8 ms·

This happened to a family member of mine, here in Toronto. Lost their gorgeous M5. Their kid normally wakes up in the middle of the night, except this time, he

This happened to a family member of mine, here in Toronto. Lost their gorgeous M5. Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way." Sure enough, enough, key fob attack and theft. Caught on their video cameras. Filed the police report, claimed insurance, cried internally about the loss of a gorgeous vehicle. In all seriousness though, it's just a car, so no big deal, but nothing will fix the violation you feel, and the fact that you were being targeted. If I were the insurance companies, I'd be putting pressure on the car companies, but hey, maybe it's just the cost of doing business for them. Better to pay out for a vehicle theft, vs. actual injuries from a collision. That's probably why there's little incentive to fix it, especially if fixing it makes your product less convenient.

ams6110 8y ago
What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Once they got very far away from the house, the car should shut off. Or so I would think.
- pofilat 8y ago
  So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?
  - dawnerd 8y ago
    Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
    - toss1 8y ago
      No, it is not reasonable for the car to stop suddenly without the key. Even if it stops by going into an emergency limp mode, this could seriously endanger the occupants by leaving them in a dangerous traffic situation, a dangerous location, or with other issues. This is why every car company has examined it and chosen to not do it. This feature actually saved huge inconvenience for us once. While visiting the other coast for wife's mom in the hospital, we used one of her parent's cars to drive to the airport with her brother to drive it back. We get out at the airport, get luggage, hugs, bye, head into terminal -- with the key still in her purse. Car running, doesn't notify him until too late to chase. If it stopped after 2min, he'd be stuck somewhere outside an airport 100mi away from anyone he knew. Instead, he just drove it home, got & used the other key for a few days, and we mailed back the first key when we arrived. Things that seem reasonable at first....
      - heavenlyblue 8y ago
        Well, it means that a simple presence of a key in the vicinity of a car isn’t enough to answer the question of “will this key be present there” by the ene of the journey. It means the key has to he inserted somewhere. That makes it both safe and predictable.
      - swift532 8y ago
        As someone who turns their car on by inserting their key into a slot in it, all this seems quite convoluted just for the convenience of pushing a button. I don't understand why the car would even let you accelerate at all if the key isn't inside the actual car (even if it's just in your pocket, if you insist on pressing a button).
        toss1 8y ago
        The key has to be in it to start it, but once started, the key can go away and it will continue to run. (& yes, I still start my car with a key that is inserted, and mine also has a clutch & manual H-pattern 5-speed)
  - pixl97 8y ago
    Or drop to 5MPH and flash the lights and horn.
- wvenable 8y ago
  > but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Mine will beep for a bit if I leave the car with the key. But the vehicle also works when the fob's battery is depleted (it has an RFID tag and an embedded physical key for the door). Having the car randomly shut off based on something so potentially flakey seems like a worse idea.
- bdcravens 8y ago
  In the article, the first car mentioned the car was found in a parking lot, contents emptied. If they wanted to take it to a chop shop, easy enough to take it far enough to put on a flatbed.
  - Scoundreller 8y ago
    Maybe they came across a better car?
- lintroller 8y ago
  > Once they got very far away from the house, the car should shut off. Or so I would think. In the event that the actual owner of the car left their fob at their previous stop and discovers this fact 40 miles down the highway later, if the car were to stop, the driver is now stranded with a car that won't start. As it is now, as long as there is enough gas in the tank, the owner can just drive back and get it.
  - jessaustin 8y ago
    That's why the car should stop after less than a mile, or even not go into drive at all, rather than driving 40 miles. In your scenario, how will the driver discover that the key is missing without turning the car off and then finding herself unable to turn it back on?
- asdff 8y ago
  That seems pretty dangerous. Why not just have the car beep at you?
pofilat 8y ago
Insurance companies pressure drivers who have these misfeatures, drivers pressure car manufactures. See also: discounts for anti-theft tech and airbags.
- ams6110 8y ago
  The latest insurance "incentive" is a tracking device in your car that tracks when and where you drive, how fast, how hard you corner and stop, etc. I've declined this but expect that insurers will push for it to become mandatory. They would love to be able to charge unsafe drivers more money, and in the abstract I don't have a problem with that, but the tracking is creepy.
  - toyg 8y ago
    No no no, they would love to charge everyone more until they prove to be safe drivers — ready to withdraw the discount at the first doubt. This is why I am not going to get one, nor a “smart” water or electricity meter: give more data to corporations, and you can be sure that they will use it against you.
  - Terr_ 8y ago
    Or to put a combative point on it: "How much money do I get when you abuse this data for any purpose other than your exclusive safety metrics?"
    - mulmen 8y ago
      This is an idea that I do not see getting enough attention. “Big Data” has a lot of possible benefits but only if companies collect limited and relevant data. I’m comfortable telling my insurance company where and how I drive as long as they cannot share that or combine it with any other data.
      - Scoundreller 8y ago
        Wait until your insurance suspends their coverage for 24 hours because the road conditions aren’t meeting their requirements, or you didn’t evacuate quickly enough, or there’s a forest fire nearby.
gnicholas 8y ago
> If I were the insurance companies, I'd be putting pressure on the car companies And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution. I remember back in the 80s my parents got a discount on their insurance for installing a third brake light in the back window of their old Camaro. If my insurance gave me a discount, I'd get a faraday cage for my keys. I'm considering doing it anyway, even though my house is pretty far from my driveway, and we have cameras. I've searched for nice-looking faraday cages but haven't found anything good. I think there's a market for fashionable key/phone faraday cages, between this car theft issue and the push to digital detox. EDIT: curious why this is downvoted? I'm not saying that this shouldn't be fixed by car manufacturers going forward, but we need to do something about the millions of cars on the road already. Is there another solution that would make more sense? Or is there something I'm missing here?
- entee 8y ago
  Could simply putting the thing in a foil/metal lined drawer in your entryway do the trick?
  - gnicholas 8y ago
    I've watched some DIY videos and am considering doing just this. I'm not sure how tight a seal you need though (one video said you want overlap from lid to sides/bottom), and the draws we have there aren't super tight. Maybe we'd make an enclosure within the drawer and be able to line that sufficiently? If anyone knows how much leakage there would be for fobs/phones, and whether it makes a difference for this application (where the sniffer/attacker would be 10+ feet away), I'd love to know it!
    - stretchwithme 8y ago
      Would be easy to test what is needed. Wrap up your keys and take them to the vehicle. I just completely wrapped my remote with one layer of aluminum foil and that was enough. A small gap on side was enough for the car to detect it.
JustSomeNobody 8y ago
Insurance companies will just raise rates and be done with it.
tomp 8y ago
> Better to pay out for a vehicle theft, vs. actual injuries from a collision. What do you mean? It's not as if anyone will be driving less... the insurance company will pay for a new car, the family will buy a new car (presumably they need it), and still be just as statistically likely to collide with the new car.
- pixl97 8y ago
  Insurance companies have more of an incentive to make cars safer because of the larger liabilities of injury.
Scoundreller 8y ago
> If I were the insurance companies, I'd be putting pressure on the car companies Oh please, this is Ontario. The auto insurance companies main innovations have been: 1) getting caps on benefits 2) creating new driving violations to jack up your premiums (eg: non-criminally blowing over 0.05, but less than 0.08) Neither resulted in lower premiums for anyone else.
- yholio 8y ago
  Sounds like a great opportunity to increase the theft premiums for people owning fobbed cars.
_trampeltier 8y ago
That's no problem for the insurance company. Everybody has to pay a bit more, problem solved.
- dclowd9901 8y ago
  Sure, if a car theft for one car spread the cost to _all_ insurance companies, but it doesn't. So to stay competitive, companies have to 1) insure good drivers so the rates stay low and 2) invest in customers who have good car security (note the discount one gets for having their car garaged).
gammateam 8y ago
So... Free cars? Whats the yield on the secondary markets for these hot vehicles since the VIN is compromised, a new license plate is needed and a thorough scrubbing has to happen
- gaahrdner 8y ago
  Get it to a chop shop for parts and/or get it out of the country and I can imagine it's pretty high.
- Scoundreller 8y ago
  In some countries, they’re worth more than American MSRP. Some luxury sellers are actively making it difficult to buy for export to arbitrage this.
stri8ed 8y ago
What are the thief's doing with these cars?
- justtopost 8y ago
  Selling parts. Usually chop shops, then to shady body shops and mechanics. With exotics, many are exported to less principled markets, with minimal vin mitigation needed. Notice how the top stolen cars on every annual list are always ones with popular body styles (accord, etc), it is no accident. The parts are often worth more than the car, and can be sold at full market value, unlike a stolen car.

ams6110 8y ago

What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Once they got very far away from the house, the car should shut off. Or so I would think.

pofilat 8y ago
So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?
- dawnerd 8y ago
  Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
  - toss1 8y ago
    No, it is not reasonable for the car to stop suddenly without the key. Even if it stops by going into an emergency limp mode, this could seriously endanger the occupants by leaving them in a dangerous traffic situation, a dangerous location, or with other issues. This is why every car company has examined it and chosen to not do it. This feature actually saved huge inconvenience for us once. While visiting the other coast for wife's mom in the hospital, we used one of her parent's cars to drive to the airport with her brother to drive it back. We get out at the airport, get luggage, hugs, bye, head into terminal -- with the key still in her purse. Car running, doesn't notify him until too late to chase. If it stopped after 2min, he'd be stuck somewhere outside an airport 100mi away from anyone he knew. Instead, he just drove it home, got & used the other key for a few days, and we mailed back the first key when we arrived. Things that seem reasonable at first....
    - heavenlyblue 8y ago
      Well, it means that a simple presence of a key in the vicinity of a car isn’t enough to answer the question of “will this key be present there” by the ene of the journey. It means the key has to he inserted somewhere. That makes it both safe and predictable.
    - swift532 8y ago
      As someone who turns their car on by inserting their key into a slot in it, all this seems quite convoluted just for the convenience of pushing a button. I don't understand why the car would even let you accelerate at all if the key isn't inside the actual car (even if it's just in your pocket, if you insist on pressing a button).
      - toss1 8y ago
        The key has to be in it to start it, but once started, the key can go away and it will continue to run. (& yes, I still start my car with a key that is inserted, and mine also has a clutch & manual H-pattern 5-speed)
- pixl97 8y ago
  Or drop to 5MPH and flash the lights and horn.
wvenable 8y ago
> but do the cars not continually (or at least every minute or two) revalidate the presence of the key? Mine will beep for a bit if I leave the car with the key. But the vehicle also works when the fob's battery is depleted (it has an RFID tag and an embedded physical key for the door). Having the car randomly shut off based on something so potentially flakey seems like a worse idea.
bdcravens 8y ago
In the article, the first car mentioned the car was found in a parking lot, contents emptied. If they wanted to take it to a chop shop, easy enough to take it far enough to put on a flatbed.
- Scoundreller 8y ago
  Maybe they came across a better car?
lintroller 8y ago
> Once they got very far away from the house, the car should shut off. Or so I would think. In the event that the actual owner of the car left their fob at their previous stop and discovers this fact 40 miles down the highway later, if the car were to stop, the driver is now stranded with a car that won't start. As it is now, as long as there is enough gas in the tank, the owner can just drive back and get it.
- jessaustin 8y ago
  That's why the car should stop after less than a mile, or even not go into drive at all, rather than driving 40 miles. In your scenario, how will the driver discover that the key is missing without turning the car off and then finding herself unable to turn it back on?
asdff 8y ago
That seems pretty dangerous. Why not just have the car beep at you?

pofilat 8y ago

Insurance companies pressure drivers who have these misfeatures, drivers pressure car manufactures. See also: discounts for anti-theft tech and airbags.

ams6110 8y ago
The latest insurance "incentive" is a tracking device in your car that tracks when and where you drive, how fast, how hard you corner and stop, etc. I've declined this but expect that insurers will push for it to become mandatory. They would love to be able to charge unsafe drivers more money, and in the abstract I don't have a problem with that, but the tracking is creepy.
- toyg 8y ago
  No no no, they would love to charge everyone more until they prove to be safe drivers — ready to withdraw the discount at the first doubt. This is why I am not going to get one, nor a “smart” water or electricity meter: give more data to corporations, and you can be sure that they will use it against you.
- Terr_ 8y ago
  Or to put a combative point on it: "How much money do I get when you abuse this data for any purpose other than your exclusive safety metrics?"
  - mulmen 8y ago
    This is an idea that I do not see getting enough attention. “Big Data” has a lot of possible benefits but only if companies collect limited and relevant data. I’m comfortable telling my insurance company where and how I drive as long as they cannot share that or combine it with any other data.
    - Scoundreller 8y ago
      Wait until your insurance suspends their coverage for 24 hours because the road conditions aren’t meeting their requirements, or you didn’t evacuate quickly enough, or there’s a forest fire nearby.

gnicholas 8y ago

> If I were the insurance companies, I'd be putting pressure on the car companies And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution. I remember back in the 80s my parents got a discount on their insurance for installing a third brake light in the back window of their old Camaro. If my insurance gave me a discount, I'd get a faraday cage for my keys. I'm considering doing it anyway, even though my house is pretty far from my driveway, and we have cameras. I've searched for nice-looking faraday cages but haven't found anything good. I think there's a market for fashionable key/phone faraday cages, between this car theft issue and the push to digital detox. EDIT: curious why this is downvoted? I'm not saying that this shouldn't be fixed by car manufacturers going forward, but we need to do something about the millions of cars on the road already. Is there another solution that would make more sense? Or is there something I'm missing here?

entee 8y ago
Could simply putting the thing in a foil/metal lined drawer in your entryway do the trick?
- gnicholas 8y ago
  I've watched some DIY videos and am considering doing just this. I'm not sure how tight a seal you need though (one video said you want overlap from lid to sides/bottom), and the draws we have there aren't super tight. Maybe we'd make an enclosure within the drawer and be able to line that sufficiently? If anyone knows how much leakage there would be for fobs/phones, and whether it makes a difference for this application (where the sniffer/attacker would be 10+ feet away), I'd love to know it!
  - stretchwithme 8y ago
    Would be easy to test what is needed. Wrap up your keys and take them to the vehicle. I just completely wrapped my remote with one layer of aluminum foil and that was enough. A small gap on side was enough for the car to detect it.

JustSomeNobody 8y ago

Insurance companies will just raise rates and be done with it.

tomp 8y ago

> Better to pay out for a vehicle theft, vs. actual injuries from a collision. What do you mean? It's not as if anyone will be driving less... the insurance company will pay for a new car, the family will buy a new car (presumably they need it), and still be just as statistically likely to collide with the new car.

pixl97 8y ago
Insurance companies have more of an incentive to make cars safer because of the larger liabilities of injury.

Scoundreller 8y ago

> If I were the insurance companies, I'd be putting pressure on the car companies Oh please, this is Ontario. The auto insurance companies main innovations have been: 1) getting caps on benefits 2) creating new driving violations to jack up your premiums (eg: non-criminally blowing over 0.05, but less than 0.08) Neither resulted in lower premiums for anyone else.

yholio 8y ago
Sounds like a great opportunity to increase the theft premiums for people owning fobbed cars.

_trampeltier 8y ago

That's no problem for the insurance company. Everybody has to pay a bit more, problem solved.

dclowd9901 8y ago
Sure, if a car theft for one car spread the cost to _all_ insurance companies, but it doesn't. So to stay competitive, companies have to 1) insure good drivers so the rates stay low and 2) invest in customers who have good car security (note the discount one gets for having their car garaged).

gammateam 8y ago

So... Free cars? Whats the yield on the secondary markets for these hot vehicles since the VIN is compromised, a new license plate is needed and a thorough scrubbing has to happen

gaahrdner 8y ago
Get it to a chop shop for parts and/or get it out of the country and I can imagine it's pretty high.
Scoundreller 8y ago
In some countries, they’re worth more than American MSRP. Some luxury sellers are actively making it difficult to buy for export to arbitrage this.

stri8ed 8y ago

What are the thief's doing with these cars?

justtopost 8y ago
Selling parts. Usually chop shops, then to shady body shops and mechanics. With exotics, many are exported to less principled markets, with minimal vin mitigation needed. Notice how the top stolen cars on every annual list are always ones with popular body styles (accord, etc), it is no accident. The parts are often worth more than the car, and can be sold at full market value, unlike a stolen car.