I thought these attacks work on a much lower layer - by adding a repeater, which is essentially extending the range of your fob? I.e. they just pass the radio signals back and forth, without analysing their content at all. Can anyone confirm/deny?
Ask HN: Why do we still have replay attacks on our cars?
11–20 of 27 posts
Re: Ask HN: Why do we still have replay attacks on our cars?
#12I thought these attacks work on a much lower layer - by adding a repeater, which is essentially extending the range of your fob? I.e. they just pass the radio signals back and forth, without analysing their content at all. Can anyone confirm/deny?
Yes likely a relay attack, best way to mitigate is to store keys in a RF blocking container.
Re: Ask HN: Why do we still have replay attacks on our cars?
#13I thought these attacks work on a much lower layer - by adding a repeater, which is essentially extending the range of your fob? I.e. they just pass the radio signals back and forth, without analysing their content at all. Can anyone confirm/deny?
Yes likely a relay attack, best way to mitigate is to store keys in a RF blocking container.
Why don't the producers just add a physical button you have to press in order to open the car? It sounds like much less hassle than remembering to store your keys in a proper container always. It looks like it's just marketed to lazy and uninformed people.
Re: Ask HN: Why do we still have replay attacks on our cars?
#14Earlier quoted context omitted.
Yes likely a relay attack, best way to mitigate is to store keys in a RF blocking container.
Why don't the producers just add a physical button you have to press in order to open the car? It sounds like much less hassle than remembering to store your keys in a proper container always. It looks like it's just marketed to lazy and uninformed people.
Because people value walking up to the car and just opening it vs finding the fob in their pocket and pressing a button, and that convenience outweighs the small risk their car gets stolen which is replaced anyway via insurance.
Re: Ask HN: Why do we still have replay attacks on our cars?
#15I'm confused. I thought normal replay attacks are solved and the issue here is more to do to forward they key range close to the car to simulate the car.key being close. That's what I can't easily just solve if not needing a button on the key which defeats the purpose of the said feature
OH that's clever ! It is probably what they did to start the car and then leave.
Re: Ask HN: Why do we still have replay attacks on our cars?
#16Insurance.
I don't see really how insurance would profit from that. Now they have to give me the value of the car in money
Re: Ask HN: Why do we still have replay attacks on our cars?
#17What incentives do automakers have to provide you with a secure product? "Old-school" key ignitions work perfectly fine, so why were they replaced with the obviously-flawed dongle? How complex would a device have to be to not be trivially defeated by a replay attack? How do you get both ends to reliably communicate without requiring an always-on internet connection in both the dongle and the vehicle to sync timing or…
> Old-school" key ignitions work perfectly fine, so why were they replaced with the obviously-flawed dongle?
It's more convenient to leave your keys in your pocket or your bag, then to rummage around for them.
There's a terminology problem here. I don't believe this is a replay attack (same open command is replayed later and works), those are largely solved with rolling codes. This is most likely a relay attack, the distance from the car to the key is bridged with a repeater. That's harder to solve --- you could measure distance by round trip time, rather than by limiting tx power, but the distances in question are small, and the timing difference between keys at car door and keys at house door isn't very much. Probably the crypto takes longer and may vary more than the difference in transmission time.
Re: Ask HN: Why do we still have replay attacks on our cars?
#18I don't have to worry about this.
My car is cheap and doesn't have a wireless key.
Re: Ask HN: Why do we still have replay attacks on our cars?
#19Earlier quoted context omitted.
Why don't the producers just add a physical button you have to press in order to open the car? It sounds like much less hassle than remembering to store your keys in a proper container always. It looks like it's just marketed to lazy and uninformed people.
Because people value walking up to the car and just opening it vs finding the fob in their pocket and pressing a button, and that convenience outweighs the small risk their car gets stolen which is replaced anyway via insurance.
Part of why insurance is so expensive is the mindset that insurance will just cover everything, leading to a lack of vigilance by some.
Re: Ask HN: Why do we still have replay attacks on our cars?
#20What incentives do automakers have to provide you with a secure product? "Old-school" key ignitions work perfectly fine, so why were they replaced with the obviously-flawed dongle? How complex would a device have to be to not be trivially defeated by a replay attack? How do you get both ends to reliably communicate without requiring an always-on internet connection in both the dongle and the vehicle to sync timing or…
Actually the said car has a continuous internet connection, using a sim card, so I guess syncing time wouldn't be that difficult. Also I remember some Renault Espace in France which had a dongle but then you had to put it somewhere specifically in the car to start it. Adding an NFC/RFID chip could solve part of the problem maybe... But yes you are right this require maintenance.
If you had to put it somewhere specific, why not just put a key in an ignition?