6 ms·
For anyone else who didn't know, I looked up what this is [1]. Essentially it boosts the search range for vehicles from a few feet to something more like 100 m
by mod 12y ago
For anyone else who didn't know, I looked up what this is [1].
Essentially it boosts the search range for vehicles from a few feet to something more like 100 meters, when searching for wireless key devices. Then the car will unlock as if the device were very close.
The devices are very inexpensive and starting to see increased use.
[1] http://www.networkworld.com/article/2909589/microsoft-subnet/thieves-can-use-17-power-amplifier-to-break-into-cars-with-remote-keyless-systems.html http://www.networkworld.com/article/2909589/microsoft-subnet...
- rasur 12y agoYou don't even need to buy an amplifier. You can stick the key against your head and the water in your brain will amplify the signal. Bonus points for taking a plastic container of water for even further extension of the range!
- Flockster 12y agoIs there a source for that? I find it hard to believe.
- MiguelHudnandez 12y agoSome googling yields this discussion: http://physics.stackexchange.com/questions/101913/why-does-a-remote-car-key-work-when-held-to-your-head-body http://physics.stackexchange.com/questions/101913/why-does-a...
- deleted 12y ago[deleted]
- i_cannot_hack 12y agoSee this video by Sixty Symbols: https://www.youtube.com/watch?v=0Uqf71muwWc https://www.youtube.com/watch?v=0Uqf71muwWc
- rasur 12y agoI did too, but I saw this video (which is part of the very entertaining Sixty Symbols series, btw) which had a demonstration. https://www.youtube.com/watch?v=0Uqf71muwWc https://www.youtube.com/watch?v=0Uqf71muwWc EDIT: i_cannot_hack got the link in before me. Kudos ;)
- 2400 12y agoTop Gear did this experiment and it worked.
- discardorama 12y agoThat is if you want to amplify the signal. But if it's an adversary, they need to do a sort-of MITM to take the car's signal, amplify it, and then turn around and take the key's response and forward it to the car.
- deleted 12y ago[deleted]
- Symmetry 12y agoI don't think the problem is that people in possession of the vehicle's key can open it from too far away. The problem is that people who don't have possession of the key can open the car and drive off with it.
- coldpie 12y agoJust to clarify, this is a vulnerability for cars with keyless entry. IE when you approach close enough to the car, it unlocks automatically if you have the key on your person, and you can start the car with the pushbutton without inserting a key. This attack makes the car consider "close enough" to be 100m instead of a few feet. If the key is inside your house a couple dozen meters away, the car unlocks automatically and you can drive it away.
- mzzk 12y agoWhat happens when I drive more than 100m away? Does the car rely on the key being "close enough" to keep the engine powered?
- CPLX 12y agoMost smart key systems will let the car run indefinitely, or until it runs out of gas, etc, once the smart key is removed from range, provided you don't turn the car off. This is done for obvious safety reasons. Imagine for example if a car just suddenly turned off while you were going over a major highway bridge with no shoulders, etc.
- dkfmn 12y agoAlso it protects against the battery in the key dying.
- comboy 12y agoCouldn't it exchange a few messages with the key and precisely measure the time? I'm not sure if such precise measurement is possible, but given that light travels ~ 1 feet per second with 10Mhz clock you could theoretically test if it was more than 50 feet away (many approximations here, but I guess within an order of magnitude)
- jffry 12y agoYou could attempt to time round-trip signal latency directly or via interference patterns, but it's a much shorter timescale. Light travels just shy of 1 billion feet per second, so we're talking differentiating in the 10s of nanoseconds, which requires nontrivial components.
- maxerickson 12y agoI already posted this link in the epic nope thread that is a sibling to this one, but the paper linked from Wikipedia speaks of an experimental implementation with a return time of 1 ns: https://en.wikipedia.org/wiki/Distance-bounding_protocol https://en.wikipedia.org/wiki/Distance-bounding_protocol
- jffry 12y agoThat's cool. I wonder how difficult it would be to implement in practice.
- maxerickson 12y agoThere are papers going back to at least 2005 (this one, a top search result, is cited 390 times: http://www.cl.cam.ac.uk/~mgk25/sc2005-distance.pdf http://www.cl.cam.ac.uk/~mgk25/sc2005-distance.pdf ), so it would not be all that surprising if there are some existing commercial implementations. The current rash of thefts seem to come down to the systems being completely naive to amplification attacks though.
- jrockway 12y ago
- emiliobumachar 12y agoMaybe the next escalation will be keys with GPS, which sends its encrypted position as part of the protocol. The car compares to its own GPS, or, in lieu of signal, it remembers its GPS stopping position. If the key has no signal, you have to insert it in the car. The escalation just after that, of course, is GPS spoofing.
- dTal 12y agoGPS is not reliable enough for that. You have to be able to start your car in an underground parking garage.
- vidarh 12y agoWouldn't be the first time someone did this... For years trains arriving at London Victoria and a few other stations where the concourse was too well covered took 30+ seconds to open the doors because the driver had to override safety systems to unlock the doors after a new system was put in place that automated which doors to open based on GPS location (there's a lot of variation in how long the stations are, and some long distance trains will operate with up to 12 carriages even though they may stop at stations with space for possibly as little as 4 on the platform, and the platform may be on either side)