Industrial crane remotes are the chunky orange handsets that move tonnes of steel in factories and yards, and you would hope their radio link is hard to fake. IoT security researcher Matt Brown (Brown Fine Security) reverse-engineered a Telecrane-style remote and its receiver, then wrote an open-source Flipper Zero app that listens to a real remote, learns its ID over the air and sends its own start, stop, up, down and direction commands, which the receiver accepts.
What the remote actually sends
The remotes talk 2-FSK at about 18.9 kbaud, around 849-851 MHz on the two channels he measured. Each frame carries a preamble, a fixed sync word, a 24-bit remote ID and a button mask, and it is repeated for as long as a button is held. Crucially, there is no checksum or CRC, the small error-check value most radio protocols add to every packet, so the receiver accepts any frame with the right sync word and structure. Each remote's serial number, a C followed by a channel digit and six decimal digits, maps straight to its ID bytes and one of 16 channels.
The Flipper's built-in CC1101 sub-GHz radio does both jobs: in Sniff mode it hops the channels, decodes a live remote and saves it, and in transmit mode it sends frames at the real cadence while you hold a button.
Key details
- Target: Telecrane-style industrial crane radio remotes
- Radio: 2-FSK, ~18.9 kbaud, 16 channels; 848.934 MHz and 850.918 MHz measured, the other 14 extrapolated
- Security: fixed 24-bit ID, no checksum or CRC, no rolling code in the frame
- Commands: start, stop, up, down, north, south, east, west, aux 1-4
- Code: telecrane-contol on GitHub, MIT licence, with a full PROTOCOL.md
Our take
The lesson is bigger than one remote: a fixed ID plus no integrity check means anyone who can hear the radio can become the remote. Brown states the app is only for equipment you own or are authorised to operate, and these frequencies are licensed in most regions. For engineers designing wireless control of heavy machinery, this is a clear case for rolling codes and authenticated frames.
Image credit: Matt Brown (YouTube thumbnail), text removed, cropped and resized.
About the author: Aswinth Raj is an electronics engineer and the editor of CircuitDigest, where he has published more than 150 hands-on projects and tutorials across Arduino, PIC, ESP32, Raspberry Pi and EV battery systems. He selects the stories on this page for what engineers and makers can actually learn or build from. Connect on LinkedIn
Add a comment
No account needed. Your comment appears once a moderator has reviewed it.