8 ms·
Thieves Break Into Cars Using Mysterious 'Black Box'
- seventytwo 13y agoAnyone know how this is done? Maybe brute forcing the keyless entry? Maybe damaging the antenna/preamp with something high-powered would work if there's a fail safe feature to unlock the car in that event?
- Sae5waip 13y agoI've recently seen a presentation about attacks on a widely used system used in current cars. There are a couple of different ways that are significantly better than brute force (as in: works against real cars in seconds to a few minutes). (Though since key length is only 48 bit, even brute forcing might be practical.) This might interest you: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final95.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- herbertwest 13y agoI post this whenever this subject surfaces. Great paper.
- cjensen 13y agoI'm pretty sure I've had this happen to me [1]: both my Chevy and Jeep were broken into on the same night without damage. Knowing nothing about how it was done, I'd just assume the security was really bad [2] and the box simply emitted all possible combinations. Has any industry ever taken security seriously before the first major breach? Our solution is to never store anything of value in the car. [1] Pretty sure because almost never leave a car unlocked. Two cars unlocked is even more unlikely. [2] By way of example, unlocking my Chevy with its fob routinely set off a car alarm for a different car. That tells you right there that the car alarm receiver has zero security.
- cincinnatus 13y agoThe typical attack in the past involves two devices, one by the car and one by the key. But that attack only works on proximity fobs for obvious reasons.
- rjd 13y agoI read last year the (Texas?) police had some similar devices in there possession. The ones the article talked about listened to lock frequencies and could then work out the unlock frequency from it. So the criminals would scan car parks waiting for people to lock cars that where brought in, wait for the person to leave, then approach the car and unlock it with the captured frequency. I have no idea if thats what all these devices are, or how legit the article was, but seems legit to me.
- deleted 13y ago[deleted]
- sparrish 13y agoThis is nothing new. I saw a similar report with a different video over a year ago (couldn't find the link).
- lstamour 13y agoThis one? http://www.reddit.com/r/videos/comments/1skuij/new_hightech_car_theft_device_showing_up_in_the_us/ http://www.reddit.com/r/videos/comments/1skuij/new_hightech_...
- alexcroox 13y agoGlad I'm not the only one that thought that. Got a serious case of deja vu, almost exactly the same article text, including Texas having confiscated one them.
- ChuckMcM 13y agoNot exactly a new story : https://www.google.com/search?q=automatic+door+unlocker&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb#channel=fflb&q=wireless+car++door+exploit&rls=org.mozilla:en-US:official https://www.google.com/search?q=automatic+door+unlocker&ie=u... That said, its annoying. I've gotten in the habit of pulling the fuse to the car locks in my car when I park it in the long term airport lot.
- skywhopper 13y agoI'm assuming automakers don't publish their specs for keyless entry for review? I'm sure they are relatively insecure, and they almost surely have backdoor codes known to thousands of individuals in each company and likely to several law enforcement agencies as well. Such info will inevitably be leaked. I'm honestly surprised we haven't already seen widespread hacking of keyless entry. Now that many cars do all their user authentication to wireless keyfobs, hotwiring's not even necessary if you can crack the protocol.
- aosmith 13y agoIt's RF so all you would need is a little know how and a spectrum analyzer...
- becauseGoogle 13y agoGee, you guize! Oh noes, scarey people is doing bad, bad tings, and let's all worry now! Police no can help! Meesuh gonna die now??? Is there a particular reason why the 5 o'clock news is dumbed down to non-verbal pre-schooler degrees of retardation? I mean this is like Barney The Purple Dinosaur "2 + 2 is 4" level informative. "...AND NO ONE KNOWS WHAT IT IS!" Bullshit. That is a fucking lie. What's the next segment going to be? Strange lights in the sky, and maybe they're space aliens? Thanks for nothing, "journalists." Someone knows exactly what it is, and where it came from, and they're just not permitted to explain on public channels, because classified. This is just an all-points-bulletin to make sure an otherwise disinformed citizenry starts reporting on a type of crime that they might've been previously unfamiliar with.
- dragonwriter 13y ago> Is there a particular reason why the 5 o'clock news is dumbed down to non-verbal pre-schooler degrees of retardation? Yes, getting eyeballs and selling ads. The simple model of appeals with high emotional resonance and low rational content that generates among a large segment of the population a feeling that the world is a scary, scary place and if they don't keep tabs on the latest danger by watching the news it will be even more dangerous for them is a very effective way of doing that.
- krapp 13y agoOften, there's simply no benefit to putting more than the minimum amount of effort into a story. Staff may be untrained, overworked, underpaid, crunched for time or (apparently in this case) just serving up whatever shit the mothership gives them to fill some space. Just look at how many times that particular 'story' mentions 'CNN reported' and 'CNN says.' And the whole thing is like ten sentences. I bet someone didn't even have to put down their coffee for this one.
- FLUX-YOU 13y agoI've worked at a local NBC station that was exactly like this. Nice people, but there's absolutely no incentive at all for anything in depth. Local stations sometimes redeem themselves when shitty weather hits the fan though.
- rl3 13y agoToo bad there isn't a market for modern vehicles with minimalist, open-source embedded systems. That would be cool.
- rsl7 13y agoExcept when you have to download security updates before you drive off, and it leaves you bricked with dependency conflicts.
- valarauca1 13y agoWriting real time serial DAQ applications that will run for 20-30 years on end on custom 20 year old microprocessor isn't exactly for the faint of heart. Source: this is part of my job, I work in fuel systems.
- rl3 13y agoI meant more in the sense that it would make all the subsystems of the vehicle subject to review by security researchers and hobbyists. Things like backdoors in key/locking mechanisms or even gross incompetence would be difficult to hide when the underlying hardware and software was open source.
- valarauca1 13y ago(sorry long weekend) The issue becomes when opening sourcing engine components it becomes very easy to damage engines in ways that could injure the driver/other people on the road, as well as maintain EPA standards for emission and fuel consumption. Not every mechanic is a Fuel System Engineer, its relatively easy to hydrolock an engine. If you screw up the internal mechanics then just a hop-skip-and-a-jump to a VERY rapid dis-assembly. It's a lot like overclocking, but instead of a 500CPU you have a 5,000 6 chamber bomb.
- mzs 13y agoThere are many options, my favorite: https://www.factoryfive.com/kits/project-818/ https://www.factoryfive.com/kits/project-818/ Go ahead and put whatever you like in there from there if you like. In person I've seen custom instruments built on Tegra and QNX in someone's project even. Sky's the limit!
- joshuaheard 13y agoI suspect it will be necessary soon to start putting a keypad on the keyfob or door handle to ender a pin code in order to unlock the door.
- zhng 13y agoRead somewhere that this is possible by re-playing bluetooth (or similar) keyless entry signals. The suspect doesn't actually know what car he or she is going to unlock. So they brute force walk by any car that opens and drive off.
- WalterBright 13y agoMy anti-theft device is a gearshift. Nobody knows how to drive them anymore.
- hnriot 13y agoexcept everyone who didn't learn to drive in the USA.
- sosborn 13y agoI love how some people believe that this is a USA-only phenomenon.
- x3ro 13y agoWell, I can't say for south american countries or asia, but in europe it is quite unusual for people to _not_ be able to drive stick :)
- dageshi 13y agoI live in the UK and everyone I know who's ever passed a driving test drives a manual/stick.
- WalterBright 13y agoFortunately, I never take my care to the UK!
- baddox 13y agoIn the USA, the vast majority of drivers, and probably an even larger majority of would-be car thieves, learned to drive in the USA.
- dkokelley 13y agoI believe these thieves are looking for valuables left in the car, as opposed to the vehicle itself. The "black box" unlocks the doors, but doesn't necessarily start the car.
- just2n 13y agoThis is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe). With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large. The same goes for things like in-home security software. The competition should not be in the critical software. That much needs to be standard. The competition should be around fluff, construction quality, body design, brand, perks, horsepower, etc. How is this kind of thing handled in the medical and aviation industries? How about NASA? Life-critical and safety-critical software isn't something you should hire the lowest bidder to create, nor is it something that should be hidden away in the belief that "obscurity is (the best, and the only) security."
- lisper 13y ago> How is this kind of thing handled in the medical and aviation industries? You need government approval (FDA or FAA respectively) to bring a product to market. Are you sure you want that kind of bureaucratic overhead (and the associated politics) in your car and home alarm?
- just2n 13y agoI don't think "government" means "good engineering", I think that it should be thoroughly vetted by sufficient expertise. I'm not sure if the FDA or FAA are capable of doing that, given how the government is really, really bad at building or contracting software (in general). If only we could have some kind of standardized software to power these devices that is built by the community at large and thoroughly reviewed for correctness. Even at the cost of limiting hardware, I think that's an option.
- awor 13y agoIt'd be neat if they could come to some sort of a standard on this so that its an open, reviewable piece of software that handles the crypto side of things and then passes that off and they (the Automakers) can "customize" the rest of the software all they want. Somewhat (but also not at all) like a more advanced ODBII[0] [0]http://en.wikipedia.org/wiki/On-board_diagnostics#OBD-II http://en.wikipedia.org/wiki/On-board_diagnostics#OBD-II
- vinalia 13y agoThere was a pretty good talk at 29C3 about side-channel analysis and how it can break secret keys of wireless devices and smartcards. [1] With knowledge of cryptanalysis and lots of free time I think it's conceivable that someone could have cracked the system. I wonder if car companies test their crypto very rigorously? 1. https://www.youtube.com/watch?v=Y1o2ST03O8I https://www.youtube.com/watch?v=Y1o2ST03O8I
- ansimionescu 13y agoGhost Dog much? :) 0: http://www.youtube.com/watch?v=VKgTdEYDlKg http://www.youtube.com/watch?v=VKgTdEYDlKg