14 ms·
Radio Attack Lets Hackers Steal Cars with Just $20 Worth of Gear
- Clubber 9y agoI don't know if it's even possible anymore, but a Slim Jim is even cheaper than that. For those who don't know what a Slim Jim is (not the snack): http://www.autobodydepot.com/AET-SJ2.html?gclid=EAIaIQobChMIsO3zwKfh1wIVXbbACh1RIgraEAQYASABEgIVefD_BwE http://www.autobodydepot.com/AET-SJ2.html?gclid=EAIaIQobChMI...
- Nexxxeh 9y agoYou aren't starting the vehicle with a slim jim. That's what we're potentially talking about here. Opening, and driving off in, a keyless vehicle literally keyless. http://www.bbc.co.uk/news/av/uk-42132804/relay-crime-theft-caught-on-camera http://www.bbc.co.uk/news/av/uk-42132804/relay-crime-theft-c...
- jasonmaydie 9y agoThere's another attack where they just break into the house and steal the keys and drive away. It's easy since most people have their keychains close to the outside entry.
- QAPereo 9y agoRight, but now you’ve added tons of serious extra felonies to your attempt at GTA.
- ceejayoz 9y agoYep, and significantly increasing the chances of things like getting shot by the homeowner.
- Xylakant 9y ago> Yep, and significantly increasing the chances of things like getting shot by the homeowner. This is very much not an issue anywhere outside the US.
- QAPereo 9y agoShot, maybe not, but stabbed or clubbed or just being beaten into a pulp are worldwide. I’m not making a statement about gun control, just pointing out that the risks of breaking into a home are not limited to firearms.
- willvarfar 9y agoUsing the contactless relay is obviously much lower risk.
- Nexxxeh 9y agoAt the moment, they're generally fishing through the catflap over here, according to a different police force. But this attack makes no noise (other that opening and closing the doors, and starting the vehicle), and won't set off the burglar alarm in the house, and probably won't be noticed until the vehicle owners go to drive off.
- pavel_lishin 9y agoSure, but if the car is parked by the house, the occupant is probably inside as well.
- Zarathust 9y agoA slim jim worked because the wires holding the lock were exposed inside the door. An extremely cheap fix was to wrap those with a metal cylinder. I was under the impression that this was standard for at least 15 years but since we're talking about automotive industry, some makers may not even be aware of that yet
- berbec 9y agoEven with cars that have the lock cables wrapped, the window has enough play to wedge it open and hit the door unlock button. Most locksmiths (sample size: number of times I've locked myself out of my car) just do that as it has less damage potential than fishing inside the door.
- Domenic_S 9y agoA slim jim worked because the lock plunger was physically connected to the locking mechanism. You could pull up on any part of that metal piece to physically manipulate the plunger, thus unlocking the door.
- nonamechicken 9y agoNot sure if its the same tech, saw this video yesterday: Relay attack Solihull: https://www.youtube.com/watch?v=8pffcngJJq0 https://www.youtube.com/watch?v=8pffcngJJq0
- dfcab 9y agoSaw that yesterday as well, always a cat and mouse game.
- maxerickson 9y agoAnybody up to date on distance bounding protocols? Is there a well studied implementation that is anywhere near practical? https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- FLUX-YOU 9y agoCouldn't you just get the key fob signal first, buffer it in the radio near the car, then initiate the negotiation with the car, and finally replay the unlock signal for the car? The key fob can't invalidate signals with the car once it's sent since it's too far away, so even if you have distance-bounding on the key fob, it can't tell the car to ignore an otherwise valid signal.
- maxerickson 9y agoIf the car initiates the distance check and the fob does some kind of signature during it, that won't work. Of course that presumes a secure implementation.
- tomalpha 9y agoIt must be possible to implement some kind of simple response time check. Given that the speed of light is ~1ns per foot then a total response time greater than (2d + p) where d = max distance in feet, and p = processing time within the keyfob in nanoseconds would provide a bound. I suspect however that making the keyfob response time consistent might be the hardest part of the check, closely followed by an accurate timing facility within the car.
- maxerickson 9y agoYeah, the Wikipedia article talks about an implementation that has a processing time of 1 ns (which gives the distance within your foot). The questions are whether it is secure against the world or secure against just the implementers and how much it would cost.
- 9y ago
- dsfyu404ed 9y agoThere's probably useful commercial applications for this "attack" for companies that manage large fleets of vehicles. If you already have some the hardware/software infrastructure to manage it (like company cell phones or tablets) you could toss all the keys in a central office somewhere and never worry about losing them or making duplicates. $30ish for a box that plugs into the 12v (or OBD2 if you want to collect that data) and $1 for a usb cable to connect it to the $100 tablet that you already have mounted in the company vehicle for doing work things. Obviously the details would need to be fleshed out and I'm sure someone (like OnStar) already offers similar services but being able to hack your way into a cheaper equivalent would put downward pressure on price.
- maxerickson 9y agoIt's also based on an inexcusable flaw in the key system. Not a good place to start a business.
- toyg 9y agoI keep seeing this problem (and likely suffered from early attempts a few years ago, when my car was effortlessly broken into), but nobody seems to be talking about solutions. What's the answer? It would be nice if I could ask about this when I get a new car in a couple of years. * Is it about making the exchange more computationally complex, so it can't be just replayed? I guess that would require some sort of clock in the key? * Have 2FA with something like a phone? Like requiring TouchID on the phone to confirm when you press the key.
- dragonwriter 9y agoDon't broadcast the signal used for ignition at all, and require key insertion, even if you have keyless entry. Simple solution. 2FA defeats the purpose, but you could have biometrics directly on the car instead of a broadcast signal.
- tomalpha 9y agoA good start, though once someone has physical access to the OBD port, all bets might be off: https://www.extremetech.com/extreme/132526-hack-the-diagnostics-connector-steal-yourself-a-bmw-in-3-minutes https://www.extremetech.com/extreme/132526-hack-the-diagnost...
- maxerickson 9y agoA working distance-bounding protocol would address it. I think ultimately you would be relying on a 3rd party evaluation of the systems automakers are using because salesmen aren't going to have a useful knowledge of the specifics.
- moioci 9y agoWhy don't they put an on-off switch on the fob? Better yet, when the vehicle locks, send a turn-off signal to the fob. Then you'll have to press a power button to reactivate it.
- Xylakant 9y agoThat's running exactly contrary to the feature that's implemented and abused: The car should unlock when the owner comes within radio distance. So the key must be on and transmitting - and it's that signal that gets relayed. It's not a replay attack, basically the signal just gets amplified to trick the car into believing that the key is close.
- trisimix 9y agoConvenience kills. All you needed was a button on the fob. Oh well.
- agumonkey 9y agoSo this model lock mechanism is based on distance only ? no human action required ?
- joper90 9y agoCorrect, you just have the key (well a card) in your pocket/wallet and walk up to the car, which unlocks, you can then get in and press 'start'.. So if you leave your keys in a bowl by the door, they can just extend the range of the key with a relay/booster. The car will only stop when you turn it off.
- pessimizer 9y agoJuvenile power fantasies are going to kill us all. People want to be magical, wave their arms and move their hands mysteriously, and affect the world. Things like this save an infinitesimal amount of time (or sometimes even make actual usage more difficult), and introduce orders of magnitude more complexity ripe for exploitation. All so people can feel like they're magical.
- agumonkey 9y ago> Juvenile power fantasies I believe society still have a lot of inertia toward this. I also think video games tapped into this brain subsystem, that IMO was designed as a desire to learn how to master the real world, except now technology can bridge the fantasy
- laumars 9y agoYou're being overly harsh there. I've found not having to reach for my keys to be rather convenient when shopping with both of my kids (eg opening the boot by touching it when my hands are full carrying shopping + kids under my arms). Sure, I would still cope with conventional keys; I wont deny that. Just as my mum coped raising me when she didn't even have a car. But I'm just making the point that this feature isn't just some "juvenile power fantasy" and actually does help make like a little bit easier. Though frankly, even if it was just a vanity feature then I still wouldn't begrudge anyone wanting it. Isn't that the half the reason people buy nice cars in the first place? For what it's worth, if this is a feature you have but don't like, then some cars (mine included) do allow you to disable that feature. So it might be worth consoling your manual / checking the in car settings menu.
- Sir_Cmpwn 9y agoThis hacker equipment needs to be outlawed! Our proud American job-making automobile companies are under attack! I'm putting forward the SAVEKIDS bill to address the issue immediately.
- downandout 9y agoFrom the article: "One hacker holds a device a few feet from the victim's key, while a thief holds the other near the target car." While this isn't awesome, it certainly limits the effectiveness. You would have to have someone waiting in a parking lot to follow the person, then another person waiting by their car. I do have a question though...I assume these things work on challenge/response schemes. That means that even if the car is started and stolen, it could never be started again without someone tailing the owner 24/7, which makes this a neat but nearly useless hack. Am I wrong in assuming this?
- maxerickson 9y agoPresumably the thieves are stealing cars that are still valuable to them after they lose access to the owner key. Sell for parts, program a new key, replace the key, replace the computer, etc. There's lots of room for profit on a $40,000 vehicle.
- TylerE 9y agoUh, you know what things like rims, catalytic converters, and airbags are worth?
- raisedbyninjas 9y agoOnce you have the vehicle, many models can have a new fob programmed by a friendly locksmith.
- deleted 9y ago[deleted]
- joper90 9y agoYes, if you park your car outside your house on the drive, and the key is in the house in a bowl by the door (for example) then they can steal the car in the middle of the night.. This is worse in the UK, as we have much less space, so things are much closer togeather (ie. the car, and the keys (where they are left overnight).
- city41 9y ago
- strictnein 9y agoFor those wondering why this is possible, a lot of new cars unlock if your key fob is in your pocket and you simply put your hand inside of the handle to open your door. And then you sit down and press the start button and you're off. It's really a rather nice feature, although it's also something that seems silly until you get a vehicle with it. The range with normal usage is very short though. If I'm on the driver side of the car, it doesn't work on the passenger door, and vice versa.
- rconti 9y agoYup. Like many new convenience features, it seems so silly until you use it and then you can't go back. My new Golf has it, and it works so well that the doors unlock as my hand is entering the door handle cup but before I even have a chance to pull on the handle. If my passenger needs to open the door without me unlocking it, i have to stand REALLY close to them. It's pretty impressive (in normal operation) how perfectly it works as the key-holder but how close you need to stand for it to work for someone else.
- ghrifter 9y agoI like manual windows but also automatic windows in cars. I still can't really fathom starting a car if I dont turn the key manually... I guess its like you say, silly until you use it
- lisper 9y agoI prefer to start my car by turning a key. I like to be able to turn my engine off but leave the radio on.
- innagadadavida 9y agoMy push to start car does this if you push the button without applying the brake.
- 9y ago
- timthelion 9y agoI know that a button on the keyfob would work, but this attack could also be prevented with clock syncing, as the re-transmission of the signal will certainly take time. A simple timed ping (with cryptographicly signed time-stamps to prevent replay) would sort this out.
- jimmies 9y agoRelying on timings for this type of thing is impractical because you'd have to sync the time to the nanoseconds and wireless is notorious for being noisy. It'd make it more expensive too. The most practical one, I think, is to make it NFC-near instead of BLE-near. Or, you know, just use a non-contactless one. Or add a button.
- berbec 9y agoOr use something that you put in a tumbler-style mechanism that requires physical contact as well as the RF
- mrb 9y agoThe problem of distance-bounding mechanisms is that the technology isn't quite there yet. A microcontroller in a keyfob operates at ~5 MHz. If it takes 1 clock cycle to receive & decode the first bit of the cryptographic challenge as well as to start transmitting the first bit of the response, then the R/F signal has already traveled 60 meters. Most cars parked in a driveway by the owner's house are less than 30 meters away from the keyfob. The limited performance of the low-power microcontroller isn't the only problem. The R/F signal itself is modulated at a low baud rate. If it's modulated at 1 Mbaud then each bit is sent as an R/F symbol that's 300 meters long in the air. In a sense the R/F receiver needs to demodulate "300 meters of R/F analog data" to be able to decode it to a 0 or a 1. If there is a little delay or noise at the beginning of the 300 meters of data because the signal is being relayed (if you can visualize what I mean), then the receiver isn't going to notice. The low-power constraint on the keyfob (as it's powered by a small battery that must last years) prevents manufacturers from developing R/F physical layers and chips that are performant enough for precise distance-bounding.
- deleted 9y ago[deleted]
- mmaunder 9y agoTighter timing constraints doesn't seem like a robust solution. I'm guessing proximity as an authenticator will become a thing of the past. New keys may have a button that must be pressed or even a fingerprint scanner.
- craftyguy 9y ago> New keys may have a button that must be pressed My 15 year old car has this feature!
- GoToRO 9y agoYou are living in the Future!
- tempay 9y agoTighter timing constraints could definitely work. If the car requires a response within 10ns you can guarantee the fob is within 1.5m of the car.[1] The only issue is the fob has to be able to decode the signal, calculate a response and transmit it very quickly (or within a very precisely known amount of time). [1] Light travels at ~30 cm/ns, so a round trip time of 1 ns corresponds to 15cm.
- r00fus 9y agoWhy couldn't proximity be GPS based instead of signal based? Too battery intensive? In that case, just make it app-only and have your iOS/Android gps-enabled device(s) be the only keyless entry.
- kansface 9y agoThis would increase the attack surface area.
- ChuckMcM 9y agoIt is an insidious problem. There were a couple of kids around here that weren't stealing the cars, they were just breaking into them on driveways at 2AM and rummaging around for spare change and what not. Almost every countermeasure defeats the convenience factor. One proposal was to have the key light up and you pressed a button on it to say 'yeah do your thing' but at that point why not just have the old style push to open fob? Perhaps something magnetically coupled rather than RF coupled will help keep it reliably a near field sort of interaction but even that is subject to a slightly more sophisticated relay device.
- jwr 9y agoFortunately, this problem has an easy solution. IEEE 802.15.4 UWB (Ultra-Wideband) radios with timestamping functionality allow measuring the time of flight (well, not directly, but it can be inferred from an exchange of messages) of your signal. With some added crypto, it isn't difficult to build a solution which is limited to a specified distance. You can get as precise as ±20cm. This means that you can build a system which will not work beyond a certain distance, because signals will take too long to travel. I'm surprised this hasn't been picked up by car manufacturers yet. Perhaps there is too little market pressure.
- londons_explore 9y agoThe time of flight is not cryptographically secure. Ie. an attacker can trick it. There are protocols which are though: https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- xr4ti 9y agoSure. However, I think the objective would to increase difficultly and the level sophistication required for exploitation rather than compete security. For instance, a physical lock on your front door can easily be defeated by someone with the requisite tools and expertise, but that doesn't make them useless as a security measure.
- 9y ago
- mikeokner 9y agoThe new Tesla model 3 uses your smartphone over bluetooth as a key. I suspect we'll see that become more prevalent, which should provide ways to mitigate most of these issues by using GPS for location instead of RF strength/timing.
- londons_explore 9y agoGPS isn't cryptographically secure, and is easy to spoof[1]. Bluetooth can be relayed[2]. The two attacks would be easy to do simultaneously from the same evil box. [1]: https://www.newscientist.com/article/2143499-ships-fooled-in-gps-spoofing-attack-suggest-russian-cyberweapon/ https://www.newscientist.com/article/2143499-ships-fooled-in... [2]: https://link.springer.com/chapter/10.1007/978-3-540-30182-0_29 https://link.springer.com/chapter/10.1007/978-3-540-30182-0_...
- jagger27 9y agoAm I missing something or is the fix a little computer in the fob to cryptographically sign a one-time challenge sent by the car? I mean, RSA isn't that hard, is it? Here's how I see it: the car broadcasts a (short duration) challenge message on short range (10 meters, say), the key fob, once in range, signs the challenge message, transmits it, the car checks the signature with the fob's known public key, and Bob's your uncle. If the fob can compute a signature of the challenge in 500ms, the window doesn't need to be much longer. Sure, people will likely be able to pull private keys from the fob with some effort, and duplicate it that way, but that's no worse than today. Reprogramming the car wouldn't significantly harder than it is today either. If we want convenience and security, it seems fine to make the key fob a little more complicated and beefy. I feel like this is by no means a new idea and maybe I'm missing something. edit: I was missing something.
- schwap 9y agoYou are misunderstanding how the attack works (probably because the article misuses the word 'spoofing' IMO). The messages between the car and the key fob are the real messages. They are just using a radio to extend the range of the car/fob communication.
- zkms 9y ago> Am I missing something or is the fix a little computer in the fob to cryptographically sign a one-time challenge sent by the car? I mean, RSA isn't that hard, is it? The problem has nothing to do with cryptography. Given radio signals can be relayed at will, and there's no way of knowing so (short of a way to measure quite small latencies), there needs to be a proper way to bind the cryptographic exchange to the person pulling the door open. Relay attacks (which do nothing to exploit cryptographic exchanges -- just relay messages fast) exploit that lack of binding.
- drdebug 9y agoDid I miss something or does it sound like a problem GPG solved a while back ?
- signet 9y agoGPS doesn't work in garages, adds complexity and is also power hungry?
- bluesign 9y agodoesn't simple frequency hopping with the OTP in the fob and the car solve this problem?
- bob_theslob646 9y agoThe thief starts the car and proceeds to drive away. Will the car continue to operate once the thief is out of range? Is the purpose of this just to get access to your car to steal goods? Or is this just an extreme demonstration to get automakers to tighten security?
- t1o5 9y agoMaybe the car can be driven away for once. The engine immobilizer requires the keyfob to be present inside the car for it be driven away. If the spoofed fob can trick the immobilizer, yes it can be driven away for once because the immobilizer check is not always "on". Its checked before the engine starts. If it was, I could throw my keyfob out of the window on a highway and the car would come to a stop.
- fenwick67 9y agoTypically with these systems they will continue running until you turn them off (or stall).
- redbeard0x0a 9y agoMy car will stay running and allow you to drive off without the key. I tested this when I got my car. I started the car, then put the keys in my garage and then drove down the street. You wouldn't be able to start the car again if you turned it off, but by then the car is long gone.
- nasredin 9y ago"Relay" attack in UK. "Thieves" - or is it hackers? - steal a Merc. https://m.youtube.com/watch?v=8pffcngJJq0 https://m.youtube.com/watch?v=8pffcngJJq0
- blacksmith_tb 9y agoI am no RF expert, but I would guess that it wouldn't take much shielding around a fob to keep its signal from being relayed (given the poor range of the fobs in general, the transmitter in there can't be very powerful). Seems like potentially an Altoids-style tin would be enough of a Faraday cage?
- xr4ti 9y agoSeems like an easy fix might be to simply kill the engine if the key fob goes out of range. I can see this problematic if erroneously triggered on a highway or something, but it would limit the range the thieves could take the car to the range of their radio, and require radio proximity to the key for the duration of their travel. Maybe this is already a thing?
- redbeard0x0a 9y agoThis could be incredibly dangerous because now your car decides to stop working because the battery became too low to keep authenticated. Or if something happens with interference. The potential failure scenarios increase by a huge margin if you require the keyfob to be authenticated with the car the entire time.
- secabeen 9y agoI've always thought that a simple measure that automakers could implement is to require the keyfob to have moved in the last X seconds to authenticate an unlock. That prevents the "key is sitting on a table in my house" relay attack.
- zeep 9y agoI wish that it would still be possible to get a "dumb" car... one that would have almost no electronics (or that you could at least disable all wireless receivers/transmitters). We know that computers can't be secured... so it is a little scary to ride in one.
- redblacktree 9y agoYou can usually buy a base model vehicle with manual locks and limited technology. You probably can't avoid the AM/FM radio. :)