Flipper Zero: Hacking Parking Barriers&Gates (Guide)

Flipper Zero: Hacking Parking Barriers & Gates

Parking barriers and gate remotes are one of the most reliable Sub-GHz wins in physical pentesting. Most systems are fixed-code or use weak rolling codes, and the Flipper handles them cleanly. Here's a guide on hacking parking barriers & gates with the Flipper Zero.

The Parking Gate Landscape

Parking systems lag behind building access control by about 20 years. While offices moved to MIFARE DESFire, the parking gate out back is still running a 24-bit Princeton fixed code from 2003.

System	Protocol	Frequency (US)	Frequency (EU)	Attack Difficulty
Generic fixed-code	Princeton, PT2262, EV1527	315 MHz	433.92 MHz	Trivial replay
LiftMaster / Chamberlain	Security+ 1.0 (fixed)	315 / 390 MHz	433 MHz	Replay
LiftMaster Security+ 2.0	Rolling code	315 / 390 MHz	433 MHz	Jam-and-grab
CAME	CAME fixed/rolling	—	433.92 MHz	Replay or brute force
Nice FLO	Nice FLO-R	—	433.92 MHz	Replay or brute force
Linear / Multi-Code	Fixed DIP	318 MHz (US)	—	Trivial replay
Doorking	Fixed DIP	318 / 433 MHz	433 MHz	Trivial replay
FAAC	FAAC RC	—	433.92 MHz	Replay
Sommer	Rolling (Keeloq)	—	433.92 / 868 MHz	Jam-and-grab
Hörmann	Rolling	—	868 MHz	Jam-and-grab
Beninca	Fixed	—	433.92 MHz	Replay
BFT	Rolling	—	433.92 MHz	Jam-and-grab

Phase 1: Frequency Reconnaissance

You need to determine what frequency the gate controller uses before you can do anything else.

Method A: Frequency Analyzer (On-Device)

bash

# Flipper → Sub-GHz → Frequency Analyzer
# Hold Flipper near your body, antenna pointed at the gate/barrier
# Have someone press the legitimate remote
# Watch for the spike — it'll jump 30-60 dB above the noise floor

# Common spikes:
# 315.00 MHz — Most US garage/gate systems, LiftMaster, Linear
# 318.00 MHz — Linear/Doorking/Multi-Code (US)
# 390.00 MHz — LiftMaster Security+ 2.0 (US)
# 433.92 MHz — Nearly all European systems, CAME, Nice, FAAC
# 868.30 MHz — Hörmann, Sommer, newer EU systems
# 310.00 MHz — Some older US systems

If the Frequency Analyzer doesn't register, the remote might be using a very short burst. Switch to Read mode and try all common frequencies manually.

Method B: Read Raw Across Common Frequencies

bash

# Flipper → Sub-GHz → Read
# Set config: AM650 (for ASK/OOK modulation) or FM238 (for FSK)
# Go through the hit list:

# US List:
# 315.00 MHz → Read → press remote → check for signal
# 318.00 MHz → Read → press remote → check
# 390.00 MHz → Read → press remote → check
# 310.00 MHz → Read → press remote → check

# EU List:
# 433.92 MHz → Read → press remote → check
# 868.30 MHz → Read → press remote → check

# If no signal on any of these: the remote might be rolling code
# with a very short transmission. Try:
# Sub-GHz → Read → increase RSSI threshold to minimum
# Or use a HackRF for wider spectrum analysis

Phase 2: Capture and Classify

Step 1: Raw Signal Capture

bash

# Once frequency is known:
# Flipper → Sub-GHz → Read
# Frequency: [your discovered frequency]
# Modulation: AM650 (default — works for most gate remotes)
# Press and hold the remote 2 inches from the Flipper

# Save the capture: "gate_signal_1"

# Press the remote again, capture a second time
# Save as: "gate_signal_2"

# Now compare them:
# Flipper → Sub-GHz → Saved → gate_signal_1 → Info
# vs gate_signal_2 → Info

# Look at key bits / data payload:
# Identical both times → FIXED CODE (replay wins)
# Different each time → ROLLING CODE (needs other approach)

Step 2: Protocol Auto-Detection

Flipper firmware auto-identifies many protocols:

bash

# After capturing, Flipper shows protocol name in the saved file info:
# "Princeton 24bit" — 24-bit fixed code, 4-bit key + 20-bit address
# "CAME 12bit" — CAME fixed or KeeLoq variant
# "Nice FLO 12bit" — Nice FLO fixed
# "BETT" — Beninca
# "Linear" — Linear Multi-Code, 10 DIP switches
# "Security+ 1.0" — Old LiftMaster, fixed 19-bit
# "Security+ 2.0" — Newer LiftMaster, rolling code
# "Keeloq 64bit" — Microchip Keeloq, may be rolling
# "Hormann HS1/2/4" — Hörmann rolling

# If Flipper says "Unknown" — that's fine. The raw signal is still replayable.

Phase 3: The Attacks

Attack A: Fixed Code Replay

If signals 1 and 2 are identical, or the protocol is known fixed-code:

bash

# Flipper → Sub-GHz → Saved → gate_signal_1
# Position yourself near the barrier/receiver
# Press Send
# Gate opens → documented successful replay attack

# If range is poor with stock Flipper antenna:
# Use external CC1101 module on GPIO
# Sub-GHz → Radio Settings → External
# Now you have 20 dBm output with PA/LNA module
# Range increases from ~10m to ~100m+

Attack B: Princeton Protocol — DeBruijn Brute Force

Princeton 24-bit (PT2262) is the most common fixed-code protocol for gates and barriers globally. The 24 bits break down into an address (typically hard-coded via DIP switches on the receiver) and a key/button code.

With Unleashed firmware, the Flipper can run a DeBruijn sequence — a clever bit string that covers all possible codes in minimum time:

bash

# Unleashed firmware required
# Sub-GHz → Bruteforcer → Princeton 24bit

# DeBruijn sequence transmits every possible code as overlapping
# substrings of the full sequence
# Total time for full 24-bit space: roughly 4-8 hours
# But practical time is much shorter:
#   - Many receivers don't use all address bits
#   - Many use standard address configurations (all switches ON, all OFF, etc.)
#   - If you know the address from DIP switch visual inspection, you
#     only need to brute-force the button code (4 bits)

Visual recon for Princeton systems: If you can physically access the receiver box, look for DIP switches. A 10-position DIP switch is a Princeton address. Photograph it. Now you know the exact address and only need to brute-force the 4-bit button code — 16 possibilities. Instant.

Attack C: CAME Fixed Code Brute Force

CAME systems are dominant in European parking barriers. Older CAME (12-bit) uses a fixed code:

bash

# Unleashed firmware: Sub-GHz → Bruteforcer → CAME 12bit
# 12-bit keyspace = 4096 codes
# At ~2 codes per second = ~34 minutes full sweep
# Many installers leave the default code or use a small range

# CAME remote teardown:
# If you find a CAME remote, open it
# The code is often written on a sticker inside
# Or set via DIP switches (older models)
# Or programmed via button press sequence (newer)

Attack D: Rolling Code — Jam-and-Grab

For Security+ 2.0, Keeloq, or other rolling codes where replay of a single capture fails:

Hardware requirement: Two Flippers, or one Flipper + HackRF/CC1101 jammer. The Flipper's CC1101 is half-duplex and cannot TX and RX simultaneously.

bash

# SETUP:
# Device A (Jammer): Sub-GHz → Read Raw → continuous wave at target frequency
#   - Or HackRF: hackrf_transfer -f 315000000 -x 40 -a 1 -t /dev/zero
# Device B (Capture): Sub-GHz → Read at target frequency

# ATTACK:
# 1. Start Device A jamming continuously
# 2. Victim presses remote — car doesn't open (signal jammed)
# 3. Victim presses remote again
# 4. Device B captures the SECOND press cleanly
# 5. Victim presses remote a third time — gate opens (they think it was glitchy)
# 6. Stop jamming
# 7. Device B: Send the captured code ONE TIME
# 8. Gate opens

# WHY THIS WORKS:
# The rolling code counter increments with each press.
# Press 2's code was never received by the gate (jammed).
# Press 3's code was received (gate opened).
# Press 2's code is still "in the window" — the gate accepts it.
# Most systems accept codes within a forward window of 256-1024
# to handle accidental button presses out of range.

Single Flipper workaround (timing-dependent, ~30% success):

bash

# Sub-GHz → Read → Raw
# Stand between the remote user and the gate
# Your body attenuates the signal enough that the gate may not receive it
# But the Flipper (closer to you) captures it fine
# This is unreliable and looks suspicious — use proper hardware

Attack E: Somfy RTS / Simu Hz — Rolling Code Reset

Some barrier systems (especially roller shutters and vehicle gates from Somfy, Simu) have a protocol-level vulnerability where a specific sequence puts the receiver in programming mode:

bash

# This is protocol-specific and requires:
# 1. Identifying the exact protocol (Somfy RTS vs Simu Hz vs io-homecontrol)
# 2. The receiver may have an exposed programming button
# 3. Sending the pairing sequence at the right moment

# Practical: if you find a physical programming button on the receiver,
# press it + transmit your Flipper's captured signal within 30 seconds.
# Your Flipper is now a paired remote.

Phase 4: Physical Reconnaissance

Walk the perimeter before transmitting anything.

What to Document

Observation	Pentest Value
Receiver box visible	Photograph. Look for DIP switches through clear cover.
Brand/model of barrier arm	Identifies the protocol. FAAC, CAME, BFT, LiftMaster, DoorKing.
Receiver antenna	External whip antenna = Sub-GHz. Small box = might be 868 or rolling.
Keypad on pedestal	Codes are often 4-digit. Test common PINs (1234, 0000, street number).
Emergency release	Manual chain/crank. Often accessible with a coat hanger or screwdriver.
Vehicle loop detector	Cut in the asphalt. Boiling water + metal plate can trigger it.
Fire department access	Key switch or optical sensor. FD often has universal keys.
Maintenance panel	Often unlocked. May have override buttons.
Adjacent pedestrian gate	Often the weak link. Clone badge, walk through, open barrier from inside.

Emergency Release Assessment

Most barriers have a manual release for fire department access. Test:

bash

# Chain pull: accessible from above with a wire hook?
# Crank handle: behind a panel with a standard key?
# Disengage motor: does the arm swing freely? Counterweight?
# Optical fire strobe sensor: point a flashing light at the sensor
#   (some systems use an optical sensor triggered by emergency vehicle strobes)

Phase 5: Advanced Protocol Analysis

For when Flipper auto-detection fails.

Export and Analyze the Raw Signal

bash

# Export .sub file via qFlipper to your computer
# The .sub file contains: frequency, modulation, raw timing data

# Parse with Python:
python3 << 'EOF'
import sys

with open("gate_signal_1.sub", "r") as f:
    data = f.read()

# Look for the RAW_Data section
# Format: positive_pulse, negative_pulse, positive_pulse, negative_pulse...
# These are microsecond timings

# Count pulses, look for:
# - Total bit length
# - Preamble (long pulse + long gap)
# - Sync word
# - Data payload pattern
# - Repeating pattern within transmission
print("Raw data extracted:")
for line in data.split("\n"):
    if "RAW_Data" in line or "Frequency" in line or "Protocol" in line:
        print(line)
EOF

Universal Radio Hacker (URH)

For unknown protocols, URH on a laptop with an RTL-SDR or HackRF connected:

bash

git clone https://github.com/jopohl/urh
cd urh
python3 -m urh.main

# 1. Record signal with HackRF at target frequency
# 2. URH auto-detects modulation (ASK/FSK/GFSK)
# 3. Demodulate to bitstream
# 4. Look for repeating patterns
# 5. Identify preamble, sync word, data, CRC
# 6. Generate replay signal
# 7. Transmit with HackRF

Phase 6: Post-Access - Chain Your Attacks

Opening the parking barrier is rarely the final objective. Use it:

bash

# 1. BARRIER OPEN → vehicle or foot access to the building perimeter
# 2. Walk to the loading dock / employee entrance
#    (often less secured than the front door)
# 3. Clone an LF badge from someone arriving
#    (125 kHz RFID → Read) — you're now near employees holding badges
# 4. Tailgate through the door
# 5. Now inside: deploy the full internal pentest

# Alternative:
# 1. BARRIER OPEN → access the parking management office
# 2. The office often has:
#    - Spare remotes in a drawer
#    - Receiver programming instructions
#    - Master codes on a post-it
#    - Network-connected parking management PC
# 3. Pivot from parking PC to corporate network (often same VLAN)

Hardware Builder: Parking Gate Pentest Kit

bash

# MINIMAL KIT ($200):
# - Flipper Zero (stock)
# - T5577 cards (for LF badges you'll find inside)
# - Screwdriver set (for receiver panel access)
# - Camera (document DIP switches, model numbers)

# STANDARD KIT ($350):
# - Above +
# - CC1101 external module + 3dBi antenna (extended Sub-GHz range)
# - HackRF One (rolling code jam-and-grab capability)

# FULL KIT ($600):
# - Above +
# - Second Flipper Zero (dedicated jam-and-grab without laptop)
# - Proxmark3 (for HF badge attacks inside)
# - USB battery pack 20000mAh (long-duration brute force)
# - Telescoping inspection mirror (read DIP switches through enclosure)

Reporting Template

markdown

## Finding: Parking Barrier Vulnerable to Signal Replay

**Asset**: Parking Barrier — [Location / Gate ID]
**Manufacturer**: [FAAC / CAME / LiftMaster / DoorKing / etc.]
**Model**: [From visual inspection]

### Technical Details
- **Frequency**: 433.92 MHz
- **Modulation**: ASK/OOK (AM650)
- **Protocol Identified**: CAME 12-bit fixed code
- **Signal Type**: Fixed code — identical on all captures

### Attack Performed
1. Captured legitimate remote transmission using Flipper Zero
   from 20 meters distance (passive, no interaction with target)
2. Verified signal identical across multiple captures
   (fixed code confirmed)
3. Replayed captured signal at barrier receiver
4. Result: Barrier opened successfully. No challenge-response
   or rolling code. No logging of unauthorized access.

### Impact
- Any person within RF range of the parking area can:
  - Capture a valid code during legitimate use (passive, undetected)
  - Replay it at any time for unauthorized entry
- The remote uses no encryption, no rolling code, no authentication
- No audit trail distinguishes authorized from replayed access

### Physical Weaknesses
- Receiver box accessible at [location]
- Emergency release chain accessible with wire hook
- Adjacent pedestrian gate uses LF prox (EM4100) — cloned in seconds

### CVSS Score: 8.6
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Remediation
1. Immediate: Upgrade receiver to rolling code (Keeloq AES or similar)
2. Short-term: Add keypad PIN + remote (two-factor at entry)
3. Medium-term: Install camera-based license plate recognition
   with logging, alert on unrecognized plates
4. Long-term: Integrate parking access into corporate badge system
   (MIFARE DESFire with mutual auth)
5. Physical: Secure receiver enclosure with tamper switch. Secure
   emergency release against casual access.