3 ms·
Both X and X+1 are jammed, then the attacker replays X. The car never sees X+1 to revoke either.
by lunixbochs 9y ago
Both X and X+1 are jammed, then the attacker replays X. The car never sees X+1 to revoke either.
- ipunchghosts 9y agoYes. There is a rolling code both inside your car rx and the fob tx. They get out of sync (think of pushing your car unlock when your car is not around) but the fob can never be behind the car. By jamming the the rx at the car it never gets code X+1 but the attacker does so the car never rolls ahead. Then, the attacker replays X+1 and the car unlocks. This attack has been known for a quite a long time along with the TPMS hack (made famous but rutgers and U South Carolina http://www.sc.edu/news/newsarticle.php?nid=1202#.WRXDdVXythE http://www.sc.edu/news/newsarticle.php?nid=1202#.WRXDdVXythE) https://www.theregister.co.uk/2010/09/21/car_jammer_vehicle_theft_scam/ https://www.theregister.co.uk/2010/09/21/car_jammer_vehicle_...