28 ms·

Thieves boosting signal from key fobs inside homes to steal vehicles

345 points by colinprince 8y ago

k_sze 8y ago
“Greater Toronto Area” = GTA. What a coincidence. Jokes aside, this is bound to happen. It’s disturbing that a vulnerability like this isn’t caught as a show-stopper before the technology is sold to consumers.
- lbriner 8y ago
  It's not a show-stopper. It's not even close to being a show-stopper any more than having keys is also a vulnerability to having a car stolen. All you have to do is keep the fob inside a shielded case at home and you're fine.
  - josefresco 8y ago
    > All you have to do is keep the fob inside a shielded case at home and you're fine. Because we all have Faraday cages in our homes, and I'm sure the salesman who sold the car also made the customer aware of this vulnerability. /sarcasm.
    - dsfyu404ed 8y ago
      >Because we all have Faraday cages in our homes Yes, most people who own cars new enough to have this vulnerability own microwave ovens.
      - asdff 8y ago
        So you have to pull your keys out of your pocket and stick them in your microwave every time you enter your house just to have the convenience of not needing to take them out of your pocket when you approach the car.
        dsfyu404ed 8y ago
        I know it's not a practical workaround. I'm just pointing out that most people do technically have a Faraday cage in their homes.
        k_sze 8y ago
        It’s gonna be fun when somebody forgets to take the fob out of the microwave before warming their coffee.
  - pjc50 8y ago
    Ah, so the convenience feature of "not having to take your key out of your pocket or purse" now requires "you have to take it out and put it in a sealed case when not in use".
  - pofilat 8y ago
    Also keep the fob in a shielded case at work and whenever you are out for shopping or entertainment.
- blattimwind 8y ago
  > It’s disturbing that a vulnerability like this isn’t caught as a show-stopper before the technology is sold to consumers. Everyone knew about this for many years. Interactive transponders are quite old (late 90s? early 2000s?) and were designed to mitigate attacks like this one (because the user has to interact with the transponder, i.e. press the button it has for it to work, all passive attacks fail).
mtgx 8y ago
But people still blindly trust carmakers to make reliable and difficult to hack fully software-based and with always-on internet access self-driving vehicles. They can't even secure the thing that directly unlocks your car and enables thieves to steal it.
- Someone1234 8y ago
  It is a legitimate point to a degree, vehicle makers have a long track record of terrible software, and now they want to go headlong into one of the most complicated software projects ever attempted by man. It will be interesting to see how legal liability shapes up with self-driving.
- deleted 8y ago
  [deleted]
Down_n_Out 8y ago
Nothing new, has been going on for a while now. Market is already providing your own "cage of Faraday[0]" for your fob. [0]https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3Aaps%2Ck%3Afaraday%20cage%20key%20fob https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3A...
- sofaofthedamned 8y ago
  Yeah this has been a thing for years in the UK. Myself and my wife put our keys into a metal lunch box in the hallway which mitigates this problem, which was prompted by both next door neighbours getting their cars broken into.
  - mysterydip 8y ago
    Top Gear did a thing on this during their one road trip: https://youtu.be/-aU09WT5rXg https://youtu.be/-aU09WT5rXg fast forward to the 3 minute mark
    - sofaofthedamned 8y ago
      Exactly. Luckily i've got a Kia which nobody wanted to steal, but it's definitely a well known attack vector. A car on one side got stolen, the other side 'just' had stuff stolen from it.
      - wkearney99 8y ago
        Wait until bad weather. I had an utterly clapped-out Jeep Cherokee stolen one cold-as-hell winter night. Sure enough, found two neighborhoods over... a fair walking distance from where the last late night bus would have dropped someone off. So, yeah, a stolen beater is just fine when it's freezing cold outside...
        sofaofthedamned 8y ago
        Good point. We've got a new (year old) Kia Ceed, and a 15 year old Ford Focus. I'd imagine if somebody needed a ride they'd just take the Focus. Either way we've got the cameras outside which, along with the fact we don't have a Jaguar or a BMW outside probably makes us less likely to be turned over.
aj_g 8y ago
It seems to me like there is often just as much creativity in thievery as there is in entrepreneurship.
- toyg 8y ago
  It is astonishing the lengths some people will go to not earn a honest salary.
  - asdff 8y ago
    Everything is risk vs. reward in life.
z2 8y ago
Two factor authentication for cars, here we come! Though, searching for this phenomenon shows articles at least 3 years old warning to get Faraday cages or otherwise wrap fobs in aluminum foil. But do they really transmit all the time, or do they contain accelerometers or something to prevent battery from being wasted?
- gruez 8y ago
  >Two factor authentication for cars, here we come! in other words, requiring a button press.
- josefresco 8y ago
  2FA seems to make sense. Maybe a 4-6 digit pin that would be optional for those in high risk areas/situations. > But do they really transmit all the time, or do they contain accelerators or something to prevent battery from being wasted? I'm curious about this as well. A family member has an older Nissan with a keyless fob and I don't recall them ever having to replace batteries/keyfobs.
  - nickspacek 8y ago
    The fob for my 2007 Altima with keyless start (not entry) has required at least one battery change since I inherited it and is now complaining that the battery is getting low.
  - rainbowzootsuit 8y ago
    Some fobs use an inductive coil to recharge a battery within the key while the key is in the ignition.
- fabricexpert 8y ago
  2fa on a car would be a disaster. I can't wait to whip out my phone in the pouring rain, trying to unlock it while my hands are full and I have no signal.
  - logfromblammo 8y ago
snarfy 8y ago
> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. Why is it transmitting without the user pressing a button? Is that a feature? As you walk up to the car it automatically starts like magic? I'm not familiar with these newer cars.
- bayindirh 8y ago
  Yes, it’s called keyless entry and ignition system.
- gregmac 8y ago
  With my car, as soon as you touch the door handle (with the keyfob in your pocket, or within a couple feet of the door) it unlocks, and to start the car you push a button. It doesn't work from even 4' away (eg, someone else touches the door handle while you're close) and it doesn't work from the other side (eg, when the keyfob close enough to driver's side door, the passenger side won't unlock). The really nice feature is when you walk away (a few seconds after you're out of range), the doors automatically lock. However, the downside of this feature is my wife's car does not have it -- and so at least half of the time when I am driving it I forget and leave it unlocked in parking lots.
  - moftz 8y ago
    Oldest car I've seen it in is a 2006 Infiniti.
  - ghaff 8y ago
    >so at least half of the time when I am driving it I forget and leave it unlocked in parking lots This is the problem with a lot of the newer tech in cars like backup alarms. You become used to various features in your own car and when you rent a car you need to consciously remember that the vehicle doesn't have $FEATURE. Effectively, cars are becoming a lot less standardized. A car I rented a few weeks ago beeped at me a couple times and it took a while before I realized it was the lane departure warning triggering on a couple turns.
delibes 8y ago
Looks like we have a new modern interpretation for 'boosting' https://www.urbandictionary.com/define.php?term=Boosting%20Cars https://www.urbandictionary.com/define.php?term=Boosting%20C...
cameldrv 8y ago
The car manufacturers are going to need to incorporate a time of flight measurement into the key system. Obviously amplitude can be faked.
- wglb 8y ago
  So the test for amplitude is aided by the fact that the signal strength received at the car increases by a factor of four if the distance is cut in half. Thus, you have a nice margin for setting your threshold. With measuring the time, however, presuming that radio signal will travel on the order of one foot per nanosecond, you have much less of a threshold tolerance. If the unlock takes place within two feet of the car, that is two nanoseconds. If the key sits 20 feet away, that is a 20-nanosecond one-way travel. So this solution would need to be able to distinguish between a four nanosecond gap (round trip time) and a 40-nanosecond round-trip time. Add to that the turnaround time in the car CPU which I would imagine to be some number of milliseconds, would 10 ms be reasonable? Thus, the electronics in the car needs to distinguish between 10ms + 4 ns vs 10ms + 40ms. And given jitter in any modern CPU/memory/OS/electronics device, I would bet that the jitter totally swamps that. (Keep in mind that this is a BOEC https://en.wikipedia.org/wiki/Back-of-the-envelope_calculation https://en.wikipedia.org/wiki/Back-of-the-envelope_calculati...)
  - deleted 8y ago
    [deleted]
- kevin_thibedeau 8y ago
  Or just use physical contacts on a real key.
  - izacus 8y ago
    Not having to drag keys out of your pockets is a feature.
    - bas 8y ago
      You meant a solution in search of a problem.
villuv 8y ago
I wonder how hard it is to measure the delay between challenge and response... Any distance extension would increase the signal flight time that should be measurable.
- shittyadmin 8y ago
  This has been proposed in the past yet I haven't seen any implementation of it - perhaps because of increased power consumption of accurate timing components needed? Any EEs able to comment on this?
gambiting 8y ago
I already put mine in a metalic bag for the night, or just press the "lock" button twice which disables the keyless entry system entirely. Manufacturers really need to hurry up and implement more accurate timing detection in the keys - it should be absolutely trivial to detect how far away the key is based on the response time, but for some reason manufacturers don't do this yet. Edit: I also know people who take the exact opposite approach with their expensive vehicles - they leave the key in plain sight near the front door, so if someone wants to steal the car using this method they can do so without entering the house or if they do break in they will(hopefully) take the key and leave, without threatening and possibly harming their family. I'm not sure which way is better - preventing the thief from stealing your vehicle and risk that they will then decide to break in and get the key from you, or let them steal it and just deal with insurance later.
- ghaff 8y ago
  > it should be absolutely trivial to detect how far away the key is based on the response time Is that true? Accurate, very low power distance detection has a lot of potential applications (e.g. your phone straying too far away) but BLE (for example) doesn't really work for measuring distance--through signal strength--at all. If it's possible, I'd be very curious how to build such a distance detector.
  - gambiting 8y ago
    If you are processing data with nanosecond precision(which is not difficult with modern microchips) then you can tell the distance to the key by just measuring the number of nanoseconds elapsed since the request was sent(accounting for amount of time taken to calculate the response). If you can measure the time in nanoseconds that's good enough to tell the difference between the key being 1m and 10m away.
    - isatty2 8y ago
      What about reflections?
    - 8y ago
Tade0 8y ago
It's useful to note that less sophisticated methods still work as well. I used to lease a 2015 Toyota Auris(facelift). One year into the lease someone broke into it smashing the rear-left window and just drove away.
- hkai 8y ago
  Curious how they started it?
  - Tade0 8y ago
    Probably via some trick that put the car into service mode. There's a gang in Warsaw that specialises in Toyota's. I know late 2000s Rav4s could be stolen by thrusting a wire through the left-front mudguard and disconnecting something(not sure what) inside this way. There's a clip of a Russian demonstrating this technique somewhere on youtube. All I found was shattered glass from the window.
  - peterwwillis 8y ago
    If it has an immobilizer? You can find immobilizer bypasses on sale online, who knows if they work, or you can create your own and disable it yourself: https://www.youtube.com/watch?v=ispXq4EMrsY#t=24m45s https://www.youtube.com/watch?v=ispXq4EMrsY#t=24m45s https://github.com/fjvva/ecu-tool/wiki https://github.com/fjvva/ecu-tool/wiki (see also https://ioactive.com/pdfs/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf https://ioactive.com/pdfs/IOActive_Adventures_in_Automotive_... and http://opengarages.org/handbook/ebook/ http://opengarages.org/handbook/ebook/) So besides relaying the key, you can just hack via the CAN bus. There's also a trick to use a second ECU to bypass the immobilizer, but that's probably too time consuming. Many manufacturers (inc. Toyota) also allow bypassing immobilizers and other features using TechStream and a maintenance tool. If they claim you have to buy a new ECU if you lose your master keys, call bullshit: https://attachments.priuschat.com/attachment-files/2015/10/96213_T-SB-0043-14.pdf https://attachments.priuschat.com/attachment-files/2015/10/9...
PhasmaFelis 8y ago
I'm confused. Are there cars where the fob can automatically start the car, without any button presses, just from proximity? How did they not realize that was a bad idea?
- Gh0stRAT 8y ago
  No, but it will unlock from just (apparent) proximity which allows the thief enter the vehicle where they are then able to push the "Start" button. Again, the car will think the key is present and will start. At that point, the thief can stop the signal relay and the car will keep running without the key being "present".
- wvenable 8y ago
  The thief just gets in the car and presses the button using the boosted key fob signal.
- secabeen 8y ago
  Yes, the Tesla Model S and X keyfobs do not require any button presses.
  - RandallBrown 8y ago
    Not even without pressing a button on the car to start it?
    - secabeen 8y ago
      Just the brake pedal.
- ticmasta 8y ago
  It's not entirely clear from the article and conversation, but they're talking about passive FOBs that use the (presumed) proximity of the FOB to unlock the doors and allow the ignition button to work. These were created to stop you from having to physically dig out your keys. If you need to push the button to unlock this won't work, but they could still smash a window and then relay attack the ignition. Challenge would be determining prior to the break-in if the FOB is close enough to relay. Plus the most vulnerable cars tend to be the most expensive. From the article I'm a little surprised the RAV4 has passive entry.
gumby 8y ago
I’m honestly more amazed that there is enough of an economy for someone to design such a device and market it (ditto skimmers). I wouldn’t even know where to look for such a thing — alibaba?
exabrial 8y ago
Can someone explain to me how keeping your keyfob in a faraday bag is supposed to increase security?
- nkurz 8y ago
  From the linked article: Relay thefts According to Bates, many of these thieves are using a method called "relay theft." Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. "The way that the thieves are getting around this is they're essentially amplifying that low power signal coming off of the push start fob," he said. "They will prey upon the general consensus that most people are leaving their key fobs close to the front door of their home and the vehicle will be in the driveway." The thief will bring a device close to the home's door, close to where most keys are sitting, to boost the fob's signal. They leave another device near the vehicle, which receives the signal and opens the car. Storing the keyfob in a faraday bag blogs the signal and prevents the relay attack from working.
  - exabrial 8y ago
    Have a link? I'm familiar with rolling code systems, but this continuous transmission is new to me
    - exabrial 8y ago
      I can't find anything on continuous transmission, but it appears most of the keys use an rfid system, where the transmitter is powering the receiver.
post_break 8y ago
Ford is really bad with this. The Fiesta and Focus, you can program a new key with the ODB2 port in under 60 seconds. Blast the key with a booster, get inside the car, plug your laptop in, program a new key, drive off. People have had to lock the ODB2 port, disable it, put keys into aluminum foil (my method). https://www.youtube.com/watch?v=dvmSOEKfkug https://www.youtube.com/watch?v=dvmSOEKfkug
raverbashing 8y ago
It seems car manufacturers are eager to be "cool" but not thinking about the consequences of their actions Center "touchscreen" consoles with awful usability, shifters that are not obvious (coupled with people that are too lazy to pull the parking brake) and now this
- fredley 8y ago
  A touchscreen is a terrible interface for anything in a car, since you must look at it to operate it. Tactile dials/knobs you can feel for—and ideally feel different to each other—are the best interface for anything in your car that you want to use while driving. Voice can be sort of ok, as long as your speech models are locally stored (no internet blackspots), but deny access to those who cannot talk, or for whom you haven't bothered to build a speech model that matches their language/accent.
Reason077 8y ago
Here's some security camera footage of a car in the UK being stolen using a relay attack: https://www.youtube.com/watch?v=odG2GX4_cUQ https://www.youtube.com/watch?v=odG2GX4_cUQ
HorizonXP 8y ago
This happened to a family member of mine, here in Toronto. Lost their gorgeous M5. Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way." Sure enough, enough, key fob attack and theft. Caught on their video cameras. Filed the police report, claimed insurance, cried internally about the loss of a gorgeous vehicle. In all seriousness though, it's just a car, so no big deal, but nothing will fix the violation you feel, and the fact that you were being targeted. If I were the insurance companies, I'd be putting pressure on the car companies, but hey, maybe it's just the cost of doing business for them. Better to pay out for a vehicle theft, vs. actual injuries from a collision. That's probably why there's little incentive to fix it, especially if fixing it makes your product less convenient.
- ams6110 8y ago
  What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Once they got very far away from the house, the car should shut off. Or so I would think.
  - pofilat 8y ago
    So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?
    - dawnerd 8y ago
      Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
      - toss1 8y ago
jaclaz 8y ago
>"The vehicle will continue running in perpetuity until it runs out of gas or until you shut it down," he said. >"They do that for safety so that if you lose the key fob or if it loses signal the vehicle doesn't shut down while you're driving, but that right there is part of the vulnerability." Anecdata, a few years ago my wife had a Renault "Megane" that used a sort of "card" that worked with proximity. She opened and started/drove it without ever taking the card out of her bag. A couple of times I was driving it with her in the passenger seat, we arrived to a shop, she got down in front of the door and went into the shop while I was going to park it when the car some 20-30 mt away "locked itself" (cannot remember if it stopped or just didn't allow more than - say - 5 km per hour) with the display saying it couldn't find the card. When she changed cars, her new Renault (using the same kind of card, at least visually, but a different car model) had to be inserted in a slot to allow the Start/Run button to operate.
Latteland 8y ago
Tesla recently added a good workaround. They added a setting where you can turn auto unlock or auto start off, which blocks this remote access hack. You have to use your key fob button at least once, say to unlock the car and then it just works wirelessly without further action. My car is unlocked at night but in my garage. If they got in my garage somehow and had the signal repeater they couldn't drive off unless I pushed the keyfob button. In the morning I just have to push it once to go. You can also en/disable auto door lock if you walk away. Of course a general solution that blocks signal repeaters would be best. Tesla has so many fun tweaks it's truly the programmer's car.
- taw123 8y ago
  A motion sensor in the remote would also work and maintain the convenience.
  - Latteland 8y ago
    Unless it was in my pocket and I was walking around with it, which I do every day.
    - oh_sigh 8y ago
      Why would a motion sensor not sense motion in your pocket?
      - bootlooped 8y ago
        I think they're saying the thieves could still execute the signal boosting attack while the car owner is walking around with their keys.
      - taw123 8y ago
        The parent is rightly pointing out that it could yield an unintended RF activation.
    - taw123 8y ago
      True, the solution isn't perfect. Just brainstorming ideas that can potentially be coupled with other layers of security. The advantage of the idea is it doesn't rely on the user activating a secure mode or knowing about the vulnerability. The protection is automatic when you're asleep. Arguably if you're walking, not a large amount of that time is near your front door - although I understand your location may still be predictable.
nkrisc 8y ago
I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.
- wvenable 8y ago
  That defeats the purpose of the fob. Be easier to put an on/off switch on the fob so you can turn it off at night.
  - babypuncher 8y ago
    I think he was making a joke about regular car keys
- jamescostian 8y ago
  I'm not sure if this is a joke about old keys being better, but I'd argue you could have the benefits of new keys and old keys combined if you just made it so that new keys have to be inserted into some compartment inside of cars, where they are authenticated by those cars. You can imagine a fob with a USB that has a different authentication code than the wireless one it sends out, and unless the USB is plugged into the car, you can only start the car up but you can't drive it. In addition, you can make it so that the car doesn't unlock due to proximity with the fob, but rather, it only unlocks if you push the unlock button on the fob.
  - deleted 8y ago
    [deleted]
  - lozaning 8y ago
    Thats essentially how my car works right now, it's push to start, but you've got to have the fob slotted into a thing in the dash for the push to start button to actually work.
    - r00fus 8y ago
      What vehicle do you have?
Reedx 8y ago
The article recommends putting your fob upstairs or as far away as possible, but that seems like false security. What's considered a safe distance? How far away can they pick up the signal?
- victor9000 8y ago
  Just put them in a Faraday cage, problem solved.
- friday99 8y ago
  They make Faraday bags (many options) for this purpose. That is where you should store your fob.
- toyg 8y ago
  Measure how far away your car unlocks, then keep the keys as far from external walls as that. But to be honest it’s easier to keep them in a metal box that shuts properly. That’s what i do (although my fob still needs interaction, so i should be a bit safer, in theory). Also consider that keyless cars actually still have a way to enter, be it physical or remote: garage-supplied universal keys and software. VWs for example have an old-school keyhole under a thin plastic bit on the door, so that garages can access it when you lose the fob.
  - searchhay 8y ago
    Thieves are boosting the fob's signal. So it's not practical for car owners to measure a safe distance.
  - gmiller123456 8y ago
    The criminals will be using more sensitive equipment than what the car is, so "Just far enough way that the car doesn't pick it up" is bad advice.
- gmiller123456 8y ago
  There really is no safe distance. A better antenna will be able to pick up the signal no matter how weak.
taw123 8y ago
A motion sensor in the remote could mitigate the issue and maintain convenience.
- deleted 8y ago
  [deleted]
- Forbo 8y ago
  How battery intensive are accelerometers? The last fob I had required a battery change once every year or so already, increasing that frequency could be quite annoying. And I'd rather not have yet another device I need to regularly charge.
  - taw123 8y ago
    Anecdotaly, I have a remote that lights up everytime it's moved (to assist finding it at night as it's a remote for a bed). I've had it for well over a year and haven't changed the batteries yet. Granted, it runs on three AAA batteries. Not entirely sure what tech it uses, but it's not necessarily a full blown accelerometer. Edit: some / all of the power drain would be offset because the RF transmitter would be off while the sensor is on.
  - oh_sigh 8y ago
    Not bad at all, especially considering you would only need very coarse grained data, and not even that often. Years ago, McDonalds was handing out pedometers[1] which had a year+ battery life along with a display in a package smaller than most key fobs. [1] https://i.imgur.com/hU15Q1u.jpg https://i.imgur.com/hU15Q1u.jpg
jwr 8y ago
A good solution to that problem are UWB radios with timestamping (like the Decawave DW1000), which let you measure the time it takes for the signal to travel. You can then place physical limits on the proximity, rather than assuming that a strong radio signal means proximity. Coupled with a cryptographic authentication protocol these solve the issue quite nicely.
- ghaff 8y ago
  It looks like the chips are about $10 each. That's quantity 1 but it's also just the radio IC. It's not immediately obvious what the power draw would look like in an application like this as the sleep mode draws far less power than when it's operating. There is an open source project based on the chip. https://github.com/lab11/polypoint https://github.com/lab11/polypoint What I'd really like to be able to do is to wirelessly tether a Tile-like small long battery life device to a band (or watch) I wear with user configurable distance settings but it doesn't look like the tech is quite there today. UWB does seem to be the current approach you'd take though.
triviatise 8y ago
ive tested a couple of things to see if they would block the signal by putting the keys in the container and then standing next to the car and trying to open the door kids Lunch box would not block, small metal garbage can, would not block, cookie tin would not block. All would block if you lined the edge with aluminum foil before putting the top on. foil lined Potato chip bag would block. Wrapping in enough aluminum foil will block the signal Those faraday bags are convenient, but I park in the garage so Im not that worried. Garage door openers now have lock switches which prevent the door from being opened using any opener.
- teejmya 8y ago
  "Garage door openers now have lock switches which prevent the door from being opened using any opener." More info on this? Mine is older and doesn't have anything like it.
- rmetzler 8y ago
  I just read "Garage opener" and automatically I have to think about Samy Kamkar's OpenSesame Hack [0]. Regarding the keyfobs, I've seen demonstrations on video where the RF signal was relayed. I can search for them, but they were in German. [0]: https://www.youtube.com/watch?v=iSSRaIU9_Vc https://www.youtube.com/watch?v=iSSRaIU9_Vc
tebbers 8y ago
Thieves have been using this method in the UK/Europe for a long time now.
nine_k 8y ago
I think convenience here is fundamentally at odds with security. The convenience here is that the system requires no confirmation from the driver, no physical interaction with buttons, handles, keys, etc. The driver just opens the door and starts the engine. This allows for a trivial remote sniff-and-replay attack, not unlike copying a key temporarily. I bet not having a lock on the door would be even more convenient. But for some reason it's not widely practiced.
- paulie_a 8y ago
  Leaving a car unlocked is sometimes safer, while not foolproof it reduces the likelihood of getting your window smashed to loot the vehicle for valuables (and non valuable items)
  - westbywest 8y ago
    Leaving car doors unlocked is SOP in urban corridors with high incidence of petty theft. I.e. don't leave attractive objects in your vehicle, and leave it unlocked so that would-be thieves can learn it themselves w/o smashing a window. The problem here being able to start the engine wirelessly, not simply getting in.
    - asdff 8y ago
      My neighborhood just got hit with a string of robberies from inside cars. Not one window was smashed; the thieves can simply use a thin piece of metal slid between the window and door to enter vehicles about as quick as someone with a key, just like what police do if you locked your key inside the car.
extrapickles 8y ago
Car makers should use frequency/channel hopping rather than time of flight until doing time of flight gets cheaper. The car and fob would also broadcast on frequencies/channels that are not in the preshared set to detect someone trying to amplify. The hopping pattern should be derived from a good cryptographic protocol that also contains mutual attestation.
- reaperducer 8y ago
  How would that affect battery life? To you and me, changing the batteries in a key fob isn't a big deal. But more than once I've seen people walk into the auto dealer's repair center because their fob stopped working, and all the tech did to repair it is replace the battery. (If you think that sounds stupid, I work in healthcare, and we have employees who spend a surprising amount of time teaching people how to put AA batteries in their blood pressure and other medical gadgets.)
  - extrapickles 8y ago
    Not much at all. You use the traditional system to wake up the more powerful radio/mcu.
billconan 8y ago
Both my audi Q5 and my roommate's Q5 mysteriously opened their trunk for a few times when parked close to our home. now I dare not park it very close to our home, assuming the issue is from the key fob.
seniorsassycat 8y ago
Another commentor describes the key handshake. The car emits a high frequency wake up signal, the key receives the signal and emits a low frequency unlock code. It is hard to restrict the time of the unlock code because it's low frequency limits the accuracy of your clock. Could you Honeypot the cars wake up signal? If the car detects a delayed broadcast of it's wake up signal it could trigger an alarm or at disable keyless entry. The high frequency signal will have lower tolerances for a timing check. Or car makers can provide Honeypot keys. If the key receives a wake up signal it can alert the owner and disable keyless entry. The owner would put the Honeypots where they don't want their keys to activate.
- firethief 8y ago
  > Could you Honeypot the cars wake up signal? If the car detects a delayed broadcast of it's wake up signal it could trigger an alarm or at disable keyless entry. The high frequency signal will have lower tolerances for a timing check. If the repeater is directional / shielded on the side toward the car, I'd think it would be impossible to distinguish echoes of a repeated signal from normal echoes.
blang 8y ago
This article gets written fairly often: https://www.nytimes.com/2015/04/16/style/keeping-your-car-safe-from-electronic-thieves.html https://www.nytimes.com/2015/04/16/style/keeping-your-car-sa... https://news.ycombinator.com/item?id=17733870 https://news.ycombinator.com/item?id=17733870 https://abc7news.com/archive/9079852/ https://abc7news.com/archive/9079852/ https://www.npr.org/sections/alltechconsidered/2018/02/23/583682220/this-gray-hat-hacker-breaks-into-your-car-to-prove-a-point https://www.npr.org/sections/alltechconsidered/2018/02/23/58...
secabeen 8y ago
I've been surprised that no vendor has put a motion/vibration sensor in their keyfobs. I know they're pretty power constrained in keyfobs, but it seems like a pretty sensible protection to require the fob to be not sitting still on a table to do a proximity-only unlock.
zzyzxd 8y ago
Why is this still news? Such relay attack has been there for years.
kazinator 8y ago
> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. It's a poor design for the system to take any access-escalating action without an explicit command from the user that initiates a secured transaction that is resistant to MITM. It's poor design to assume that the range is based on raw signal strength; it should use round-trip-time measurements (for packets exchanged with MITM resistance).
- darkmighty 8y ago
  RTT measurements can give proof-of-proximity (due to relavity), but I think they're quite hard to get right (you'd need nanosecond RTT resolution in a cheap keyfob) -- I think analog signal repeaters would't add significant RTT. It's not impossible though, GPS decoders work in a similar fashion. Requiring user iniciation seems like the adequate solution here...
  - kazinator 8y ago
    It's the vehicle side system that measures RTT, not the fob. The fob just has to have consistent response latency so as not to perturb the RTT.
  - xenadu02 8y ago
    The Apple Watch manages to handle RTT measurements to prevent exactly this attack. You don't need complexity in the FOB; the car starts the clock, sends the signal, measures the time taken to reply. If it exceeds some threshold ignore the response. There is no way to spoof this if the request/response itself is using proper cryptography.
- kokx 8y ago
  RTT measurements are hard to make reliable with wireless systems. You don't want to set the bounds to tight, to avoid locking out the car owner in circumstances with a lot of interference. But neither do you want a signal booster to be in those bounds. But there are better solutions. I've heard about a car maker (I think it was BMW, but don't quote me on that) that put an acceleration sensor in the key fob. It would only broadcast the signal while the key fob is moving.
siffland 8y ago
There is a lot of great technical discussions here of ways to possibly solve the issue. The real problem points back to the lackluster security the auto industry is used to. Only if some sort of accountability or software security testing requirements are enforced this will get fixed. They have to have a mandatory recall if your Audi accelerates quickly by itself (that was in the early 80's i think), but no recall for a possible vulnerability in a jeep where someone can hack into the machine and control the acceleration (and other items). This would be worse with centrally controlled autonomous vehicles, they are always sending and receiving data. Image the firmware on your car not being updated after 2 years and being stuck with the still open vulnerabilities.
- asdff 8y ago
  IIRC for the Audi 5000s it was because the brake and throttle were too close and your foot or floormat frequently got stuck on top of the throttle. People would shift out of park not realizing this and go flying, not any kind of software or security issue.
  - siffland 8y ago
    You are correct it was mechanical, I was just drawing a connection that mandatory recalls exist for issues the auto industry is use to (I.E. mechanical), but nothing exists to track and force updates to software issues (like a CVE database, Perhaps something does exist and I have not heard of it) and have not in the past been the best at software assurance. It is kind of an apples to oranges comparison, but nonetheless it gets the point across.
    - asdff 8y ago
      They don't issue recalls for every mechanical catastrophe, and they don't ignore them for software issues either. When an automaker has a problem that merits a recall, it's because very careful accounting has indicated it is cheaper to roll out the recall than it would be to litigate or settle in court, not from any kind of good faith action. Even Audi would have never had that recall if only just a handful of people were injured or died from the issue.
megraf 8y ago
I work at very large OEM. We've run the numbers, and key fob exploits are _extremely_ rare. (most) Modern keys use rolling keys that are verified by the ECU, making cloning (let alone initial pairing) extremely time consuming. However, Keyless-go key fobs _can_ be captured and replayed (not necessarily exploited). 99.99% of the time that cars are stolen (which we find much more common in Europe due to small jurisdictions), someone will break a window, steal your keys, and drive your car away. (wireless) Key fob capturing and replaying require far more equipment than NFC PVC card (credit card) cloning.
- sroussey 8y ago
  Why clone? Why replay? You just need signal boosters so the key and the car think they are next to each other.
  - megraf 8y ago
    Following around someone with a 'signal booster' could be very difficult. If you capture and reply, you afford yourself a lot of advantages.
    - jiveturkey 8y ago
      it’s not difficult when you steal it from their house. which is what happens.
      - megraf 8y ago
        See my original comment.
        jiveturkey 8y ago
        ? Your original comment is that cloning is nearly if not entirely nonexistent. Of course it has advantages. But it's difficult and doesn't happen in the real world. What happens is replaying. Which isn't difficult.
noobermin 8y ago
Where's the public link to how to hack together one of these?
mirekrusin 8y ago
My mother in law just got her car stolen 3 days ago in Nice, France, fob thingy as well. Police just called today they found it, apparently car is ok.
intrasight 8y ago
I'm sure this problem can be solved with blockchains ;)
ChuckMcM 8y ago
That this vulnerability is being exploited in the wild isn't particularly new news is it? Perhaps it is the fact that I live in the Bay Area but I was walking with a home made Yagi (directional) antenna that I normally keep in the camper for picking up distant WiFi signals and the police noticed enough to stop and ask what was up. It does make me wonder if carrying around and SDR will get you in trouble at some point :-)
tomerico 8y ago
I wonder how difficult it is to add some clock syncing and time-of-flight measurements to ensure a certain distance. If the speed of light is to fast, maybe using sound could work.
- frankus 8y ago
  Apple claims that they use time-of-flight for their "Unlock with Apple Watch" feature on macOS, so it seems like something that a car maker/supplier could pull off, especially if they're willing to throw dedicated hardware at the problem. That said, the fob is much more battery-constrained than a watch that you charge on a daily basis.
  - comboy 8y ago
    This is such an obvious solution that maybe some patents are the reason it's not implemented by every car manufacturer.
    - williamscales 8y ago
      Indeed, the last time this attack vector came up on HN, it was pointed out that one company has patented using time of flight to validate keyless entry. Here's the patent: https://patents.google.com/patent/US8930045 https://patents.google.com/patent/US8930045
      - comboy 8y ago
        Nice find. Looks like Apple cites it in some of its own patents ("Enhanced automotive passive entry" from 2018-08-16) so maybe they already have rights to it and that's why unlock with Apple watch can work correctly.
      - andrewstuart2 8y ago
        `ping`. They were granted a patent for ping. That seems ridiculous.
gray_-_wolf 8y ago
Well I'm not sure that recommended solutions are better than the one I use. Just turn this feature off and use my car keys as normal (lock/unlock button).
EGreg 8y ago
This is ridiculous. I never understood why it's THAT needed for a keyfob to open a car by merely being close to it. Whatever happened to key fobs you had to PRESS to open a car?
- dragonwriter 8y ago
  > I never understood why it's THAT needed for a keyfob to open a car by merely being close to it. It's convenience factor that makes a big difference for people that tend to get to their car with full hands. > Whatever happened to key fobs you had to PRESS to open a car? They still exist, handsfree entry is an upgrade (or an included feature but only on higher trim levels) on many models.
verelo 8y ago
My car was recently “broken into”, it’s a Mercedes C400, i thought it to be fairly secure so my assumption has been that i forgot to lock the car. I just double checked, and the car has an “auto-lock” feature and it is already turned on...so...did this happen to me? I just want an off switch in my fob, so i can disable it at night. More fancy solutions would be a motion sensor on the fob to only power it when had recently moved, or for retrofits, this technology in a battery?
- deleted 8y ago
  [deleted]
- calmyournerves 8y ago
  You can turn off keyless-go by double pressing the close button. The LED on the key will light up (short - long) as a confirmation.
  - verelo 8y ago
    Ha, that’s an interesting one! I am sure I’ve done that by accident given how unreliable i find pulling the handle to be.
    - calmyournerves 8y ago
      Just to clarify: Double pressing the close button on the key, not the one on the door handle. I was a bit unclear, sorry! And it‘s only disabled temporarily. As soon as you press any button on the key again (e.g. open the car), keyless-go will be activated again.
      - verelo 8y ago
        Hmm ok yeah, that wouldn't be it then. However it's still good to know! I'd love to be able to just disable the remote without taking out the battery or storing it in some faraday cage.
pontifier 8y ago
I'm convinced that time of flight analysis could solve this problem, and many others. If someone could beat that, then they deserve much more than just a new car. I've currently got a blockchain "proof of proximity" idea on one of my back burners.
vwvw 8y ago
Research in this type of attack was published in 2010 already [1]. A spin-off was created out of it [2] for those interested. [1] https://eprint.iacr.org/2010/332.pdf https://eprint.iacr.org/2010/332.pdf [2] https://www.3db-access.com/ https://www.3db-access.com/
xenihn 8y ago
This seems like as good a HN thread as any to ask this, since I've been looking into it recently. What are some cars to look into if I'm interested in the following things? Or what are some cars that I should specifically avoid? - Low appeal to thieves interested in stealing the vehicle itself, due to the hardware (locks and whatever else) being exceptionally difficult to deal with - Some sort of secure/hidden compartment for concealing valuables (I know, I know, don't keep anything valuable in your car, but let's say it will still be more secure than keeping it outside of the car) - Following up to that, an especially secure trunk (if such a thing exists) - A wagon or smaller, so no minivans/crossovers or anything bigger - Under $25k used for something recent, maintainable (was looking at Audis but I don't want to risk maintenance issues), and with low mileage, which puts Teslas out of the picture (sadly)
- analog31 8y ago
  When I was a grad student, my parking permit put me in the law school parking lot. Problem solved.
- sturmeh 8y ago
  Get a manual, nobody steals a manual.
  - gerbilly 8y ago
    See: https://imgur.com/gallery/snhvea1 https://imgur.com/gallery/snhvea1
deytempo 8y ago
Wouldn’t the technology behind thwarting this essentially be a solution to the man in the middle attack?
- asimpletune 8y ago
  Yup
  - jiveturkey 8y ago
    no. it’s a relay attack, not a mitm attack. mitm acts at layer 7, relay at layer 2.
conanthe 8y ago
It seems like this is easy to do with cryptography. Sounds like a gross negligence on the car makers part, similar to storing passwords in plain text.
- crooked-v 8y ago
  "Easy to do" how? Please give an example, not an analogy.
  - conanthe 8y ago
    The same way as MFA works. Every time the key generates different token that can't be reused. This renders replay of signal useless.
dwighttk 8y ago
Why are these fobs constantly sending a signal? Just make it so that the holder of the key has to push a button to open/start and this attack becomes much more difficult.
yonatron 8y ago
I think it's the fault of the municipal government of Toronto. I mean really, if you nickname your metropolitan area "the GTA", what do you think will happen?!!
mandeepj 8y ago
This is really strange and shallow thinking of some manufacturers. I have a 2009 car. It'd NOT start if I don't have my key fob inside the car.
- tasty_freeze 8y ago
  I'm sure the car in these break-ins are like that too. The remote fob is inside the car, but they have an RF relay outside the car which proxies the keycode to the one inside the car.
Zamicol 8y ago
Why not triangulate the signal? I don't hear much about the speed of light being used for security, but it's applications are innumerable.
- rovr138 8y ago
  The attack uses 2 antennas. One next to the keys and one next to the car. It transmits the signal from both sides. The car thinks the key is inside/near. Triangulating it won’t help. It thinks it’s there.
quickthrower2 8y ago
IoT security FTW! Glad I have a key. Easy fix: a thing called a "button" that you press before it broadcasts the private key. Even better, also broadcast a different key each minute, like GA
- rb808 8y ago
  The S in IoT stands for security.
k_sze 8y ago
Shower thought: make a system where you unlock and start your car using your iPhone’s Face ID or Touch ID, and you can drive the car via the phone, like in Golden Eye. That would be really cool. I don’t care about security. It just sounds really cool.
INTPenis 8y ago
I believe the issue is that key fobs are too small and underpowered to have any real security. Everything else in our lives we've automated using our cellphone and apps. So why not cars? Bring back the old mechanical coupling method, upgraded for better security in close proximity, and provide a long range automation method via app. Just like your standard light switch. We have the old mechcanical way of using it, and our new radio based way via app.
DannyBee 8y ago
This is of course not limited to cars or even this type of key fob, but instead, anything that uses transmitter power as a proxy for distance/proximity, and that transmitter power has any chance of being signal boosted within reasonable means. The only true solution is to stop using transmitter power as a proxy for proximity when houses/etc are not opaque to that signal. Instead, use something that the house is effectively opaque to for the distance part of it. IE include an ultrasonic receiver in the keyfob, transmitter in the car and require it output the distance to the car. (or something, i'm just spitballing) The problem is almost certainly the power requirement.
GreeningRun 8y ago
Not to be pedantic, but wait, what about the security by design concept? It is at least astonishing that you implement a functionality without any thought to how to protect it ...
CaRDiaK 8y ago
Really good video of the attack in action here: https://www.youtube.com/watch?v=bR8RrmEizVg https://www.youtube.com/watch?v=bR8RrmEizVg

345 points by colinprince 8y ago

“Greater Toronto Area” = GTA. What a coincidence. Jokes aside, this is bound to happen. It’s disturbing that a vulnerability like this isn’t caught as a show-stopper before the technology is sold to consumers.

lbriner 8y ago
It's not a show-stopper. It's not even close to being a show-stopper any more than having keys is also a vulnerability to having a car stolen. All you have to do is keep the fob inside a shielded case at home and you're fine.
- josefresco 8y ago
  > All you have to do is keep the fob inside a shielded case at home and you're fine. Because we all have Faraday cages in our homes, and I'm sure the salesman who sold the car also made the customer aware of this vulnerability. /sarcasm.
  - dsfyu404ed 8y ago
    >Because we all have Faraday cages in our homes Yes, most people who own cars new enough to have this vulnerability own microwave ovens.
    - asdff 8y ago
      So you have to pull your keys out of your pocket and stick them in your microwave every time you enter your house just to have the convenience of not needing to take them out of your pocket when you approach the car.
      - dsfyu404ed 8y ago
        I know it's not a practical workaround. I'm just pointing out that most people do technically have a Faraday cage in their homes.
        k_sze 8y ago
        It’s gonna be fun when somebody forgets to take the fob out of the microwave before warming their coffee.
- pjc50 8y ago
  Ah, so the convenience feature of "not having to take your key out of your pocket or purse" now requires "you have to take it out and put it in a sealed case when not in use".
- pofilat 8y ago
  Also keep the fob in a shielded case at work and whenever you are out for shopping or entertainment.
blattimwind 8y ago
> It’s disturbing that a vulnerability like this isn’t caught as a show-stopper before the technology is sold to consumers. Everyone knew about this for many years. Interactive transponders are quite old (late 90s? early 2000s?) and were designed to mitigate attacks like this one (because the user has to interact with the transponder, i.e. press the button it has for it to work, all passive attacks fail).

mtgx 8y ago

But people still blindly trust carmakers to make reliable and difficult to hack fully software-based and with always-on internet access self-driving vehicles. They can't even secure the thing that directly unlocks your car and enables thieves to steal it.

Someone1234 8y ago
It is a legitimate point to a degree, vehicle makers have a long track record of terrible software, and now they want to go headlong into one of the most complicated software projects ever attempted by man. It will be interesting to see how legal liability shapes up with self-driving.
deleted 8y ago
[deleted]

Down_n_Out 8y ago

Nothing new, has been going on for a while now. Market is already providing your own "cage of Faraday[0]" for your fob. [0]https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3Aaps%2Ck%3Afaraday%20cage%20key%20fob https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3A...

sofaofthedamned 8y ago
Yeah this has been a thing for years in the UK. Myself and my wife put our keys into a metal lunch box in the hallway which mitigates this problem, which was prompted by both next door neighbours getting their cars broken into.
- mysterydip 8y ago
  Top Gear did a thing on this during their one road trip: https://youtu.be/-aU09WT5rXg https://youtu.be/-aU09WT5rXg fast forward to the 3 minute mark
  - sofaofthedamned 8y ago
    Exactly. Luckily i've got a Kia which nobody wanted to steal, but it's definitely a well known attack vector. A car on one side got stolen, the other side 'just' had stuff stolen from it.
    - wkearney99 8y ago
      Wait until bad weather. I had an utterly clapped-out Jeep Cherokee stolen one cold-as-hell winter night. Sure enough, found two neighborhoods over... a fair walking distance from where the last late night bus would have dropped someone off. So, yeah, a stolen beater is just fine when it's freezing cold outside...
      - sofaofthedamned 8y ago
        Good point. We've got a new (year old) Kia Ceed, and a 15 year old Ford Focus. I'd imagine if somebody needed a ride they'd just take the Focus. Either way we've got the cameras outside which, along with the fact we don't have a Jaguar or a BMW outside probably makes us less likely to be turned over.

aj_g 8y ago

It seems to me like there is often just as much creativity in thievery as there is in entrepreneurship.

toyg 8y ago
It is astonishing the lengths some people will go to not earn a honest salary.
- asdff 8y ago
  Everything is risk vs. reward in life.

z2 8y ago

Two factor authentication for cars, here we come! Though, searching for this phenomenon shows articles at least 3 years old warning to get Faraday cages or otherwise wrap fobs in aluminum foil. But do they really transmit all the time, or do they contain accelerometers or something to prevent battery from being wasted?

gruez 8y ago
>Two factor authentication for cars, here we come! in other words, requiring a button press.
josefresco 8y ago
2FA seems to make sense. Maybe a 4-6 digit pin that would be optional for those in high risk areas/situations. > But do they really transmit all the time, or do they contain accelerators or something to prevent battery from being wasted? I'm curious about this as well. A family member has an older Nissan with a keyless fob and I don't recall them ever having to replace batteries/keyfobs.
- nickspacek 8y ago
  The fob for my 2007 Altima with keyless start (not entry) has required at least one battery change since I inherited it and is now complaining that the battery is getting low.
- rainbowzootsuit 8y ago
  Some fobs use an inductive coil to recharge a battery within the key while the key is in the ignition.
fabricexpert 8y ago
2fa on a car would be a disaster. I can't wait to whip out my phone in the pouring rain, trying to unlock it while my hands are full and I have no signal.
- logfromblammo 8y ago

snarfy 8y ago

> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. Why is it transmitting without the user pressing a button? Is that a feature? As you walk up to the car it automatically starts like magic? I'm not familiar with these newer cars.

bayindirh 8y ago
Yes, it’s called keyless entry and ignition system.
gregmac 8y ago
With my car, as soon as you touch the door handle (with the keyfob in your pocket, or within a couple feet of the door) it unlocks, and to start the car you push a button. It doesn't work from even 4' away (eg, someone else touches the door handle while you're close) and it doesn't work from the other side (eg, when the keyfob close enough to driver's side door, the passenger side won't unlock). The really nice feature is when you walk away (a few seconds after you're out of range), the doors automatically lock. However, the downside of this feature is my wife's car does not have it -- and so at least half of the time when I am driving it I forget and leave it unlocked in parking lots.
- moftz 8y ago
  Oldest car I've seen it in is a 2006 Infiniti.
- ghaff 8y ago
  >so at least half of the time when I am driving it I forget and leave it unlocked in parking lots This is the problem with a lot of the newer tech in cars like backup alarms. You become used to various features in your own car and when you rent a car you need to consciously remember that the vehicle doesn't have $FEATURE. Effectively, cars are becoming a lot less standardized. A car I rented a few weeks ago beeped at me a couple times and it took a while before I realized it was the lane departure warning triggering on a couple turns.

delibes 8y ago

Looks like we have a new modern interpretation for 'boosting' https://www.urbandictionary.com/define.php?term=Boosting%20Cars https://www.urbandictionary.com/define.php?term=Boosting%20C...

cameldrv 8y ago

The car manufacturers are going to need to incorporate a time of flight measurement into the key system. Obviously amplitude can be faked.

wglb 8y ago
So the test for amplitude is aided by the fact that the signal strength received at the car increases by a factor of four if the distance is cut in half. Thus, you have a nice margin for setting your threshold. With measuring the time, however, presuming that radio signal will travel on the order of one foot per nanosecond, you have much less of a threshold tolerance. If the unlock takes place within two feet of the car, that is two nanoseconds. If the key sits 20 feet away, that is a 20-nanosecond one-way travel. So this solution would need to be able to distinguish between a four nanosecond gap (round trip time) and a 40-nanosecond round-trip time. Add to that the turnaround time in the car CPU which I would imagine to be some number of milliseconds, would 10 ms be reasonable? Thus, the electronics in the car needs to distinguish between 10ms + 4 ns vs 10ms + 40ms. And given jitter in any modern CPU/memory/OS/electronics device, I would bet that the jitter totally swamps that. (Keep in mind that this is a BOEC https://en.wikipedia.org/wiki/Back-of-the-envelope_calculation https://en.wikipedia.org/wiki/Back-of-the-envelope_calculati...)
- deleted 8y ago
  [deleted]
kevin_thibedeau 8y ago
Or just use physical contacts on a real key.
- izacus 8y ago
  Not having to drag keys out of your pockets is a feature.
  - bas 8y ago
    You meant a solution in search of a problem.

villuv 8y ago

I wonder how hard it is to measure the delay between challenge and response... Any distance extension would increase the signal flight time that should be measurable.

shittyadmin 8y ago
This has been proposed in the past yet I haven't seen any implementation of it - perhaps because of increased power consumption of accurate timing components needed? Any EEs able to comment on this?

gambiting 8y ago

I already put mine in a metalic bag for the night, or just press the "lock" button twice which disables the keyless entry system entirely. Manufacturers really need to hurry up and implement more accurate timing detection in the keys - it should be absolutely trivial to detect how far away the key is based on the response time, but for some reason manufacturers don't do this yet. Edit: I also know people who take the exact opposite approach with their expensive vehicles - they leave the key in plain sight near the front door, so if someone wants to steal the car using this method they can do so without entering the house or if they do break in they will(hopefully) take the key and leave, without threatening and possibly harming their family. I'm not sure which way is better - preventing the thief from stealing your vehicle and risk that they will then decide to break in and get the key from you, or let them steal it and just deal with insurance later.

ghaff 8y ago
> it should be absolutely trivial to detect how far away the key is based on the response time Is that true? Accurate, very low power distance detection has a lot of potential applications (e.g. your phone straying too far away) but BLE (for example) doesn't really work for measuring distance--through signal strength--at all. If it's possible, I'd be very curious how to build such a distance detector.
- gambiting 8y ago
  If you are processing data with nanosecond precision(which is not difficult with modern microchips) then you can tell the distance to the key by just measuring the number of nanoseconds elapsed since the request was sent(accounting for amount of time taken to calculate the response). If you can measure the time in nanoseconds that's good enough to tell the difference between the key being 1m and 10m away.
  - isatty2 8y ago
    What about reflections?
  - 8y ago

Tade0 8y ago

It's useful to note that less sophisticated methods still work as well. I used to lease a 2015 Toyota Auris(facelift). One year into the lease someone broke into it smashing the rear-left window and just drove away.

hkai 8y ago
Curious how they started it?
- Tade0 8y ago
  Probably via some trick that put the car into service mode. There's a gang in Warsaw that specialises in Toyota's. I know late 2000s Rav4s could be stolen by thrusting a wire through the left-front mudguard and disconnecting something(not sure what) inside this way. There's a clip of a Russian demonstrating this technique somewhere on youtube. All I found was shattered glass from the window.
- peterwwillis 8y ago
  If it has an immobilizer? You can find immobilizer bypasses on sale online, who knows if they work, or you can create your own and disable it yourself: https://www.youtube.com/watch?v=ispXq4EMrsY#t=24m45s https://www.youtube.com/watch?v=ispXq4EMrsY#t=24m45s https://github.com/fjvva/ecu-tool/wiki https://github.com/fjvva/ecu-tool/wiki (see also https://ioactive.com/pdfs/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf https://ioactive.com/pdfs/IOActive_Adventures_in_Automotive_... and http://opengarages.org/handbook/ebook/ http://opengarages.org/handbook/ebook/) So besides relaying the key, you can just hack via the CAN bus. There's also a trick to use a second ECU to bypass the immobilizer, but that's probably too time consuming. Many manufacturers (inc. Toyota) also allow bypassing immobilizers and other features using TechStream and a maintenance tool. If they claim you have to buy a new ECU if you lose your master keys, call bullshit: https://attachments.priuschat.com/attachment-files/2015/10/96213_T-SB-0043-14.pdf https://attachments.priuschat.com/attachment-files/2015/10/9...

PhasmaFelis 8y ago

I'm confused. Are there cars where the fob can automatically start the car, without any button presses, just from proximity? How did they not realize that was a bad idea?

Gh0stRAT 8y ago
No, but it will unlock from just (apparent) proximity which allows the thief enter the vehicle where they are then able to push the "Start" button. Again, the car will think the key is present and will start. At that point, the thief can stop the signal relay and the car will keep running without the key being "present".
wvenable 8y ago
The thief just gets in the car and presses the button using the boosted key fob signal.
secabeen 8y ago
Yes, the Tesla Model S and X keyfobs do not require any button presses.
- RandallBrown 8y ago
  Not even without pressing a button on the car to start it?
  - secabeen 8y ago
    Just the brake pedal.
ticmasta 8y ago
It's not entirely clear from the article and conversation, but they're talking about passive FOBs that use the (presumed) proximity of the FOB to unlock the doors and allow the ignition button to work. These were created to stop you from having to physically dig out your keys. If you need to push the button to unlock this won't work, but they could still smash a window and then relay attack the ignition. Challenge would be determining prior to the break-in if the FOB is close enough to relay. Plus the most vulnerable cars tend to be the most expensive. From the article I'm a little surprised the RAV4 has passive entry.

gumby 8y ago

I’m honestly more amazed that there is enough of an economy for someone to design such a device and market it (ditto skimmers). I wouldn’t even know where to look for such a thing — alibaba?

exabrial 8y ago

Can someone explain to me how keeping your keyfob in a faraday bag is supposed to increase security?

nkurz 8y ago
From the linked article: Relay thefts According to Bates, many of these thieves are using a method called "relay theft." Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. "The way that the thieves are getting around this is they're essentially amplifying that low power signal coming off of the push start fob," he said. "They will prey upon the general consensus that most people are leaving their key fobs close to the front door of their home and the vehicle will be in the driveway." The thief will bring a device close to the home's door, close to where most keys are sitting, to boost the fob's signal. They leave another device near the vehicle, which receives the signal and opens the car. Storing the keyfob in a faraday bag blogs the signal and prevents the relay attack from working.
- exabrial 8y ago
  Have a link? I'm familiar with rolling code systems, but this continuous transmission is new to me
  - exabrial 8y ago
    I can't find anything on continuous transmission, but it appears most of the keys use an rfid system, where the transmitter is powering the receiver.

post_break 8y ago

Ford is really bad with this. The Fiesta and Focus, you can program a new key with the ODB2 port in under 60 seconds. Blast the key with a booster, get inside the car, plug your laptop in, program a new key, drive off. People have had to lock the ODB2 port, disable it, put keys into aluminum foil (my method). https://www.youtube.com/watch?v=dvmSOEKfkug https://www.youtube.com/watch?v=dvmSOEKfkug

raverbashing 8y ago

It seems car manufacturers are eager to be "cool" but not thinking about the consequences of their actions Center "touchscreen" consoles with awful usability, shifters that are not obvious (coupled with people that are too lazy to pull the parking brake) and now this

fredley 8y ago
A touchscreen is a terrible interface for anything in a car, since you must look at it to operate it. Tactile dials/knobs you can feel for—and ideally feel different to each other—are the best interface for anything in your car that you want to use while driving. Voice can be sort of ok, as long as your speech models are locally stored (no internet blackspots), but deny access to those who cannot talk, or for whom you haven't bothered to build a speech model that matches their language/accent.

Reason077 8y ago

Here's some security camera footage of a car in the UK being stolen using a relay attack: https://www.youtube.com/watch?v=odG2GX4_cUQ https://www.youtube.com/watch?v=odG2GX4_cUQ

HorizonXP 8y ago

This happened to a family member of mine, here in Toronto. Lost their gorgeous M5. Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way." Sure enough, enough, key fob attack and theft. Caught on their video cameras. Filed the police report, claimed insurance, cried internally about the loss of a gorgeous vehicle. In all seriousness though, it's just a car, so no big deal, but nothing will fix the violation you feel, and the fact that you were being targeted. If I were the insurance companies, I'd be putting pressure on the car companies, but hey, maybe it's just the cost of doing business for them. Better to pay out for a vehicle theft, vs. actual injuries from a collision. That's probably why there's little incentive to fix it, especially if fixing it makes your product less convenient.

ams6110 8y ago
What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Once they got very far away from the house, the car should shut off. Or so I would think.
- pofilat 8y ago
  So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?
  - dawnerd 8y ago
    Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
    - toss1 8y ago

jaclaz 8y ago

>"The vehicle will continue running in perpetuity until it runs out of gas or until you shut it down," he said. >"They do that for safety so that if you lose the key fob or if it loses signal the vehicle doesn't shut down while you're driving, but that right there is part of the vulnerability." Anecdata, a few years ago my wife had a Renault "Megane" that used a sort of "card" that worked with proximity. She opened and started/drove it without ever taking the card out of her bag. A couple of times I was driving it with her in the passenger seat, we arrived to a shop, she got down in front of the door and went into the shop while I was going to park it when the car some 20-30 mt away "locked itself" (cannot remember if it stopped or just didn't allow more than - say - 5 km per hour) with the display saying it couldn't find the card. When she changed cars, her new Renault (using the same kind of card, at least visually, but a different car model) had to be inserted in a slot to allow the Start/Run button to operate.

Latteland 8y ago

Tesla recently added a good workaround. They added a setting where you can turn auto unlock or auto start off, which blocks this remote access hack. You have to use your key fob button at least once, say to unlock the car and then it just works wirelessly without further action. My car is unlocked at night but in my garage. If they got in my garage somehow and had the signal repeater they couldn't drive off unless I pushed the keyfob button. In the morning I just have to push it once to go. You can also en/disable auto door lock if you walk away. Of course a general solution that blocks signal repeaters would be best. Tesla has so many fun tweaks it's truly the programmer's car.

taw123 8y ago
A motion sensor in the remote would also work and maintain the convenience.
- Latteland 8y ago
  Unless it was in my pocket and I was walking around with it, which I do every day.
  - oh_sigh 8y ago
    Why would a motion sensor not sense motion in your pocket?
    - bootlooped 8y ago
      I think they're saying the thieves could still execute the signal boosting attack while the car owner is walking around with their keys.
    - taw123 8y ago
      The parent is rightly pointing out that it could yield an unintended RF activation.
  - taw123 8y ago
    True, the solution isn't perfect. Just brainstorming ideas that can potentially be coupled with other layers of security. The advantage of the idea is it doesn't rely on the user activating a secure mode or knowing about the vulnerability. The protection is automatic when you're asleep. Arguably if you're walking, not a large amount of that time is near your front door - although I understand your location may still be predictable.

nkrisc 8y ago

I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.

wvenable 8y ago
That defeats the purpose of the fob. Be easier to put an on/off switch on the fob so you can turn it off at night.
- babypuncher 8y ago
  I think he was making a joke about regular car keys
jamescostian 8y ago
I'm not sure if this is a joke about old keys being better, but I'd argue you could have the benefits of new keys and old keys combined if you just made it so that new keys have to be inserted into some compartment inside of cars, where they are authenticated by those cars. You can imagine a fob with a USB that has a different authentication code than the wireless one it sends out, and unless the USB is plugged into the car, you can only start the car up but you can't drive it. In addition, you can make it so that the car doesn't unlock due to proximity with the fob, but rather, it only unlocks if you push the unlock button on the fob.
- deleted 8y ago
  [deleted]
- lozaning 8y ago
  Thats essentially how my car works right now, it's push to start, but you've got to have the fob slotted into a thing in the dash for the push to start button to actually work.
  - r00fus 8y ago
    What vehicle do you have?

Reedx 8y ago

The article recommends putting your fob upstairs or as far away as possible, but that seems like false security. What's considered a safe distance? How far away can they pick up the signal?

victor9000 8y ago
Just put them in a Faraday cage, problem solved.
friday99 8y ago
They make Faraday bags (many options) for this purpose. That is where you should store your fob.
toyg 8y ago
Measure how far away your car unlocks, then keep the keys as far from external walls as that. But to be honest it’s easier to keep them in a metal box that shuts properly. That’s what i do (although my fob still needs interaction, so i should be a bit safer, in theory). Also consider that keyless cars actually still have a way to enter, be it physical or remote: garage-supplied universal keys and software. VWs for example have an old-school keyhole under a thin plastic bit on the door, so that garages can access it when you lose the fob.
- searchhay 8y ago
  Thieves are boosting the fob's signal. So it's not practical for car owners to measure a safe distance.
- gmiller123456 8y ago
  The criminals will be using more sensitive equipment than what the car is, so "Just far enough way that the car doesn't pick it up" is bad advice.
gmiller123456 8y ago
There really is no safe distance. A better antenna will be able to pick up the signal no matter how weak.

taw123 8y ago

A motion sensor in the remote could mitigate the issue and maintain convenience.

deleted 8y ago
[deleted]
Forbo 8y ago
How battery intensive are accelerometers? The last fob I had required a battery change once every year or so already, increasing that frequency could be quite annoying. And I'd rather not have yet another device I need to regularly charge.
- taw123 8y ago
  Anecdotaly, I have a remote that lights up everytime it's moved (to assist finding it at night as it's a remote for a bed). I've had it for well over a year and haven't changed the batteries yet. Granted, it runs on three AAA batteries. Not entirely sure what tech it uses, but it's not necessarily a full blown accelerometer. Edit: some / all of the power drain would be offset because the RF transmitter would be off while the sensor is on.
- oh_sigh 8y ago
  Not bad at all, especially considering you would only need very coarse grained data, and not even that often. Years ago, McDonalds was handing out pedometers[1] which had a year+ battery life along with a display in a package smaller than most key fobs. [1] https://i.imgur.com/hU15Q1u.jpg https://i.imgur.com/hU15Q1u.jpg

jwr 8y ago

A good solution to that problem are UWB radios with timestamping (like the Decawave DW1000), which let you measure the time it takes for the signal to travel. You can then place physical limits on the proximity, rather than assuming that a strong radio signal means proximity. Coupled with a cryptographic authentication protocol these solve the issue quite nicely.

ghaff 8y ago
It looks like the chips are about $10 each. That's quantity 1 but it's also just the radio IC. It's not immediately obvious what the power draw would look like in an application like this as the sleep mode draws far less power than when it's operating. There is an open source project based on the chip. https://github.com/lab11/polypoint https://github.com/lab11/polypoint What I'd really like to be able to do is to wirelessly tether a Tile-like small long battery life device to a band (or watch) I wear with user configurable distance settings but it doesn't look like the tech is quite there today. UWB does seem to be the current approach you'd take though.

triviatise 8y ago

ive tested a couple of things to see if they would block the signal by putting the keys in the container and then standing next to the car and trying to open the door kids Lunch box would not block, small metal garbage can, would not block, cookie tin would not block. All would block if you lined the edge with aluminum foil before putting the top on. foil lined Potato chip bag would block. Wrapping in enough aluminum foil will block the signal Those faraday bags are convenient, but I park in the garage so Im not that worried. Garage door openers now have lock switches which prevent the door from being opened using any opener.

teejmya 8y ago
"Garage door openers now have lock switches which prevent the door from being opened using any opener." More info on this? Mine is older and doesn't have anything like it.
rmetzler 8y ago
I just read "Garage opener" and automatically I have to think about Samy Kamkar's OpenSesame Hack [0]. Regarding the keyfobs, I've seen demonstrations on video where the RF signal was relayed. I can search for them, but they were in German. [0]: https://www.youtube.com/watch?v=iSSRaIU9_Vc https://www.youtube.com/watch?v=iSSRaIU9_Vc

tebbers 8y ago

Thieves have been using this method in the UK/Europe for a long time now.

nine_k 8y ago

I think convenience here is fundamentally at odds with security. The convenience here is that the system requires no confirmation from the driver, no physical interaction with buttons, handles, keys, etc. The driver just opens the door and starts the engine. This allows for a trivial remote sniff-and-replay attack, not unlike copying a key temporarily. I bet not having a lock on the door would be even more convenient. But for some reason it's not widely practiced.

paulie_a 8y ago
Leaving a car unlocked is sometimes safer, while not foolproof it reduces the likelihood of getting your window smashed to loot the vehicle for valuables (and non valuable items)
- westbywest 8y ago
  Leaving car doors unlocked is SOP in urban corridors with high incidence of petty theft. I.e. don't leave attractive objects in your vehicle, and leave it unlocked so that would-be thieves can learn it themselves w/o smashing a window. The problem here being able to start the engine wirelessly, not simply getting in.
  - asdff 8y ago
    My neighborhood just got hit with a string of robberies from inside cars. Not one window was smashed; the thieves can simply use a thin piece of metal slid between the window and door to enter vehicles about as quick as someone with a key, just like what police do if you locked your key inside the car.

extrapickles 8y ago

Car makers should use frequency/channel hopping rather than time of flight until doing time of flight gets cheaper. The car and fob would also broadcast on frequencies/channels that are not in the preshared set to detect someone trying to amplify. The hopping pattern should be derived from a good cryptographic protocol that also contains mutual attestation.

reaperducer 8y ago
How would that affect battery life? To you and me, changing the batteries in a key fob isn't a big deal. But more than once I've seen people walk into the auto dealer's repair center because their fob stopped working, and all the tech did to repair it is replace the battery. (If you think that sounds stupid, I work in healthcare, and we have employees who spend a surprising amount of time teaching people how to put AA batteries in their blood pressure and other medical gadgets.)
- extrapickles 8y ago
  Not much at all. You use the traditional system to wake up the more powerful radio/mcu.

billconan 8y ago

Both my audi Q5 and my roommate's Q5 mysteriously opened their trunk for a few times when parked close to our home. now I dare not park it very close to our home, assuming the issue is from the key fob.

seniorsassycat 8y ago

Another commentor describes the key handshake. The car emits a high frequency wake up signal, the key receives the signal and emits a low frequency unlock code. It is hard to restrict the time of the unlock code because it's low frequency limits the accuracy of your clock. Could you Honeypot the cars wake up signal? If the car detects a delayed broadcast of it's wake up signal it could trigger an alarm or at disable keyless entry. The high frequency signal will have lower tolerances for a timing check. Or car makers can provide Honeypot keys. If the key receives a wake up signal it can alert the owner and disable keyless entry. The owner would put the Honeypots where they don't want their keys to activate.

firethief 8y ago
> Could you Honeypot the cars wake up signal? If the car detects a delayed broadcast of it's wake up signal it could trigger an alarm or at disable keyless entry. The high frequency signal will have lower tolerances for a timing check. If the repeater is directional / shielded on the side toward the car, I'd think it would be impossible to distinguish echoes of a repeated signal from normal echoes.

blang 8y ago

This article gets written fairly often: https://www.nytimes.com/2015/04/16/style/keeping-your-car-safe-from-electronic-thieves.html https://www.nytimes.com/2015/04/16/style/keeping-your-car-sa... https://news.ycombinator.com/item?id=17733870 https://news.ycombinator.com/item?id=17733870 https://abc7news.com/archive/9079852/ https://abc7news.com/archive/9079852/ https://www.npr.org/sections/alltechconsidered/2018/02/23/583682220/this-gray-hat-hacker-breaks-into-your-car-to-prove-a-point https://www.npr.org/sections/alltechconsidered/2018/02/23/58...

secabeen 8y ago

I've been surprised that no vendor has put a motion/vibration sensor in their keyfobs. I know they're pretty power constrained in keyfobs, but it seems like a pretty sensible protection to require the fob to be not sitting still on a table to do a proximity-only unlock.

zzyzxd 8y ago

Why is this still news? Such relay attack has been there for years.

kazinator 8y ago

> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. It's a poor design for the system to take any access-escalating action without an explicit command from the user that initiates a secured transaction that is resistant to MITM. It's poor design to assume that the range is based on raw signal strength; it should use round-trip-time measurements (for packets exchanged with MITM resistance).

darkmighty 8y ago
RTT measurements can give proof-of-proximity (due to relavity), but I think they're quite hard to get right (you'd need nanosecond RTT resolution in a cheap keyfob) -- I think analog signal repeaters would't add significant RTT. It's not impossible though, GPS decoders work in a similar fashion. Requiring user iniciation seems like the adequate solution here...
- kazinator 8y ago
  It's the vehicle side system that measures RTT, not the fob. The fob just has to have consistent response latency so as not to perturb the RTT.
- xenadu02 8y ago
  The Apple Watch manages to handle RTT measurements to prevent exactly this attack. You don't need complexity in the FOB; the car starts the clock, sends the signal, measures the time taken to reply. If it exceeds some threshold ignore the response. There is no way to spoof this if the request/response itself is using proper cryptography.
kokx 8y ago
RTT measurements are hard to make reliable with wireless systems. You don't want to set the bounds to tight, to avoid locking out the car owner in circumstances with a lot of interference. But neither do you want a signal booster to be in those bounds. But there are better solutions. I've heard about a car maker (I think it was BMW, but don't quote me on that) that put an acceleration sensor in the key fob. It would only broadcast the signal while the key fob is moving.

siffland 8y ago

There is a lot of great technical discussions here of ways to possibly solve the issue. The real problem points back to the lackluster security the auto industry is used to. Only if some sort of accountability or software security testing requirements are enforced this will get fixed. They have to have a mandatory recall if your Audi accelerates quickly by itself (that was in the early 80's i think), but no recall for a possible vulnerability in a jeep where someone can hack into the machine and control the acceleration (and other items). This would be worse with centrally controlled autonomous vehicles, they are always sending and receiving data. Image the firmware on your car not being updated after 2 years and being stuck with the still open vulnerabilities.

asdff 8y ago
IIRC for the Audi 5000s it was because the brake and throttle were too close and your foot or floormat frequently got stuck on top of the throttle. People would shift out of park not realizing this and go flying, not any kind of software or security issue.
- siffland 8y ago
  You are correct it was mechanical, I was just drawing a connection that mandatory recalls exist for issues the auto industry is use to (I.E. mechanical), but nothing exists to track and force updates to software issues (like a CVE database, Perhaps something does exist and I have not heard of it) and have not in the past been the best at software assurance. It is kind of an apples to oranges comparison, but nonetheless it gets the point across.
  - asdff 8y ago
    They don't issue recalls for every mechanical catastrophe, and they don't ignore them for software issues either. When an automaker has a problem that merits a recall, it's because very careful accounting has indicated it is cheaper to roll out the recall than it would be to litigate or settle in court, not from any kind of good faith action. Even Audi would have never had that recall if only just a handful of people were injured or died from the issue.

megraf 8y ago

I work at very large OEM. We've run the numbers, and key fob exploits are _extremely_ rare. (most) Modern keys use rolling keys that are verified by the ECU, making cloning (let alone initial pairing) extremely time consuming. However, Keyless-go key fobs _can_ be captured and replayed (not necessarily exploited). 99.99% of the time that cars are stolen (which we find much more common in Europe due to small jurisdictions), someone will break a window, steal your keys, and drive your car away. (wireless) Key fob capturing and replaying require far more equipment than NFC PVC card (credit card) cloning.

sroussey 8y ago
Why clone? Why replay? You just need signal boosters so the key and the car think they are next to each other.
- megraf 8y ago
  Following around someone with a 'signal booster' could be very difficult. If you capture and reply, you afford yourself a lot of advantages.
  - jiveturkey 8y ago
    it’s not difficult when you steal it from their house. which is what happens.
    - megraf 8y ago
      See my original comment.
      - jiveturkey 8y ago
        ? Your original comment is that cloning is nearly if not entirely nonexistent. Of course it has advantages. But it's difficult and doesn't happen in the real world. What happens is replaying. Which isn't difficult.

noobermin 8y ago

Where's the public link to how to hack together one of these?

mirekrusin 8y ago

My mother in law just got her car stolen 3 days ago in Nice, France, fob thingy as well. Police just called today they found it, apparently car is ok.

intrasight 8y ago

I'm sure this problem can be solved with blockchains ;)

ChuckMcM 8y ago

That this vulnerability is being exploited in the wild isn't particularly new news is it? Perhaps it is the fact that I live in the Bay Area but I was walking with a home made Yagi (directional) antenna that I normally keep in the camper for picking up distant WiFi signals and the police noticed enough to stop and ask what was up. It does make me wonder if carrying around and SDR will get you in trouble at some point :-)

tomerico 8y ago

I wonder how difficult it is to add some clock syncing and time-of-flight measurements to ensure a certain distance. If the speed of light is to fast, maybe using sound could work.

frankus 8y ago
Apple claims that they use time-of-flight for their "Unlock with Apple Watch" feature on macOS, so it seems like something that a car maker/supplier could pull off, especially if they're willing to throw dedicated hardware at the problem. That said, the fob is much more battery-constrained than a watch that you charge on a daily basis.
- comboy 8y ago
  This is such an obvious solution that maybe some patents are the reason it's not implemented by every car manufacturer.
  - williamscales 8y ago
    Indeed, the last time this attack vector came up on HN, it was pointed out that one company has patented using time of flight to validate keyless entry. Here's the patent: https://patents.google.com/patent/US8930045 https://patents.google.com/patent/US8930045
    - comboy 8y ago
      Nice find. Looks like Apple cites it in some of its own patents ("Enhanced automotive passive entry" from 2018-08-16) so maybe they already have rights to it and that's why unlock with Apple watch can work correctly.
    - andrewstuart2 8y ago
      `ping`. They were granted a patent for ping. That seems ridiculous.

gray_-_wolf 8y ago

Well I'm not sure that recommended solutions are better than the one I use. Just turn this feature off and use my car keys as normal (lock/unlock button).

EGreg 8y ago

This is ridiculous. I never understood why it's THAT needed for a keyfob to open a car by merely being close to it. Whatever happened to key fobs you had to PRESS to open a car?

dragonwriter 8y ago
> I never understood why it's THAT needed for a keyfob to open a car by merely being close to it. It's convenience factor that makes a big difference for people that tend to get to their car with full hands. > Whatever happened to key fobs you had to PRESS to open a car? They still exist, handsfree entry is an upgrade (or an included feature but only on higher trim levels) on many models.

verelo 8y ago

My car was recently “broken into”, it’s a Mercedes C400, i thought it to be fairly secure so my assumption has been that i forgot to lock the car. I just double checked, and the car has an “auto-lock” feature and it is already turned on...so...did this happen to me? I just want an off switch in my fob, so i can disable it at night. More fancy solutions would be a motion sensor on the fob to only power it when had recently moved, or for retrofits, this technology in a battery?

deleted 8y ago
[deleted]
calmyournerves 8y ago
You can turn off keyless-go by double pressing the close button. The LED on the key will light up (short - long) as a confirmation.
- verelo 8y ago
  Ha, that’s an interesting one! I am sure I’ve done that by accident given how unreliable i find pulling the handle to be.
  - calmyournerves 8y ago
    Just to clarify: Double pressing the close button on the key, not the one on the door handle. I was a bit unclear, sorry! And it‘s only disabled temporarily. As soon as you press any button on the key again (e.g. open the car), keyless-go will be activated again.
    - verelo 8y ago
      Hmm ok yeah, that wouldn't be it then. However it's still good to know! I'd love to be able to just disable the remote without taking out the battery or storing it in some faraday cage.

pontifier 8y ago

I'm convinced that time of flight analysis could solve this problem, and many others. If someone could beat that, then they deserve much more than just a new car. I've currently got a blockchain "proof of proximity" idea on one of my back burners.

vwvw 8y ago

Research in this type of attack was published in 2010 already [1]. A spin-off was created out of it [2] for those interested. [1] https://eprint.iacr.org/2010/332.pdf https://eprint.iacr.org/2010/332.pdf [2] https://www.3db-access.com/ https://www.3db-access.com/

xenihn 8y ago

This seems like as good a HN thread as any to ask this, since I've been looking into it recently. What are some cars to look into if I'm interested in the following things? Or what are some cars that I should specifically avoid? - Low appeal to thieves interested in stealing the vehicle itself, due to the hardware (locks and whatever else) being exceptionally difficult to deal with - Some sort of secure/hidden compartment for concealing valuables (I know, I know, don't keep anything valuable in your car, but let's say it will still be more secure than keeping it outside of the car) - Following up to that, an especially secure trunk (if such a thing exists) - A wagon or smaller, so no minivans/crossovers or anything bigger - Under $25k used for something recent, maintainable (was looking at Audis but I don't want to risk maintenance issues), and with low mileage, which puts Teslas out of the picture (sadly)

analog31 8y ago
When I was a grad student, my parking permit put me in the law school parking lot. Problem solved.
sturmeh 8y ago
Get a manual, nobody steals a manual.
- gerbilly 8y ago
  See: https://imgur.com/gallery/snhvea1 https://imgur.com/gallery/snhvea1

deytempo 8y ago

Wouldn’t the technology behind thwarting this essentially be a solution to the man in the middle attack?

asimpletune 8y ago
Yup
- jiveturkey 8y ago
  no. it’s a relay attack, not a mitm attack. mitm acts at layer 7, relay at layer 2.

conanthe 8y ago

It seems like this is easy to do with cryptography. Sounds like a gross negligence on the car makers part, similar to storing passwords in plain text.

crooked-v 8y ago
"Easy to do" how? Please give an example, not an analogy.
- conanthe 8y ago
  The same way as MFA works. Every time the key generates different token that can't be reused. This renders replay of signal useless.

dwighttk 8y ago

Why are these fobs constantly sending a signal? Just make it so that the holder of the key has to push a button to open/start and this attack becomes much more difficult.

yonatron 8y ago

I think it's the fault of the municipal government of Toronto. I mean really, if you nickname your metropolitan area "the GTA", what do you think will happen?!!

mandeepj 8y ago

This is really strange and shallow thinking of some manufacturers. I have a 2009 car. It'd NOT start if I don't have my key fob inside the car.

tasty_freeze 8y ago
I'm sure the car in these break-ins are like that too. The remote fob is inside the car, but they have an RF relay outside the car which proxies the keycode to the one inside the car.

Zamicol 8y ago

Why not triangulate the signal? I don't hear much about the speed of light being used for security, but it's applications are innumerable.

rovr138 8y ago
The attack uses 2 antennas. One next to the keys and one next to the car. It transmits the signal from both sides. The car thinks the key is inside/near. Triangulating it won’t help. It thinks it’s there.

quickthrower2 8y ago

IoT security FTW! Glad I have a key. Easy fix: a thing called a "button" that you press before it broadcasts the private key. Even better, also broadcast a different key each minute, like GA

rb808 8y ago
The S in IoT stands for security.

k_sze 8y ago

Shower thought: make a system where you unlock and start your car using your iPhone’s Face ID or Touch ID, and you can drive the car via the phone, like in Golden Eye. That would be really cool. I don’t care about security. It just sounds really cool.

INTPenis 8y ago

I believe the issue is that key fobs are too small and underpowered to have any real security. Everything else in our lives we've automated using our cellphone and apps. So why not cars? Bring back the old mechanical coupling method, upgraded for better security in close proximity, and provide a long range automation method via app. Just like your standard light switch. We have the old mechcanical way of using it, and our new radio based way via app.

DannyBee 8y ago

This is of course not limited to cars or even this type of key fob, but instead, anything that uses transmitter power as a proxy for distance/proximity, and that transmitter power has any chance of being signal boosted within reasonable means. The only true solution is to stop using transmitter power as a proxy for proximity when houses/etc are not opaque to that signal. Instead, use something that the house is effectively opaque to for the distance part of it. IE include an ultrasonic receiver in the keyfob, transmitter in the car and require it output the distance to the car. (or something, i'm just spitballing) The problem is almost certainly the power requirement.

GreeningRun 8y ago

Not to be pedantic, but wait, what about the security by design concept? It is at least astonishing that you implement a functionality without any thought to how to protect it ...

CaRDiaK 8y ago

Really good video of the attack in action here: https://www.youtube.com/watch?v=bR8RrmEizVg https://www.youtube.com/watch?v=bR8RrmEizVg