Noooooooo Touch! – Bypassing IR No-Touch Exit Sensors with a...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://sensepost.com/blog/2025/noooooooooo-touch/
• Blog Title: Noooooooo Touch! – Bypassing IR No-Touch Exit Sensors with a Covert IR Torch
• Suggested Section: 😎 Hardware/Physical Access -> Physical Attacks -> IR Proximity Exit Sensor Bypass / Optical Injection Against No-Touch Door Sensors

🎯 Content Summary

This blog post details a practical, hardware-level bypass of cheap infrared (IR) "no-touch" exit sensors that control access-controlled doors. These sensors are typically used on the egress side of doors that require a credential (RFID, fingerprint, etc.) to enter, but only a hand wave to leave. The author reverse-engineers the sensor, characterises its IR signalling, and then builds a covert IR injection device embedded inside a flashlight (torch) that can open such doors from outside by spo...

🔧 Technical Details

IR carrier spoofing against proximity-based exit sensors.
Many low-cost "no-touch" exit sensors emit a near-infrared carrier (≈30 kHz) and rely on a narrow-band IR receiver to detect reflections from nearby objects like a hand. The receiver outputs high when it sees several pulses (typically 4–10) of the correct carrier frequency, and the controller then energises a relay to open the door. Because the receiver does not authenticate the source or direction of the IR, an attacker can remove or ignore the built-in emitter and instead inject a strong, external IR signal with a similar carrier pattern. As long as the external modulation meets the receiver’s pulse and timing requirements, it will be misinterpreted as a valid reflection from a close object, causing the relay to trigger and unlocking the door.

Leveraging post-detection waveforms and burst transmission.
Some sensors change their emitter waveform after they detect a valid ...

🤖 Agent Actions

Summary:

• Added a new “Covert IR Injection Against No-Touch Exit Sensors” section to src/hardware-physical-access/physical-attacks.md detailing how ~30 kHz IR exit sensors operate, how their post-detection waveform can be replayed with gated bursts, and how reflections plus high-power LEDs enable long-range triggering.
• Documented the covert flashlight/torch build (ATtiny412 driver, MOSFET-switching IR LED, haptic feedback, modulation cycling) and provided practical mitigations for defenders.
• Updated the References list with the SensePost blog source.

These changes integrate the new hardware attack technique into the existing physical attacks page with proper citing.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://sensepost.com/blog/2025/noooooooooo-touch/

Content Categories: Based on the analysis, this content was categorized under "😎 Hardware/Physical Access -> Physical Attacks -> IR Proximity Exit Sensor Bypass / Optical Injection Against No-Touch Door Sensors".

Repository Maintenance:

• MD Files Formatting: 909 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge