7 ms·
Car key 'relay' attack caught on CCTV
- abcd_f 9y agoWhich manufacturers are affected? -- Edit - this seems to be exploiting the "convenience unlocking" feature, whereby you can unlock the car by having the key in a pocket and standing next to the door. Similarly the car will also allow starting the engine if the key is detected inside of the car, so this too can be done via a relay. But you'll need to have the key continuously present to drive, so I guess the whole scheme would involve a flatbed/tow truck around the corner. -- Edit - I guess one can stretch the relay tether by planting the key-side relay on site, next to the garage door, and have it talk to the car-side counterpart via cell connection. Also as far as countermeasures go - one would probably be to have the key shut down completely it detects no motion for N minutes. Or just have a physical Off switch on it.
- dan1234 9y agoThe car in the video is a Mercedes.
- tjoff 9y agoNot sure if there exists any decent counter-measures.
- RantyDave 9y agoOther than the asymmetric encryption we've had since the 1970's?
- 013 9y agoStore your car keys in a Faraday cage?
- bjelkeman-again 9y agoI do this (a key fob bag with foil). Some cars can disable the regular broadcast from the car too. Then you have to press the button on the key to open the doors.
- janco 9y agoLatency measurement from car side?
- bartkappenburg 9y agoWouldn't help: the latency to the relay box is at least as good as having the physical key nearby.
- icebraining 9y agoThat can't be true, because the request/reply still has to travel all the way to the key and back.
- gambiting 9y agoIf the receiver is accurate enough(we're talking nanosecond precision) then you can absolutely tell if the key is 1m or 10m away, so a relay wouldn't help at all.
- GoToRO 9y agoFrom the video it seems that the car was parked in front of the house and they just amplified the signal coming from the key inside the house. So not exactly a relay attack. The latency increase must be really low.
- deleted 9y ago[deleted]
- benpbenp 9y agoThere are distance-bounding protocols[0], but I don't think anyone has implemented them in something as small as a car key yet. [0] https://en.m.wikipedia.org/wiki/Distance-bounding_protocol https://en.m.wikipedia.org/wiki/Distance-bounding_protocol
- londons_explore 9y agoNFc and wireless credit cards urgently need to implement something like this... It's only a matter of time till NFC credit cards get read with a high power reader and proxied across a cell connection to steal money from someone hundreds of miles away from the thief.
- deleted 9y ago[deleted]
- zaxomi 9y agoHow about having a button on the keyfob, that unlocks and locks the car? Then you don't need to worry about the relay-attack, don't need to worry that you car unlocks just because you walk past it, and don't need a steering lock...
- tjoff 9y agoAt some point you have to ask yourself, why not just use a real key? The "inconvenience" of having to insert the key can't seriously outweigh the issue of forgetting your key in your car (because it was in the wrong bag), driving away from the key. Or the security issues. Or the added cost. I just don't see the appeal even if it worked perfectly. I'd rather pay extra to have it removed.
- consp 9y agoNormal keys are notoriously unsafe and get worse over the years by continuous use (grinding of the locking pins). You can also cover the locking mechanism completely inside the door so no fishing for the lock handle can be done via the window or cracks in the handle. The 'easy unlocking' feature is idiotically simple to fool as shown. Almost the same as in the late '90s when you could just cycle through the ~2-10k combinations on the fobs. My advise would be: use the buttons on the key and disable the easy-unlock feature which can usually be done either in the car's settings or at the garage.
- dazc 9y ago' ...why not just use a real key? ' Because they break into the house to get the key. It's happened to a few people I know - one time they used a wire hook through a partly opened window.
- roel_v 9y agoPolice on the tv here (nl) this morning suggested storing your keys wrapped in aluminum foil...
- dazc 9y agoShouldn't there be some kind of simple disable switch? You might still want keyless entry during the day for routine shopping trips and such but for parking the car overnight you can live without it; and probably sleep a lot better too.
- gambiting 9y agoYou can - I happen to have a Mercedes, so I know as a fact that you can just double-click the lock button on the key to disable the contactless feature completely - the car can then be only unlocked with a physical button press on the fob. I keep my key in a metalic pouch every night as a countermeasure, works just as well. However, there's one concern with it - if a thief tries to steal your car using the relay attack and fails, will they break in and try to steal the physical key(which might lead to confrontation and people getting hurt). It's a risk either way.
- xbmcuser 9y agoA faraday cage key fob holder. Will remove the convenience of just keeping the fob in your pocket though.
- tomalpha 9y agoNot requiring an explicit (or at least conscious) action on the part of the user seems to be the flaw in the process. The countermeasures would appear to be: * blocking the signal using some kind of Faraday cage to store your keys this relies on changing user behaviour, and not forgetting; kinda removes some of the “convenience” factor have some kind of disable switch on the key fob, in which case there’s not a huge difference to a regular remote lock/unlock button * expanding the range of frequencies the key fob uses to try and defeat the range extenders this likely has regulatory issues, and is probably easy to just update the hardware to cope with (if it doesn’t already) have the car do some kind of latency measurement on the challenge/response radio message exchange; given that light travels at 1ns per foot (ish!) the car will have to accurately and precisely measure only a few nanos difference, and not suddenly stop working because of nearby radio echoes in a concrete car park (or whatever) how close to the car is “convenient” to have it unlock automatically? 2 feet (driver standing by car)? 20 feet (kids running ahead to get into car)? * some kind of “parked up at home” mode so that the first unlock of the day requires a button push loses some of the convenience again got to remember to set it (some kind of car locking button again...) * you could have a second type of “anti-key” that you always leave at home, and when in range of this key the car won’t unlock keylessley easy target to block in the arms race or car theft easy to misunderstand as a user less convenience
- matt-attack 9y agoI had thought you offered a thorough exploration of the possible countermeasures, but you missed jgrahamc's suggestion below of adding an accelerometer to the fob. Only unlock when motion is detected. What are you thoughts? Seems that keys are incredible idle when sitting on the kitchen counter, and never perfectly idle when walking to approach your car.
- tomalpha 9y agoI think that’s a neat idea. In my defence, I might put that under the some-kind-of-switch-to-turn-it-off category but only in hindsight ;) Like latency-measurement though I wonder how robust it would be to the vagaries of modern life both in terms of reliability - potential moving parts - and in the face of user expectations - “I keep having to jiggle my keys to open my door” or worse, the dreaded “it doesn’t work!”. Where doesn’t work == doesn’t work how I think it should.
- bestest 9y agoThe relay attack is very old and is very commonly used to steal all kinds of cars, here in Europe it's mostly Toyota. You do not need the key to be present in the car once it's started up. It's a feature of all key-less cars. For example, one would not want the car to suddenly stop if the key's battery dies on the go. So, once you start the engine, it will run. It will complain and beep if the key is not present in the car, but it will run. They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome. A more convenient way is to store your key in a special keyless key protector "pouch" when you're not driving your car, which is basically a Faraday Cage, blocking it's signal.
- abcd_f 9y agoIf the key battery dies, there is a spot on the dashboard that is NFC-equipped, so you just need to get the key next to it and it will ID regardless of the battery state. > It will complain and beep if the key is not present in the car, but it will run. Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.
- CPLX 9y agoYour assumption is incorrect. It will run until the car is turned off. If it behaved as you're assuming it would be wildly unsafe, imagine someone inadvertently dropping off a passenger who has the key with them in a purse or jacket pocket, then stopping briefly on a bridge without shoulders, or a railroad crossing.
- tjoff 9y agoSo now when you are on the highway you need to suddenly search your bag for the key so you can insert it. > Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero. Not in any implementation I've heard of (and it would be quite dangerous and irresponsible). Actually, one story I've heard from pretty much everyone I know owning a keyless car is that the driver drops of a passenger that unknowingly had they key all along (typically a spouse). The driver then drives along, fills up for gas or make some other stop and then can't start the car anymore because the key is with the long gone passenger.
- mrb 9y ago«But you'll need to have the key continuously present to drive» Not true. Virtually all "keyless ignition" cars let you continue to drive when the key is suddenly no longer detected as present in the car. I verified this myself on my 2012 Audi S4, driving 1 km away from home without my key. Think about it. It would be too dangerous if the car suddenly shut down the engine eg. when the key's battery dies or when some random persistent R/F communication failure occurs.
- gambiting 9y agoYep. I've had a situation where I was driving on the motorway and suddenly my car decided that my key was no longer in the car(which obviously was still in my pocket) - and a warning was shown on the dash, but the car continued running. Imagine if it shut down while doing 70mph on the motorway!
- jgrahamc 9y agoAdd an accelerometer to the key and only transmit when moving.
- function_seven 9y agoI had a '94 Corvette that did this. Probably to save on battery life. There was a tiny ball that moved around in the key fob. The fob wouldn't transmit the "hey, I'm here" signal unless it was moving. Not sure what the tech was. Not an accelerometer per se, but still motion detection that worked pretty well.
- abraae 9y agoPerhaps a strain gauge (https://en.wikipedia.org/wiki/Strain_gauge https://en.wikipedia.org/wiki/Strain_gauge), a primitive sort of accelerometer that has been around for donkey's years.
- consp 9y agoIf it is a ball it probably is a ground plate on the bottom and top with sense connector plates on the edge of the box where the ball is in. The ball moves around and if it gets a connection (ground to sense) a counter gets increased and a time gets reset and since you are moving the thing usually moves around and make some connection when braking/accelerating/steering. You need bumpy roads though on longer trips on the highway. Dirt cheap, but unreliable. Straingauges (in my experience) generally need to be tuned for every gauge which makes them somewhat more expensive.
- function_seven 9y agoOh, I think I misread my parent's comment. On my fob, it was purely to unlock the doors when you approached the car. It didn't involve itself with the ignition or running of the car. That was still an old-school key (but with the tiny improvement of a known resistor ohm-age in the key itself†) † http://ricksfreeautorepairadvice.com/gm-anti-theft-systems-overview/ http://ricksfreeautorepairadvice.com/gm-anti-theft-systems-o...
- lexxed 9y agoWhat if i put my car keys in the microwave ?
- GoToRO 9y agoToo extreme. If I understand correctly how it works any metalic enclosure will work. Tinfoil!
- paulhilbert 9y agoBoth of these seem way more complicated than using the buttons to open doors (i.e. disabling the easy unlock feature) - but I probably just missed the sarcasm again ;)
- jo-m 9y agoThere is a startup from ETH Zurich [1] which develops technology to make relay attacks impossible. In short, they are developing a method to make the key proove its within a certain distance of the car. Some of the tech behind it: https://arxiv.org/abs/1404.4435 https://arxiv.org/abs/1404.4435 [1] http://www.3db-technologies.com/de/Anwendungen.3.html http://www.3db-technologies.com/de/Anwendungen.3.html
- antouank 9y agoJust yesterday a friend was showing me the video where his white Mercedes was stolen in London in the exact same way! I guess someone made good sales on those relay boxes...
- ewjordan 9y agoQuestion: who buys these stolen cars, and would having a tracker on one solve the problem? From experience I know that when it comes to computers, at least in San Francisco, even if you know the exact address where 20+ stolen computers are at, the police will not engage. Are most police similarly hesitant to track down stolen cars, or is that just a weird SFPD quirk about ignoring theft?
- jore 9y agoin Europe they are often sold in parts like spare parts, it is then much easier than selling the complete car
- paulhilbert 9y agoAt least for motorcycles I know you also make more money selling in parts. Of course this ignores the work spent disassembling...
- PeachPlum 9y agoThen you can track it all the way to the shipping container
- gambiting 9y agoIn the UK if you have a tracker fitted the police will absolutely go and check it out immediately after reporting, they are pretty efficient at it. What the thieves started doing though is they take the car to a car park several miles out and let it sit there for a week, without spoiling the thief's position - if the car is still there after a week it's good to take. A lot of tracker-fitted cars are recovered this way, they are usually found just sitting in parking lots, not in some dodgy garages.
- wiz21c 9y agoInterestingly, for many people here, the solution to the problem is even more technology. Is there a study demonstrating that more advanced keys actually reduce stealing ?
- gambiting 9y agoThat's why at night I keep my keys in a metalic pouch that blocks all signals. I've tried and the car doesn't recognize the key even if I hold the pouch right next to the sensor, so it must be doing a good job. I'd highly recommend doing that if you have a keyless entry system installed in your car. Edit: This specific one if anyone is interested in protecting themselves: https://www.amazon.co.uk/gp/product/B01HETGX00/ref=oh_aui_search_detailpage?ie=UTF8&psc=1 https://www.amazon.co.uk/gp/product/B01HETGX00/ref=oh_aui_se...
- chatmasta 9y ago> West Midlands Police crime reduction team, said: "To protect against this type of theft, owners can use an additional tested and Thatcham-approved steering lock to cover the entire steering wheel We've come full circle. Tech has advanced so much that you need a physical lock to backup your technical lock. Reminds me of the rubber hose method. Trouble decrypting his 2048 bits of encryption? Just whack him with a rubber hose til he gives you the password. [xkcd ref]
- ninju 9y agohttps://xkcd.com/538/ https://xkcd.com/538/ (it's a wrench rather than a rubber hose)