26 ms·
A Dutch first: Ingenious BMW theft attempt
- ashleyn 8y agoImmediately, I'd be wondering what very powerful spy agency or organisation felt the need to break into my car, and why.
- whataboutism 8y agoThey were in posession of a 0-day for this car
- 21 8y agoThat agency would have jammed communications in the area so no alarm would have been raised, unless raising an alarm was their actual purpose.
- frockington 8y agoThat would make me crazy. Before an important meeting that would seriously throw me off. It's a good play
- vwelling 8y agoSignal jamming will trigger high-end car alarms as well. Also, if the alarm is connected to a security provider, a disruption in communication with the car will also cause them to follow up on it.
- madeuptempacct 8y agoWhat is this magical land you live in where signal jamming triggers a CAR alarm?
- vwelling 8y agoPDF alert: https://automotive.vodafone.co.uk/media/239296/stolen%20vehicle%20tracking%20brochure%20-%202017.pdf https://automotive.vodafone.co.uk/media/239296/stolen%20vehi...
- Rjevski 8y agoI wouldn’t trust a mobile carrier with anything - they can’t even protect their mobile customers from basic stuff as SMS spam or eavesdropping via SS7. Not to mention, I technically can’t see how this thing will be able to phone home if the mobile phone frequencies are being jammed.
- soneil 8y agoI'm not sure I'd be so paranoid. We've read of people managing to hack the key openers, etc. They're an attractive target. I mean, if you were going to leave a box containing $30,000 on your doorstep. A box not only containing 30k, but a box that was labelled that it contained 30k. How would you protect it? Put a serial number on it so you can prove it's yours? A bike lock? A motion sensor? Cement it into the ground? What lengths would you expect someone to go to, to try to walk away with this box? Just give it a little kick to see if it moves? A screwdriver or a pry bar? Angle grinder? Once you divorce yourself from the commonality of a car, it's quite bizarre to think that not only do most people leave their second most valuable possession (or most valuable, if you rent your home) on their doorstep .. but that they just assume it won't happen to them. It doesn't take a targeted attack for someone to realise that that exposed, valuable, mobile asset is .. well, exposed, valuable and mobile.
- dsfyu404ed 8y ago$30k in cash is not the same as a $30k car. A $30k car that's been stolen is not worth $30k, then there's liquidity, risk and a bunch of other things. Having your car parked outside is not at all like having a box containing $30k outside your house.
- lphnull 8y agowell then is it closer to having a box with $15k? $10k? $5k? In all these situations, the incentive is still there.
- wjnc 8y agoNah, BMW-thieves are incredibly resourceful. They managed to steal parts of the dashboard and airbag from my neighbours car, without further damage, while in the driveway with the alarms not triggered on a modern 3-series. All the neighbour noticed was the dog barking a few times at night. We all sleep within 30 ft of that car. Practice makes perfect. Those parts are sourced to eastern Europe and are stolen on demand.
- hvidgaard 8y agoIt's a widespread problem right now. It happens in waves, and if you go to BMW dealers in larger cities it's not uncommon to see 4-5 5 series missing the dashboard and airbags. What I don't understand is what are they using it for? Can they upgrade older models with it?
- ollie87 8y agoCrashed vehicles will need replacement dashboards and airbags, probably stealing them to do dodgy repairs on cars that have been in big accidents.
- wjnc 8y agoSorry for the late reply. The story (I'm in insurance, but no means to check for validity) is that in Europe total losses are sold for their chassis numbers and then pretty much built up from stolen parts in Eastern Europe. I had a bad run in with a likewise situation when someone crashed into my rear and the offer for the wreck was way high. That meant I had to go get a new one, since via technical total loss I could not get my own car repaired without financial risk.
- barbegal 8y agoHardly, this was a very unsophisticated attack, they cut through the entire loom as opposed to through individual wires so it was quickly noticeable what had occurred.
- modells 8y agoDid you even read the article? They knew enough to disable SOS and interior car alarm sensors in a seemingly subtle way most people would dismiss. Maybe they should’ve taken their time and waited around for police? What’s unsophisticated is stealing a radio or nav by slashing the back of the wiring loom, and then the owner having to replace the entire loom at the cost of many thousands of dollars. It sucks but that’s life. Car thieves aren’t your friends, DGAF about damage, and those that don’t operate on a “speed is life” principle get caught. Maybe you should show a little respect to the knowledge and tactics demonstrated?
- tempestn 8y agoWhy should they show respect to these car thieves? They made a valid point; it's easy to imagine an attack like this being done better.
- draw_down 8y agoProbably not necessary to flatter oneself in such a fashion.
- noncoml 8y agoI was sure he would wake up next morning and find the car missing. I think he was really lucky that this wasn’t the case and the thieves waited(?) for the next night.
- jimmy1 8y agoYeah, I don't understand this. After you went through all the work of disabling the SOS, you can just take the car then, unless breaking the window was the way they initially got inside, and maybe they were thinking that the person would blindly repair the broken window to increase the value of the car on the black market? I don't know.
- cptskippy 8y agoWhen they broke the window SOS was triggered. They knew this and that Police were en route. When they cut the wire in the pillar, they didn't disable SOS, they disabled the triggering mechanism. The idea being that they would return and break the window again only SOS wouldn't be triggered because that wire was cut.
- deleted 8y ago[deleted]
- rconti 8y agoBecause the police arrived 5 minutes after they disabled the SOS button. The next night, there would be no SOS notification when they broke the window again. Or maybe they'd only have to tear away a plastic bag, if the owner hadn't gotten the window replaced. Or maybe they were hoping to find a valet key in the car, making their job even easier, either that night, or the next night.
- deleted 8y ago[deleted]
- rosege 8y agoI don't know why he didn't talk to the police and tell them what he suspects and see if they would set up an ambush for the car thieves that night. Put the car back in place and wait for them to show up
- mabbo 8y agoThe thieves would have been wiser to take something, anything to make the narrative of the original break in more believable. They didn't sell the narrative well enough, which left people curious.
- giarc 8y agoMaybe there was nothing in the car, but you are correct, should have taken something or at least opened the glovebox to make it seem like they were searching for valuables and found nothing.
- Nasrudith 8y agoI wonder why they bothered with the smash - broken glass would make people take their car to a dealer. Just the "failed jimmying" might have gone if not unnoticed as a police issue procrastinated in fixing. Maybe they were just frustrated auto thieves.
- TheCowboy 8y agoThe other one was an air pressure sensor, used for detecting sudden changes in air pressure. This is the sensor that will, among other things, detect a broken window. Might be related to tripping this sensor in advance.
- flak48 8y agoHow would they have disabled the alarm without breaking into the car?
- test6554 8y agoThere's an old saying about not committing more than one crime at a time.
- slededit 8y agoThe cops probably scared them away while they were in the act.
- Cthulhu_ 8y ago
- barbegal 8y agoThis definitely isn't the first time this technique has been used. I'm sure I've heard many similar stories before and the internet backs me up. https://www.askaboutmoney.com/threads/attempted-car-theft-wires-cut-with-hacksaw-blade-thru-door-jamb.181216/ https://www.askaboutmoney.com/threads/attempted-car-theft-wi... https://rutlandnhw.org.uk/crime-update/rutland-south-crime-report/ https://rutlandnhw.org.uk/crime-update/rutland-south-crime-r...
- jasonmaydie 8y agoI think the proper cause of action in that case was to return the car and do an old fashioned stake out with lots of beer.. I mean redbull and catch the burglars redhanded.
- ironjunkie 8y agoyes. I honestly don't know why this was not done. It sounds like the most obvious thing to do if you know that the burglars are going to come back anyways the next day.
- Freestyler_3 8y agoWay to catch some sophisticated thieves, and if they don't show up anyway. Then stop going to that dealership.
- giobox 8y agoI've anecdotally heard a lot of stories about the relay/replay attacks on keyless ignition systems used in many BMW models and other cars as well. No need to smash the window at all in some cases. Remarkably simple attack in principle, and probably a nightmare to explain to your insurer given there will be no evidence of a break in. Makes you wonder if you should start storing the key in a metal/RF shielded box at home... > https://www.bbc.com/news/uk-england-birmingham-42132689 https://www.bbc.com/news/uk-england-birmingham-42132689
- jasoncartwright 8y agoThis has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off the passive entry feature that allows this attack. https://pasteboard.co/HypzOWg.png https://pasteboard.co/HypzOWg.png Here's a video of a relay theft (of a Merc) from West Midlands police in the UK... https://www.west-midlands.police.uk/news/4544/watch-police-release-footage-relay-crime https://www.west-midlands.police.uk/news/4544/watch-police-r... Photo from a camera of attempted theft, from a UK Tesla owner... https://pasteboard.co/HypF8Ep.jpg https://pasteboard.co/HypF8Ep.jpg
- maym86 8y agoMaybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
- jasoncartwright 8y agoMany suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
- maym86 8y agoSure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
- gagabity 8y agoMore surprising that the car has some call home feature that the owner doesn't seem to know about.
- drglitch 8y agoHaving recently gotten a new BMW (in USA), they give you a huge packet of about 30 pages explaining the BMW TeleService and the "SOS" button. They also make you sign a power of attorney-style doc giving them rights to notify police in case they believe your vehicle is in trouble and provide police/EMS with its exact location. Mercedes and Audi have similar systems, as do others via OnStar. This is one of few cases where i believe having an "oh shit" button/system that automatically activates in case of serious accident or another event is valuable. EDIT: oh, and this is entirely opt-in, at least on BMW.
- jiveturkey 8y agoNo, not entirely. Please give me the instructions on how to opt out. Whenever someone asks (which is rare), the forums are filled with replies like "why would you not want BMW to monitor you? are you a fraudster?" IOW the forums do not know how to opt out either. Everytime I take my 2016 in to service, I ask both sales and service to disable teleservices. They say they cannot. I then call BMW teleservices (every time), and they tell me that the dealer has to do it. There are explicit instructions from BMW online that in Germany you can take it to the dealer to have it disabled. No mention of any other country. Yes, the emergency aspect of it is valuable. It's not worth the compromise in privacy, at the complete discretion and ineptitude of a corporation that has a profit motive. In 2016, I certainly did not sign (and was not asked) any kind of doc authorizing location disclosure. My car definitely does have teleservices activated. (don't know if they will report my location)
- driverdan 8y agoCan you pull the SIM card?
- 8y ago
- spockz 8y agoBMW burglars appear to be very skilled. The entire board computer was taking from a friend’s car and the screws and cables etc were all tidily set aside as if it was a professional replacement. And this within an hour, on the front porch..
- samstave 8y agoMakes me wonder how many of the thieves of modern cars are professionally trained service people from the respective car companies who are paid off to get the vehicle into a state where it can be cleanly taken away. You are basically just paid to bypass security.
- Rjevski 8y agoThe difference is that in IT, whether you are a professional or not, the systems you’re working on will still ask you for authentication. In cars, it’s security by obscurity. If you know the protocol to talk to the car’s computers via the OBD port, you are pretty much root without even providing any credentials.
- monocasa 8y agoWell, I assume that the burglar was paid, de facto making it a professional replacement.
- mschuster91 8y ago> The entire board computer was taking from a friend’s car and the screws and cables etc were all tidily set aside as if it was a professional replacement. Probably the thief didn't want to risk any kind of damage on the board caused e.g. by shorting two wires during cutting the cabling and thus shorting a capacitor on the board.
- hashifynet 8y agoIt would seem the person took the time to review a wiring diagram or had some previous experience.
- avar 8y agoReading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands? Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Meanwhile, wherever this guy lives they're sending officers because some BMW call center calls the police in the middle of the night telling them that some car reported unspecified distress within some radius, and they sent officers to search the whole neighborhood for the car and locate the owner. I guess the next time I need police help I'll use a burner phone and tell them a BMW is in distress.
- NightlyDev 8y agoThey didn't search the whole neighborhood. They got a call about a potential accident and ofc checked it out.
- Dayshine 8y ago>because some BMW call center calls the police in the middle of the night telling them that some car reported unspecified distress within some radius Isn't that much more severe than "window smashed"? It's "Burglary in process, or someone might be dying, and you haven't received a 112 so no ambulance is on the way."
- avar 8y agoThe BMW just reported some ambiguous state of distress, whereas a person calling the police and telling them that some car has had its windows smashed in in downtown is by all reasonable criteria equivalent to a burglary in process. If someone's not stealing from that car now, they will be in 5 minutes.
- Dayshine 8y ago>The BMW just reported some ambiguous state of distress It reported damage to the car severe enough to sever the door frame!!
- deleted 8y ago[deleted]
- ironjunkie 8y agoWhy did they not park the car back and wait with the police on call in order to catch the thieves that would have come back the next night?
- stingraycharles 8y agoI would assume because of the short timeline, the novelty of the technique, a lot of paperwork being involved, and possibly a whole different police department that would have to do it.
- test6554 8y agoWith the alarm disabled, they could wait a month.
- Cthulhu_ 8y agoI'd argue they would have to act quickly though - there was an alarm going on the dashboard when the car was started.
- Rjevski 8y agoI had a phone stolen recently at knifepoint (attempting to sell it on a classifieds site). When I told the police I could make them come back next day (posting another ad, etc) they wouldn’t give a shit. I suspect this is the same reason.
- chrischen 8y agoYou'd have to get the Japanese police involved. https://www.economist.com/asia/2017/05/18/as-crime-dries-up-japans-police-hunt-for-things-to-do https://www.economist.com/asia/2017/05/18/as-crime-dries-up-...
- hartator 8y agoIt seems overly complicated when just relaying your key fob is a known attack that's working. The scenario of them just failing to steal the car seems more plausible.
- ransom1538 8y agoIn Sacramento car theft is a big problem. The scheme there is to steal a nice car, purchase a wrecked one at a lot (salvaged) for pennies, then swap the vins and serial numbers with the salvaged car then sell it. It works really well. So if you buy a used car in sacramento there is a %90 chance it has a salvaged title.
- tempestn 8y agoHowever large an issue it is, I'm pretty confident a majority of used cars sold in Sacramento are not stolen, let alone 90%. (Maybe you were just exaggerating.)
- gok 8y agoHow is cutting the line to a car's panic button unlike cutting a car's brake line? (that is, attempted murder)
- siliconwrath 8y agoI imagine they hoped to steal it before anything were to happen to the owner.
- tempestn 8y agoEven cutting brake lines wouldn't automatically be attempted murder; it would depend on circumstances. Equating that to cutting off the panic button is quite a stretch though. I've never owned a car with a panic button, nor known anyone whose life one has saved (unlike brakes).
- londons_explore 8y agoIt's clear what has happened here... Cutting that wire loom disables the cars 'call home' functionality (probably by cutting it's antenna), as well as conveniently disabling the alarm. The thieves who cut it this time were too slow though. Presumably, the 3G connection takes ~30 secs to boot up, find a cell tower, and connect to BMW servers. The thieves hoped to break the window and cut the loom immediately, before the connection to the server was made.
- rtkwe 8y agoAren't they just always on? Also the modem would have to be on the other end of that cable loom for that to work when it's much more likely to be down in the glove box with the rest of the control modules and you don't need an antenna that long for a WAN modem.
- londons_explore 8y agoYou probably want the antenna away from all the metal body panels of the car. Hence normally running a cable up the A pillar. The modem itself probably isn't booted up to reduce vampire power drain. If it was always on, it would drain the battery after a few weeks. More likley, when the alarm goes off it starts booting up.
- rtkwe 8y agoMy cell phone still gets decent signal sitting down in the center console in the cubby below the entertainment system, enough to stream music at least which is more than it'd need for an SOS function. If your phone can send a text it's got more than enough signal to do the SOS functions.
- Rjevski 8y agoI’m surprised they wouldn’t just arrive with a GSM/3G/LTE jammer to begin with.
- lucb1e 8y ago
- post_break 8y agoIf you have a car that has keyless entry store your keys in a metal box and confirm it wont unlock the vehicle even if you take the box and put it next to your door. Also if you drive a modern ford do everything you can to block access to odbii port as they can clone a key in seconds using special tools.
- Coding_Cat 8y agoAfter the frst paragraph(s) I was expecting the security center to be fake, the actual thieves, and have them send out a 'customary repair service' that would have to take the car back to the dealer or something.
- Rjevski 8y agoI used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of the cars I really doubt anyone would bother stealing them. Car security is based on obscurity. There is very little cryptography involved (if any), and where there is, the car’s “computers” would happily install new, untrusted firmware through the diagnostics (OBD) port, which means you can do pretty much anything - program new keys, disable the immobiliser or alarm completely (by installing patched firmware) or even rewind the odometer. I’m frankly surprised it took this long for “high tech” car theft to appear, unless it’s been going on for a while but executed perfectly so nobody would find a trace. Happy to answer any questions if anyone’s curious.
- kccqzy 8y agoHave you taken a look at a Tesla car yet? From PR materials I'm led to believe that they treat their car software seriously. I doubt one can install untrusted firmware on a Tesla car; is that so?
- Rjevski 8y agoI’ve never worked on a Tesla. I’ve left the trade long ago finding my way in software engineering instead. Tesla is probably the only one I’d trust though. While I don’t expect them to be bulletproof either (at least not at first), I expect them to quickly catch on should this kind of theft appear, and make the necessary fixes. In any case I doubt they’d be stupid enough to accept arbitrary code over a diagnostics port (if they have one even). I mean, even if we forget security, why would they? Teslas update remotely via the Internet.
- FredFS456 8y agoI believe Telsas have a minimal OBD-II port (where mandated by law) but mostly use an Ethernet port for debugging/service.
- multjoy 8y agoAmateurs, frankly. The current modus operandi is to find your BMW/Land Rover/Mercedes. Wait for it to come to your hand carwash, tyre company etc and get uninterrupted access to the OBD port along with the key. Program new key, find the address of the vehicle, walk up a few days later and drive it off at 3am in seconds. If that's too much like shooting fish in a barrel, then the 'keyless relay theft' is probably more your bag. Using a relay transceiver, if the key is in the house within range, then you can trick the motor into thinking the key is present. Many cars will allow you to continue to drive them even if the key if out of range. Provided you don't turn the engine off, this gives you plenty of scope to get away and clone a new key in the meantime. Tl;DR, OBD and keyless technology is basically flawed. The best countermeasure is a good old fashioned crook lock.
- mobilemidget 8y agoHope he still went on vacation as planned, I kind of miss that information
- mrooding 8y agoWe are actually. Not with the BMW as intended but with my girlfriends car. Currently driving from the south of France to Bretagne for our last week. The car has been fixed by now and will be picked up the 18th. I'll update the article later today too!
- jeroentrappers 8y agoJust use a steering wheel lock.
- trukterious 8y agoThieving isn't a good life -- for one thing, thieves lie awake at night worrying that someone's going to steal their stuff.
- chrischen 8y agoSounds like a perfect opportunity to do a sting.
- purpleidea 8y agoThe smart thing to do would have been to leave your car outside again, and have the police hidden down the street, so when they returned they could catch the crooks!
- danieltrembath 8y agoI wonder if they were in fact intending to steal the airbag, but were disturbed in the process. Airbag theft is fairly common and lucrative. You can extract the A-Pillar bag through the window without opening the door. In cars without the radar/pressure sensors you have some chance of doing that without setting off the alarm.
- vanous 8y agoWould it be possible, that the order of actions was actually different? The thief first pushed thin tools through the door gasketing and actually cut the wires from the outside. Not sure how well and how successfully, but i actually presume that this wasn't as good cut as they tried to achieve. Then, they tried to break the window and continue with the theft, but the system reported them too fast anyways...?
- mrooding 8y agoI doubt that this is what happened. I'd like to see someone remove the jamb cover from the outside and also cut the loom from the outside. Not sure what kind of tool would be able to fit through the door and do these things. You can clearly see on the third image that they forcefully removed the cover with a screw driver or something else since it's completely bent
- Cthulhu_ 8y agoThe author also mentions that these cars have radar and air pressure sensors - I don't know how accurate these are, but forcing something through the gasketing could cause a change in air pressure enough for it to trigger.
- dig1 8y agoSince all protection in cars (no matter how complex is) is mass produced, it is very easy for thieves to purchase same/similar car and study it. However, I'm wondering what will happen if an ordinary Hacker Joe (a guy who knows a little bit of electronics and software) installs custom protection, no matter how simple is? Knowing that for thieves, the most precious resource is time and if you force them to work more than expected, they might gave up...
- mrooding 8y agoHi guys, very cool to see how this is being picked up over here. Shame on me, but I actually forgot to submit it to Hacker News. The key fob method is out of the question for my car. I've known about it for a while and store my keys in special bags. I see quite a few people asking why a sting wasn't organised. I of course shared the M.O. with the police and we actually had a few phone calls from them over the past few days. They are sharing the information with their colleagues but to be frank, they are not going to spend an entire night waiting around for a potential car theft. We live in Ijsselstein, a city just south west of Utrecht, and car burglary and theft is quite a big issue in our area. My previous car, a BMW F20, actually got broken into twice in 2 weeks. Both times they stole the entire nav system. I've become quite adapt at filing reports but besides filing a report the police can't do anything for you. The first time it happened they asked me whether or not I saw visible blood stains. Only then would they send a patrol car to do sample research. In any other case, they just ask you to file a report and be done with it. Let me know if there are any questions you'd like me to answer while I'm at it. I'm also interested in writing some follow-up articles about car security/theft prevention. If there's anyone willing to contribute, let me know!
- Scoundreller 8y agoYou may want to look into rewiring your OBD port so that it doesn’t work without you flipping a switch somewhere, or building a “key” with a male and female port + some wires, then storing the “key” in some hidden location (spare tire?). Or just expose two data lines from the OBD wiring harness and jump them together. Remove the jumper to operationalize the OBD port. FYI: cutting off VCC may not always work since some devices may derive enough power through other lines that have pull-up resistors to function. I’ve seen it happen in other industries. Not sure if such products exist commercially, but it would have some value for someone to build them.
- mrooding 8y agoA few days ago, I read on the most reliable source in the world, the internet, that if you have a class 3 alarm system from BMW, the OBD port is blocked as soon as the alarm goes off. I do want to verify this with the dealer once my holiday is over. I also read about the OBD key cloning, but I'm not sure whether or not that was an issue with the first F30s. I'm unsure whether or not it still works with the F30 LCI from 2017 that I have
- jmnicolas 8y agoThe author should feel lucky that he encountered "fancy" thieves. Modern cars are so hard to steal that mots thieves resort to violence to get your car. Contrary to insurance companies, I'd rather have my car stolen than to be knifed.
- stealthmodeclan 8y agoTheives are usually lazy and they don't make more efforts then required. My friend has holes in the front of the car to make it easier for theives to attach a hook and then tow the car into a truck. But if you put pressure above a threshold on any of the holes, car keeps sending one SMS to his number every 5 minutes. This is in Romania.
- danielovichdk 8y agoFunny reading this. I had the same experience with a rental bmw 530 in italy. Nothing stolen, only window shaddered and SoS going blind. I left for Germany that day though, so I must have been lucky. Thanks for posting