5 ms·

Similar relay attacks have been made to work over longer distances and through various obstacles, like exterior walls and locked doors. From 2015: “Mr. Danev s

Similar relay attacks have been made to work over longer distances and through various obstacles, like exterior walls and locked doors. From 2015: “Mr. Danev said that when the teenage girl turned on her device, it amplified the distance that the car can search, which then allowed my car to talk to my key, which happened to be sitting about 50 feet away, on the kitchen counter. And just like that, open sesame.“ https://www.nytimes.com/2015/04/16/style/keeping-your-car-safe-from-electronic-thieves.html https://www.nytimes.com/2015/04/16/style/keeping-your-car-sa...

13of40 9y ago
Seems like a simple fix would be to put an accelerometer into the key fob and turn off the radio if it hasn't moved in a minute or two.
- mastax 9y ago
  Better solution is to determine fob distance based on response time rather than signal strength.
  - amenghra 9y ago
    It's an active field of research. You can learn more by starting here: https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
  - _wmd 9y ago
    I was thinking exactly the same thing, speed of light is the only robust way to prevent the attack without hobbling the entire feature.. doubt it could be reliably retrofitted to an exiting design though, timing that precise probably requires additional hardware or at least hardware specifically designed for low jitter
  - dsp1234 9y ago
    Radio waves move at the speed of light. Light can move about 300 meters in one millionth of a second. It's easy enough to find a store where the parking lot is well within that distance from the middle of the store. So whatever system that goes into place would need to possibly have accuracy down to the 1us level or smaller.
    - jagger27 9y ago
      In 1 μs light travels 300 m (984 ft) in a vacuum, or 225 m (738 ft) in air (roughly). That's not good enough. 1 nanosecond is about a foot. A 100MHz clock gives us a resolution of 10 ns, which translates to 2.25 meters away by light in air. As a backup if your fob battery is dead, you could use inductive power in the door, or just use that to begin with (still with distance-bounding).
    - derekp7 9y ago
      You can also have three antennas in the car, and have high speed electronics measure the RF delay as received on each antenna. From there the key can tell how far away it is from the car (similar to how GPS works), and it would only respond to the challenge when it is in the proper position.

13of40 9y ago

Seems like a simple fix would be to put an accelerometer into the key fob and turn off the radio if it hasn't moved in a minute or two.

mastax 9y ago
Better solution is to determine fob distance based on response time rather than signal strength.
- amenghra 9y ago
  It's an active field of research. You can learn more by starting here: https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- _wmd 9y ago
  I was thinking exactly the same thing, speed of light is the only robust way to prevent the attack without hobbling the entire feature.. doubt it could be reliably retrofitted to an exiting design though, timing that precise probably requires additional hardware or at least hardware specifically designed for low jitter
- dsp1234 9y ago
  Radio waves move at the speed of light. Light can move about 300 meters in one millionth of a second. It's easy enough to find a store where the parking lot is well within that distance from the middle of the store. So whatever system that goes into place would need to possibly have accuracy down to the 1us level or smaller.
  - jagger27 9y ago
    In 1 μs light travels 300 m (984 ft) in a vacuum, or 225 m (738 ft) in air (roughly). That's not good enough. 1 nanosecond is about a foot. A 100MHz clock gives us a resolution of 10 ns, which translates to 2.25 meters away by light in air. As a backup if your fob battery is dead, you could use inductive power in the door, or just use that to begin with (still with distance-bounding).
  - derekp7 9y ago
    You can also have three antennas in the car, and have high speed electronics measure the RF delay as received on each antenna. From there the key can tell how far away it is from the car (similar to how GPS works), and it would only respond to the challenge when it is in the proper position.