3 ms·
> No amount of encryption prevents relay attacks Identity verification and public/private keys are a solved problem, how is it at all impossible to prevent rel
by jimmaswell 4y ago
> No amount of encryption prevents relay attacks
Identity verification and public/private keys are a solved problem, how is it at all impossible to prevent relay attacks?
Key: I want to unlock the door.
Car: Here's a random number encrypted with my key, which only the real fob should have the pair key to.
Fob: Here's the number encrypted with another key, which only the car should have the pair key for.
Car: This matches, opening the door.
Blindly repeating these bits won't work and it should be impossible to eavesdrop without an NSA cluster of supercomputers. What am I missing?
- arlcode 4y agoThis is not what they did. They used a relay attack which means that they tunneled the actual keyfob signal over the internet (or a direct connection). Tesla and others try to mitigate that by making sure that the latency of the signal is not too high. <Everything you described> Car: your encrypted authentication looks right but you took 200ms to send it. You are probably not within BLE range. The researchers contribution was to show that despite that a relay attack is still possible.
- jimmaswell 4y agoSo they could add a power switch to the fob or make it need a button press. Maybe people don't think it's worth it. Could also keep your fob in a radio frequency blocking bag.
- arlcode 4y agoIt's usually working without a dedicated fob and uses the users phone to open and start the car. I believe they have an option where you need a pin to start the engine at least however I'm not an owner
- brewdad 4y agoWait. Does this mean thieves are downloading a car? What a world!
- oofbey 4y agoBlindly repeating the bits actually works just fine. The relay doesn't need to know anything about the content of the conversation - it just needs to boost the signal enough that the car and key can talk to each other when they're far away. Neither key nor car are the wiser, as long as the latency is low enough.
- jimmaswell 4y agoI was unfamiliar with this buttonless setup. Seems silly. The attack is defeated by keeping your fob in something that blocks radio frequencies I guess. Same idea as those metal wallets but this time for an actual threat.
- oofbey 4y ago"Buttonless" is also critical. If you make people press a button on their key to open the car, it's secure.
- deleted 4y ago[deleted]
- LeonM 4y agoThe attack in the article is a relay attack, not a replay attack. One letter difference. Every keyless/wireless car key already uses a challenge-response scheme, just like you described, to prevent replay attacks. However, that will not work against relay attacks. Cryptography does not prevent relaying. Fun fact: Even most physical car keys produced >1990 have a small RFID based transponder in the key head (the plastic part that you hold). This transponder responds to a challenge transmitted by the ignition barrel. Without a correct response, the ECU will refuse to start the engine. This is mainly done to prevent 'Hollywood' style theft where you connect 2 wires from the ignition barrel together to start a car.
- jimmaswell 4y agoThis has caused me a lot of grief on my 1999 Jeep Grand Cherokee Limited. The reader is known to go bad and refuse to let the thing start. Took a long time to find the solution somewhere online to take the steering column cover off and reconnect/jiggle the thing. Probably just some bad solder joints. Personally considering sending in my ecu to be reprogrammed and taking the reader out permanently.