Relay car theft

[Halcyon]

At this point I plan to store my fob under my foil hat until I figure a defense.

Simple, don't keep your keys by your front door like 95% of people do. Perhaps keep it in a drawer somewhere else in the house along with all the spare keys, in the unlikely event that the crooks can reach that far into your home with their gear (and not manage to be caught in the process), then multiple keys responding at the same is likely to confuse both their equipment and the vehicle security system.

[G7PSK]

What is wrong with having a button on the key that has to be pushed,or are people so lazy that even that is too much effort. If a button had to be pushed to get the key to transmit it would be no good standing outside the door with a relay unit.

[Brumby]

What is wrong with having a button on the key that has to be pushed,or are people so lazy that even that is too much effort. If a button had to be pushed to get the key to transmit it would be no good standing outside the door with a relay unit.

That's just too sensible as a concept.

Probably got knocked on the head by a beancounter that found out adding a mechanical switch cost an extra 8.6 cents to the BOM ... and then justified by someone from engineering who said something about reliability of a mechanical component.

[Halcyon]

What is wrong with having a button on the key that has to be pushed,or are people so lazy that even that is too much effort. If a button had to be pushed to get the key to transmit it would be no good standing outside the door with a relay unit.

To be honest though, there are cases where it is handy. For example, grocery shopping. If I've got my hands full, I don't need to put bags down in order to grab the keys from my pocket (usually I just want to get the hell out of there). It's not always about laziness. Another example is I usually keep my phone, keys, wallet, laptop etc... all in my back pack which I take to work with me. To be able to unlock the door without going through my bag is great.

[cybermaus]

Soon this will all be over.

A few more years and your car will recognize you and happily drive up to the shop entrance like a happy puppy because he felt alone when he was not allowed into the shop with you. You may even be able to train him to automatically open the booth.

[G7PSK]

My keys are clipped to my belt, it is easy enough to hold the shopping bags by the handles and reach down with the other to press the unlock button. If I have so much shopping I need both hands I take the trolley to the car. But to a large extent that is all a bit mote, most of shopping is on line and delivered now.

[rbm]

Car manufacturers need to add a second factor to get into the car.  Possession of the key or key code is the only factor used today.  These thieves proved that this can be defeated as easily as guessing a password can give access to an online account.  A second factor needs to be present - a biometric such as fingerprint reader on the car handle or  PINpad on the door with knowledge of a code to enter.  Yes, it's inconvenient.

[CJay]

Car manufacturers need to add a second factor to get into the car.  Possession of the key or key code is the only factor used today.  These thieves proved that this can be defeated as easily as guessing a password can give access to an online account.  A second factor needs to be present - a biometric such as fingerprint reader on the car handle or  PINpad on the door with knowledge of a code to enter.  Yes, it's inconvenient.

Fingerprint recognition would be difficult to make totally secure and if it was, is you car worth more to you than your fingers because I'm pretty sure that if the car was valuable enough there would be people ruthless enough to deprive you of it and a finger or two.

[fcb]

Fingerprint is a big no-no.

We looked into it as part of an automotive anti-carjacking project 10+ years ago. In the country concerned they even had cases of drivers being taken along for the first mile or two of the ride (then disposed of!!) in-case a particular anti-hijack system was fitted to a vehicle - can't think a professional thief would think twice about removing a finger.

It'll probably be the car insurers that force a temporary solution to this problem, either by mandating you have and use a crook-lock (how will they prove it?), or you having to prove that you have had keyless entry disabled.  Can't quite see them picking up the bill for long.

[Marco]

To be secure, you would have to be measure response time between an encrypted challenge-response pair.

Just send an encrypted word first. The key decrypts that at leisure, then masks the pings with the decrypted word before ponging.

On second thought though, with GHz range EM the pulses get awfully wide. If the attacker has a better discriminator than the key/car it might be able to "beat" light speed in a  relay attack. Ultrasonic might be easier.

[coppice]

When at home a lot of people sit really close to their car. If the car is in an integrated garage, or an integrated car port, the car might be less than 2m from the fob in your pocket when you sit in your lounge. Doesn't this cause lots of people problems with keyless entry cars remaining active for much of the time?

[fcb]

Renault's keyless entry requires you to be quite close to the vehicle (I think they use LF to trigger a response and/or prove proximity, then VHF/UHF for the comms - the keycard will lock/unlock the vehicle when you press it from a much greater distance than the keyless entry system works).  You also have to press a little soft-button on the handle to unlock the vehicle, just being close won't open unlock the door.

I expect that the devices used by thieves in the video have an LF<>UHF relay built in, probably as well as a UHF<>UHF device - non-trivial stuff, probably only targeting BMW, Mercedes and Land Rover.  Also,the video showed the units as quite big, and it looked like they had a backlit LCD display on them.

[voltsandjolts]

List of affected vehicles on ADAC is quite long and not all posh brands either. Hell, even my car is on there, ha!

https://www.adac.de/_mmm/pdf/Keyless_Liste-gepr%C3%BCfte-Fahrzeuge%20mit%20Motorr%C3%A4dern%2020171016_257944.pdf

[janoc]

Fingerprint is a big no-no.

We looked into it as part of an automotive anti-carjacking project 10+ years ago. In the country concerned they even had cases of drivers being taken along for the first mile or two of the ride (then disposed of!!) in-case a particular anti-hijack system was fitted to a vehicle - can't think a professional thief would think twice about removing a finger.

It'll probably be the car insurers that force a temporary solution to this problem, either by mandating you have and use a crook-lock (how will they prove it?), or you having to prove that you have had keyless entry disabled.  Can't quite see them picking up the bill for long.

Also most fingerprint readers are very easy to fool. Fingerprints are good to prove identity but (along with all biometrics) must never be used for access control/authentication - we are literally leaving them all over the place. And once compromised, you are screwed - a lost key can be replaced but fingerprint or iris patterns not. You could as well hand the keys to the thieves if you decide to use this.

[janoc]

Renault's keyless entry requires you to be quite close to the vehicle (I think they use LF to trigger a response and/or prove proximity, then VHF/UHF for the comms - the keycard will lock/unlock the vehicle when you press it from a much greater distance than the keyless entry system works).  You also have to press a little soft-button on the handle to unlock the vehicle, just being close won't open unlock the door.

I expect that the devices used by thieves in the video have an LF<>UHF relay built in, probably as well as a UHF<>UHF device - non-trivial stuff, probably only targeting BMW, Mercedes and Land Rover.  Also,the video showed the units as quite big, and it looked like they had a backlit LCD display on them.

Renault is also known to be vulnerable - in fact, their system has been one of the first ones where these hacks have been demonstrated if I remember correctly. Just fewer people care, because Renaults are not likely to be stolen in this way - they are not exactly considered as premium cars and most are stolen to be taken apart and sold for parts, so nobody cares if the thief breaks a window/door lock and hotwires something. People buying expensive BMWs and Mercedes cars are much more likely to make fuss - and those cars are usually stolen on order to be resold because in the East they are (still) considered a status symbol.


And for people trying to "improve" this by suggesting things like fingerprint readers and what not - keep in mind that the thief can always break a window, hook up an little box to the OBDII socket and drive off with your car, bypassing all these extra gadgets you put in. Most cars have no security whatsoever on the internal bus. Most is just security by obscurity, relying on the fact that the diagnostic messages are proprietary and not publicly available. All you need is a bit of info how to enroll a new key in the immobilizer/ECU - information that every dealer has and it is more than certain that some had it stolen (or exfiltrated by rogue employees).

Either Mercedes or BMW has made it even easier for the crooks by making the CAN bus connection accessible from outside of the car so they can even save themselves the window breaking. All this has been demonstrated, just search Youtube ...

This is far from a new issue, there have been mainstream press articles about it since at least the last year:
https://www.techlicious.com/blog/hackers-keyless-entry-car-radio-tools/

And researchers were raising alarm about it for several years now, pretty much ever since the keyless entry systems have been introduced.