5 ms·

Do you have a citation for this? In my experience, pairing a new key requires either providing a cryptographically signed certificate or having an existing pair

Do you have a citation for this? In my experience, pairing a new key requires either providing a cryptographically signed certificate or having an existing paired key within range before a new key can be added.

thought_alarm 5y ago
Cars with key fobs are easily stolen and shipped overseas by programming a new key fob. https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396215 https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396...
CoastalCoder 5y ago
> Do you have a citation for this? I don't think it was limited to Chevies.
- RavingGoat 5y ago
  Come for the car vulnerabilities and stay for the Chevy Citation jokes.
serf 5y ago
there isn't much citation needed; it's common practice at many dealerships for certain eras of cars. the 90s era hondas up to about 2001 use various key-turn-rituals to enroll/program keys into the immobilizer, the later ones use the Honda HDS system which is just a specialty Toshiba/Panasonic ToughBook with an obd dongle and special software.[0] I've enrolled keys myself for my 04 BMW with bootleg 'BMW MODIC' and 'BMW Rheingold' software packs pirated from The Pirate Bay. You don't need existing keys for either system. The trick (used to be) at the time that BMW keys were difficult to cut, and the key cutters were well controlled. This isn't the case any more, and in reality if a key was the deterrent you could always just program an immobilizer chip from another key, tape the key/chip to the column, and then use a pry bar and screwdriver to break the key tumbler and turn the switch without a key. This is neither rare nor hard to do -- and it used to be the defacto way to steal pre-immobilizer Hondas (breaking the column/tumbler, that is). It was common enough that an in-joke at the Honda dealership I worked at was that a flathead screwdriver could be referred to as a 'lazy CRX key', a majority of those era cars encountered were so worn that a flat head would turn most of their tumblers by the time I got to work on them. [0] : I was a Honda tech from 07ish to 09ish
- olyjohn 5y ago
  I used the key from my 84 Accord to get into my 98 Integra when I locked the keys in it. Similarly, my 89 Accord would unlock using pretty much any other Honda key. One day, I locked myself out of my 81 Accord... but it uses the short, old school style Honda keys, so I didn't have another car to take keys from to try... so I called a locksmith. He comes out and goes "Oh I haven't done one of these in a while..." pulls a blank key out of his toolbox, sticks it in the door tumbler, and opens it right up. So now I have an 80 and an 81 Accord... and I have also interchanged keys between them. The 80 doesn't open as easily, as I think it's less worn out. But there's practically no security on these old Hondas.
- nilleo 5y ago
  Doesn't HDS require you to obtain a number from the cars ECU to then pass that into an Internet-connected HDS terminal where you have to sign in with your dealer and technician credentials so you can put in a request for another number from a Honda server somewhere for you to input back into the ECU in order to program another transponder?
Too 5y ago
It’s a legal requirement. Or at least used to be, maybe they realized the loophole it opened up. To allow third party shops to issue new keys, preventing official dealers to charge usury fee for giving you back access to your own car if you loose your key. Right to repair has two sides of the coin.

thought_alarm 5y ago

Cars with key fobs are easily stolen and shipped overseas by programming a new key fob. https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396215 https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396...

CoastalCoder 5y ago

> Do you have a citation for this? I don't think it was limited to Chevies.

RavingGoat 5y ago
Come for the car vulnerabilities and stay for the Chevy Citation jokes.

serf 5y ago

there isn't much citation needed; it's common practice at many dealerships for certain eras of cars. the 90s era hondas up to about 2001 use various key-turn-rituals to enroll/program keys into the immobilizer, the later ones use the Honda HDS system which is just a specialty Toshiba/Panasonic ToughBook with an obd dongle and special software.[0] I've enrolled keys myself for my 04 BMW with bootleg 'BMW MODIC' and 'BMW Rheingold' software packs pirated from The Pirate Bay. You don't need existing keys for either system. The trick (used to be) at the time that BMW keys were difficult to cut, and the key cutters were well controlled. This isn't the case any more, and in reality if a key was the deterrent you could always just program an immobilizer chip from another key, tape the key/chip to the column, and then use a pry bar and screwdriver to break the key tumbler and turn the switch without a key. This is neither rare nor hard to do -- and it used to be the defacto way to steal pre-immobilizer Hondas (breaking the column/tumbler, that is). It was common enough that an in-joke at the Honda dealership I worked at was that a flathead screwdriver could be referred to as a 'lazy CRX key', a majority of those era cars encountered were so worn that a flat head would turn most of their tumblers by the time I got to work on them. [0] : I was a Honda tech from 07ish to 09ish

olyjohn 5y ago
I used the key from my 84 Accord to get into my 98 Integra when I locked the keys in it. Similarly, my 89 Accord would unlock using pretty much any other Honda key. One day, I locked myself out of my 81 Accord... but it uses the short, old school style Honda keys, so I didn't have another car to take keys from to try... so I called a locksmith. He comes out and goes "Oh I haven't done one of these in a while..." pulls a blank key out of his toolbox, sticks it in the door tumbler, and opens it right up. So now I have an 80 and an 81 Accord... and I have also interchanged keys between them. The 80 doesn't open as easily, as I think it's less worn out. But there's practically no security on these old Hondas.
nilleo 5y ago
Doesn't HDS require you to obtain a number from the cars ECU to then pass that into an Internet-connected HDS terminal where you have to sign in with your dealer and technician credentials so you can put in a request for another number from a Honda server somewhere for you to input back into the ECU in order to program another transponder?

Too 5y ago

It’s a legal requirement. Or at least used to be, maybe they realized the loophole it opened up. To allow third party shops to issue new keys, preventing official dealers to charge usury fee for giving you back access to your own car if you loose your key. Right to repair has two sides of the coin.