5 ms·
Not sure if there exists any decent counter-measures.
by tjoff 9y ago
Not sure if there exists any decent counter-measures.
- RantyDave 9y agoOther than the asymmetric encryption we've had since the 1970's?
- 013 9y agoStore your car keys in a Faraday cage?
- bjelkeman-again 9y agoI do this (a key fob bag with foil). Some cars can disable the regular broadcast from the car too. Then you have to press the button on the key to open the doors.
- janco 9y agoLatency measurement from car side?
- bartkappenburg 9y agoWouldn't help: the latency to the relay box is at least as good as having the physical key nearby.
- icebraining 9y agoThat can't be true, because the request/reply still has to travel all the way to the key and back.
- gambiting 9y agoIf the receiver is accurate enough(we're talking nanosecond precision) then you can absolutely tell if the key is 1m or 10m away, so a relay wouldn't help at all.
- GoToRO 9y agoFrom the video it seems that the car was parked in front of the house and they just amplified the signal coming from the key inside the house. So not exactly a relay attack. The latency increase must be really low.
- deleted 9y ago[deleted]
- benpbenp 9y agoThere are distance-bounding protocols[0], but I don't think anyone has implemented them in something as small as a car key yet. [0] https://en.m.wikipedia.org/wiki/Distance-bounding_protocol https://en.m.wikipedia.org/wiki/Distance-bounding_protocol
- londons_explore 9y agoNFc and wireless credit cards urgently need to implement something like this... It's only a matter of time till NFC credit cards get read with a high power reader and proxied across a cell connection to steal money from someone hundreds of miles away from the thief.
- deleted 9y ago[deleted]
- zaxomi 9y agoHow about having a button on the keyfob, that unlocks and locks the car? Then you don't need to worry about the relay-attack, don't need to worry that you car unlocks just because you walk past it, and don't need a steering lock...
- tjoff 9y agoAt some point you have to ask yourself, why not just use a real key? The "inconvenience" of having to insert the key can't seriously outweigh the issue of forgetting your key in your car (because it was in the wrong bag), driving away from the key. Or the security issues. Or the added cost. I just don't see the appeal even if it worked perfectly. I'd rather pay extra to have it removed.
- consp 9y agoNormal keys are notoriously unsafe and get worse over the years by continuous use (grinding of the locking pins). You can also cover the locking mechanism completely inside the door so no fishing for the lock handle can be done via the window or cracks in the handle. The 'easy unlocking' feature is idiotically simple to fool as shown. Almost the same as in the late '90s when you could just cycle through the ~2-10k combinations on the fobs. My advise would be: use the buttons on the key and disable the easy-unlock feature which can usually be done either in the car's settings or at the garage.
- dazc 9y ago' ...why not just use a real key? ' Because they break into the house to get the key. It's happened to a few people I know - one time they used a wire hook through a partly opened window.
- roel_v 9y agoPolice on the tv here (nl) this morning suggested storing your keys wrapped in aluminum foil...
- dazc 9y agoShouldn't there be some kind of simple disable switch? You might still want keyless entry during the day for routine shopping trips and such but for parking the car overnight you can live without it; and probably sleep a lot better too.
- gambiting 9y agoYou can - I happen to have a Mercedes, so I know as a fact that you can just double-click the lock button on the key to disable the contactless feature completely - the car can then be only unlocked with a physical button press on the fob. I keep my key in a metalic pouch every night as a countermeasure, works just as well. However, there's one concern with it - if a thief tries to steal your car using the relay attack and fails, will they break in and try to steal the physical key(which might lead to confrontation and people getting hurt). It's a risk either way.
- xbmcuser 9y agoA faraday cage key fob holder. Will remove the convenience of just keeping the fob in your pocket though.
- tomalpha 9y agoNot requiring an explicit (or at least conscious) action on the part of the user seems to be the flaw in the process. The countermeasures would appear to be: * blocking the signal using some kind of Faraday cage to store your keys this relies on changing user behaviour, and not forgetting; kinda removes some of the “convenience” factor have some kind of disable switch on the key fob, in which case there’s not a huge difference to a regular remote lock/unlock button * expanding the range of frequencies the key fob uses to try and defeat the range extenders this likely has regulatory issues, and is probably easy to just update the hardware to cope with (if it doesn’t already) have the car do some kind of latency measurement on the challenge/response radio message exchange; given that light travels at 1ns per foot (ish!) the car will have to accurately and precisely measure only a few nanos difference, and not suddenly stop working because of nearby radio echoes in a concrete car park (or whatever) how close to the car is “convenient” to have it unlock automatically? 2 feet (driver standing by car)? 20 feet (kids running ahead to get into car)? * some kind of “parked up at home” mode so that the first unlock of the day requires a button push loses some of the convenience again got to remember to set it (some kind of car locking button again...) * you could have a second type of “anti-key” that you always leave at home, and when in range of this key the car won’t unlock keylessley easy target to block in the arms race or car theft easy to misunderstand as a user less convenience
- matt-attack 9y agoI had thought you offered a thorough exploration of the possible countermeasures, but you missed jgrahamc's suggestion below of adding an accelerometer to the fob. Only unlock when motion is detected. What are you thoughts? Seems that keys are incredible idle when sitting on the kitchen counter, and never perfectly idle when walking to approach your car.
- tomalpha 9y agoI think that’s a neat idea. In my defence, I might put that under the some-kind-of-switch-to-turn-it-off category but only in hindsight ;) Like latency-measurement though I wonder how robust it would be to the vagaries of modern life both in terms of reliability - potential moving parts - and in the face of user expectations - “I keep having to jiggle my keys to open my door” or worse, the dreaded “it doesn’t work!”. Where doesn’t work == doesn’t work how I think it should.