The first wireless garage door openers were invented and developed by two US inventors at the same time, one in Illinois and the other in Washington state, around 1930. They were unknown to each other. The first garage door opener remote controls were simple and consisted of a simple
transmitter (the remote) and
receiver which controlled the opener mechanism. The transmitter would transmit on a designated frequency; the receiver would listen for the radio signal, then open or close the garage, depending on the door position. The basic concept of this can be traced back to World War II. This type of system was used to detonate remote
bombs. While novel at the time, the technology ran its course when garage door openers became popular. While the garage door remote control transmitter is low power and has limited range, its signal can be received by other, nearby, garage door openers. When two neighbors had garage door openers, then opening one garage door might open the neighbor's garage door as well. The second stage of the
wireless garage door opener system solved the opening-the-neighbor's-garage-door problem. The remote controls on these systems transmitted a digital code, and the receiver in the garage responded only to that code. The codes were typically set by eight to twelve
DIP switches on the receiver and transmitter, so they allowed for to different codes. As long as neighbors used different codes, they would not open each other's garage doors. The intent of these systems was to avoid interference with nearby garage doors; the systems were not designed with security in mind. Intruders were able to defeat the security of these systems and gain entry to the garage and the house. The number of codes was small enough that even an unsophisticated intruder with a compatible remote control transmitter could just start transmitting all possible codes until he found one that opened the door. More sophisticated intruders could acquire a black box master key that automatically transmitted every possible code in a short time. An even more sophisticated method is known as a
replay attack. The attacker would use a code grabber, which has a receiver that captures the remote's digital code and can retransmit that digital code at a later time. The attacker with a code grabber would wait nearby for the homeowner to use his remote, capture the code, and then replay the code to open the door when the homeowner was gone. Multicode openers became unpopular in areas where security was important, but due to their ease of programming, such openers are often used to operate such things as the gates in gated apartment complexes. An intermediate stage of the garage door opener market eliminated the DIP switches and used remotes preprogrammed to one out of roughly 3.5 billion unique codes. The receiver would maintain a security list of remotes to which it would respond; the user could easily add the unique remote's code to the list by pressing a button on the garage door opener while activating the remote control. A large number of codes made the brute force try-all-possible-digital-codes attacks infeasible, but the systems were still vulnerable to code grabbers. For user convenience, these systems were also backward compatible with the older DIP switch remote codes, but adding an old technology remote to the security list made the garage door opener vulnerable to a brute force attack to find the DIP switch code. The larger code space approach was an improvement over the fixed DIP switch codes but was still vulnerable to the replay attack. The third stage of garage door opener technology uses a frequency spectrum range between 300–400
MHz and
rolling code (code hopping) technology to defeat code grabbers. In addition to transmitting a unique identifier for the remote control, a sequence number and an encrypted message are also sent. Although an intruder could still capture the code used to open a garage door, the sequence number immediately expires, so retransmitting the code later would not open the garage door. The encryption makes it extremely difficult for an intruder to forge a message with the next sequence number that would open the door. Some rolling code systems are more involved than others. Because there is a high probability that someone will push the remote's button while not in range and thus advance the sequence number, the receiver does not insist the sequence number increase by exactly one; it will accept a sequence number that falls within a narrow window or two successive sequence numbers in a much wider window. Rolling code technology is also used on car remote controls and with some internet protocols for secure sites. The fourth stage of garage door opener systems is similar to third stage, but it is limited to the 315 MHz frequency. The 315 MHz frequency range avoids interference from the
land mobile radio system (LMRS) used by the U.S. military. The following standards are used by units manufactured by
Chamberlain (including LiftMaster and
Craftsman):
Does not apply to keyless entry keypads or universal remotes. Recent Chamberlain garage door openers that have Security+ 2.0 features also use a special serial protocol on wired connections rather than a simple switch closure. The following standards are used by units manufactured by Overhead Door Corporation and its subsidiary
The Genie Company:
Note: There are no standard color codes for the learn button or LED on units manufactured by Overhead Door or Genie. All accessories made for later versions of Genie Intellicode and Overhead Door CodeDodger are backward compatible with previous generations of Intellicode and CodeDodger. == Cloning garage door opener remotes ==