We Be Jammin’ – Bypassing Chamberlain myQ Garage Doors

McAfee Advanced Threat Research analyzed the Chamberlain MyQ Hub and discovered an RF protocol weakness in the remote door sensor to hub communications: an FHSS OOK-based rolling-code implementation that can be subverted using a Frequency-Hopping Spread Spectrum roll-jam (JIT jamming) technique. Researchers extracted firmware via JTAG, examined local APIs, captured and analyzed the multi-frequency OOK waveform, and demonstrated how selective jamming or automated capture of state transmissions can cause the mobile app to misreport garage state, enabling attackers to open a garage without obvious detection. The report includes attack reproduction details, automation via GNU Radio for a stealthy device, discussion of practical limitations (range, need for proximity, complexity), and notes that Chamberlain was notified and released an app update adding a warning about unreliable door state.