5 ms·

Which manufacturers are affected? -- Edit - this seems to be exploiting the "convenience unlocking" feature, whereby you can unlock the car by having the key

• dan1234 9y ago
  The car in the video is a Mercedes.
• tjoff 9y ago
  Not sure if there exists any decent counter-measures.
  • RantyDave 9y ago
    Other than the asymmetric encryption we've had since the 1970's?
    • tjoff 9y ago
      Encryption isn't the issue, the whole concept is. All this is is a range extender.
      • RantyDave 9y ago
        Oh, right. Damn. So it fakes the presence of the key by merely extending its range? This is not good.
  • 013 9y ago
    Store your car keys in a Faraday cage?
    • bjelkeman-again 9y ago
      I do this (a key fob bag with foil). Some cars can disable the regular broadcast from the car too. Then you have to press the button on the key to open the doors.
  • janco 9y ago
    Latency measurement from car side?
    • bartkappenburg 9y ago
      Wouldn't help: the latency to the relay box is at least as good as having the physical key nearby.
      • icebraining 9y ago
        That can't be true, because the request/reply still has to travel all the way to the key and back.
      • gambiting 9y ago
        If the receiver is accurate enough(we're talking nanosecond precision) then you can absolutely tell if the key is 1m or 10m away, so a relay wouldn't help at all.
    • GoToRO 9y ago
      From the video it seems that the car was parked in front of the house and they just amplified the signal coming from the key inside the house. So not exactly a relay attack. The latency increase must be really low.
  • deleted 9y ago
    [deleted]
  • benpbenp 9y ago
    There are distance-bounding protocols[0], but I don't think anyone has implemented them in something as small as a car key yet. [0] https://en.m.wikipedia.org/wiki/Distance-bounding_protocol https://en.m.wikipedia.org/wiki/Distance-bounding_protocol
    • londons_explore 9y ago
      NFc and wireless credit cards urgently need to implement something like this... It's only a matter of time till NFC credit cards get read with a high power reader and proxied across a cell connection to steal money from someone hundreds of miles away from the thief.
  • deleted 9y ago
    [deleted]
  • zaxomi 9y ago
    How about having a button on the keyfob, that unlocks and locks the car? Then you don't need to worry about the relay-attack, don't need to worry that you car unlocks just because you walk past it, and don't need a steering lock...
    • tjoff 9y ago
      At some point you have to ask yourself, why not just use a real key? The "inconvenience" of having to insert the key can't seriously outweigh the issue of forgetting your key in your car (because it was in the wrong bag), driving away from the key. Or the security issues. Or the added cost. I just don't see the appeal even if it worked perfectly. I'd rather pay extra to have it removed.
      • consp 9y ago
        Normal keys are notoriously unsafe and get worse over the years by continuous use (grinding of the locking pins). You can also cover the locking mechanism completely inside the door so no fishing for the lock handle can be done via the window or cracks in the handle. The 'easy unlocking' feature is idiotically simple to fool as shown. Almost the same as in the late '90s when you could just cycle through the ~2-10k combinations on the fobs. My advise would be: use the buttons on the key and disable the easy-unlock feature which can usually be done either in the car's settings or at the garage.
      • dazc 9y ago
        ' ...why not just use a real key? ' Because they break into the house to get the key. It's happened to a few people I know - one time they used a wire hook through a partly opened window.
  • roel_v 9y ago
    Police on the tv here (nl) this morning suggested storing your keys wrapped in aluminum foil...
  • dazc 9y ago
    Shouldn't there be some kind of simple disable switch? You might still want keyless entry during the day for routine shopping trips and such but for parking the car overnight you can live without it; and probably sleep a lot better too.
    • gambiting 9y ago
      You can - I happen to have a Mercedes, so I know as a fact that you can just double-click the lock button on the key to disable the contactless feature completely - the car can then be only unlocked with a physical button press on the fob. I keep my key in a metalic pouch every night as a countermeasure, works just as well. However, there's one concern with it - if a thief tries to steal your car using the relay attack and fails, will they break in and try to steal the physical key(which might lead to confrontation and people getting hurt). It's a risk either way.
  • xbmcuser 9y ago
    A faraday cage key fob holder. Will remove the convenience of just keeping the fob in your pocket though.
  • tomalpha 9y ago
    Not requiring an explicit (or at least conscious) action on the part of the user seems to be the flaw in the process. The countermeasures would appear to be: * blocking the signal using some kind of Faraday cage to store your keys this relies on changing user behaviour, and not forgetting; kinda removes some of the “convenience” factor have some kind of disable switch on the key fob, in which case there’s not a huge difference to a regular remote lock/unlock button * expanding the range of frequencies the key fob uses to try and defeat the range extenders this likely has regulatory issues, and is probably easy to just update the hardware to cope with (if it doesn’t already) have the car do some kind of latency measurement on the challenge/response radio message exchange; given that light travels at 1ns per foot (ish!) the car will have to accurately and precisely measure only a few nanos difference, and not suddenly stop working because of nearby radio echoes in a concrete car park (or whatever) how close to the car is “convenient” to have it unlock automatically? 2 feet (driver standing by car)? 20 feet (kids running ahead to get into car)? * some kind of “parked up at home” mode so that the first unlock of the day requires a button push loses some of the convenience again got to remember to set it (some kind of car locking button again...) * you could have a second type of “anti-key” that you always leave at home, and when in range of this key the car won’t unlock keylessley easy target to block in the arms race or car theft easy to misunderstand as a user less convenience
    • matt-attack 9y ago
      I had thought you offered a thorough exploration of the possible countermeasures, but you missed jgrahamc's suggestion below of adding an accelerometer to the fob. Only unlock when motion is detected. What are you thoughts? Seems that keys are incredible idle when sitting on the kitchen counter, and never perfectly idle when walking to approach your car.
      • tomalpha 9y ago
        I think that’s a neat idea. In my defence, I might put that under the some-kind-of-switch-to-turn-it-off category but only in hindsight ;) Like latency-measurement though I wonder how robust it would be to the vagaries of modern life both in terms of reliability - potential moving parts - and in the face of user expectations - “I keep having to jiggle my keys to open my door” or worse, the dreaded “it doesn’t work!”. Where doesn’t work == doesn’t work how I think it should.
• bestest 9y ago
  The relay attack is very old and is very commonly used to steal all kinds of cars, here in Europe it's mostly Toyota. You do not need the key to be present in the car once it's started up. It's a feature of all key-less cars. For example, one would not want the car to suddenly stop if the key's battery dies on the go. So, once you start the engine, it will run. It will complain and beep if the key is not present in the car, but it will run. They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome. A more convenient way is to store your key in a special keyless key protector "pouch" when you're not driving your car, which is basically a Faraday Cage, blocking it's signal.
  • abcd_f 9y ago
    If the key battery dies, there is a spot on the dashboard that is NFC-equipped, so you just need to get the key next to it and it will ID regardless of the battery state. > It will complain and beep if the key is not present in the car, but it will run. Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.
    • CPLX 9y ago
      Your assumption is incorrect. It will run until the car is turned off. If it behaved as you're assuming it would be wildly unsafe, imagine someone inadvertently dropping off a passenger who has the key with them in a purse or jacket pocket, then stopping briefly on a bridge without shoulders, or a railroad crossing.
    • tjoff 9y ago
      So now when you are on the highway you need to suddenly search your bag for the key so you can insert it. > Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero. Not in any implementation I've heard of (and it would be quite dangerous and irresponsible). Actually, one story I've heard from pretty much everyone I know owning a keyless car is that the driver drops of a passenger that unknowingly had they key all along (typically a spouse). The driver then drives along, fills up for gas or make some other stop and then can't start the car anymore because the key is with the long gone passenger.
• mrb 9y ago
  «But you'll need to have the key continuously present to drive» Not true. Virtually all "keyless ignition" cars let you continue to drive when the key is suddenly no longer detected as present in the car. I verified this myself on my 2012 Audi S4, driving 1 km away from home without my key. Think about it. It would be too dangerous if the car suddenly shut down the engine eg. when the key's battery dies or when some random persistent R/F communication failure occurs.
  • gambiting 9y ago
    Yep. I've had a situation where I was driving on the motorway and suddenly my car decided that my key was no longer in the car(which obviously was still in my pocket) - and a warning was shown on the dash, but the car continued running. Imagine if it shut down while doing 70mph on the motorway!