3 ms·
Most keyless systems are insecure in several other ways to a surprising degree for this decade. Even in more recent years, most of them seemingly do not implem
by lathiat 8y ago
Most keyless systems are insecure in several other ways to a surprising degree for this decade.
Even in more recent years, most of them seemingly do not implement
(1) Time of flight checks, e.g. that a radio relay isn't being used to get to the keyfob many more meters away in the house using a relay/amplifier. This is a commonly exploited theft method currently. The Apple watch implements this to unlock your MacBook Pro(!) This has also been shown to be a viable attack method on many contactless payment terminals.
(2) Replay protection - another possible common attack is to receive the rolling code from transmitter, jam it so the car can't hear it and wait for the remote to transmit a second one. Then you jam that also, store that code, but then re-transmit the first code and the car unlocks and now you have a second code to use to unlock the car later. It's possible to both receive and jam the code by using a very precise tuned receiver, and jam in the surrounding the frequencies which in most cases the actual receiver (e.g. car) won't have filtered out. This works particularly well on most garage doors.
(3) Let alone having some kind of recoverable/brute forcible ID scheme, which as we can see here, is also true. I'm sure these aren't the only ones.
It's kindof silly really. I'd be curious to know if any manufacturers have been fixing this in the last couple of years.
- cjrp 8y ago> Time of flight checks, e.g. that a radio relay isn't being used to get to the keyfob many more meters away in the house using a relay/amplifier. That one's surprising. What's to stop someone following you into a supermarket after you've parked your Porsche, standing next to you with a relay device transmitting via the cell network, and someone else in the car park with the equivalent receiver/relay?