BEGIN:VCALENDAR
CALSCALE:GREGORIAN
PRODID:-//Apple Inc.//iOS 6.1.3//EN
VERSION:2.0
BEGIN:VTIMEZONE
TZID:Europe/Berlin
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DESCRIPTION:Hoermann BiSecur is a bi-directional wireless access control system “for 
 the convenient and secure operation of garage and entrance gate operators\,
  door operators\, lights […]” and smart home devices. The radio signal 
 is AES-128 encrypted and the system is marketed to be “as secure as onlin
 e banking”. In comparison to conventional and often trivial to break wire
 less access control systems\, the system should thus make it practically in
 feasible to clone a genuine transmitter so that attackers can get unauthori
 zed access. We used the low-cost CCC rad1o software defined radio (SDR) pla
 tform to intercept and analyze the wireless radio signal. We took apart sev
 eral Hoermann BiSecur hand transmitters and subsequently utilized a vulnera
 bility in the microcontroller to successfully extract the firmware. In orde
 r to conduct a security audit\, the extracted firmware was disassembled and
  analyzed so that the encryption mechanism\, the key material\, the cryptog
 raphic operations as well as the RF interface could be reverse engineered. 
 Our security analysis shows that the overall security design is sound\, but
  the manufacturer failed to properly initialize the random seed of the tran
 smitters. As a result\, an attacker can intercept an arbitrary radio frame 
 and trivially compute the utilized encryption key within less than a second
 . Once the key is known to the attacker\, a genuine transmitter can be clon
 ed with an SDR platform such as the CCC rad1o. In addition to unauthorized 
 operation of gates and doors\, there is a likely (although currently untest
 ed) impact on Smart Home appliances that use the BiSecur system. We tested 
 a total of 7 hand transmitters from 3 different model series and with manuf
 acturing dates between 2015 and 2017. All analyzed hand transmitters shared
  the same static random seed and were found to be vulnerable to our attack.
  The vulnerability can easily be fixed so that future hand transmitters and
  radio transmission are protected from our attack.
DTEND;TZID=Europe/Berlin:20171229T003000
DTSTAMP:20171220T105656Z
DTSTART;TZID=Europe/Berlin:20171228T233000
LAST-MODIFIED:20171220T105651Z
LOCATION:Saal Clarke
SEQUENCE:0
SUMMARY:Uncovering vulnerabilities in Hoermann BiSecur - Markus Müllner\, Markus K
 ammerstetter
TRANSP:OPAQUE
UID:7f293cf6-6d19-43ed-8aa7-7371e008bd45@frab.cccv.de
URL;VALUE=URI:https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9029.html
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:Reminder
TRIGGER:-PT1H
UID:344159A6-C0F3-4949-A79E-F98C3DD4B6C8
X-APPLE-DEFAULT-ALARM:TRUE
X-WR-ALARMUID:344159A6-C0F3-4949-A79E-F98C3DD4B6C8
END:VALARM
END:VEVENT
END:VCALENDAR
