8 ms·
Since most car manufacturers seem to be vulnerable (to my knowledge), I assume all or most buy the same COTS keyfob + electronic lock product. Much like Takata
by retSava 8y ago
Since most car manufacturers seem to be vulnerable (to my knowledge), I assume all or most buy the same COTS keyfob + electronic lock product. Much like Takata airbags or Bosch ECUs.
Being a step away from the problem probably helps keep that OEM manufacturer from strapping in and solving it. They don't feel any pain from it.
- kevin_thibedeau 8y agoBefore the keyfobs become poplar there were transponder keys with embedded RFIDs. While still attackable, they aren't actively pinging their car and revealing their presence like the fobs do.
- cptskippy 8y ago> Before the keyfobs become poplar there were transponder keys with embedded RFIDs. Tesla is using an NXP Athena OS based smartcard that uses the Java Card 2.2 platform for it's NFC Key on the Model 3.
- mikeash 8y agoThe vulnerability is pretty much inherent to the idea. No amount of encryption can protect you from a relay attack. The only foolproof mitigation is to enforce a short round trip time to ensure the fob is actually close to the car, but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds.
- improbable22 8y agoAs long as the fob's own delay is very consistent, I don't see why you couldn't time the signal. Edit: there's a discussion down the page somewhere. The issue seems to be that (for power reasons) they use low-freq radio, on which it's hard to get timing accurate enough for 10m distance changes.
- alistproducer2 8y agoI disagree. A physical switch on the key itself which opened a circuit to the decryption key would mean the key would need to physically be in the possession of the driver.
- mikeash 8y ago“The idea” here refers to having the key operate automatically without having to manipulate it. If you require the driver to push a button on the key, the problem is trivially solved.
- raisedbyninjas 8y agoThis eliminates all of the convenience of keyless entry/start.
- askvictor 8y agoAnd what problem does keyless entry/start aim to solve?
- frankchn 8y agoIt is a convenience feature -- you don't have to fish your keys out of your pocket/handbag and press a button to unlock your car doors or to start the car. So long as you have the key somewhere on you (bag/handbag/pocket), you can unlock and start the car.
- mulmen 8y agoIt’s really pretty impressive too. I once tried (accidentally) to lock my key in the trunk of my car and it refused to close the latch.
- askvictor 8y agoIs getting your keys out of your bag or pocket really that hard? In comparison to the security risks? To think of it another way: before keyless entry was a thing - how many people were thinking 'damn I wish I didn't have to get these annoying keys out of my pocket?' To think of it yet another way: How many people buy the upgraded trim on their car mainly for the keyless entry? (Not having a go - genuinely curious)
- ryacko 8y agoEmbedded devices can be laggy at times. More efficient for the car to estimate the distance and power of the transmitter.
- jules 8y agoCan't you stop the car if the key is not present in the car? I guess the thieves could fake it with long distance transmission of the signal, but that would be more difficult and the further the car drives away from the actual key, the easier if becomes to detect the timing delay.
- blattimwind 8y agoNo. Safety-wise you can't just shut the engine off and lock the steering because the RF connection to some keyfob is wonky. These thefts have been going on for years and they will not stop until key-less go is dropped or changed such that the key requires interaction (like every higher security transponder has for, like, always).
- jules 8y agoObviously you would not use that absurd shutdown procedure. You'd give a warning and tell the driver that the engine is going to shut off in X minutes, and after X minutes you decrease its max speed to 10 km/h for Y minutes before shutting down completely. Cars already do way more dangerous stuff if you assume that arbitrary components fail. It also depends on the reliability. You could also say that you can't just shut the engine off if the electrical contact in the keyhole is wonky.
- maxerickson 8y agoSome links at https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- deleted 8y ago[deleted]
- mulmen 8y agoIs it true that encryption cannot proetect from a relay attack? If the encrypted payload is passed based on some kind of pre-shared secret (pairing) then each message should be unpredictable to a third party right?
- mikeash 8y agoThe third party doesn’t need to predict it, just repeat it. The relay doesn’t need to understand or modify the message, just pass it along.
- mulmen 8y agoIf the message is encrypted with some time component and a pre-shared secret then it is protected from a replay attack no?
- mikeash 8y agoYes, but a replay attack is quite different from a relay attack.
- mulmen 8y agoHm, good point. I guess I don't really know how these systems work. I assumed there was some kind of rotating value but I have no reason to believe this. Based on these attacks it seems the keys are really just sending the same signal every time. That appears to be a real shortcoming of the design.
- squarefoot 8y ago"but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds." And the challenge-response pair must be different for every transaction, otherwise the thief can easily grab a SDR with tx capabilities, get to the car and ask for a transmission, record the spectrum, then go near the car owner door, transmit the car challenge and record the key fob response, go back to the car, wait for another challenge transmission and time the response accordingly. Not even need for a second thief.