9 ms·
Some new cars at risk of theft by exploiting weaknesses in keyless entry systems
- izzydata 7y agoI can break into an old or new car in 2 seconds with a hammer. Thankfully people don't break into your car just because they can.
- viraptor 7y agoBut you can't start the car with a hammer and drive away, which is something the article talked about as well.
- izzydata 7y agoGood point. That is concerning.
- galangalalgol 7y agoRelay attacks let them start it an drive away too.
- duxup 7y agoHas there ever been a lot of friction as far as how quickly someone could get into a car? Let's say it took someone 60 seconds in the past, is 10 seconds really that big of a change as far as committing the crime goes?
- gambiting 7y agoIt's not the getting in part that's the problem, it's starting the car that is. When key-based immobilisers got introduced in the 90s the rate of car theft has dropped through the floor, because suddenly thieves couldn't start the car as easily as before. The keyless relay attack allows thieves not only to open but also to start the car within seconds, all of which without triggering the alarm.
- tyingq 7y agoThe article doesn't support the headline. I don't doubt there are vulnerabilities, but the article didn't deliver.
- qekbg 7y agoIt's the BBC, they are another Buzzfeed.
- galangalalgol 7y agoThey mention the relay attack. You hav an antenna amd amp. You press a button and the car challenges the key. The amp makes it reach the key.
- izzydata 7y agoPerhaps it make sense to place all your key fobs in a small Faraday cage while not in use.
- galangalalgol 7y agohttps://www.fobguard.com/ https://www.fobguard.com/ They make them just for that purpose.
- room505 7y agoWould the fob still announce with the battery removed? A fob still works without the battery when put up-close to the start button.
- snarf21 7y agoIt is clear what the vulnerability is. A lot of these remotes are susceptible to relay attacks. The car's challenge is being relayed into the house so the fob can respond. This response is relayed back to the car. The door just opens and you can start it and drive away. It is also trivial to be this attack by adding an accelerometer to the fob. If the fob isn't moving, don't respond to the broadcast from the car. You could also be more extreme and have the car check constantly. If fob disappears, kill the engine.
- gambiting 7y agoOn my Mercedes key I always double click the lock button which entirely disabled the keyless features until I use the key again. Now the question is - is this actually safer? If some thieves arrive at my house to steal my car and their relay gadget doesn't work, are they going to give up, or are they going to break in and threaten me for the key? Now that's a question I don't like to think about too much.
- wycy 7y agoYou can probably rest assured that that won't happen. The type of thieves interested in quickly/easily/silently breaking into your car are probably not the same as the type of thieves who are willing to turn it into a violent crime. Probably.
- hugh-avherald 7y agoThey're going to give up. It's opportunistic, they're not going to risk robbery, or they'll think it's not working.
- jcims 7y agoYou would give up, as would most rational people. Once you’re committing felonies the primacy of rational thought could be called into question.
- dpark 7y agoNo. The typical person who is willing to steal a car is not willing to commit violent assault in order to take keys from you. Someone whose logic is so flawed that they think “oh well, felony” is probably not just stealing cars. At that point they might as well break into your house, murder you for your stuff, and then do the same for every house on the block. “Because felony”, right?
- jcims 7y agoSo ‘No.’ but then you go on to restate my point?
- dpark 7y agoHow would the victims quoted here have any idea if their cars were opened with a relay attack? Someone grabbed your bag? It’s more likely that you forgot to lock your car than that you were a relay attack victim. Especially if you were in such a bad state that one of you literally passed out at the airport. But also how are manufacturers still selling vulnerable cars? This seems like a class-action lawsuit waiting to happen. Relay attacks have been a known vulnerability with known solutions for years.
- cjrp 7y agoLeaving the car unlocked wouldn't explain how they were able to start the car and drive off with it. Car missing + all keys accounted for in your house + no smashed glass = relay attack.
- dpark 7y agoThe people who have their bag stolen, did not have their car driven away. That’s a valid question for the other victim, but I’m pretty sure cars are still occasionally stolen without the keys nearby by defeating the immobilizer.
- SAI_Peregrinus 7y agoSo can many old cars, with rockout keys[1]. [1] https://www.sparrowslockpicks.com/product_p/ck13.htm https://www.sparrowslockpicks.com/product_p/ck13.htm
- sofaofthedamned 7y agoBoth my neighbours either side of my house had their cars stolen by this on the same night. One was a Jaguar, think the other was an Audi. They didn't touch my car even though it was newer, probably because it was a Kia. I am happy with my choice.
- throwaway3627 7y agoThere's a common attack that boosts the wireless signal of proximity fob to trick the vehicle into unlocking & starting. Fob wireless systems should ideally redesigned such that the round trip time is precisely measured of only valid encrypted challenge responses that only the fob can answer. Spending a bunch of money on a luxury vehicle is usually idiotic and most people who do so usually can't afford it in proportion to their income sheet and balance sheet. Plus, it advertises the owner and the vehicle as targets for all sorts of criminal intrigue.
- sofaofthedamned 7y agoYeah I know the attack model, it was just amusing they took the cars that were worth less (at market value) over the newer car that was less cool but worth more. We put our car keys in a metal tin near the door now which stops all this anyway.
- dpark 7y agoYour car probably wasn’t actually worth more to them. Even if your Kia was worth more according to the Blue Book, it’s quite likely that Audis and Jaguars fetch more on the parts market, and many (most?) stolen cars are torn down for parts.
- forgingahead 7y agoA lot of new car "innovations" remind me of my issues with the newer iPhones and Macbook Pros (no headphone jack, thinness above all else, etc): I like having a physical key to start the engine. There was never any confusion in our household about "who has the keys" like there is now. I despise the start-stop nonsense. Let me use the pedals to start and stop. I don't need my car to broadcast a wifi signal. Etc etc etc Sometimes manufacturers should just "version-lock" their devices and keep going with it -- a lot of customers would be happier.
- nerdponx 7y agoI despise the start-stop nonsense. Let me use the pedals to start and stop. What's this in regard to? Hybrid engines starting and stopping?
- derekp7 7y agoHybrids are ok, since the initial acceleration is done using the electric motor, and is instantaneous. But some non-hybrid cars will stop the engine when the car stops, and start it real quick as you move your foot off the brake. This gets a bit disconcerting for us drivers that grew up with cars that would have a hard time starting back up if the engine died in an intersection, so the first few times it happens it induces a bit of mild panic. Especially if you are at an intersection waiting for a gap in traffic, you take your foot off the brake and the engine starts, you start to ease up a bit for a better view then the engine stops again. Now there is a gap in traffic, and you want to go "right now", but if feels like there is that slight hesitation as the engine starts up again before you can start accelerating. Now on the technical side, then the engine stops, the engine is positioned at a part of the combustion cycle so that it takes very little effort for the starter to get the engine to pop off. And the starter motor is an upgraded version, designed for the frequent use, so overall it is very reliable. But from a psychological viewpoint, it is very hard to shake the feeling that your car engine just died and you are about to get hit by an oncoming car.
- throwaway3627 7y ago"Innovation" is increasingly newspeak for "regression."
- rad_gruchalski 7y agoA faraday car key bag costs about €20. And they work, I use one. But one has to be consistent and always put the key in the bag. Not a problem, really.
- mpclark 7y agoBut... you shouldn't have to do this! It's an extra step, an inconvenience.
- rad_gruchalski 7y agoYes, I agree. What’s the point of keyless access when one has to always take the key out of the faraday bag... And I blame car manufacturers and dealerships for this. For introducing and advertising these features without explaining to less saavy buyers what are the risks.
- modernerd 7y ago“Stolen in 20 seconds, but could not drive away.” Isn’t that the same as “not stolen”? The definition of stolen seems fuzzy here.
- bombledmonk 7y agoAnd here I am living in smalltown America and I don't lock the doors on my car in my driveway. For much of my life, I didn't even take the keys out of the ignition.
- macrolime 7y agoApple Watch Mac unlock uses time of flight to prevent relay attacks. Wouldn't that prevent this kind of thefts? Here's a description of the Apple Watch Mac unlock process https://networkingnerd.net/2016/09/21/apple-watch-unlock-802-11ac-and-time/ https://networkingnerd.net/2016/09/21/apple-watch-unlock-802...
- astura 7y agoBack in the 80s my aunt and uncle each owned the same car, though different model years. It didn't take them long to realize that both keys worked in both cars.