Keyless Remote Entry For Cars May Have Been Cracked 398
WheezyJoe writes "The Today Show had a piece this morning showing video of thieves apparently using a small device to open and enter cars equipped with keyless entry. Electronic key fobs, which are supposed to be secure, are replacing keys in more and more new cars, but the evidence suggests that a device has been developed which effortlessly bypasses this security (at least on certain makes and models). 'Adding to the mystery, police say the device works on some cars but not others. Other surveillance videos show thieves trying to open a Ford SUV and a Cadillac, with no luck. But an Acura SUV and sedan pop right open. And they always seem to strike on the passenger side. Investigators don't know why.' Police and security experts say they are 'stumped.'"
Stumped my ass (Score:5, Insightful)
Haven't we seen proof of concept hacks of these kinds for a while?
Also, "adding to the mystery", also my ass. Different keyfobs work with different algorithms and protocols. Someone's hacked a particular subset of them.
Re:Stumped my ass (Score:5, Funny)
Haven't we seen proof of concept hacks of these kinds for a while?
Also, "adding to the mystery", also my ass. Different keyfobs work with different algorithms and protocols. Someone's hacked a particular subset of them.
Maybe the car is sentient, hates the current own and wants to be stolen.
Re:Stumped my ass (Score:5, Interesting)
Maybe the car is sentient, hates the current own and wants to be stolen.
That, or the guy carrying the backpack in the video has something big enough in it to need a backpack; like a large coil, battery, and circuit board. People seem to forget that every electronic device is both a radio transmitter and receiver. With a powerful enough transmitter, any signal can be induced in any part of a circuit. Of course, physics also demands that any signal induced would be strongest along parallel wires -- power cables, to be specific.
The reason why they're targetting passenger-side doors is probably because the control logic is in the driver side door, and the doors on the right-hand side would have the longest run of cable between the control board and the door's selenoid. of course, you don't run power cable from one side of the car to the other, you run a signal wire; which depending on what kind of logic gate is on the other side, may only require a tenth to a half volt of voltage across it to trigger.
The equipment to generate a short, broadband pulse at a right angle should be sufficient to induce the required voltage, thus causing the door to unlock. Never attack the crypto system when you can go after the control interface. This is, for all intents and purposes, a side channel attack. It would only work on makes and models of cars that have a sufficiently long run of signal cable running along the longitudal axis of the vehicle. The attacker would need to be within about 5 feet to do this, and to not be obvious the car would need to be equipped with a lock that is along the window-frame or make an audible noise during unlock -- otherwise an attacker would have to visually inspect the interior of the car first, and the suspicious behavior of doing so in a parking lot filled with cars could attract law enforcement.
Anyway, that's my suspicion for what's going on. To detect this, you'd need to be able to detect a sudden increase in broadband EMR, and triangulate its location, and the emission would only last a few milliseconds, if that. The police won't have the resources to find this, but the FCC might if the attacks are happening within a single metropolitan area... or if you had one of those multimillion dollar semitruck rigs with millimeter wave x-ray tech like what they use in airports to scan people (and their backpacks) for the tell-tale metal loop, which would be optimally placed around the circumference of the bag.
Mind you, all of this ignores potential 4th amendment issues, along with all manner of other legal obstacles, including the fact that you'd be irradiating innocent people who are also unaware of your activities while in public. Failing that, you're tasked with swarming an area with officers and detaining anyone with a backpack within a certain radius, that radius being defined as the response time between signal acquisition and having boots on the ground.
As to profiling them, you're probably looking for a van without windows, SUV, or similar vehicle where stolen goods can be dropped off and the attacker picked up quickly and removed from the area... statistically, he'll be within a few blocks. The equipment needed to generate a powerful enough EM pulse would take up most of the backpack and be very bulky -- even with high energy density batteries... it probably wouldn't have enough room to store much in the way of stolen items, necessitating a nearby collection point.
Re: (Score:3)
Oh, and P.S., if you're trying to catch this crew without the multimillion dollar anti-terrorist equipment or the FCC, you should canvas upscale shopping malls and retail establishments that cater to people who make an excess of $40,000 per year and are aged 45+; Look for lots filled with cars that are 2007 or newer, SUVs, etc. That's the most lucrative target for this type of criminal. Prioritize for surveillance areas with a lot of vehicle traffic, but not a lot of foot traffic. You already know their M.O
Re:Stumped my ass (Score:5, Interesting)
Yeah, the fact that it works only on certain makes/models, if anything, makes it much less mysterious. Compromises that exploit particular broken implementations of a cryptosystem are by far the most common kind of vulnerability, more common than fundamental breaks of a cryptosystem. If this device is opening only certain kinds of Hondas, it's likely Honda screwed up its implementation in at least some models.
Re: (Score:3, Informative)
Also, "adding to the mystery", also my ass. Different keyfobs work with different algorithms and protocols. Someone's hacked a particular subset of them.
The linked article on Today is horrible. They also talk over and over about how "The Police" are stumped. As if "The Police" was some kind of borg mind. Better articles with more facts and less made up stuff can be found [msn.com]. It's the Long Beach Police Department, btw.
Re:Stumped my ass (Score:5, Funny)
They also talk over and over about how "The Police" are stumped. As if "The Police" was some kind of borg mind.
Well, The Police did put out an album entitled Ghost in the Machine, so perhaps that qualifies as Borg-Lite.
Re:Stumped my ass (Score:5, Funny)
Borg-Lite.
Same great assimilation, only one calorie.
Re:Stumped my ass (Score:5, Interesting)
Re:Stumped my ass (Score:5, Interesting)
that was a Volvo, everything uses the same damn bus
Re:Stumped my ass (Score:4, Interesting)
I have wondered myself recently too if it were at all possible. Someone was trying to open a rather expensive car in a parking lot (forgot keys or whatever, security was helping too so not a burglary) - I thought, if you can just pop the hood (you can open a hood with simple tools) and connect to one of the busses, can't you just tell the car to unlock by sending a message on it. It's most likely on a CAN or I2C bus, something open-y enough that you can just get a generic system for most cars. An Arduino could probably do it.
Re:Stumped my ass (Score:5, Informative)
Most manufacturers outside of the German cars are using systems developed by KeeLoq [wikipedia.org], so a vulnerability in that would impact a large number of vehicles. Parts of the encryption method have been attacked by researchers, with papers like How To Steal Cars [kuleuven.be]. Some of these papers point out [emsec.rub.de] that the exact security mechanisms used by manufacturers on top of KeyLoq's hardware are not public, so turning the theoretical hacks into a working device is still hard even with these issues identified. Based on that FAQ, KeeLoq itself seems secure against anything but very knowledgeable attackers with significant resources--they're quoting months of work to find a real-world vulnerability. However, we can't be sure that a specific implementation of the security approach wasn't weakened by a manufacturer mistake. I wouldn't place a large bet on that though. Someone like a car manufacturer wants to be able to say they passed the risk to someone expert in this area. If they start customizing things to add back doors, they're going to lose any ability to blame KeeLoq if there's a nasty vulnerability.
Re: (Score:3)
At some point in there, the encryption has to end, and a logic 0 or 1 has to be sent to some device to unlock the door. If you found that point, and had a way to get into it... ...
A regular car probably has some place where exactly 1 logic 1 or 0 can be sent to unlock the door, but it's not unusual to have a system that first requires an enable solenoid to be activated, then simultaneously the unlock solenoid actually moves the bolt. (Mostly military stuff)
The solenoids also take a bit of current, so if the logic controller is well shielded and takes a stream of bits to open, your system would be fairly secure against EMP type attacks, even if the solenoid isn't well shielded. Y
Seems an unnecessary feature (Score:2)
Maybe not so much the remote lock/unlock feature, but to be able to start it without actually inserting the key? A carjacker can push someone into their car as the door is opened and start it without fumbling for a key. Depending on the behavior of the car when the key becomes too far away, it can shut down during operation - dangerous - or be immobilized at its next destination (think a couple arrive at home, keyholder enters home and driver goes to run an errand).
Re:Seems an unnecessary feature (Score:5, Informative)
As far as I can tell, the compromise discussed in this article is only keyless entry, not related to starting a car. The thieves are using it to steal stuff like cell phones and GPS units from inside parked cars, not stealing the cars themselves.
Re: (Score:2)
The keyfob works to start or keep the car running only a matter of a few feet. If you get out of the car, or someone forces past you to get into the car when you're not in it they aren't going to start it with you standing outside the vehicle. Worst case, they might get a few feet before the car shuts down.
It's a convenience feature that isn't necessary, but some people want it. They can keep their keys in their pocket or purse and not take them out to start the vehicle.
Re: (Score:2)
At least on the Prius once the car is running even if you move the key fob out of range, the car keeps running (actually a good safety feature as you wouldn't want the car to shutdown on a key fob failure.) On the Prius (and maybe other Toyotas), there is a metal key for mechanically unlocking the driver's side door and a electronic slot for starting the car. You can use the electronic slot if the key fob batter is completely dead so I suspect it's a passive NFC device. There is also a mode that you can
Re: (Score:2)
Re: (Score:2)
It's a lot easier to fence a laptop, cell phone, digital projector, petty cash, company credit card or whatever other sales materials/samples a business traveler might have in their car, than driving an entire car (and it's easily traceable serial numbers) back to a chop shop. Plus you have to go back (taxi?) to the scene of the crime to get your car. The logistics just don't make sense.
Re: (Score:2)
Wait, no it won't.
Re: (Score:2)
On the other hand, if a carjacker pulls me OUT of my running car and drives away (I keep my doors locked, but still)... the keyfob is still in my pocket and I can even hit the alarm for whatever good that will do (I don't know if the car shuts off if I get too far away, once I started it up to fill my tires but I never went too far), but more importantly he can't shut the car off or he can't start it again.
Re: (Score:3)
I believe the key actually has to be present only for the initial start of the car, though I might be mistaken. That would be how I'd design it, at any rate. I see no point in the key needing to be present while the vehicle is in operation.
On a whole, keyless start is an irritating and stupid feature, I think. For those of us who work out of our vehicles, it's irritating to have to lock/unlock the vehicle frequently just to make sure it's not jacked.
Re: (Score:3, Informative)
Maybe not so much the remote lock/unlock feature, but to be able to start it without actually inserting the key? A carjacker can push someone into their car as the door is opened and start it without fumbling for a key. Depending on the behavior of the car when the key becomes too far away, it can shut down during operation - dangerous - or be immobilized at its next destination (think a couple arrive at home, keyholder enters home and driver goes to run an errand).
There are several systems involved here.
First of all you have the remote lock/alarm/window fobs. These are powered by a small watch-style battery in the fob, and allow the car to be locked/unlocked (or roll down windows) from a pretty good distance away.. sometimes as far as 50 yards or more. This is basically a coded message using a pre-shared key stored on the FOB and in the car's computer system. Unless you have a specific remote-start system added to the car (or builtin to a few luxury models) this won'
Re:Seems an unnecessary feature (Score:5, Informative)
Re: (Score:3)
...the secondary crime scene, where the homicide (yours) takes place.
Like this [dallasnews.com] from yesterday.
That's some sad stuff.
Re:Seems an unnecessary feature (Score:4, Funny)
They're in my glove box if you'll just lean in and grab them for me...
Re: (Score:2)
Not all of them have actual keys.
Re: (Score:2)
Pretty sure they would. It's a nice reliable fallback.
You can't tell that mine has a key because it's hidden inside the fob, you have to pull a little latch and the key slides out.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Did the car not notify her in some way that the key was no longer in the car? I know my Ford does this, it beeps and displays something on the dash if I get out of the car with the key and leave the car running. I'm pretty sure my BMW had a similar feature but I don't have it anymore so I can't verify that.
Just a thought. (Score:5, Insightful)
Maybe because people commonly stuff things like their GPS into the glove box, which is located on the passenger side?
My car is so old it doesn't even have door locks, so not really a problem for me.
Re:Just a thought. (Score:5, Insightful)
Also, the passenger side is right next to the sidewalk if the car is parallel-parked. That makes it a lot easier than trying to break into a car while traffic is barely missing your tush.
Re: (Score:3)
Re: (Score:3)
maybe they should try to find which device it is.
here's a thought though, maybe it causes induction in the lock relay itself.
a more realistic reason though is this: it's less suspicious if someone goes to a car on the passenger side, gets something and gets out again, like picking something up from the car he's supposed to be picking up.
or cars are just parked with the passenger door towards sidewalk....
Re: (Score:3)
Add to the fact that most in-vehicle theft is performed with a broken window, it's kinda stupid. I'd prefer to leave my doors unlocked so I don't have to shell out $300 for new glass - and a broken window is a much more visible sign of B&E than someone fiddling with a coat hanger or gaining access keyless.
Re: (Score:2)
I just wish thieves would check to see if the door is locked before breaking the glass. I had a quarter glass shattered in my unlocked car.
PS: Never, ever, lock a soft-top convertible.
Re:Just a thought. (Score:5, Funny)
Add to the fact that most in-vehicle theft is performed with a broken window
Isnt that kinda dangerous for the burglar? Walking around with a broken window to be used to break into a car is unwieldy, and they can easily cut themselves on the glass of the broken window they are carrying.
Not to mention it would look pretty suspicious walking down the street with a broken window.
kits for sale online (Score:2, Interesting)
You can get a keyless universal unlocker from china for around $2000USD.
Re: (Score:2)
Re: (Score:3)
Care to back up this statement?
probably not a key that is sent (Score:2, Interesting)
This is probably something that is not what is expected, like some of those steering wheel locks that can be removed by breaking them in half by hitting in the middle of them rather than trying to pick the lock. They are not breaking the encryption, they are breaking the system, going around the expected secure path, not through it.
Re: (Score:3)
You are probably right... Either that or its a brute force attack and they just throw lots of codes at it in a short time and hope one works which is unlikely.
My guess is they have radio/microwave transmitter that is causing a computer reboot/corruption or messing with the sensor information being fed from the mechanical parts of the lock and tricking the computer into thinking the mechanical key was used which triggers the central locking to open. As for the passenger side thing it could be that side is mo
Or attacking the source... (Score:2)
Re: (Score:2)
Having access to the algorithms should not compromise security.
Re: (Score:2)
Having access to the algorithms should not compromise security.
Assuming that they are using some actually-competent cryptosystem, and didn't add a 'convenience feature' somewhere foolish to make it easier to create replacement fobs.
Given the historical enthusiasm in lock and key circles for 'blind codes' that are super-magical-secure and can only be turned into bitting codes with the equally super-magical-secure codebooks that Trustworthy Authorized Locksmiths are supposed to have access to, I wouldn't be 100% optimistic about the market being handled according to the
Re: (Score:2)
Valid, and stupid on their part. That is why I said should.
Re: (Score:3)
Valid, and stupid on their part. That is why I said should.
Fair enough. I'm just deeply pessimistic that the (wise and superior) "knowledge of the algorithm Must Not compromise the system" standard that crypto systems are held to prevails with keyless entry systems.
For whatever reason(whether it be power/gate constraints, cultural sharing with the world of locksmithing, or vendor lousiness uninhibited by the ruthlessness of the internet), keyless-entry/RFID auth/etc. seems to be one of the last major bastions of vendors talking about 'Proprietary Encryption' as tho
Re: (Score:2)
Re: (Score:2)
If that is the case then they lost before they started.
This tempts me to go black hat so bad. (Score:3)
Re: (Score:2)
This tempts me so bad. I don't want to steal cars. I just want a button that sets off everyone's panic alarms.
Have you thought about trying a wiffle ball bat with a thin lay of foam on it? Sure you have run up and down the row or vehicles to make it work but it's 100% reliable and much cheaper.
Re: (Score:3)
That sets off car alarms, most cars do not have them.
He wants to trigger the panic button, which just uses the normal horn and pretty much all cars with keyless entry have.
Not code cracking but some other mechanism? (Score:3)
Re: (Score:2)
Good guess. All you need to do is trigger the relay which could be electronic/magnetic instead of digital.
Re: (Score:2)
No, doesn't make much sens to use EMP. Generating enough of a pulse to trigger something at 5 feet is going to take a pretty big device.
My money is on them having broken a backdoor code or are able to capture/replay when the driver "locks" the door.
Re: (Score:3)
OR.... They simply are opening unlocked doors..... (See post from jklovanc below)
Seems to be "Honda-Specific" (Score:3)
I have an exploit that works on all cars (Score:2)
I have an exploit that works on all cars and I am willing to share it!
Step 1. Apply brick swiftly to car side window.
Step 2. Unlock car.
Step 3. Gain entry.
On some models Step 1 will need to be repeated several times before progressing to Step 2.
Re: (Score:2)
Step 1. Apply brick swiftly to car side window.
That doesn't always work either.
Re: (Score:2)
On which cars?
Even armored vehicles should just take longer. Possibly a lot longer.
Re: (Score:2)
I demand you cease and desist. This spark plug method is clearly just a method of infringing on my Brick + Window Intellectual Property. Please have slashdot remove your post and contact me for information on where you may send the settlement check.
Thumb (Score:4, Informative)
Did anyone even really watch the video? The "object" in his hand was his thumb. He was opening a door where the handle is embedded in the door . His palm was up and his thumb was out. The door was not locked in the first place. Did anyone see him try the door before he supposedly used the "device"? The incident with the guy with the backpack is even more telling. He was walking along trying doors till he found one unlocked. Notice we took a step back when the door opened.
What is the evidence that the vehicles were locked? Statements from the victims who would loose the insurance award if they admitted that they forgot to lock their vehicle?
As another poster put it, these criminals are targeting vehicle contents; most of which are in the glove compartment.
Re:Thumb (Score:4, Insightful)
The incident with the guy with the backpack is even more telling. He was walking along trying doors till he found one unlocked. Notice we took a step back when the door opened.
He is walking by cars, hitting the button on his device. If you watch it again, you'll see that as he walks by, the lights in the car go on before he touches it...just like they do when you hit your unlock button on the keyfob. When that happens, he then backs up to enter the vehicle, as it is now unlocked.
Re: (Score:3)
His hand is on the door handle as he walks by. The inside lights come on when the door is unlatched as well as when the remote is used.
Re: (Score:2)
Maybe the guy was just looking for a car vulnerable to this attack, trying each car in turn. It seems to be very short range. Trying the handle might just be the device not working the first time and having to trigger it again. The video quality is too poor to really see anything.
If there is no-one in my Mitsubishi it locks itself after about a minute. Unless you leave something heavy on a seat so it thinks there is someone sitting there it is impossible to leave it unlocked.
Re: (Score:2)
Hence the fact it works on some cars and not others. Opening an unlocked door does not work on cars that automatically lock their doors.
You must not be familiar with keyless (Score:5, Informative)
Such cars (usually) have push-button start systems that also work based on the proximity of the keyless remote.
It is very convenient if your hands are full and you want to open the rear door, for example, without having to search your pocket and fumble with buttons.
Approach the car, open the handle, press the button - drive. No need to even touch the key/remote, which sits in your wallet or pocket.
Re: (Score:2)
Very few cars have that right now and I doubt any of those in the video do.
Re: (Score:2)
Where are my mod points....
Mod this post UP folks..
Re: (Score:2)
You still need to physically open the door? Presumably the device can be activated with the off hand.
I almost expect... (Score:2)
unlock = true;
try {
if (!rxkeycode()) { unlock = false; }
} catch { }
if (unlock) { unlock_the_door(); }
Short of having found a "master keycode", I'd suspect something analogous to the above. Pretty much find any type of problem in the hypothetical rxkeycode() and you win, if that's how it's implemented. The cars it doesn't work on... either the triggered bug doesn't happen, or the logic starts with "unlock=false" blah blah blah.
Would be interesting to know, not that they'll ever tell.
Keypad (Score:4, Insightful)
Re:Keypad (Score:5, Interesting)
Re: (Score:3)
Second Click.... (Score:2)
I know with my Nissan, and I believe that all cars are the same, you need to press on the unlock button twice to unlock the passenger doors. Perhaps there is something in that sequence that allows them to create a shortcut sequence that opens the passenger doors.
For example, maybe there is something in the "lock" code that is sent to lock all of the doors that triggers the start of the "unlock passenger doors" sequence and all it is waiting for is the extra code from the second key press.
NXP seems to be the common factor (Score:2)
NXP, google it yourself, don't believe me. NXP's Mifare is insecure, used in Oyster, OV-Chip and a few other very large deployments. Similar weak chipsets are found inside key fobs. Similar problems. Trivially exploitable. Just listening and some knowledge of the platform is enough to predict the next 'secure' exchange. And steal the car. Embarrassing: the next car could as well be a extremely expensive Mercedes Benz S-class.
Thinking out of the box - Jamming the close signal (Score:5, Interesting)
Re: (Score:3)
A better theory would be that the guys just placed a device in the neighbourhood earlier, that JAMS the signal that closes the car door. Most users wouldnt notice, since they just turn back and start walking while pressing the lock button. AFAIK, it is easier to JAM a signal than to decrypt it. :)
A small device with a 2W amplifier could cover a range from 500mts easily.
I have the habit of always hitting the lock button twice, and making sure I hear the horn. That way I know my truck is locked.
Back door password (Score:3)
Re:just now? (Score:5, Funny)
Nah, it's just a tennis ball with a hole in it.
Re:just now? (Score:5, Informative)
I was under the impression that these things were always vulnerable to replay attacks and I wouldn't be surprised if there was a master code as well.
See Rolling Code [wikipedia.org] for why you are under the wrong impression. There might be a recent vulnerability, but for the vast extent of their history these kinds of systems have been safe against amateur tactics like simple radio tricks, and if there is a "Backdoor" code it has been a pretty well guarded secret.
Re: (Score:3, Insightful)
This wasn't an amateur attack. This is security by obscurity. SMH. So they had it set to a high level of encryption like maybe 256. Computers are powerful enough now that it can be done with a short amount of time and patience. Thats what cops don't grasp. It was never hard to break in for someone skilled. It was time consuming. Yes it took someone who could roll crypto with program writing. How do you think, Iphones were jailbroken? Android rooted? DeCSS, and Blueray broken? Same way.
Honestly. they wanted
Re: (Score:3)
it more than that now though as more and more cars come with keyless start were you just have to have fob within a certin proximity of the vehicle to start it, now that this has been cracked all that it will take for a car theif is a little bit of crypto know how and they will be able to take off with random cars off the street and no one will be the wiser as to the car it will appear as though its the correct fob so no security alert like when someone tries to hot wire it or open the lock with a coat hange
Re: (Score:3)
Re: (Score:3, Informative)
The key for my 2013 Ford Escape never leaves my pocket. When I touch the door handle it unlocks; I get in, step on the brake pedal, and press the Start button on the dashboard. Put it in gear and drive away.
All you need is the key within so-many feet of the vehicle.
Re: (Score:3)
Definitely scary stuff, though as I'm one of those people who hates having things in my pockets and almost always leave my wallet in the car. Of course, I can see it from my office window and my house/garage are alarmed.
Re: (Score:3)
Re: (Score:3)
I can open a car in under 5 seconds. faster then most people can with a key. And it isn't obtrusive.
I can also get OTHER people to break into a car for me.
The issue at hand can be fixed with authentication.
Re: (Score:3)
Re: (Score:3)
Re:just now? (Score:4, Informative)
So they had it set to a high level of encryption like maybe 256.
There is so much wrong with that statement I dont even know where to begin.
"Encryption" isnt the word you want for this, since sending a static, encrypted message would be highly vulnerable to a replay attack. You want "authentication", which if its using a rolling code can be highly secure. But assuming youre talking about a 256-bit key, thats still not something you can just throw out as a "we can crack this". How fast you can brute-force it depends on how long it takes to attempt one key; any sane system would limit it to 1 attempt per 0.5 seconds or something, which would make it utterly infeasible to brute-force.
It was never hard to break in for someone skilled. It was time consuming.
Technically all computer security is "easy" if you have an infinite length of time to work with, but we're talking about time scales in the billions of years with a lot of modern computer security. We have the ability to have perfectly secure systems, the flaws are often in the implementation. With simple systems (ie, only access through an RF signal), your chances of getting security right are a lot higher.
Most of the things you listed are irrelevant. You are the owner of the device in all of those examples, so you must necessarily have all of the keys to access the content in question. Accessing a car is different; you need more than access to "the car" to break in unless you feel like disassembling the car, disassembling the internal computer, and reverse engineering the ROM chip inside.
Re:just now? (Score:4, Insightful)
Re:just now? (Score:4, Informative)
I would be surprised if the majority of keyless entry was RFID. It may be that the vulnerable ones use this, but RFID is not in anyway a form of authorization. It is a form of identification. The difference is your username and your password. Anyone should be able to get the RFID and be no closer to accessing the system, just as your username is not private information and is fairly useless without the password. Their are lots of easy and inconspicuous ways to steal an RFID because it's just their saying "HEY, I'm 157951234654..." and anything can read that ID and then easily masquerade as that RFID.
A proper keyless system uses cryptography(and does so properly). This is why many FOBS are quite expensive to replace and have a battery inside. When you attempt to unlock the vehicle, the vehicle sends a challenge to the FOB, and the FOB uses a private key to sign it, the vehicle then gets that signed response and verifies it using the public key. I know that my FOB uses a 40bit key, which isn't very strong. Hopefully the vehicle has delays in place to prevent someone from trying thousands of keys a second, otherwise it could be broken with brute force given the small key size. This would still take a good while though.
It's possible that some of these vehicles are vulnerable if someone got their hands on a database of public keys(or worse private keys), from which you could spend time searching for the private keys through brute force and build up a database of the private keys, and then load that list onto a portable device the masquerades as a FOB.
There's lots of possibilities.
Re: (Score:3)
Exactly, jailbreaking a phone is a completely different animal, because within the device somewhere is the private key, and it is only hidden through obfuscation. Just like a desktop, you have access to the complete system, and it's just a matter of time, skill, and effort to pulling it a part and either finding the private key or bypassing.
On the other hand, a proper keyless system has the private key in the FOB, and assuming all the components of the system are properly implemented using well established
Re:just now? (Score:5, Interesting)
Some are vulnerable to replay attacks, but Hondas (and Acuras, which are Hondas) most definitely should not be. There was an European study that used more than just simple replay attacks, and they found a dozen brands of remote devices that were susceptible. Hondas were not amongst them.
This said, the article is retarded. I hope it's not the police officers' stupidity, but the authors'.
1) Of course they will go for the passenger's door, you morons, that's where drivers leave their stuff, and that's where the glove compartment is. The thieves are not stealing the cars, they are burglarizing them.
2) Of course, it will not work on all cars, you morons. The remotes use different protocols, and the thieves clearly have cracked Honda's. This will not help them much with Ford's.
3) Ok... three I'll keep to myself. As a former law enforcement agent, I'm sure the officers know that one, and are keeping it close to their chest. The authors are still morons, though.
Re:just now? (Score:5, Interesting)
Actually, now that I have had two minutes to think about it, I have a theory.
It may be that the thieves did not hack the remote, maybe they are triggering accident detection, which unlocks the doors. If I were a Honda engineer, this is what I would look at first.
Hell, maybe Honda is even blameless. I know some car dealerships push poorly thought-out mods on their customers. I would check to see whether there isn't a local dealership that is peddling a 'safety' add-on.
Re: (Score:2)
Re: (Score:3)
But a micro SD card can store four gigabytes of key data now, which should be good for the life of the system, so maybe the next step is to embed a one time pad in both the key fob and the car security system.
Erm... I don't think this would be necessarily a good idea. If you move out of range of the car and use the fob, you can record a copy of the next key that will be used in the sequence, and then broadcast it back. Not only would that allow you to unlock the car, but it immediately borks the key fob as well....
But surely its a challenge response thing:
key -> car (lets talk)
car -> key (random challenge number)
key -> car (challenge combined with key)
In this case the challenge would be an index into the array of key values stored at both ends.
Re: (Score:3)