4 ms·
The news here is the fact that this very old and well-known attack works on cars in the 2020/2021 model years. This is pretty surprising, since the appropriate
by matthewdgreen 5y ago
The news here is the fact that this very old and well-known attack works on cars in the 2020/2021 model years. This is pretty surprising, since the appropriate countermeasures have been widely-deployed even in inexpensive cars for well over a decade. Modern “keyless” vehicles have largely moved on to dealing with relay attacks, which is at least a more challenging class of attack than this one.
- formerly_proven 5y agoHonestly keyless go is a clusterfuck. Cars are getting stolen all over the place. Police says to wrap keys in tinfoil. It's not particularly obvious why insurers don't seem to care, though there have been some rulings where they didn't need to pay because stealing a car like this wasn't technically stealing under the insurance policy.
- throwaway0a5e 5y agoInsurers don't care because vulnerability can be predicted by make/model/year so they a) can readily predict how much they'll pay out, are all saddled with the same cost increase (per vulnerable vehicle) and are free to pass that on to customers knowing that the competition has to do the same so they won't be undercut. Basically they don't care because the cost passes right through them with minimal friction in this case.
- avidiax 5y agoThat assumes a static level of exploitation. If criminal gangs decide that Honda/Acura is the low-hanging fruit and ramp up theft of these vehicles, the insurance companies will have to react with increased insurance costs, which will put pressure on the manufacturers since it raises TCOO.
- jdavis703 5y agoInsurance renews every 6 or 12 months. At least in the US criminal gangs are fairly decentralized, so it seems insurance companies are on somewhat even ground with any shift in crime patterns.
- calvinmorrison 5y agoInsurers don't care because risk is proportionate to cost. Hence actuaries.
- kook_throwaway 5y ago>though there have been some rulings where they didn't need to pay because stealing a car like this wasn't technically stealing under the insurance policy. Link? This seems so wild.
- hunter2_ 5y agoI'm guessing it's because the key has to be present for a relay (not replay) attack, so it's analogous to the way "card present" shifts some of the liability in payment card fraud? Pretty wild that the authorized user should know to protect against key fob relays though. Fun fact: they usually go to sleep (i.e., way more battery life) based on an accelerometer detecting no motion, because legitimate use would always be hand-held. To take advantage, put it on a table or hook (but not too close to your front door, perhaps) instead of keeping it in your pocket while home.
- fomine3 5y agoIs motion sensor on key fob common even for cheaper cars?
- hunter2_ 5y agoIt seems to be a mixed bag. https://www.iaati.org/news/entry/thatcham-releases-latest-results-of-motion-sensors-in-key-fobs-that-block-r https://www.iaati.org/news/entry/thatcham-releases-latest-re... I guess sleep mode is really more about preventing relay attacks, with improved battery life being a side effect.
- intellix 5y agoI had key pouches that I put my keys inside without fail. Wasn't a problem for me personally but it is a potential thing for average Joes to not think about or remember to do