brute-force attack project

Discussion in 'The Projects Forum' started by trivedipy, Sep 22, 2011.

  1. trivedipy

    trivedipy Thread Starter New Member

    Joined:
    Sep 21, 2011
    Messages:
    3
    hi guys,
    I have to develop a prototype for a device to perform a 'brute-force' attack upon a keypad entry system.The device may assume a keypad of 3 columns and 4 rows. It may also assume a pass-code of 4-6 key-presses. The device will be required to press the keys and record (sound) the result - to differentiate valid guesses from invalid.

    The device may sequentially try various keystrokes in order to determine the correct 'combination'. It is this guessing (trial-and-error) which makes it a 'brute force' technique.

    We are told that we can buy a lock with 9 keys-keypad on it and then use a solenoid to press and try different combinations.
    Can anyone help us with what the block diagram will be and how the circuit will be? We are told to use a pic controller for this project. We can offer rewards as well.
  2. strantor

    strantor Well-Known Member

    Joined:
    Oct 3, 2010
    Messages:
    3,659
    Location:
    Houston tx
    How is this "trial and error"? does the "attacked" keypad give you audible feedback if you are "close"? does it make a different sound when you get one of the numbers correct, and then a different sound if you get two numbers correct, like "hey, your guesses are getting closer! don't give up yet!"? or does it just beep (or do nothing) when you get it wrong? and do you have to press *, then the 4-6 digit code, then #? if so, you would have to go through every 4 digit combination (10,000 different combinations) then every 5 digit combination (100,000) then every 6 digit combination (1,000,000) so if some idiot made their comination 999999, then your little solenoid filled "brute force" box would have to sit there and pound out 1,110,000 combinations. how long would that take? I can just see it there for weeks on end going "tikkatikkatikkatick" and then you have to worry about your quarry coming home and seeing this hideous kludge attached to his front door keypad.
  3. John P

    John P Senior Member

    Joined:
    Oct 14, 2008
    Messages:
    1,329
    Location:
    Massachusetts
    It seems to me Strantor is asking the right questions. If the device truly has to get a random 6-digit number, it will need to be quite a rugged little machine!
  4. trivedipy

    trivedipy Thread Starter New Member

    Joined:
    Sep 21, 2011
    Messages:
    3
    Hey Strantor, Thanks for getting back so quickly. Basically we don't have to worry about how long the device would take to get the right combination. We need to hook up the device to a keypad entry system which just make the beep sound for the correct combination and do nothing when you get it wrong. The device then detects this beep sound produced by the keypad and stop trying further combinations. Assume a 4 to 6 digit long password. We can use the ready made keypad entry system so we only need to worry about the device for now. The device should use the solenoids to press keys on the keypad and a PIC controller to drive the solenoids. Any help would be greatly appreciated.
  5. strantor

    strantor Well-Known Member

    Joined:
    Oct 3, 2010
    Messages:
    3,659
    Location:
    Houston tx
    ok then, here is a link to a standard type of keypad you will find in security systems:
    http://www.storm-interface.com/product_attachments/1000Series.pdf
    look at the dimensions, 19mm between keys centers. that means your solenoids can't be bigger than 19mm across. that's a tall order. they are normally fat squatty things. this is the closes one I could find, at .77in across (19.5mm) http://www.newark.com/ledex/195205-...Popular Solenoids&MER=PPSO_N_P_Solenoids_None
    you'll need 11 of them (assuming you need to push # and *, that's pretty normal).
    you'll need 12V to drive them, and count on including a few deep cycle marine batteries in your project because these draw 7W each and they'll be clicking away for weeks. next you'll need some NPN transistors (or N-channel MOSFETs) to switch them and diodes across them. other than that, the code should be simple.
  6. strantor

    strantor Well-Known Member

    Joined:
    Oct 3, 2010
    Messages:
    3,659
    Location:
    Houston tx
    you would save yourself a lot of heartache if you ditch the solenoids, bust the face off the keypad to get at the keypad matrix wires and send signals straight from your micro into the security circuit. but I wouldn't know. and just to make your day, some security systems have a timeout period if you get the code wrong too many times, it won't accept keystrokes for X amount of time. you need to know how many times it takes to lockout and how long the lockout is (that is, if it's not a random amount of time) so your micro can account for that, otherwise your micro could send the correct password during a lockout period and then after weeks of waiting, the thing has cycled through all 1.1 million combinations and it still hasn't unlocked. and factoring in this delay means instead of weeks, it could take months or years to get it open. also make sure you know the format. I've mentioned the *......# format already because its most common, but there are others. if you don't know the format then you have try all the formats which could take you into the billions of combinations.
  7. trivedipy

    trivedipy Thread Starter New Member

    Joined:
    Sep 21, 2011
    Messages:
    3
    Thank you very much for your help on this. Solenoids seems to be bit costly to me, so do you think there is any way to make such a device without using solenoids?
  8. strantor

    strantor Well-Known Member

    Joined:
    Oct 3, 2010
    Messages:
    3,659
    Location:
    Houston tx
    yeah, like I said:

    It would be waaay faster. in the grand scheme of things, solenoids are really slow, beastly metallic fingers chugging in and out one at a time. if you interfaced your circuit directly with the security circuit, you could send thousands of passcodes per second.
  9. kubeek

    kubeek AAC Fanatic!

    Joined:
    Sep 20, 2005
    Messages:
    3,717
    Location:
    Prague, Czech Rep
    Probably not, if the lock isn´t completely stupid it will have some delay after the wrong entry.
  10. strantor

    strantor Well-Known Member

    Joined:
    Oct 3, 2010
    Messages:
    3,659
    Location:
    Houston tx
    Yes, I've already pointed that out, but I think we're ignoring all real-world aspects for this little exercise in futility
  11. kubeek

    kubeek AAC Fanatic!

    Joined:
    Sep 20, 2005
    Messages:
    3,717
    Location:
    Prague, Czech Rep
    I don´t think this is an excersise in futility, I recently saw a nice video of about the same thing used to brute force unlock an Ipad or something similar. I think it used solenoids to tap on the touchscreen and probably some camera to check if it is unlocked yet. Wish I could find it..
  12. THE_RB

    THE_RB AAC Fanatic!

    Joined:
    Feb 11, 2008
    Messages:
    5,435
    Agreed! I designed one with a timeout that doubled, so first wrong entry got you a 15 second timeout, followed by 30 secs, 60 secs, 2 mins, 4 mins etc. From memory I think I capped it at about half an hour timeout max. With 6 hexadecimal digits giving about 16million combinations.

    Good luck brute forcing that lock!
  13. tgotwalt1158

    tgotwalt1158 Member

    Joined:
    Feb 28, 2011
    Messages:
    111
    Location:
    gypsies have no place to live. They just wander an
    It is not practical! No keypad can withstand of the destructive force of millions of mechanical key strokes required to decipher an unknown code with the help of brute force decoding technique. Tell them this and ask for any alternate practical project!
  14. wayneh

    wayneh AAC Fanatic!

    Joined:
    Sep 9, 2010
    Messages:
    8,539
    Location:
    Roscoe, IL
    Why? Who's forcing you?

    How do we know you're not trying to get us to pick locks for you? (Not that I'm much worried about the success of this approach.) ;)
  15. nsaspook

    nsaspook Senior Member

    Joined:
    Aug 27, 2009
    Messages:
    1,274
    Location:
    Fairview, Oregon
  16. THE_RB

    THE_RB AAC Fanatic!

    Joined:
    Feb 11, 2008
    Messages:
    5,435
    Nah, you need those Hollywood keypad door locks where any damage to the keypad (like shooting it or smashing it) causes the door to open. ;)

Share This Page