Hacking shopping carts with RF signals / 2023-08-28

My favourite mix of subjects: security (or lack of security) and RF signals.

Joseph Gabay has researched how shopping carts with wheel locks are locked and unlocked, and found out it's really easy to replay these signals. The signals for the shopping carts with wheel locks from Gatekeeper systems are at 7.9 kHz (ELF or extremely low frequency) and at 2.4 GHz (UHF or Ultra High Frequency and the license free range also used by WiFi and Bluetooth).

After a lot of work with a coil to act as a (bad) antenna for 7.9 kHz he found out the magnetic field of a speaker in a smartphone can also create the field and do replay attacks via audio files.

All of this at Control Shopping Cart Wheels With Your Phone! including the video of the Defon 29 presentation about this.

Now I really wonder how the shopping carts at our nearby supermarket work! I know it is a wire loop in the parking lot, I've seen the loop transmitter in the supermarket.

Found via Issac Kelly: "Somebody linked this to me rec…" - Mastodon

Update

The nearby supermarket uses the Rocateq system which operates on 8.13 kHz. So I can probably do the same replay attacks to these carts. Found by taking a picture of the loop transmitter in the supermarket and checking for the name in some variations at the searchable FCC ID Database and finding COP Caster STD&OCS; COP User Manual Zhuhai Rocateq Technology which lists the VLF frequency: 8.13 kHz.