Car Thieves and Insurers Vote On Keyless Car Security 221
RockDoctor writes: The BBC reports that Britain's car thieves, rapidly followed by Britain's car insurance companies, have been expressing their opinions on the security of keyless car entry and/or control systems. The thieves are happy to steal them (often using equipment intended for dealer maintenance of the vehicles) and in consequence the insurance companies are refusing to insure such vehicles (or to accept new policies on such vehicles) unless they are parked overnight in underground (or otherwise secured) car parks. I guess I won't be considering buying one of those for another generation. If ever.
I wish I'd thought of that (Score:5, Interesting)
I've never been a fan of the keyless car design. But if I wanted a new car, I had little choice. And I knew I'd have no chance convincing car manufacturers to make a keyed version. All this time, I should have been making a fuss to the insurance industry instead.
Thank you insurance industry for making a sensible decision. Unfortunately, that may suck for anyone who owns such vehicles.
Re:I wish I'd thought of that (Score:5, Insightful)
What I can't figure out is how incompetent the car industry's software engineers must be. The implication of this is that it's possible to clone a key based only on the signal it gives off. The implication of that is that they're sending out a static password.
I mean, why are these keys not just broadcasting an "I'm here" signal (possibly with a unique id), and then doing some challenge/response authentication ala SRP that can't have the key reverse engineered from the transmissions to actually perform the unlock.
How did the car companies think they could get away with such crappy security?
Re:I wish I'd thought of that (Score:5, Insightful)
The problem is lost keys. There has to be a mechanism for an automotive dealer or manufacturer to replace lost keys, and it has to function without the original key. It's the 2010's version of old master keys for tumbler locks.
Even the summary says thieves are using those reprogramming/recovery tools intended for dealers.
Re:I wish I'd thought of that (Score:5, Interesting)
And master-keying a pin tumbler comes with the caveat that you multiply the number of keys which can open a given door. If you use multi-level master keying, you wind up with potentially dozens of key bittings that you didn't intend to allow but will also open such a lock.
Theoretically, we should be able to avoid that problem with a challenge/authentication protocol. Of course, I'm still skeptical of it being implemented well any time in the near future. For now, I'll stick with my crusty old sidebar wafer locks.
Oh yeah, any halfway competent locksmith (not these fly-by-night people) can open most of your physical locks without any real effort. The only reason they're drilling is to save a few minutes. And if we're talking about a car, it's usually faster to use some other sort of opening tool. Heck, my old Subaru, you could bend the window out with your bare hands and shove your whole arm in to unlock the door.
Locks keep honest people honest. They barely slow down a professional.
Re:I wish I'd thought of that (Score:5, Insightful)
Locks keep honest people honest. They barely slow down a professional.
Damn straight.
Another thing people don't take into consideration is that about 40% of vehicle thefts are tow-aways.
That way they can work on the locks and security in the safety of their chop shops.
@weilawei - Re:I wish I'd thought of that (Score:2)
Locks keep honest people honest. They barely slow down a professional.
Yes, but there are a lot of potential thieves who fall between those ends of the spectrum.
Re:I wish I'd thought of that (Score:5, Interesting)
And that's a disc lock (not to be confused with a "disk"/wafer lock). Those aren't terribly common, although the price has come down significantly in the past couple years. I've got a couple on hand and the tools [dx.com] to pick them (yes, IAAL--I Am A Locksmith). And yes, they can also be picked, although it's a real bear, because they don't give you any feedback on whether or not you've spun the disc to the right position (they're built very similarly to a sidebar wafer lock in the sense that they use a sidebar to avoid giving you feedback). One of my bicycle locks is also a disc lock, works fabulously for gritty/dirty conditions that would murder a pin tumbler. They also have another vulnerability to speed things up, but this isn't a locksmithing forum and I'm too lazy to do your googling for you.
If I had a customer ask me to get in, I'd probably suggest drilling it. The price has come down enough to replace them.
Re:I wish I'd thought of that (Score:4, Insightful)
Basing your protocol's PRNG (I'm assuming that sort of design here, although it's by no means the only way to skin that cat) on a serial number is Bad Idea (#1). If you need to hide the algorithm, you've already lost. That's Bad Idea #2.
Something more along the lines of using public-key crypto for your CHAP is more sensible. The car spits out a one-time value and asks the key to encrypt it. Then, the car decrypts the result to verify it. (DISCLAIMER: I am NOT a cryptographer, just a hobbyist in this regard. There's about a million and one ways to screw this up, most of them non-obvious. Taking my advice for anything besides experimentation is downright stupid. Don't roll your own. Hire a professional to do the work.)
Re: (Score:3)
I'm an engineer that has worked with these systems a little. In the end we decided not to use one, but I researched them in some detail anyway.
They usually use a rolling code, similar to 2 factor authentication systems used by Google and banks. The code is based on a PRNG, and the car and the key have the same seed. A new random code is generated every 30 seconds, and the car will accept recent or near future codes as well just in case the clock in the keyfob drifts significantly.
When you change the battery
Re:I wish I'd thought of that (Score:5, Interesting)
Even the summary says thieves are using those reprogramming/recovery tools intended for dealers.
Mostly they aren't. They're using other tools which connect to the same interface. It's trivial (in theory anyway) to put your ELM327 into sniffer mode, and with it hidden inside of the car someplace connected to the diagnostic bus, the dealership will never know that you're logging. I can literally buy an off the shelf device for a hundred bucks that will read the immobilizer code out of my Audi, and it's not an Audi-approved tool. Or I can get the code with freeware and a ten dollar cable.
Re: (Score:2)
The problem is lost keys. There has to be a mechanism for an automotive dealer or manufacturer to replace lost keys, and it has to function without the original key.
No there doesn't.... they can have a frickin' lock control module mated to the keys which must be physically removed and replaced with a new unit paired to new keys, like various manufacturers have been doing with the immobilizer chips since the 2000s.
The "recovery" mechanism should involved forced entry.
Alternatively... a backup tr
Re:I wish I'd thought of that (Score:5, Interesting)
Okay, I typed out a whole post, but this is laughable.
Most locksmiths (I Am A Locksmith) and thieves have the same goal, but for different reasons: get in, and get in quickly. (For the professional locksmith, time is money, and I can make more calls if I bust your lock open versus spending a few more minutes to pick it; for the thief, the longer you stand around, the more likely you are to be caught).
They'll just break out the drill if you make it too hard to pick quickly. Or the screwdriver. It's amazing what a long-handled flat-bladed screwdriver will do to your average pin/wafer tumbler lock...
The only way tools/knowledge get expensive is if you're into safecracking (oohhh.. so pretty...>/drool>). The idea that you can make a physical lock (crypto offers some quite nice advantages here) that the average locksmith is going to spend time picking but a thief won't is absurd.
I'll just tell the customer to replace it, unless they have some weird sentimental attachment and feel like paying me to stand there and pick it (I'm totally cool with that too). A disc (not to be confused with a disk tumbler) is a good option in the "hard-to-pick" category (though not unpickable by any stretch, and the Abloy Protecs have a serious flaw... you can google for it). They also take about 10 seconds to drill with the proper milling cutter. If that.
The closest thing to an unpickable lock is the one on some fortress phones which uses a ratcheting lever lock (so once you raise a lever, it will never come down any lower than that). It also doesn't give you any feedback, so if you screw up, it's back to the drill with you!
Re: (Score:2)
They'll just break out the drill if you make it too hard to pick quickly. Or the screwdriver. It's amazing what a long-handled flat-bladed screwdriver will do to your average pin/wafer tumbler lock...
I suggest the use of a lever tumbler lock design with some defense of the lock surface using hard plate steel containing tungsten-carbide chips, randomization of placement, and false drill points where an entering drill will pierce a pressurized bladder triggering separate re-locking mechanisms to preve
Re:I wish I'd thought of that (Score:5, Interesting)
Forget it. They'll just smash the window and replace it, or haul it onto a flatbed and work on it at their leisure.
Lever tumblers aren't going to be my first choice for something like a car. Large mechanism for one that's difficult to pick, and not as robust as a disc lock. Drill points are available from the manufacturers. Not hard to get. Hard plate and ball bearings and chips are wonderful, but...again, better for safes. Also, auto lockies are going to hate you. Relockers? Same deal. That sort of thinking works better for safes, where you have an object which is purposely large, heavy, and bolted down to concrete. Modern cars already have immobilizers.
Electronic locks hold an immense amount of promise for the future of auto locks. They're not nearly so prone to dust, dirt, space, or cost. A proper implementation will take work, but I don't see it as being infeasible. Crypto done right is harder to get past than a physical lock, which will of course just shift the means of entry to something more appealing. Modern car thieves will use a laptop more than a lockpick. That's just how the arms race goes.
Re: (Score:2)
Old spark plugs work nicely too. That ceramic stuff is super-hard. Will shatter a window like nothing with just a small chip of it.
Re: (Score:2)
It's amazing what a long-handled flat-bladed screwdriver will do to your average pin/wafer tumbler lock...
I am always shocked at how many people don't know that trick. I did that to an old fire chest I had that in all the moves I had lost the key and the fire chest was only $30 so it was the quick and simple route. Also if you damage the pins and tumbler enough just about anything will work as a key as those things wear out. The ignition on my old Bronco II was so worn I could use a small pocket knife blade in the key slot to start it. For security forget padlocks since the easy way around them has and always w
Re: (Score:2)
Drilling your way in won't help you steal the vehicle itself though, as all modern cars have an immobilizer. That's why this attack is so popular - instead of stealing a few quid's worth of CDs and change out of the glove box, they get the whole car complete with working set of keys, ready for a new VIN and transport to eastern Europe. The insurance companies end up paying out for a new car, hence their unwillingness to insure.
Re: (Score:2)
The real problem is you need to be able to scare people sufficiently that they will allow the location of their car to be tracked 24/7 via systems already built in and paid for, with just some software changes required. So target the greediest ones and tell them they either have to give up their poseur convenience or their insurance or accept the vehicle can be tracked at any time. Of course the tracking will only be enabled when the vehicle has been reported stolen, uh huh. Once you have forced tracking o
Re: (Score:2)
Most of the key reset procedures I've seen require inside access to the car, and if the thieves already have that, slaving a new key to the car is mostly a moot point.
Re: (Score:3)
With my 2006 Prius I was told that if I lost both keys that the only way to recover was to replace the computer. If I had at least one key fob I could add more key fobs but it required having at least one fob.
My current car does not have a physical lock, making it all the more difficult to break in to. It can't be programmed over ODB either.
Re: (Score:2)
The problem is lost keys. There has to be a mechanism for an automotive dealer or manufacturer to replace lost keys, and it has to function without the original key.
Why?
If you have no key available for the car, the car's private key can (and should) be wiped and replaced with a new one, and the key fob given the matching public key. Again, this is assuming that the system uses public key encryption (which it should) and that you have physical access to the car.
Re: (Score:3)
In case of the challenge/response, the car knows what response to expect on the challenge it sent out. So the car and the key basically do the same calculation.
The lost key situation is very simple: reprogram not only the key, but also the car. The car can be reprogrammed after gaining entry with a physical key - this may be a traditional key, or a smart key, or whatever. Just a second key, that the owner receives with his car and which can only be used for gaining access for reprogramming purposes.
Now what
Re: (Score:3)
But again, it goes back to how do we make sure that a dealer backdoor isn't stolen from a dealer and then used to steal cars?
Heh. Heh. Heh.
Your keys are marked with a short numerical code on them. This is often also printed in various places on the car itself. You can go purchase the books (these days, software) which lists out the codes according to year, make, model, and code and what bitting goes with each one. You don't need to be a dealer or a certified anything to purchase them, at least where I'm from.
You thought this stuff was actually hard to get? My ribs hurt.. I'm going to go fall over now. It's textbook insecurity thr
Re:I wish I'd thought of that (Score:4, Interesting)
Eventually my glove-box lock failed. Since it was a convertible, that was important (I left it unlocked always, so nobody would cut the top to get in, the glove box was always locked, and the faceplate for the radio was always removed). So I ordered a new lock. They took my VIN, and when the lock came in, it came with two brand-new keys, and the lock was already keyed to go with my old keys. So, just read the VIN off your neighbor's car, and order a replacement glove box lock mechanism, and you'll get two keys to his car. At least, that worked for me. Verified the locks were never re-keyed as well.
Re:I wish I'd thought of that (Score:5, Interesting)
So, just read the VIN off your neighbor's car,
Keep your VIN number covered up.
I have a neatly printed and laminated card that says "Bait Car #6" over mine.
Re: (Score:3)
Keep your VIN number covered up.
Obstructing VIN = Violation of the law, possible Ticket.
Sufficient probable cause for police to force entry into the vehicle to investigate.
Suspicion of car theft, may result in you being detained.
Re: (Score:3)
In other parts of the world they're covered by default. In Japan for example there's never s vi visible from the outside. (I have a Japanese domestic market vehicle, the VIN is on a plate under the hood.
Re: (Score:2)
In which jurisdiction is this? What is the actual law cited?
Re: (Score:2)
Keep your VIN number covered up.
Obstructing VIN = Violation of the law, possible Ticket.
Sufficient probable cause for police to force entry into the vehicle to investigate.
That explains something. I am in the UK and have an American car. The VIN is visible in the windscreen, the first car I have ever known like that, and it puzzled me why. I thought perhaps to save opening the bonnet (sorry, hood) to quote it when ordering spare parts?
Perhaps because, in the USA, don't you physically change the licence plate every year? In the UK the licence plate is permanent and is all that the police nornally need to know. You could physically and illegally change the number plate
Re: (Score:2)
I'm used to such numbers being inside the passenger compartment, under the rug - rather concealed places like that.
If the police would want to check on it (never heard they do), I'd have a hard time finding it. It'd require me to read the car manual to check on the location of it.
Re: (Score:2)
Re: (Score:3)
The implication of this is that it's possible to clone a key based only on the signal it gives off. The implication of that is that they're sending out a static password.
Not only is it possible, but it's in common practice. Aftermarket remote starters need to clone your keys. You can get a remote starter for basically any car. It's not like you need a dealer for it either, because car electronics places that install these things will be the ones cloning the keys.
Re: (Score:2)
Re: (Score:2)
"I haven't heard of a car key that you can just easily clone. The code is never static."
I have, most of the GM VATS chip keys were nothing more than a simple resistor.
http://vats.likeabigdog.com/ [likeabigdog.com]
Trivial as hell and was broken BEFORE the system was released by GM, even though it was used from 1990-2005
Re: (Score:2)
Re: (Score:2)
... and then doing some challenge/response authentication
Power management. Ever tried to make a decent transceiver that runs for 3-5 years on a 2016 coin cell? Burst transmitters are easy enough, but receivers eat power. And everything else you assume is pretty much wrong too. Its not a static password, and its not possible to clone a key based on the signal it gives off. Now, you can do a man-in-the-middle replay attack with a jammer, maybe, and if you have the master key you can clone a key from two sequential transmissions, but thats different. And its been su
Re: (Score:2)
Re: (Score:3)
The only problem with keyless cars systems is that the car companies forgot to secure them. That can be fixed.
I'll flip it around on you. Here's my problem with traditional keys; They can be lost, they can be stolen, they can be copied and there isn't a way of logging access or revoking access. Many older vehicles can even be started(and stolen) with a minimal amount of knowledge and tools.
All your cars are connected to the internet or soon will be. If you work for Google you just swipe your badge and take
Re: (Score:3)
Many older vehicles can even be started(and stolen) with a minimal amount of knowledge and tools.
GM was the last hold-out for two keys. One for the outside and one for the inside. The idea was that someone that managed to match one of the outside keys wouldn't be able to match the inside keys. And you didn't need a "valet key" because the ignition key was the same thing, though a valet couldn't then lock it in their lot, but one would assume they were safe.
Well, back in the early '90s, Texas A&M used lots of GM, and lots of students drove GM as well. So, a group tried all their door keys in the
Re: (Score:2)
Well, back in the early '90s, Texas A&M used lots of GM, and lots of students drove GM as well.
Interesting. I never heard anything about that, and the group of people I hung around with were just the sort that would pull that kind of stunt. I left in 1995, though, so maybe it was a little later.
Re: (Score:2)
Didn't those cars have license plates attached to them for easy identification?
Re: (Score:2)
Welcome to the future: http://blog.caranddriver.com/s... [caranddriver.com]
Re: (Score:2)
Tesla's keyless design seems to work well enough so far.
Tesla owners are some of the most satisfied car owners in America, and now they have one more reason to love their Model S: They basically never get stolen.
In the last three years just four of the luxury electric cars have been stolen, MarketWatch reported. Three were reported stolen last year, none in 2012 and only one was stolen in 2011.
It's not like they are too rare for thieves to get their hands on. At least 20,000 were sold last year alone. The National Highway Traffic Safety Administration says cars are stolen at an average rate of about 3.56 thefts per 1,000 vehicles produced. The Model S, however, squeaks by with a 0.15 per 1,000 theft rate, making it the least-stolen vehicle in America. The second-lowest theft rate is that of the Hyundai Tucson, with 0.40 thefts per 1,000 vehicles, according to the Highway Data Loss Institute.
All that technology makes the Tesla tempting, but ultimately too difficult to steal. The Model S doesn't have any locks to pick, since the car opens and starts only when its corresponding key fob is near. Sure a thief could go to the trouble of hacking the car, but once they had it there isn't much they could do with it. Most cars are stolen and parted out in chop shops, and there simply isn't a market for additional Tesla parts.
http://autos.aol.com/article/o... [aol.com]
Re: (Score:2)
What is wrong with a physical key? Are they so big that people can't manage to carry them?
Keyless cars seem to be a fancy, insecure solution for a problem that barely exists.
Re: (Score:3)
All your keys are belong to us.
Fixed that for you.
Re:Key or keyless, all the same (Score:5, Interesting)
>According to BMW their so-called "security" is so secured that there are BILLIONS of combination in their "secure key" system
Well there's the problem right there - obviously they didn't take computer security seriously or they'd realize that billions of combinations hardly gives a brute-force hacking simpleton time tor their coffee to cool - I don't think anyone has considered 32 bit encryption keys secure since... ever, really. And that's assuming there's no vulnerabilities in the system. Meanwhile in order for the mechanic to be able to replace a lost key you need to install a gaping back door in every car you make, rendering your security system irrelevant except to the most casual of thieves.
Re: (Score:2)
There's an app for that.
Re:Key or keyless, all the same (Score:5, Funny)
;According to BMW their so-called "security" is so secured that there are BILLIONS of combination in their "secure key" system
Well there's the problem right there - obviously they didn't take computer security seriously or they'd realize that billions of combinations hardly gives a brute-force hacking simpleton time tor their coffee to cool
It only works if you say "BILLIONS of combinations" in Car Sagan's voice.
Re: (Score:2)
;According to BMW their so-called "security" is so secured that there are BILLIONS of combination in their "secure key" system
Well there's the problem right there - obviously they didn't take computer security seriously or they'd realize that billions of combinations hardly gives a brute-force hacking simpleton time tor their coffee to cool
It only works if you say "BILLIONS of combinations" in Car Sagan's voice.
And only if you're stoned.
Re:Key or keyless, all the same (Score:5, Interesting)
>According to BMW their so-called "security" is so secured that there are BILLIONS of combination in their "secure key" system
Well there's the problem right there - obviously they didn't take computer security seriously or they'd realize that billions of combinations hardly gives a brute-force hacking simpleton time tor their coffee to cool - I don't think anyone has considered 32 bit encryption keys secure since... ever, really.
Given that physical keys can have only "thousands" of combinations and provide reasonable security (car thiefs will break the window rather than try to pick the lock), you don't need a bit 128 digital key to make a secure car door lock, you just need to rate-limit brute force attacks. no thief can spend the time testing thousands of physical keys in the lock door lock, and if the system stops listening for 5 minutes every N number of incorrect keys, then even a 32 bit digital key can be immune to a brute force attack (though the protocol has to protect against snooping)
And that's assuming there's no vulnerabilities in the system. Meanwhile in order for the mechanic to be able to replace a lost key you need to install a gaping back door in every car you make, rendering your security system irrelevant except to the most casual of thieves.
It needn't be a big gaping back door -- if every new car-key generation request has to be signed by the secure private key only known by the manufacturer, then stolen car-key programming equipment has a very short lifetime - it's only good until the equipment is reported stolen, and only validated service stations can get their car-key requests signed and it's trivial to track stolen cars back to the machine that generated the key.
Re:Key or keyless, all the same (Score:5, Interesting)
Rate limiting would help a LOT, but may not be enough if the bad guys rig up a strong transmitter. If you are in a crowded parking lot, you probably don't much care which BMW you steal, the first one to unlock will be good enough.
It's not like BMWs are bargain basement cars, surely they could have spent a bit on an actually secure keyless entry system.
Re: (Score:3)
It's not like BMWs are bargain basement cars, surely they could have spent a bit on an actually secure keyless entry system.
The problem is that the only right way to do it is a public key-based challenge/response system. This prevents replays from snooping, keeps the keys secure (they never leave the car or key fob), and essentially prevents brute force.
The issue is that this requires the key fob to have both a transmitter and a receiver, plus more computing power, making it larger, and would likely run the battery down pretty fast (even if the receiver is only powered for a few seconds after a button is pressed). Nobody wants
Re:Key or keyless, all the same (Score:5, Interesting)
The radios they use in these systems are ISM band, often 433MHz (Europe), 432MHz (Japan) or 915MHz (US). The bit rate is fairly low, often 9600 or maybe 30kb tops. Thus you can really only try maybe a couple of hundred keys per second, at the absolute limit.
Fortunately there is no need to brute force. Just set up a jammer, wait for someone to fail to notice that their car didn't lock as they were walking away, and attach your hardware to the car's debug port.
Re: (Score:3)
Rate limiting would help a LOT, but may not be enough if the bad guys rig up a strong transmitter.
Exactly. Even if the guy had to park right next to the car he wants to steal, the fact that he doesn't have to touch the target car means it doesn't look like anything nefarious is happening. So he can walk away, do his grocery shopping, while his tools do their thing, and if all goes well, he'll drive home in a much nicer car.
Re: (Score:3)
Re: Key or keyless, all the same (Score:5, Funny)
Rate limiting would make ddosing a country club parking lot lots of fun.
Re:Key or keyless, all the same (Score:5, Interesting)
Most of those billions of codes are easly circumvented by a replay attack. The cure is to lock and unlock your car with a physical key to prevent reading of the code. The other step is to add a switch to simply turn off the RF trancievers in the car when parking it in an unsecure location. A replay attack will fail when the RF is OFF.
Re:Key or keyless, all the same (Score:5, Interesting)
...The cure is to lock and unlock your car with a physical key to prevent reading of the code. The other step is to add a switch to simply turn off the RF trancievers in the car when parking...
Great point.
Once hackers started popping passenger doors remotely, I found out you could disable remote door unlock just by pulling the fuse on the receiver.
Now you need a physical smart key turn to open the door and disable the alarm.
Just picking the lock won't work either, because it's the smart key that disables the alarm.
Underground as rare as hens teeth (Score:2)
At least in the U.K. which is where the article is about. Basically underground car parks at private residences don't for practical purposes exist in the U.K., which is why the article *NEVER* mentions them at all.
Never liked the idea of a keyless car, just being near the car means anyone can get in the car as you approach. Heck even if it is parked on the drive and the keys are inside. One of the stupidest ideas in existence really.
Re: (Score:2)
... And carjackers, since you are in the car at the time.
Re: (Score:2)
My old boss had a Porsche Carerra GT (and other fabulous Porsches in his collection) and he used to leave it parked with the keys in it.
One day I was joking with his secretary about taking it for a spin:
"You don't want to lose your job"
"I can get another job, but I'll never get a better chance to total out a sweet ass Porsche"
About a minute later I played a clip of one being started and revved up, and he bolted out of his office.
I made him take me for a ride (no he wouldn't let me drive it)
He let me follow
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: Underground as rare as hens teeth (Score:2)
Really don't get this... (Score:2)
It's easier enough to get into a standard auto keylock. People get the key cut books, and cut their own keys. No different.
Re: (Score:2)
How does a key cut book help you get in to a random specific car?
Re: (Score:2)
How does a key cut book help you get in to a random specific car?
Yeah, I'm at a loss there, too. My car came with a tag which I don't actually have which had the key code on it. Otherwise the dealer has to actually get the data from the manufacturer. This is standard for OBD-II-era Audis, and probably VWs too.
Re: (Score:2)
Your key code numbers were provided by the manufacturer on one of the various stickers on the ECU (which matches the tag you lost), it's just easier to call them than yank the kickpanel off.
Well, I'll test your theory once I build my bench flashing rig, but I'm pretty sure that the immo code is not anywhere on my Motronic PCM. And the PCM is not behind the kick panel, there's only fuses there. The PCM is in the e-Box, where it's easy to access from beneath the hood (somewhere 6-8 #2 philips screws) and you can even easily read the label without removing the unit itself.
This most important thing in the article (Score:5, Funny)
"By far the most common way of a car being stolen is still from thieves breaking into homes and stealing keys," he said.
Don't leave your keys in the obvious places, including the spare keys.
For bonus points: Have some keys labeled "neighbor's house" that are useless.
Re: (Score:3)
This is Britain, not America. Burglary with violence is an extremely rare occurrence. Probably less than a one-in-a-million event per household.
Hell - our police forces have to work hard to find enough officers to volunteer for firearms training.
Other risks (Score:2)
A few years ago I had a jacket stolen from a restaurant. The crooks walked round the local car parks pressing the button on the key-less entry fob until my (ex) car flashed its lights. Easy job for them.
I reported it to the police, got a video of it being stolen from a camera - the police were less than interested. I was then told that it had been seen on an auction site - by the time that the police got round to visiting it 3 weeks later the guy claimed to not remember anything about it & that was that
Re: (Score:2)
Lesson that was learned: The Police are 100% useless.
Remember kids, the police are not there to protect and serve or stop crime. They are there for their own reasons to do what they want to do.
Re: (Score:3)
Re: (Score:2)
Why waste time dusting for prints when you are not going to follow up?
Probably because the suspect is involved in another, bigger investigation - is he a known gang member whose gang is being investigated for human trafficking or drug distribution? Why pick up the known gang member when he can lead to them other members and on up the chain?
Re: (Score:2)
Of course, you may want to warn the valet.
Modified car? (Score:5, Interesting)
Re: (Score:2)
Yeah, I just found out there's a sweet hack for the immobilizer in my Audi A8, which admittedly is first-generation. A free program with a ten dollar cable lets you pull the ROM image through the OBD-II port, and then you read the immo code out of the flash. You can get the hood open by cutting the cable, and you can bench flash the PCM (inside a box under the hood) by connecting your OBD-II cable to just three pins since you only need +, -, and the K line. Then you can program your $20 fob to get you in th
Re: (Score:2)
What's the point when someone can load it onto a flatbed in under 5 minutes and drive off with it?
You don't need a flatbed.
Fool me once... (Score:2, Insightful)
The thieves are happy to steal them (often using equipment intended for dealer maintenance of the vehicles) and in consequence the insurance companies are refusing to insure such vehicles
This is ironic. When electronic systems were first rolled out, the car manufacturers did a fantastic job of convincing insurance companies they were far superior to mechanical lock systems. So good, that in some cases insurance companies initially labeled any theft of such a car as being likely to have been done in conspiracy with consent of the owner, since it was obvious no common thief could have cracked such awe-inspiring technological marvels of security.
Of course, this point of view was unfortunate
Re: (Score:3)
Re: (Score:2)
Not "repacked", but "re-placed". And it happens so rarely because no one will assume the liability of anything ever going wrong with the replacement. Should you have a crash and the airbag doesn't deploy, guess who's going to be sued? (answer: who ever replaced that airbag.)
Re: (Score:2)
Re: (Score:2)
your medical bills are higher than they would have been if you didn't have an airbag
True, dead people don't have very high medical bills...
AIG (Score:2)
Liability (Score:2)
This problem is easily solved by placing the liability of a "proper" locking system on the manufacturer and vendor of the car. If the system gets hacked, the manufacturer should be made liable to come up with a fix for that, or buy the car back from the owner at the original price of sale. In the UK most of the provisions for such a system are already in place. It will just take a relatively small and easy law where the party responsible for sale and/or manufacture of a device that later turns out to be fun
Re: (Score:2)
The UK already has consumer protection laws that should be sufficient to cover this. Our statutory rights include that goods are 'fit for purpose' an
Re: (Score:2)
Already exists. Goods sold in the UK have to be of 'Satisfactory Quality' and 'Fit for Purpose' [wikipedia.org]. A car you cannot insure for us on the public road is unlikely to be deemed by the courts to be of 'fit for purpose', so the sale of such a car is likely to be void.
IANAL.
Best deterrence: Scratched car (Score:3)
Our car is badly scratched. It's second hand and one of us made additional scratch to it (non intentional).
I don't think anyone would be interested in robing such a car and we feel quite relaxed regarding theft risk (and when going through tight places).
Re: (Score:2)
Car thieves in any country have been expressing their opinions on the security of keyed car entry and/or control systems. The thieves are happy to steal them (often using equipment intended for dealer maintenance of the vehicles *OR SIMPLY USING A COAT HANGAR/SLIM-JIM, A PAIR OF WIRE CLIPPERS/STRIPPERS/THEIR TEETH AND THEIR HAND AND FINGERS*)
Too slow. A body pull tool pops the key mechanism out of the dash/column and exposes the wires.
Re: (Score:3, Insightful)
Because 10 years ago that's as good as it got. We moved on. Now the insurance companies are saying "This is fucking stupid. Fix it or we won't pay for your idiotic keyless thingamabob. Cmon guys, we fixed keys years ago. If you can't do better, don't bother"
Re: (Score:2)
Because there was very little choice for the insurance companies. Because ALL cars could be stolen like that.
But, unlike with the problems of the old days, there is a tool that can easily remedy the problem of the keyless car. It's called a key.
slim jim = stolen CDs. Hot wiring much harder (Score:4, Informative)
Opening a car door is easy enough. That way the thief can steal your CDs. Hot wiring a modern car to steal the entire automobile is quite a bit more difficult. I've opened a lot of car doors. I've never started the ignition without a key on anything newer than 1980s, when you could just pull the lock cylinder with a sufficiently strong tool, then turn the switch with a screwdriver.
Re: (Score:2)
That is one thing I've always wanted the time and equipment to muck around with. Its all security through obscurity since at the end of the day it comes down to a single bit saying whether the car can start or not. Change that bit and all the rest of the security vanishes. Just like hotwiring a older car means the key as a security mechanism.
It might be difficult to get to that bit without half dismantling the car, but it would be interesting to tinker with nevertheless.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You must either use the key, or enter the PIN on the keypad.
Re: (Score:2)
#1: Basic insurance is required to drive your vehicle on public roads.
All you need to legally drive your vehicle on the road is third party liability insurance. You do not need coverage against fire and theft and you do not need coverage against damage you cause to yourself and your own vehicle.
#2: Insurers can refuse to insure some vehicles, or set the price such that no one is going to try to insure it anyway.
They can but there are a lot of insurers out there. If a rational risk analysis says there is money to be made then it's likely someone will insure it. At least the freely accessible bits of TFA don't make it clear if he was denies third party insurance or only denied insurance policie
Re: (Score:3)
Re: (Score:2)
There tend to be three levels you can buy in the UK. The least common is 'Third party only', which only covers your liabilities to other people. Next you get 'Third party fire and theft', which does what you'd expect. Last is fully comprehensive which covers everything including making good your losses even if there's no third party to pay out.