6 ms·
Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
by maym86 8y ago
Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
- jasoncartwright 8y agoMany suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
- maym86 8y agoSure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
- gambiting 8y agoIf you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
- matthewdgreen 8y agoIt's coming in the next generation of keyless systems: https://www.3db-access.com/ https://www.3db-access.com/
- Rjevski 8y agoI’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.
- leot 8y agoWhy not relay that, too?
- Rjevski 8y agoRelaying would still require the owner to push a button on the keyfob, right?
- maym86 8y agoNo. The point of this whole thread is there is no button so that when you approach the car it unlocks automatically. That's why this attack is possible by extending the range with repeaters. The key likely already has something similar to what you suggested but that can't prevent this attack.
- giobox 8y agoThe entire point, rightly or wrongly, of keyless entry is that you never have to touch the key, simply have it somewhere in the vicinity of the car, such as in your pocket. No button pressing or user input. You approach the car and it is already magically unlocked and ready to be started, usually via a starter button on the dash. Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.
- gambiting 8y agoThis is precisely how it works already, exactly as you described. The issue is that the relay just boosts the signal,so the car thinks your key is nearby, while in reality it's in your bedside drawer.
- yc-kraln 8y agoI have built an access control system that does a similar thing. Long story short: Time Of Flight is patented and no one can use it. Our system used a nice workaround... We tried to convince car manufacturers to use or license our tech and they seemed happy with their current stuff.
- williamscales 8y agoHow can one patent something so obvious as measuring how far away something is based on how long the signal takes to bounce back? That principle underlies...so many things. Edit: I looked up the patent. Here it is: https://patents.google.com/patent/US8930045 https://patents.google.com/patent/US8930045. I understand that patents protect novel inventions and that under some standard this may be considered "novel". On the other hand, I myself have frequently used the technique of sending a signal, awaiting a response, and then using timing to derive the distance. It seems such an obvious application to this use case that there is nothing novel here.
- rachelbythebay 8y agoHmmm. 2013? I beat them by a year. http://rachelbythebay.com/w/2012/02/07/ping/ http://rachelbythebay.com/w/2012/02/07/ping/
- fjsolwmv 8y agoA few years before 2002: https://www.ibiblio.org/harris/500milemail.html https://www.ibiblio.org/harris/500milemail.html
- db48x 8y agoYou just have to convince the patent examiner that it's not obvious. There's bound to be prior art (radar), so it could probably be invalidated if you want to spend the money on it, and you don't have some alternative ready to hand.
- dzhiurgis 8y agoIs that how contactless payment cards are protected?
- deleted 8y ago[deleted]
- gambiting 8y agoNo, contactless cards could be hacked in the exact same way cars are, but it's not worth the trouble since you would need an authorized terminal and the most you could steal is £30 - it's just not worth the trouble.
- gargravarr 8y agoSteal £30 off enough people, though - RFID/NFC has been demonstrated to have a range of several meters under some conditions, so just stick your equipment in a bag and wander through a shopping centre. Probably pickup a dozen or so. I understand those who buy RF-shielded wallets all too well.
- gambiting 8y agoBut like I said, only an authorized terminal will process transactions, so you need to figure out how to get one. And then, visa and MasterCard take at least a week to pay out any money from card transactions - so your terminal and likely the entire account will get banned before you get a penny out of that money. It's not that £30 is little money - it's that it's nearly impossible to secure a working terminal and then once you have that actually get any money out of it.
- gruez 8y agoLike the parent comment said, you need an authorized terminal, which is linked to a merchant account, which is linked to your bank account (and thus your identity). What do you think visa/mastercard is going to do when the fraud reports start flooding in? Chances are, you're going to be caught before your first payment arrives in your bank account.
- 8y ago
- raverbashing 8y agoWell, for some people, pulling the parking brake is a "massive inconvenience" which ends up having serious consequences. Technology can't solve everything.
- tbrock 8y agoThe attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up
- maym86 8y agoIt doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.
- hvidgaard 8y agoThe entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob. That also means that relay attack is always going to work. So either accept the risk or disable the feature.