6 ms·

What about a classical mechanical key? I am referring to a laser cut key, the type that can't be easily lock picked, other than in Hollywood movies. The proble

What about a classical mechanical key? I am referring to a laser cut key, the type that can't be easily lock picked, other than in Hollywood movies. The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographically signing won't help. However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute. Upmarket car manufacturers like Mercedes have started to add this. The only reason this is not yet widespread as increased car theft is good for car manufacturers. Keyless cars top the list for most stolen cars across the UK, with around 93% of all stolen vehicles in 2020 being taken without vehicle keys. Addressing this stupidity would be the first step. It is like projecting your bank account details and security details on the facade of your building, and then being surprised your bank account is drained.

gruez 3y ago
> What about a classical mechanical key? can be picked >The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographical signing won't help. AFAIK the attack you describe only applies to keyless entry systems (ie. you can open and start a car without having to pull your key out), which is related but not the same as an immobilizer. Transponder keys without keyless entry systems still exist on today's models, and is the default on most cars unless you opt for an upgrade. >However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute. That helps against someone cloning your key while you're at your desk, but it seems way easier to clone the key while the driver is walking away from the car? That way you know which car to steal and don't have to follow the victim into the building, which might be secured (eg. office building with badge system). Measuring RTT time and/or trilateration (multiple antennas inside car) should be much more reliable.
- oxfordmale 3y ago
  Picking a laser cut key isn't trivial. Even picking a standard house lock isn't trivial, especially not in the dark. They don't clone the key, they use an antenna to amplify the signal from your key fob and then drive off. In principle you can do this by following someone, but much safer to do this at 2am at night. Similar to a one time password, the signal is only valid for a short period of time.
  - sleepybrett 3y ago
    Darkness doesn't have anything to do with anything. Once you get the tensioner and pick into the keyway you aren't using your eyes anymore, at that point it's all feel.
    - oxfordmale 3y ago
      If you are that good a lock pick, you are better off as a locksmith. In real life the people send out to steal the car aren't the most talented and brightest, otherwise they would be running the operation safely from an office somewhere.
      - sleepybrett 3y ago
        I spent maybe 2 hours with my first set of picks to unlock my first shitty masterlock padlock. An hour later I was through my front door deadbolt. It's not a hard skill to learn, especially when it comes to typical american door locks (pin tumbler). But this is all non-destructive. I used to keep a set of picks in my desk specifically to open up people personal rolling underdesk drawers/file cabinets, when they lost or forgot their keys. My understanding that your average ignition is a little more complicated (or at least different .. wafer locks) circa 70s-90s and then they started adding radios and other things into the mix. I dunno, I've never tried to pick one of these. Destructively bypassing your average old-school ignition is still something you can do blindly with a bent flathead screwdriver and some elbow grease in about 15 seconds flat. As is destructively bypassing any given door lock.. well not bypassing the lockper se, but instead the bolt/doorframe generally.
  - mdorazio 3y ago
    Bypassing the door locks is not as difficult as you think with the proper tools. See: https://www.youtube.com/watch?v=vLy65ASXuEQ https://www.youtube.com/watch?v=vLy65ASXuEQ Standard house locks don't require picking at all - you can bump them in a few seconds in any light conditions.
    - MostlyStable 3y ago
- rocqua 3y ago
  The modern versions of these keys cannot be cloned, they are challenge response. So you need to relay the challenge from the key, and then relay the response from the key back to the car. This is often used by thiefs who bring the relay close to the front door, hoping for the keys to be in a bowl or a hook near the door. Then they can open and start the car using the relay. The car then won't turn off when it loses connection to the key (because that is dangerous) which allows stealing of the car. There are cases where this was done over much larger distance, but those attacks are more easily defeated by having tighter tollerances on the latency of the reply. The latency tollerance does not do much for the 'keys near the front-door' attack, which is what the 'stationary keys do not reply' solution is aimed at.
  - dcow 3y ago
    > (because that is dangerous) I've always wondered why the car doesn't warn the driver that there's 100 yards left before it will cut the engine (or limit it to idle), keep the power steering, turn on the hazards, and warn the driver that the vehicle won't continue to function because the key is not in range. Doesn't seem dangerous at all...
    - hdctambien 3y ago
      I dropped my wife off downtown in her car and she had the key in her purse. The car did make a weird beeping noise as I drove away, but I had no idea what it meant and I was pulling onto the highway which would have been a bad time for the car to stop driving on me.
    - genocidicbunny 3y ago
      That's still dangerous, and it doesn't matter how far out you warn the driver. The moment the car cuts to idle, the driver will lose some control. Imagine this happens while you're in less-than-ideal road conditions and you need to be able to accelerate. And there are a lot of reasons that the key might lose connection to the car other than the 'not present inside the car' case, like for example, the keyfobs battery running out, or the driver dropping their keys into some kind of shielded bag (my car for example has problems sensing the key when it's in an insulated shopping bag that I have). I think at most you could do something like have the car go into 'limp home' mode if it senses the key was never present in the car for some amount of time after the car is started.
IshKebab 3y ago
I don't know if that completely solves it. People keep keys in pockets. The full fix is time of flight measurement but as I understand it that's still beyond cheap electronics. Or just.. you know press a button when you want to unlock your car.
thomastjeffery 3y ago
Doesn't the system already check the latency from key fob to car antenna? Better yet, you could use two antennas in the car, and triangulate the key fob.
- rocqua 3y ago
  The latency check is usually not sensitive enough to prevent a car being stolen from the drive-way from a relayed key that lies near the front door. For reference 20 meters is about 66 nano-seconds.
  - gruez 3y ago
    Why not? A 2GHz is very attainable in modern CPUs and translates to 0.0005ns per cycle. This isn't theoretical either. 802.11mc[1] is a real standard and is accurate to 1-2m. [1] https://en.wikipedia.org/wiki/IEEE_802.11mc https://en.wikipedia.org/wiki/IEEE_802.11mc
    - hanche 3y ago
      Aren’t you off by three orders of magnitude? 2GHz translates to 0.5ns per cycle. Or perhaps you meant to write ms.
      - gruez 3y ago
        Whoops, you're right!
  - gsich 3y ago
    So, solvable?
  - sebk 3y ago
    UWB is augmenting Bluetooth for car keys solving this exact issue; The Car Connectivity Consortium came up with the Digital Key 3.0 standard that's available today, as implemented by some makes like BMW and the Hyundai/Kia group and Apple, and resists relay and replay attacks through precise ranging.
boobsbr 3y ago
Why not put a button on the fob, like old car alarms had? Car won't start unless button is pressed on the fob, enabling the embedded radio.
- TylerE 3y ago
  Not great from an accessibility standpoint. For anyone with any sort of arthritis/rsi type issues, doing two things with the same hand at the same time is anywhere between tricky and impossible. Consider how annoying the modern cigarette lighter is for a non-smoker.
scintill76 3y ago
> However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute. Now I'm wondering how hard it would be for the thieves to shake the ground outside the house enough to fool the motion sensor...
- oxfordmale 3y ago
  Most thieves try to be quiet to avoid detection. However, one should be open minded to new technologies, and the use of a loud jackhammer on the drive way sound like an excellent solution to this problem.
IanCal 3y ago
This is two factor auth but when the "thing you own" is the standard case. I don't get why it's not a keypad and relay though. Sounds like a complex solution to a fairly simple problem. I might be missing something though. Edit - ah it's intended to work with many other options like controlling indicators or wipers or something - so you choose some pattern that is your password.
- bscphil 3y ago
  > it's intended to work with many other options like controlling indicators or wipers I think you're asking exactly the right question though - how is all this not just a more complex, less secure, shittier version of a keypad that you enter a 4-6 digit code on?
  - ehnto 3y ago
    It is also not any better than any other immobiliser. Unless it's on the CANBUS talking securely to the ECU, thieves will likely just bypass the module physically if they have the time. This coupled with a CANBUS integration with the ECU to prevent it from starting would be pretty good though, since no one can wirelessly collect the signals to spoof the code.
LadyCailin 3y ago
> The only reason this is not yet widespread as increased car theft is good for car manufacturers. Not if your brand is one of the ones known to be easy to steal. I doubt I’d buy a Hyundai in the future given my understanding of their reputation as easy targets.
mixedCase 3y ago
Don't modern keyless fobs use something akin to TOTPs? A well kept clock can easily prevent relay attacks.
blincoln 3y ago
I don't think any of your typical car thieves are actually picking locks. For a traditional mechanical key ignition, generally they're going to break into the steering column and just hotwire the right connections together, or possibly jam a strong tool in the keyway and forcibly twist the cylinder depending on the design of the lock. Obviously that won't spoof a signal from a fob or other electronic signal, but it's why having a traditional mechanical lock on the ignition isn't really worthwhile. If the electronic communication is secure, a mechanical lock doesn't add value. Maybe it's different for very high-end vehicle thieves, though.
yencabulator 3y ago
> The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographically signing won't help. It seems relay theft could be 100% prevented by measuring the response time, and capping it to whatever is the equivalent of say 100 meters + processing time in key fob.

gruez 3y ago

> What about a classical mechanical key? can be picked >The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographical signing won't help. AFAIK the attack you describe only applies to keyless entry systems (ie. you can open and start a car without having to pull your key out), which is related but not the same as an immobilizer. Transponder keys without keyless entry systems still exist on today's models, and is the default on most cars unless you opt for an upgrade. >However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute. That helps against someone cloning your key while you're at your desk, but it seems way easier to clone the key while the driver is walking away from the car? That way you know which car to steal and don't have to follow the victim into the building, which might be secured (eg. office building with badge system). Measuring RTT time and/or trilateration (multiple antennas inside car) should be much more reliable.

oxfordmale 3y ago
Picking a laser cut key isn't trivial. Even picking a standard house lock isn't trivial, especially not in the dark. They don't clone the key, they use an antenna to amplify the signal from your key fob and then drive off. In principle you can do this by following someone, but much safer to do this at 2am at night. Similar to a one time password, the signal is only valid for a short period of time.
- sleepybrett 3y ago
  Darkness doesn't have anything to do with anything. Once you get the tensioner and pick into the keyway you aren't using your eyes anymore, at that point it's all feel.
  - oxfordmale 3y ago
    If you are that good a lock pick, you are better off as a locksmith. In real life the people send out to steal the car aren't the most talented and brightest, otherwise they would be running the operation safely from an office somewhere.
    - sleepybrett 3y ago
      I spent maybe 2 hours with my first set of picks to unlock my first shitty masterlock padlock. An hour later I was through my front door deadbolt. It's not a hard skill to learn, especially when it comes to typical american door locks (pin tumbler). But this is all non-destructive. I used to keep a set of picks in my desk specifically to open up people personal rolling underdesk drawers/file cabinets, when they lost or forgot their keys. My understanding that your average ignition is a little more complicated (or at least different .. wafer locks) circa 70s-90s and then they started adding radios and other things into the mix. I dunno, I've never tried to pick one of these. Destructively bypassing your average old-school ignition is still something you can do blindly with a bent flathead screwdriver and some elbow grease in about 15 seconds flat. As is destructively bypassing any given door lock.. well not bypassing the lockper se, but instead the bolt/doorframe generally.
- mdorazio 3y ago
  Bypassing the door locks is not as difficult as you think with the proper tools. See: https://www.youtube.com/watch?v=vLy65ASXuEQ https://www.youtube.com/watch?v=vLy65ASXuEQ Standard house locks don't require picking at all - you can bump them in a few seconds in any light conditions.
  - MostlyStable 3y ago
rocqua 3y ago
The modern versions of these keys cannot be cloned, they are challenge response. So you need to relay the challenge from the key, and then relay the response from the key back to the car. This is often used by thiefs who bring the relay close to the front door, hoping for the keys to be in a bowl or a hook near the door. Then they can open and start the car using the relay. The car then won't turn off when it loses connection to the key (because that is dangerous) which allows stealing of the car. There are cases where this was done over much larger distance, but those attacks are more easily defeated by having tighter tollerances on the latency of the reply. The latency tollerance does not do much for the 'keys near the front-door' attack, which is what the 'stationary keys do not reply' solution is aimed at.
- dcow 3y ago
  > (because that is dangerous) I've always wondered why the car doesn't warn the driver that there's 100 yards left before it will cut the engine (or limit it to idle), keep the power steering, turn on the hazards, and warn the driver that the vehicle won't continue to function because the key is not in range. Doesn't seem dangerous at all...
  - hdctambien 3y ago
    I dropped my wife off downtown in her car and she had the key in her purse. The car did make a weird beeping noise as I drove away, but I had no idea what it meant and I was pulling onto the highway which would have been a bad time for the car to stop driving on me.
  - genocidicbunny 3y ago
    That's still dangerous, and it doesn't matter how far out you warn the driver. The moment the car cuts to idle, the driver will lose some control. Imagine this happens while you're in less-than-ideal road conditions and you need to be able to accelerate. And there are a lot of reasons that the key might lose connection to the car other than the 'not present inside the car' case, like for example, the keyfobs battery running out, or the driver dropping their keys into some kind of shielded bag (my car for example has problems sensing the key when it's in an insulated shopping bag that I have). I think at most you could do something like have the car go into 'limp home' mode if it senses the key was never present in the car for some amount of time after the car is started.

IshKebab 3y ago

I don't know if that completely solves it. People keep keys in pockets. The full fix is time of flight measurement but as I understand it that's still beyond cheap electronics. Or just.. you know press a button when you want to unlock your car.

thomastjeffery 3y ago

Doesn't the system already check the latency from key fob to car antenna? Better yet, you could use two antennas in the car, and triangulate the key fob.

rocqua 3y ago
The latency check is usually not sensitive enough to prevent a car being stolen from the drive-way from a relayed key that lies near the front door. For reference 20 meters is about 66 nano-seconds.
- gruez 3y ago
  Why not? A 2GHz is very attainable in modern CPUs and translates to 0.0005ns per cycle. This isn't theoretical either. 802.11mc[1] is a real standard and is accurate to 1-2m. [1] https://en.wikipedia.org/wiki/IEEE_802.11mc https://en.wikipedia.org/wiki/IEEE_802.11mc
  - hanche 3y ago
    Aren’t you off by three orders of magnitude? 2GHz translates to 0.5ns per cycle. Or perhaps you meant to write ms.
    - gruez 3y ago
      Whoops, you're right!
- gsich 3y ago
  So, solvable?
- sebk 3y ago
  UWB is augmenting Bluetooth for car keys solving this exact issue; The Car Connectivity Consortium came up with the Digital Key 3.0 standard that's available today, as implemented by some makes like BMW and the Hyundai/Kia group and Apple, and resists relay and replay attacks through precise ranging.

boobsbr 3y ago

Why not put a button on the fob, like old car alarms had? Car won't start unless button is pressed on the fob, enabling the embedded radio.

TylerE 3y ago
Not great from an accessibility standpoint. For anyone with any sort of arthritis/rsi type issues, doing two things with the same hand at the same time is anywhere between tricky and impossible. Consider how annoying the modern cigarette lighter is for a non-smoker.

scintill76 3y ago

> However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute. Now I'm wondering how hard it would be for the thieves to shake the ground outside the house enough to fool the motion sensor...

oxfordmale 3y ago
Most thieves try to be quiet to avoid detection. However, one should be open minded to new technologies, and the use of a loud jackhammer on the drive way sound like an excellent solution to this problem.

IanCal 3y ago

This is two factor auth but when the "thing you own" is the standard case. I don't get why it's not a keypad and relay though. Sounds like a complex solution to a fairly simple problem. I might be missing something though. Edit - ah it's intended to work with many other options like controlling indicators or wipers or something - so you choose some pattern that is your password.

bscphil 3y ago
> it's intended to work with many other options like controlling indicators or wipers I think you're asking exactly the right question though - how is all this not just a more complex, less secure, shittier version of a keypad that you enter a 4-6 digit code on?
- ehnto 3y ago
  It is also not any better than any other immobiliser. Unless it's on the CANBUS talking securely to the ECU, thieves will likely just bypass the module physically if they have the time. This coupled with a CANBUS integration with the ECU to prevent it from starting would be pretty good though, since no one can wirelessly collect the signals to spoof the code.

LadyCailin 3y ago

> The only reason this is not yet widespread as increased car theft is good for car manufacturers. Not if your brand is one of the ones known to be easy to steal. I doubt I’d buy a Hyundai in the future given my understanding of their reputation as easy targets.

mixedCase 3y ago

Don't modern keyless fobs use something akin to TOTPs? A well kept clock can easily prevent relay attacks.

blincoln 3y ago

I don't think any of your typical car thieves are actually picking locks. For a traditional mechanical key ignition, generally they're going to break into the steering column and just hotwire the right connections together, or possibly jam a strong tool in the keyway and forcibly twist the cylinder depending on the design of the lock. Obviously that won't spoof a signal from a fob or other electronic signal, but it's why having a traditional mechanical lock on the ignition isn't really worthwhile. If the electronic communication is secure, a mechanical lock doesn't add value. Maybe it's different for very high-end vehicle thieves, though.

yencabulator 3y ago

> The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographically signing won't help. It seems relay theft could be 100% prevented by measuring the response time, and capping it to whatever is the equivalent of say 100 meters + processing time in key fob.