26 ms·
Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
- jaclaz 7y agoGarcia is a professor at the UNI of Birmingham, he already made a paper on similar topic that in 2012 was blocked by a Court: https://www.theguardian.com/technology/2013/jul/26/scientist-banned-revealing-codes-cars https://www.theguardian.com/technology/2013/jul/26/scientist...
- zenlot 7y agoAnd those who steal cars can clone pretty much any car keys. No sensation here.
- Scoundreller 7y ago... except you don't need physical or visual access to clone an electronic key, just proximity. Which is straightforward when you want to steal a particular vehicle because you know where it is and can easily follow its patterns.
- zyztem 7y agoAnd folks with access to Mentor (Advanced Orion) likely can clone keys from other side of the planet
- Russtopia 7y agoGreat! The dealership charges inordinately for a new key so I would love to be able to do it myself.
- 1123581321 7y agoI am married to someone who has lost her keys several times so far. Upgrading from a car with a $50 fob to one with a $200 fob was not fun.
- webninja 7y agohttps://www.thetileapp.com/en-us/store/tiles/pro https://www.thetileapp.com/en-us/store/tiles/pro If she loses her keys just once it pays for itself many times over.
- code_duck 7y agoI assume this person must be losing their keys in public or somewhere unknown. Otherwise their house must have quite the bonanza of keys waiting for them.
- 1123581321 7y agoYeah, that would have been a good call. Though as noted below, we don’t always know generally where they were lost. I’ll take a look at the peer-to-per discovery.
- gambiting 7y agoKey insurance is a thing if this is a legitimate issue for you.
- 1123581321 7y agoI didn’t know about this. Any idea how typical premiums run? I may have to start the quote process to find that out.
- blankobj 7y agoI live in the city and it's extremely common for cars to be broken into and/or stolen because of key fobs. It's a common topic on our FB neighborhood group. We store our keys in a Faraday box by the front door now, instead of leaving them out. Not surprised the attack vectors keep growing here.
- PopeDotNinja 7y agoThe LockPickingLawyer has done a few recent videos on RFID locks and how one can bypass them. They were pretty interesting to me: "[1052] Defeating a RFID System With The ESPKey" => https://youtu.be/0SEHUqkbIjU https://youtu.be/0SEHUqkbIjU "[1056] This Black Box Reads RFID Cards in Your Pocket" => https://youtu.be/dTObKtHzroM https://youtu.be/dTObKtHzroM
- tialaramex 7y ago[ Edited to insert: 1056 sort-of covers this, that's what I get for not having seen his latest video ] The lesson in 1052 sort of misses the point. LPL (his videos are a lot of fun by the way and I recommend them to anyone who is curious about lock picking) says: > So, if you are installing an access control system like this it is really important to use one that only transmits encrypted data This would defeat the ESPKey demonstrated, but of course that product exists precisely because it's all you need for common systems today. If "encrypted data" was common the ESPKey's successor would probably be a product that sits next to the reader and gets its own copy of the raw RFID signal. Not as convenient, and less fun for doing cool demos, but still plenty effective enough for crooks. What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. That would actually fix the problem, because to get the current code a bad guy needs to steal the token and that's an ordinary physical security consideration that humans are used to dealing with. This way an ESPKey gets the one-time code you just used, but neither replaying it nor copying it to a card to try later will do anything useful. Unfortunately this smarter token would be significantly more expensive. We saw with EMV cards (payment cards) that the smart and secure option (DDA with changing cryptograms) is expensive enough that providers would often rather take a risk and give you an insecure cheaper alternative which looks identical, especially if they believe regulators, courts etc. won't realise they took the cheap option and so the risk actually lands on their customers not on them.
- dmurray 7y ago> What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. Why do you need the keyfob to rely on a "surge of power"? Can't you put a battery in it and charge that battery when driving? If the battery runs down, you needed a backup anyway (physical key or phone app) in every implementation I've seen.
- amluto 7y agoIMO this is what class action lawsuits are for.
- cosmodisk 7y agoCeo's BMW X5 was stolen last year.He watched the CCTV later on.The guy came to the car with a laptop and drove away after a minute or so. Police found the car dumped somewhere on a road,as the car ran out of fuel and apparently it had some security feature that prevented the thieves from refiling it.
- ryanlol 7y agoSounds like you’re describing a range extender attack on the keyless start. Almost(I don’t know any that aren’t) all cars with the feature are vulnerable to this.
- ohmaigad 7y agoLatest BMW, Audi, VW and Ford (or at least some models from these manufacturers) key fobs stop transmitting after X amount of time (based on motion).
- VectorLock 7y agoInteresting. So do you have to put your fob in a bowl so it won't be moving to prevent it from being relay attacked, or some such?
- ohmaigad 7y agoYes but I would assume that coming home and putting all your keys somewhere to lay down is a routine for most people.
- VectorLock 7y agoLots of people sure. Mine stay on me til I go to sleep typically.
- daveFNbuck 7y agoThis feature can still protect you if it works for enough people that it's no longer worthwhile to attempt to unlock a car this way.
- neuralRiot 7y agoCall me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.
- slovette 7y agoI disagree, when you’ve got 4 kids and both arms full of groceries, when the doors open automatically or even unlock on their own it’s a godsend. I’d even say it’s probably saved some lives as the kids race to get in and out of the parking lot instead of waiting on me to shuffle around for the keys, dropping bags in the process, and then chasing each other around in blind traffic.
- Krasnol 7y agoHow much of an inconvenience would it be if your car gets stolen having 4 kids and both arms full of groceries in contrast to placing the bags on the floor for a second? I have this smart key thingy too and I keep it in one of those RFID pouches. Since I don't have to use the key to start the engine, I feel the whole thing became more of a problem than it was before. You at least always knew where the key is and where to put it. Now it sometimes slids down the seat, or is in my jacket that I wanted to leave in the car or the engine/electric is not on/off because pushing the button does several things. It became an inconvenience and the few times I really used the automatic open feature after deliberately taking out the key out of the pouch to profit from it are negligible.
- frandroid 7y ago> when you’ve got 4 arms arms full of groceries Damnit, speaking of unwanted features...
- Dylan16807 7y agoIsn't the solution to that situation a shopping cart?
- aluminussoma 7y agoMy reaction: Great! Reproducing these keys costs hundreds of dollars and a trip to the dealer. Maybe it can finally be affordable again. I'm less concerned about someone stealing my car. The local police department takes it seriously, no less because stolen cars are used to commit other crimes.
- gambiting 7y agoWait, what are you advocating? Return to keys without an immobiliser??? You do realise that that's the feature that has single-handedly destroyed car theft that was so rampant by the 90s? That is what made cars so difficult to steal, but also what makes keys cost what they do and require an approved dealer to code the keys. Return to the old keys where you only had the key and nothing else would be......crazy, really.
- Dylan16807 7y agoYeah, if they're overcharging then it would probably be better to go after that directly. It doesn't need to cost more than $20.
- taeric 7y agoI wouldn't be surprised to find car thieves also diminished since the nineties. Akin to why violent crime is down. Could be other confounding circumstances. Is almost certainly a combination of things.
- OrgNet 7y agoFor my Honda, I purchased a 5 dollar keyfob on Ebay and programmed it myself... no hacking required (the instructions are available online).
- VectorLock 7y agoHow would the dealer be able to trick you into buying key insurance if they didn't threaten to charge you hundreds of dollars though?
- bonestamp2 7y ago
- notlukesky 7y agoThe essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.
- _iyig 7y ago>The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme: https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal-car/ https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...
- chapium 7y agoDoesn't this require the attacker to have the keys?
- tialaramex 7y agoThe relay attack (which is not what this article is about) relies on an erroneous idea in the design of keyless entry and keyless ignition systems. Signals from an RFID device don't travel very far. So, (here's the error) if the keys can receive and respond to a signal from the car they must be very close to the car. But signals can be relayed. Crook A stands next to your car. Crook B walks up to your front door. Crook B is relying on the fact that most people leave their car keys on a key hook, or in a bowl, or maybe even in their outside jacket, which they leave by the door because that's convenient. You have done this. The car is sending radio pulses. "Hey, are you my key?". Crook A has a relay transceiver, it doesn't need to understand this pulse, just relay it to Crook B. Crook B has another transceiver, and when it says "Hey, are you my key?" the key, on the far side of a locked front door, says "Yes! I'm the right key, see! 023483109" and Crook B's transceiver sends that right back to Crook A. "Yes! I'm the right key, see! 023483109" the one-time code from the key matches, the car unlocks. Crook A gets into the car and starts it. Crook B walks over and gets into the passenger seat. In a few seconds the car will discover that the key, which was apparently right there, has somehow vanished. But for safety reasons it is unsafe to suddenly lock everything and shut off. The thieves will ensure that by the time it decides it would be safe to lock itself, it's inside a chop shop and that's too late. So no, the attacker doesn't "have" the key, they just need to be able to stand relatively close to it.
- robomartin 7y agoOne related and another unrelated though... First: Auto manufacturers ought to get together and agree on one common key + entry system standard. It can be a combination of physical key and remote key if necessary. The problem: If you have multiple vehicles (and many families do) you end-up with a keychain full of horrendously large and unnecessarily inconvenient keys, key-fobs, whatever. Some manufacturers seem intent on making the larges and most inconvenient boxes they can possibly imagine. This is entirely unnecessary. In this day and age one ought to be able to have a universal programmable entry system that gets programmed for your vehicles and that's that. One device to rule them all. Second: Auto manufacturers ought to get together and agree on placing the fuel tank port on the same side. The problem: Today you have cars and trucks with fuel tank refill ports on the left and the right. It can be an absolute nightmare to go to a gas station where most of the cars have ports on the left and you show-up with one on the right. This is one of the reasons for which I hated driving our BMW. Going to the gas station was always a game of chicken with cars entering in the other direction.
- maxerickson 7y agoPhone as fob is more or less here. Probably watches too.
- close04 7y ago> fuel tank port on the same side I want to believe this is to be able to spread the use around both sides of the pump without pulling the pump hose over/around the car. In some gas stations there's no easy way to turn the car around the pump.
- garaetjjte 7y ago>was always a game of chicken with cars entering in the other direction Uh, other direction? Almost always there are hoses from both side of pillar. Is it some regional thing?
- Dylan16807 7y agoThere are hoses on both sides of the line of pillars, but at the same time cars can approach the line from either end. No matter what side your port is on, you can use any spot. In these stations.
- maxerickson 7y agoCan they do Honda, please?
- unnouinceput 7y agoQuote: "By contrast, the cloning attack the Birmingham and KU Leuven researchers developed requires that a thief scan a target key fob with an RFID reader from just an inch or two away." Story time: Back in 2005/2006 when I worked for Siemens Automotive on Immobilizer feature (was involved in Mazda and Ford projects) I got my hands on the highly secret crypto source...and much to my surprise I've seen they implemented a Vigenere style of cipher. I was astounded by this. Having some crypto background as pet projects on previous years I knew this class of ciphers are at least 1.5 centuries obsolete and they are thought only from historical perspective. Therefore I prepared and called a panel of higher-ups (managers, group leaders and even including the hardware department chief) showing to them that the source code implementation is very dangerous and that for a criminal group to mass steal cars would be very easy. Including telling them exactly what the article is talking about - put an RF recorder under the handle door (how many car owners will check there?), record sessions of radio communications between key fob and the car, analyze that, extract the crypto key and steal the car with a duplicate no more then maximum a week after. Their reply? : "standard in industry call that we also allow mechanical keys to open doors/start the car, so a criminal group can do them as well much easier", and that was the end of that meeting.
- optimiz3 7y agoHopefully that's in writing somewhere for when the lawsuits happen. Financial consequences tend to motivate large companies to change their ways.
- unnouinceput 7y agoIt's not. Was an internal meeting and around 2008 Siemens also sold its entire Automotive division. Also they are the original inventors of Immobilizer feature back in late 80's, and their code "stood" the test of time. You have no idea how much opposition you get to touch even a line of code in Automotive industry when codebase is a decade old, not to mention an entire feature. So I am not surprised this is now all over the place in all auto-makers.
- tialaramex 7y agoAre you sure you aren't misremembering? DST40 https://en.wikipedia.org/wiki/Digital_signature_transponder https://en.wikipedia.org/wiki/Digital_signature_transponder used in Fords of that period is a Feistel cipher not a Vigenere cipher. Now, I wouldn't choose a Feistel cipher for this problem today but it certainly is not 1.5 centuries obsolete, this type of encryption wasn't even invented until the mid 20th century and a very famous example would be DES.
- sowbug 7y agodang, can we get a ruling? These headlines might not violate the letter of the "If the title begins with a number or number + gratuitous adjective" guideline, but they do violate the spirit. "Hackers Can Clone Toyota, Hyundai, and Kia Keys" gets the same point across without the sensationalism. I'm bringing it up because I've seen many of these "millions of [thing that exists in the millions]" headlines recently, and I think it's more than just Baader-Meinhoff at work.
- wpietri 7y agoI'm not seeing the problem. Your suggested title makes it sound like they could clone all the keys from those manufacturers which isn't true. And if you inserted a word like "some", my first question would be, "Well, how many?" To me "millions" is useful in conveying it isn't just a niche issue, but it isn't everything, either.
- beatgammit 7y agoWhy not include a percent? Are we talking about 10% of cars, or more like 80%? Is it mostly recent cars, or are cars from several years ago also affected? It's not a terrible headline, but it could also be improved.
- sverhagen 7y agoDoes it matter at all that this is the original title of the article? How about quoting it if we don't like it?
- wpietri 7y agoIt could be improved if that data were available. But it's not in the article, and it wouldn't be easy to gather. So I think we should stick with reasonably achievable choices.
- DayDollar 7y agoStolen cars are almost a sale. So good news. Supporting the industry by lowriding security.
- ck2 7y agoSome class-action lawyers will sue and make millions for themselves while every car owner will get $1 for the unfixable problem. If only this was deemed as a road safety problem forcing a recall. Is it possible to remove the antenna or disable the radio receiver in the car to force physical key use?
- quantified 7y agoInformation wants to be free. Including encryption keys.
- kweks 7y agoFor the curious or eagle-eyed, David Oswald, one of the co-authors of this paper is also one of the co-creators of the ChameleonMini [1], an open source RFID emulation device which has become the defacto tool for emulation in the penetrating community. Well done David, and thank you :) [1] https://github.com/emsec/ChameleonMini/wiki https://github.com/emsec/ChameleonMini/wiki
- muzika 7y ago“Though the list also includes the Tesla S, the researchers reported the DST80 vulnerability to Tesla last year, and the company pushed out a firmware update that blocked the attack.”
- brownbat 7y agoDoes Schuyler Towne read hacker news? He made the point in one amazing talk (that included references to centaurs and American exceptionalism and possibly ancient sumerian) that we've long used locks not for security, but as a social symbol of security. Anyone can just put a cinder block through your window and steal your car. The barrier isn't technological, it's social. Locks are a great defense against the kid or confused person who is wandering around and forgets that we have social mores against making off with thousands of dollars of other people's property on a whim. They are not designed to defend against dedicated thieves. We defend against dedicated theives by hiring detectives and prosecutors and making it in general more hazardous as a profession than other professions that one might take up. We defend against theft by just generally making it more lucrative to apply the same amount of ingenuity and dedication to other endeavors, like giving amazing talks about perfect security and American centaurs. I'm probably butchering or overextending his point though, would love for the man himself to weigh in.
- kjaftaedi 7y agoThe important point these days is one of responsibility. Whether or not these locks are made to be appropriately 'secure' is the difference between the owner and the manufacturer being liable for the result of criminal action.
- ianai 7y agoIndeed, most locks are societal items instead of actually being difficult to defeat. It doesn’t make a lot of sense to over engineer one part of a system that an OoB attack can easily defeat unless that other attack vector is much more often attacked. I doubt that’s the case here. People should avoid locations where their cars are likely targets.
- sriram_malhar 7y agoAm I the only one still fuming about those two idiots who turned the engine off on the highway, and the hazard lights as well, with no shoulder to pull into? Then the idiots smugly claim they would never put anyone's life in danger. The author also gives them a wide pass. Why? This is such irresponsible behaviour. They couldn't demo it in some large unused lot?