Thread by @ktemkin

okay; now that we have that remote black-box RE'd; let's cheat a little, and open the remote up! ^_^

https://twitter.com/ktemkin/status/1328758572801425408

The remote's PCB is ultra-simple-- it's literally:

- a single EV1527 control IC
- four buttons
- four diodes
- a crystal
- a switching FET
- an LED
- a PCB antenna

We can guess a lot of this by looking; but it turns out we don't have to-- we can pretty easily grab a schematic!

If we take a moment to look up the part number on the main SO-8 IC, we'll find that it's an EV1527 "OTP Encoder", manufactured by Silvan Chip Electronics.

Looking just a bit further, we can find a short data brief, which happens to contain the schematic for a reference design!

This reference design matches our PCB pretty much exactly; the only minor difference being the 'encapsulation' of the resonating passives used in the transmit circuit in the nice little tin can that is X1.

We now have a very good idea of the circuit we're looking at!

This data brief also gives us a pretty good idea of how this device works: it reads the digital values of four pins, prefixes them with a "chip ID", and then repeatedly sends them out as RF signaling.

The data format we discovered earlier is spelled out right there, for us!

We also get a pretty good idea of how this chip is intended to be used: at some point, each transmitter IC has a unique 20-bit ID "burned in" to it; which uniquely pairs this remote with our lamp.

Ostensibly, at some point, the lamp is also programmed with the ID of its remote.

This is the same type of IC used in lots of little things with fobs -- most commonly in garage door openers.

In fact, with a teensy bit of searching, we can actually find a vendor for this exact remote, just waiting to be paired with a product!

This brings us to perhaps the most amusing fact about this particular lamp: it's vulnerable to an unmodified version of the OpenSesame attack [samy.pl/opensesame/], as implemented here by @samykamkar.

The layers of amusement here grow deeper, though:

This whole bit of post-RE 'poking' came about after I suggested to @michaelossmann that it might be neat for us (@GSGlabs) to blog a "lamp security" exploration.

Ironically, with a little surface-level poking, I quickly found that this lamp was just another OpenSesame target...

... an attack that had been initially implemented as part of @michaelossmann's work on reversing the behavior of his RF garage door opener.

Instead of yet another novel target to explore, we wound up with exactly the behaviors we've seen before -- but this time, in lamp form.

You might be tempted to take away some kind of infosec-y message about the Sisyphean progress of security, or how vulnerable everything is...

...but tbh, I think everything here has worked pretty much as it should. Risk acceptance is as much a part of security as mitigation.

In the end, I think the real message is that reverse engineering these things can be a lot more approachable than you think-- and chances are, the thing you're looking at really isn't that different from a lot of the things folks have worked to understand before. ^_^

In any case, I'm going to put this aside until a second lamp comes in a couple of days; at which point we can play a bit more with treating lamps like garage doors. :)