6 ms·
The vulnerability is pretty much inherent to the idea. No amount of encryption can protect you from a relay attack. The only foolproof mitigation is to enforce
by mikeash 8y ago
The vulnerability is pretty much inherent to the idea. No amount of encryption can protect you from a relay attack. The only foolproof mitigation is to enforce a short round trip time to ensure the fob is actually close to the car, but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds.
- improbable22 8y agoAs long as the fob's own delay is very consistent, I don't see why you couldn't time the signal. Edit: there's a discussion down the page somewhere. The issue seems to be that (for power reasons) they use low-freq radio, on which it's hard to get timing accurate enough for 10m distance changes.
- alistproducer2 8y agoI disagree. A physical switch on the key itself which opened a circuit to the decryption key would mean the key would need to physically be in the possession of the driver.
- mikeash 8y ago“The idea” here refers to having the key operate automatically without having to manipulate it. If you require the driver to push a button on the key, the problem is trivially solved.
- raisedbyninjas 8y agoThis eliminates all of the convenience of keyless entry/start.
- askvictor 8y agoAnd what problem does keyless entry/start aim to solve?
- frankchn 8y agoIt is a convenience feature -- you don't have to fish your keys out of your pocket/handbag and press a button to unlock your car doors or to start the car. So long as you have the key somewhere on you (bag/handbag/pocket), you can unlock and start the car.
- mulmen 8y agoIt’s really pretty impressive too. I once tried (accidentally) to lock my key in the trunk of my car and it refused to close the latch.
- askvictor 8y agoIs getting your keys out of your bag or pocket really that hard? In comparison to the security risks? To think of it another way: before keyless entry was a thing - how many people were thinking 'damn I wish I didn't have to get these annoying keys out of my pocket?' To think of it yet another way: How many people buy the upgraded trim on their car mainly for the keyless entry? (Not having a go - genuinely curious)
- frankchn 8y agoLike with anything to do with security and convenience, there is always a trade off (longer passwords are more secure but harder to type, etc...). I don’t think this is a big enough security issue right now for car manufacturers and insurance companies to really do too much about. I used to have a car without this feature and it was sort of annoying for 5 seconds each time I have to unlock the car. I do get annoyed when I get a rental without this feature too. Additionally, this also helps when I am carrying bags or other large items with two hands. I can simply make a kicking motion at the bottom bumper of my car and the trunk will open automatically instead of me having to put the bags down and fish for my keys. I agree that it is minor and not a real deal-breaker, but it is a nice to have.
- altfredd 8y agoIsn't "keyless entry" basically same concept as "not locking a door"? You can trivially implement it on every vehicle without using any electronics at all.
- frankchn 8y agoUh, no? When you touch a door handle when the car is locked, the car will try to detect a keyfob near the door and then unlock itself when the keyfob is detected. The car won't unlock if a keyfob is not detected.
- alistproducer2 8y agoI suspect many people will happily give up such a convenience if it means they won't have their cars stolen so easily.
- huebnerob 8y agoYou suspect that the average person is going to give up a convenience that benefits them multiple times daily to ever so slightly mitigate the risk of an incredibly rare problem? I do not agree.
- zuppy 8y agoi'm a very technical person and I also wouldn't give up the convenience of keyless entry. that is what insurance is for.
- closeparen 8y agoThat’s what we had 10 years ago.
- alistproducer2 8y agoAnd apparently what we had 10 years ago was better as people couldn't steal your car without touching it.
- ryacko 8y agoEmbedded devices can be laggy at times. More efficient for the car to estimate the distance and power of the transmitter.
- jules 8y agoCan't you stop the car if the key is not present in the car? I guess the thieves could fake it with long distance transmission of the signal, but that would be more difficult and the further the car drives away from the actual key, the easier if becomes to detect the timing delay.
- blattimwind 8y agoNo. Safety-wise you can't just shut the engine off and lock the steering because the RF connection to some keyfob is wonky. These thefts have been going on for years and they will not stop until key-less go is dropped or changed such that the key requires interaction (like every higher security transponder has for, like, always).
- jules 8y agoObviously you would not use that absurd shutdown procedure. You'd give a warning and tell the driver that the engine is going to shut off in X minutes, and after X minutes you decrease its max speed to 10 km/h for Y minutes before shutting down completely. Cars already do way more dangerous stuff if you assume that arbitrary components fail. It also depends on the reliability. You could also say that you can't just shut the engine off if the electrical contact in the keyhole is wonky.
- maxerickson 8y agoSome links at https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- deleted 8y ago[deleted]
- mulmen 8y agoIs it true that encryption cannot proetect from a relay attack? If the encrypted payload is passed based on some kind of pre-shared secret (pairing) then each message should be unpredictable to a third party right?
- mikeash 8y agoThe third party doesn’t need to predict it, just repeat it. The relay doesn’t need to understand or modify the message, just pass it along.
- mulmen 8y agoIf the message is encrypted with some time component and a pre-shared secret then it is protected from a replay attack no?
- mikeash 8y agoYes, but a replay attack is quite different from a relay attack.
- mulmen 8y agoHm, good point. I guess I don't really know how these systems work. I assumed there was some kind of rotating value but I have no reason to believe this. Based on these attacks it seems the keys are really just sending the same signal every time. That appears to be a real shortcoming of the design.
- squarefoot 8y ago"but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds." And the challenge-response pair must be different for every transaction, otherwise the thief can easily grab a SDR with tx capabilities, get to the car and ask for a transmission, record the spectrum, then go near the car owner door, transmit the car challenge and record the key fob response, go back to the car, wait for another challenge transmission and time the response accordingly. Not even need for a second thief.