> It’s pretty shocking how secure those early systems are I generally don't think this is true; most early immobilizer systems were DST80 or Hitag2 based and a

> It’s pretty shocking how secure those early systems are I generally don't think this is true; most early immobilizer systems were DST80 or Hitag2 based and are broken both cryptographically and practically. The reason enthusiasts re-flash ECUs is that it's easy, permanent, and works across a whole model line of cars, compared to reverse engineering immobilizer cryptography which is difficult, transient and requires re-work for each individual car. Even modern systems are generally broken in private; you can find "emergency start" and "all keys lost" products for most newer cars, even European ones using AES. However, they're usually much more complex to use than the fake JBL speaker in the parent article's attack - most revolve around extracting key material from a control module using a software exploit. Common approaches include leveraging a leftover development artifact of some kind which allows sensitive key material to be exfiltrated from RAM, or locating a state-confusion or memory safety exploit against a CAN message handler. But, at the end of the day, most modern cars are attacked using simple bent-pipe range-extension/relay attacks, so there's less investment in cryptographic attacks or compromising the actual system anyway.