Revealed: car industry was warned keyless vehicles vulnerable to theft a decade ago
Revealed: car industry was warned keyless vehicles vulnerable to theft a decade ago
Experts alerted motor trade to security risks of ‘smart key’ systems which have now fuelled highest level of car thefts for a decade
Experts alerted motor trade to security risks of ‘smart key’ systems which have now fuelled highest level of car thefts for a decade.
You're viewing a single thread.
Well that's why i don't like keyless vehicles, it's easy to stole it with some wireless signal emulator
In the end the principle is same like wireless garage door opener, some thieves can hijack it very easily like no effortDo you not know what rolling codes are?
I have a question. What do you think a rolling code style security system does if the thief is amplifying your key fobs signal by standing in your driveway at 3 am and then transmitting it to your door lock? Because we're talking about keyless entry where you don't have to push any buttons on the key fob it just has to be within three feet of the vehicle. They are literally using your key to unlock your door. The key is always transmitting. The vehicle is always receiving. At the point where they have access to the interior of the vehicle they can just pull the fuses for the horn and lights and then pop the transmission shifter cable off the transmission control lever and manually put the car in neutral. This attack takes maybe ten minutes. At that point they can literally just roll the car onto a flatbed and drive away. The flipper zero costs $169 USD. But you can make one from parts for much less. A GPS blocking tool costs around $15. A signal repeater isn't expensive either. Keyless entry on the whole is broken.
You may stop joyriders and petty thieves. But you won't stop anyone looking to steal a car who has the know how and who is looking to sell your car for parts. The fact is, a lot of premium cars are vulnerable to attacks like this.
And before you even start about what I know about it, literally I'm an avionics tech. Rolling codes and frequency hopping is how we keep unfriendly forces from listening in on comms. Electronic attack and defence is literally what I did in the Navy for twelve years.
Rolling codes are a good security feature. But they do nothing to stop the attack that other articles on this subject better explain.
https://www.cbsnews.com/news/cars-hacked-stolen-keyless-vehicle-thefts/
Did you read OPs article or the ones you linked?
I went to the ARS one and it's talking about CAN hacking which requires a physical connection...
It's a great article, but if it has anything to do with this conversation and if anything backs me up. It's about all the work thieves are going thru because rolling keys beats emulators.
C'mon man, even if you know what you're talking about about (doesn't seem to be the case) you still gotta read your own articles.
The articles I linked do explain how they can start a car in order to drive it away using the CAN injection hack. But they also talk about the key signal repeater attack which would give them access to the interior of the car which does two things. The first is that it allows them to have access to the hood release and thereby the horn and the fuse box. Pulling the connector to the horn, or the fuse that gives the horn and lights power will make it so even if the alarm activates it can't sound. It also gives them Access to the transmission select lever which allows them to physically put the car in neutral. With the use of a GPS jammer it would prevent the car from sending it's location anywhere. Rolling codes prevent them from walking by you in the grocery store, recording the code your fob was putting out at that moment and then using that code later to enter your vehicle and drive away with it. It does nothing to prevent the kind of attack ops article is alluding to.
https://driving.ca/features/feature-story/where-do-you-park-your-car-keys-preventing-relay-attacks
"The research uncovered a form of keyless vehicle theft neither researcher had seen before. In the past, thieves found success using what’s known as a relay attack. These hacks amplify the signal between the car and the keyless entry fob used to unlock and start it. Keyless fobs typically only communicate over distances of a few feet. By placing a simple handheld radio device near the vehicle, thieves amplify the normally faint message that cars send. With enough amplification, the messages reach the nearby home or office where the key fob is located. When the fob responds with the cryptographic message that unlocks and starts the vehicle, the crook's repeater relays it to the car. With that, the crook drives off." This quote is directly from the Ars Technica article.
Isn’t that what the Flipper Zero is for ;-) Kia notwithstanding it’s not that easy. But the relay attacks have been around since at least 2018 and I suspect years longer.
For garage doors... Yeah, it's been a thing
Because you can sit something there, monitor the rolling codes, then inject so it has a real one.
For a car, you have to follow them around while they lock/unlock repeatedly. And that's only if people are using the button and not proximity. If they're just using proximity, you're going to have to be standing right next to them.
I think most of the wireless attacks aren't trying to be so sophisticated. They target cars parked at home and use a relay attack that uses a repeater antenna to rebroadcast the signal from the car to the fob inside and vice versa, tricking the car into thinking the fob is nearby. Canada has seen a large spike in this kind of attack. Faraday pouches that you put the fob inside of at home mitigates the attack.
So does not leaving your keys by the front door… not that I follow my own advice :-)
Yeah. Shockingly people store things where it is convenient to have them. :) I'm glad I didn't have a keyless system to with about.
I’m just banking on my car being the least fancy in my complex ;-)
Keyless entry sounds stupid and I’ve totally mocked people for being “to lazy to turn a key.” But pushbutton start makes my slow little Subaru feel like a race car :-)
By keyless entry they don't mean key fobs with buttons you press to unlock. They mean key fobs on cars with a proximity sensor where you can open the door without taking the key out of your pocket.
Relay attacks don't need the key to be in close proximity, they can be read from almost anywhere in the house if they aren't in a faraday pouch or microwave. Have you seen the size of the antennas these attacks use?
I’ve seen a few low res clips over the years… one did use a yagi (Christmas tree looking one?). I’m sure it’s possible, but I don’t think it’s actually a given. I’m not even expert adjacent on this one though 😅
The more recent ones I've seen are pretty funny. It's usually two people with a relay kit: one carrying a massive flexible loop antenna, posing like a starfish walking around the front of the property, and the other beside the vehicle with a wireless keyfob emulator.
Sadly not so funny for the car owners though, AFAIK the vehicles usually end up being broken down into parts. In Canada it's a little different, they seem to be immediately driven to a port and loaded onto a ship for export.
I don't believe this is possible on older cars though, just ones with keyless start. Except if you have a US-spec Kia... where you literally just rip out the lock cylinder and use a USB cable to turn the engine start switch, although I believe they've fitted immobilizers to those now
Also a microwave isn’t a good Faraday cage… at least not mine ;-)
Keyed vehicles are stolen just as easily.
Aren't most keyless cars also keyed? It seems to me that extending the signal of a wireless fob is just easier and quicker.