6 ms·

Probably best you don't look into the security of other manufacturer's keyless entry systems... Many people refer to it as "relay theft" since historically it'

Probably best you don't look into the security of other manufacturer's keyless entry systems... Many people refer to it as "relay theft" since historically it's often just a matter of relaying/repeating a signal - there may be no real authentication involved. Around physical security, I'm often reminded that "locks are for honest thieves".

piyh 6y ago
My car unlocks keyless, but needs a key and immobilizer chip to be present to drive. Anyone can break a window to steal your stuff, getting a duplicate immobilizer chip is hard and usually requires an inside man in a dealer network.
- 8ytecoder 6y ago
  My car allows remote lock but has no feature to unlock via the app at all. And in addition the key has to be present inside the car to drive.
  - egwor 6y ago
    If they can boost the signal of the key, then it would appear that the key is in the car. The car is unlikely to stop if the key signal is lost due to safety concerns.
    - yellowapple 6y ago
      Would triangulation solve at least the signal boost part of the equation? A car thief would have a heck of a time trying to violate the laws of physics to trick that, no?
      - yencabulator 6y ago
        No need to triangulate, just measure round-trip time.
        egwor 6y ago
        Ooh, interesting. Wouldn't that be an extremely short time to measure? It would need to compare <1m response time vs <10m? I would imagine that having an accurate time chip for that short duration would be quite expensive? I have no idea though. I'd be interested to know more
        egwor 6y ago
        (as in 1meter rather than 1min!)
        yencabulator 6y ago
        You won't be driving a stolen car very far if you have to stay within 10 meters of the owner & their keyfob/phone. Accuracy of <200 meters would already eliminate the idea of being able to drive away with a stolen car by just boosting the keyfob signal. And modern cars absolutely know how to switch safely to a "limp mode" that lets you pull over safely.
- Nextgrid 6y ago
  > getting a duplicate immobilizer chip is hard and usually requires an inside man in a dealer network Unless you talk to the car's ECUs over the diagnostic port and read out the secret values for creating a duplicate or outright patch out the immobilizer check in the firmware. There's usually no auth on this and it's just obscurity, which I expect to already be broken and exploited by tools available on the black market.
  - gamblor956 6y ago
    If you have access to the car's diagnostic port you already have the physical access required to steal the car...
    - Kirby64 6y ago
      Which is the point. Getting inside the car does not require the immobilizer chip, so being able to get inside is really all that's required... assuming you can use the diag port to bypass the immobilizer. The immobilizer doesn't actually do much to a savvy criminal.
- cesis 6y ago
  Immobilizer chip is probably only required to start driving. I can't imagine any car would stop if it lost signal with immobilizer chip- that would be a safety problem. That is how relay attacks work- signal is required only for a brief period.
  - gray_-_wolf 6y ago
    Luckily my Toyota has an option to disable this remote proximity bullshit all together. I need to press button on the keys to unlock the car, and I need to put the keys on the start button to get it to start the engine.
    - londons_explore 6y ago
      > the keys on the start button to get it to start the engine So it's wireless... So someone can still use a relay attack to send the signal from the start button to the keys hanging up by your front door...
      - gray_-_wolf 6y ago
        It works only short-while after pressing the button. If I take too much time setting my stuff in the car I need to press the unlock button again to "wake up" the keys in order for it to work. So I believe it should be good enough against relay attack.
      - iso1631 6y ago
        Anyone remember the days when you used to put the key in the ignition?
        gray_-_wolf 6y ago
        I remember my father having a car like that :D
        yellowapple 6y ago
        Yeah, this is exactly why I'll be buying used pretty much forever. Don't trust self-driving anything, don't trust wireless/remote start, don't trust half-baked services like OnStar... if it gets to the point where ICEs are outright illegal, then I'd sooner convert an old beat-up Tacoma or 4Runner to an electric drivetrain than buy new. The only exception is if I have full control over it, including the ability to lock it down. No OTA updates; if I want to install security patches, it'll be through Ethernet or USB or some other wired connection. But preferably, there wouldn't be a whole lot of software to update in the first place.
pwagland 6y ago
Note that this is _not_ a relay attack. This actually updates the firmware on the Key Fob, which allows you to bypass (for example) the old workaround of disabling the "walk up unlocking" to defeat relay attacks. Many manufacturers have actually worked to improve wireless key security. Including Tesla. But this is a new class of attack on the key fob.

piyh 6y ago

My car unlocks keyless, but needs a key and immobilizer chip to be present to drive. Anyone can break a window to steal your stuff, getting a duplicate immobilizer chip is hard and usually requires an inside man in a dealer network.

8ytecoder 6y ago
My car allows remote lock but has no feature to unlock via the app at all. And in addition the key has to be present inside the car to drive.
- egwor 6y ago
  If they can boost the signal of the key, then it would appear that the key is in the car. The car is unlikely to stop if the key signal is lost due to safety concerns.
  - yellowapple 6y ago
    Would triangulation solve at least the signal boost part of the equation? A car thief would have a heck of a time trying to violate the laws of physics to trick that, no?
    - yencabulator 6y ago
      No need to triangulate, just measure round-trip time.
      - egwor 6y ago
        Ooh, interesting. Wouldn't that be an extremely short time to measure? It would need to compare <1m response time vs <10m? I would imagine that having an accurate time chip for that short duration would be quite expensive? I have no idea though. I'd be interested to know more
        egwor 6y ago
        (as in 1meter rather than 1min!)
        yencabulator 6y ago
        You won't be driving a stolen car very far if you have to stay within 10 meters of the owner & their keyfob/phone. Accuracy of <200 meters would already eliminate the idea of being able to drive away with a stolen car by just boosting the keyfob signal. And modern cars absolutely know how to switch safely to a "limp mode" that lets you pull over safely.
Nextgrid 6y ago
> getting a duplicate immobilizer chip is hard and usually requires an inside man in a dealer network Unless you talk to the car's ECUs over the diagnostic port and read out the secret values for creating a duplicate or outright patch out the immobilizer check in the firmware. There's usually no auth on this and it's just obscurity, which I expect to already be broken and exploited by tools available on the black market.
- gamblor956 6y ago
  If you have access to the car's diagnostic port you already have the physical access required to steal the car...
  - Kirby64 6y ago
    Which is the point. Getting inside the car does not require the immobilizer chip, so being able to get inside is really all that's required... assuming you can use the diag port to bypass the immobilizer. The immobilizer doesn't actually do much to a savvy criminal.
cesis 6y ago
Immobilizer chip is probably only required to start driving. I can't imagine any car would stop if it lost signal with immobilizer chip- that would be a safety problem. That is how relay attacks work- signal is required only for a brief period.
- gray_-_wolf 6y ago
  Luckily my Toyota has an option to disable this remote proximity bullshit all together. I need to press button on the keys to unlock the car, and I need to put the keys on the start button to get it to start the engine.
  - londons_explore 6y ago
    > the keys on the start button to get it to start the engine So it's wireless... So someone can still use a relay attack to send the signal from the start button to the keys hanging up by your front door...
    - gray_-_wolf 6y ago
      It works only short-while after pressing the button. If I take too much time setting my stuff in the car I need to press the unlock button again to "wake up" the keys in order for it to work. So I believe it should be good enough against relay attack.
    - iso1631 6y ago
      Anyone remember the days when you used to put the key in the ignition?
      - gray_-_wolf 6y ago
        I remember my father having a car like that :D
      - yellowapple 6y ago
        Yeah, this is exactly why I'll be buying used pretty much forever. Don't trust self-driving anything, don't trust wireless/remote start, don't trust half-baked services like OnStar... if it gets to the point where ICEs are outright illegal, then I'd sooner convert an old beat-up Tacoma or 4Runner to an electric drivetrain than buy new. The only exception is if I have full control over it, including the ability to lock it down. No OTA updates; if I want to install security patches, it'll be through Ethernet or USB or some other wired connection. But preferably, there wouldn't be a whole lot of software to update in the first place.

pwagland 6y ago

Note that this is _not_ a relay attack. This actually updates the firmware on the Key Fob, which allows you to bypass (for example) the old workaround of disabling the "walk up unlocking" to defeat relay attacks. Many manufacturers have actually worked to improve wireless key security. Including Tesla. But this is a new class of attack on the key fob.