6 ms·
Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car. In typical designs, the car continually transmits a lo
by wsh 8y ago
Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car.
In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed.
The reply signal, at least, is uniquely coded to the car. The attack is to extend the range of the LF wake-up signal, causing a key stored away from the car to transmit a valid reply.
In some models, besides the transponder described above, the key also has a passive RFID tag, which works with a reader in the car to allow starting even if the battery in the key is dead.
(The article is wrong about the broadcasts, by the way; if the key transmitted continually, its battery wouldn’t last long.)
- cjjuice 8y agoIs there any type of encryption between the car and the key? Or are the signals always constant? Could you just record the relay signal and play it back whenever, essentially replicating the key?
- W-_-D 8y agoI believe a nonce is used to prevent replay attacks, but wouldn't be surprised if there are some fobs out there which are vulnerable to replay.
- Reason077 8y agoIt uses a challenge-response protocol, so you can’t simply record the signal and play it back.
- deleted 8y ago[deleted]
- thebluehawk 8y agoEvery run of the mill garage door opener using rotating keys or nonces to prevent replay attacks. I assume any fob design worth its salt would implement something similar.
- ehsankia 8y agohttps://www.youtube.com/watch?v=CNodxp9Jy4A https://www.youtube.com/watch?v=CNodxp9Jy4A
- lordnacho 8y agoIt might not matter. If the point of the amp is to reduce the effective distance between the car and the fob, whatever messages are exchanged will look right to the car and the door will open.
- ryandrake 8y agoThis is insane. Please tell me this is an option that non-insane consumers can get their car without. Fortunately I drive an old car so this does not affect me—yet. If I ever have to replace mine, this looks like yet-another-misfeature I’ll have to look out for to avoid.
- whyaduck 8y agoOn many models keyless entry and remote start are options, rather than standard. If you park in a garage at night, then this particular attack isn't much of an issue.
- blacksmith_tb 8y agoI'm sure you didn't intend it that way, but "let them park in their garages" seems to imply the hoi polloi who don't have covered parking deserve to have their vehicles stolen...
- blattimwind 8y agoIt's standard with many "premium" brands (e.g. BMW, Audi, ...)
- com2kid 8y agoMy 2015 Kia has it. It is pretty much standard across all cars now days, except maybe the very bottom of the line models.
- cfmcdonald 8y agoWhew, my 2014 Camry does not have it. Dodged the bullet.
- mdtancsa 8y agoThankfully, the 2019 Honda Fit I got does not have this feature. The Sport model had it, and was one of the reasons I decided against it. Old school keyless entry via fob button and traditional key ignition