I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significa

I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significantly for BLE? So either they establish normal connections between relays and victims (meaning two keys, one between each relay and each victim), and then forward data coming out of the Link Layer between the attacker devices - or they need to sniff the whole spectrum in case there is just one key between car and fob. Last time I checked, sniffing the full spectrum of BT required three SDRs, meaning six in total; making this attack rather expensive to pull off (no problem for professional thieves though, I guess). OTOH if they can use any BT stack (or manipulate it with e.g. InternalBlue[1]), potential carjackers just need two Android Phones and good WiFi :( [1] InternalBlue: https://github.com/seemoo-lab/internalblue https://github.com/seemoo-lab/internalblue //edit: I think letting the phone do some sanity checking is already a good idea. There are some indicators that can be used to make this much harder (though not impossible), and which are generally available right now (that is, without additional hardware). The two most obvious: Do the GPS locations match up (prevent theft while at other end of a mall)? Did the acceleration sensors indicate that the phone might have been moved closer to the car (prevent theft while sleeping with phone on the nightstand)?