8 ms·

I've anecdotally heard a lot of stories about the relay/replay attacks on keyless ignition systems used in many BMW models and other cars as well. No need to sm

by giobox 8y ago

I've anecdotally heard a lot of stories about the relay/replay attacks on keyless ignition systems used in many BMW models and other cars as well. No need to smash the window at all in some cases. Remarkably simple attack in principle, and probably a nightmare to explain to your insurer given there will be no evidence of a break in. Makes you wonder if you should start storing the key in a metal/RF shielded box at home... > https://www.bbc.com/news/uk-england-birmingham-42132689 https://www.bbc.com/news/uk-england-birmingham-42132689

jasoncartwright 8y ago
This has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off the passive entry feature that allows this attack. https://pasteboard.co/HypzOWg.png https://pasteboard.co/HypzOWg.png Here's a video of a relay theft (of a Merc) from West Midlands police in the UK... https://www.west-midlands.police.uk/news/4544/watch-police-release-footage-relay-crime https://www.west-midlands.police.uk/news/4544/watch-police-r... Photo from a camera of attempted theft, from a UK Tesla owner... https://pasteboard.co/HypF8Ep.jpg https://pasteboard.co/HypF8Ep.jpg
- maym86 8y ago
  Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
  - jasoncartwright 8y ago
    Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
    - maym86 8y ago
      Sure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
    - gambiting 8y ago
      If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
      - matthewdgreen 8y ago
        It's coming in the next generation of keyless systems: https://www.3db-access.com/ https://www.3db-access.com/
        Rjevski 8y ago
        I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.
        leot 8y ago
        Why not relay that, too?
        Rjevski 8y ago
        Relaying would still require the owner to push a button on the keyfob, right?
        8y ago
  - tbrock 8y ago
    The attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up
    - maym86 8y ago
      It doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.
  - hvidgaard 8y ago
    The entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob. That also means that relay attack is always going to work. So either accept the risk or disable the feature.
MichaelApproved 8y ago
> "probably a nightmare to explain to your insurer given there will be no evidence of a break in." Is that really an issue? This isn't the first type of theft that doesn't require a break-in. Tow the car and there's no evidence either. If you say it's been stolen then it's been stolen. File the police report and that's the end of that, no? Unless they have specific reason not to believe you personally (history of fraud), it'd be a crappy insurance company that would question it.
- giobox 8y ago
  True, it's probably not _that_ hard, but I doubt it's all that great an experience either. At least with towing there is arguably a significantly higher chance of witnesses or CCTV footage of a number plate, and on most modern luxury vehicles will trigger the alarm. With this attack it looks like the driver simply opened the door and drove off as if they were the owner, which is far less likely to arouse suspicion in most neighborhoods I would imagine.
blensor 8y ago
That's actually not hard to explain to your insurance or the police at all. This happened to me 5 weeks ago. The car was parked directly in front of my entrance door and the key was basically on the other side of that door. The scene of my car not being where it was supposed to be was so surreal that I did not even realize it was missing the first time when I walked out the trash. I basically walked around an invisible car. Only when I wanted to leave the house and thought, well shouldn't my car supposed to be there did it dawn on me that something is amiss. When I went to the police, the first thing they asked me was how far my keys were away from the car. My insurance was asking the exact same thing. Remarkably the car was found when the police in our neighboring country stopped a driver under the influence of drugs. Getting the car back (still ongoing) was so much hassle that I almost would be happier if it would not have been found. It goes without question that all my keys are now stored inside a metal box when not in use. I was a bit worried that the box does not shield the signal enough. The best way I could think of to test it was to put the key inside the box and hold the box to the steering column and try to start the car. It's probably not foolproof but I hope it is enough.
- tjoff 8y ago
  Well, now when that technique is well known it's another story. It's like the case where PIN numers on credit-cards where cracked but because noone knew it could be done people where assumed to have been negligent if the thief knew the code and automatically denied any compensation. ... until they caught the guys.
- akira2501 8y ago
  > I was a bit worried that the box does not shield the signal enough. They make "Faraday Bags" exactly for this purpose.
  - blensor 8y ago
    I needed a quick fix that everyone in our house would be adopting quite quickly, and it should also fit into the style my wife used to decorate the entrance area. So the bowl where our keys were usually collected was replaced by a metal box with a lid. However, in the long run I won't bet on workarounds to prevent the signal to be repeated, I will rather use one of those steering wheel locks that's brightly visible from the outside. That does not prevent someone from breaking into the car, but it will prevent them from easily driving away with it. A security camera has also been placed there, so I hope overall it is enough of a deterrence
gambiting 8y ago
I already do. I keep the keys to my mercedes in an rfid-blocking bag next to my bed at night, because unfortunately it's vunerable to that exact type of attack.
city41 8y ago
I keep my keys inside of these: https://www.amazon.com/Faraday-Wisdompro-Blocking-Shielding-Protection/dp/B01HETGX00 https://www.amazon.com/Faraday-Wisdompro-Blocking-Shielding-...
bostik 8y ago
A personal anecdote from this side of the table. Back in early 201x I was asked to take a look at a certain car manufacturer's project proposal. They wanted to introduce keyless unlock and ignition to their line. I got the spec and the proposal. There was no security - the number of possible signalling combinations was in low thousands and the system was completely open to trivial replay attacks. So I got back and laid out my concerns and requirements: unique keys per car, strong nonce and proper cryptographic setup to make replay attacks impossible. The manufacturer balked, claimed it was too expensive and we lost the project. Less than a year later certain mr. Miller demonstrated the very same type of key-fob replay attack against a different manufacturer.

by giobox 8y ago

jasoncartwright 8y ago

This has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off the passive entry feature that allows this attack. https://pasteboard.co/HypzOWg.png https://pasteboard.co/HypzOWg.png Here's a video of a relay theft (of a Merc) from West Midlands police in the UK... https://www.west-midlands.police.uk/news/4544/watch-police-release-footage-relay-crime https://www.west-midlands.police.uk/news/4544/watch-police-r... Photo from a camera of attempted theft, from a UK Tesla owner... https://pasteboard.co/HypF8Ep.jpg https://pasteboard.co/HypF8Ep.jpg

maym86 8y ago
Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
- jasoncartwright 8y ago
  Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
  - maym86 8y ago
    Sure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
  - gambiting 8y ago
    If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
    - matthewdgreen 8y ago
      It's coming in the next generation of keyless systems: https://www.3db-access.com/ https://www.3db-access.com/
      - Rjevski 8y ago
        I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.
        leot 8y ago
        Why not relay that, too?
        Rjevski 8y ago
        Relaying would still require the owner to push a button on the keyfob, right?
        8y ago
- tbrock 8y ago
  The attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up
  - maym86 8y ago
    It doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.
- hvidgaard 8y ago
  The entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob. That also means that relay attack is always going to work. So either accept the risk or disable the feature.

MichaelApproved 8y ago

> "probably a nightmare to explain to your insurer given there will be no evidence of a break in." Is that really an issue? This isn't the first type of theft that doesn't require a break-in. Tow the car and there's no evidence either. If you say it's been stolen then it's been stolen. File the police report and that's the end of that, no? Unless they have specific reason not to believe you personally (history of fraud), it'd be a crappy insurance company that would question it.

giobox 8y ago
True, it's probably not _that_ hard, but I doubt it's all that great an experience either. At least with towing there is arguably a significantly higher chance of witnesses or CCTV footage of a number plate, and on most modern luxury vehicles will trigger the alarm. With this attack it looks like the driver simply opened the door and drove off as if they were the owner, which is far less likely to arouse suspicion in most neighborhoods I would imagine.

blensor 8y ago

That's actually not hard to explain to your insurance or the police at all. This happened to me 5 weeks ago. The car was parked directly in front of my entrance door and the key was basically on the other side of that door. The scene of my car not being where it was supposed to be was so surreal that I did not even realize it was missing the first time when I walked out the trash. I basically walked around an invisible car. Only when I wanted to leave the house and thought, well shouldn't my car supposed to be there did it dawn on me that something is amiss. When I went to the police, the first thing they asked me was how far my keys were away from the car. My insurance was asking the exact same thing. Remarkably the car was found when the police in our neighboring country stopped a driver under the influence of drugs. Getting the car back (still ongoing) was so much hassle that I almost would be happier if it would not have been found. It goes without question that all my keys are now stored inside a metal box when not in use. I was a bit worried that the box does not shield the signal enough. The best way I could think of to test it was to put the key inside the box and hold the box to the steering column and try to start the car. It's probably not foolproof but I hope it is enough.

tjoff 8y ago
Well, now when that technique is well known it's another story. It's like the case where PIN numers on credit-cards where cracked but because noone knew it could be done people where assumed to have been negligent if the thief knew the code and automatically denied any compensation. ... until they caught the guys.
akira2501 8y ago
> I was a bit worried that the box does not shield the signal enough. They make "Faraday Bags" exactly for this purpose.
- blensor 8y ago
  I needed a quick fix that everyone in our house would be adopting quite quickly, and it should also fit into the style my wife used to decorate the entrance area. So the bowl where our keys were usually collected was replaced by a metal box with a lid. However, in the long run I won't bet on workarounds to prevent the signal to be repeated, I will rather use one of those steering wheel locks that's brightly visible from the outside. That does not prevent someone from breaking into the car, but it will prevent them from easily driving away with it. A security camera has also been placed there, so I hope overall it is enough of a deterrence

gambiting 8y ago

I already do. I keep the keys to my mercedes in an rfid-blocking bag next to my bed at night, because unfortunately it's vunerable to that exact type of attack.

city41 8y ago

I keep my keys inside of these: https://www.amazon.com/Faraday-Wisdompro-Blocking-Shielding-Protection/dp/B01HETGX00 https://www.amazon.com/Faraday-Wisdompro-Blocking-Shielding-...

bostik 8y ago

A personal anecdote from this side of the table. Back in early 201x I was asked to take a look at a certain car manufacturer's project proposal. They wanted to introduce keyless unlock and ignition to their line. I got the spec and the proposal. There was no security - the number of possible signalling combinations was in low thousands and the system was completely open to trivial replay attacks. So I got back and laid out my concerns and requirements: unique keys per car, strong nonce and proper cryptographic setup to make replay attacks impossible. The manufacturer balked, claimed it was too expensive and we lost the project. Less than a year later certain mr. Miller demonstrated the very same type of key-fob replay attack against a different manufacturer.