using some ICs (I mean one time codes)?Anyway, it looks like they let to tristate only adress pins A0..A7 (8 pins) while another 4 address pins A8..A11 are soldered as floating, which means I could have not 3^12=531441 different one time addresses, but only 3^8= 6551, so probably it could be good idea to implement something like two one time adresses needed to make some action using this remote, so someone had to guess within 1minute not only 6551 numbers, but 43046721 which with additional timeouts after missed guess try probably should be fine even for 1 minute period-very little chance to guess two numbers one after previous one without mistakeBTW: If you have the same remote control, it could be fun to see if I'm right and ONLY 8 adress pins A0..A7 adjustable (left floating in this thing) since another 4 are used for those 4 channel switches/data pins

author: eneuro
author_rank: Super Contributor
timestamp: June 11, 2015, 12:06:41 pm
content: Yep, I've made some art work with those remote control PCBs to make them usableUsed random generator and defined those adjustable 8 address pins A0..A7 than soldered all unsoldered pins and pulled up/down/leaved open in transmiter and receiver ICs and now I'm confident that this dongle will not interfere with each other, if two the same were used in similar rempte contoled toysTested and it works as expectedAnyway, for garage door of course no plans to use such easy to scan fixed code RF remote control "keys". Forget about itMessing with those PCBs to implement one way codes probably not worth effort and it will be easier make custom PCB with DIP8/SO8 MPUs which will easy fit into this case, when needed higher security with one way control codes token.