Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why do we still have replay attacks on our cars?

news.ycombinator.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Ask HN: Why do we still have replay attacks on our cars?

#21

Post by rit »

giantg2 wrote: post #19
nikau wrote: post #14

Earlier quoted context omitted.

Because people value walking up to the car and just opening it vs finding the fob in their pocket and pressing a button, and that convenience outweighs the small risk their car gets stolen which is replaced anyway via insurance.

Part of why insurance is so expensive is the mindset that insurance will just cover everything, leading to a lack of vigilance by some.

In point of fact, Insurance companies have been refusing to cover some of these Kia and Hyundai cars because they're "too easy to steal". The lack of immobilizer chip apparently is the culprit.

https://www.cnn.com/2023/01/27/business/progressive-state-fa...

Re: Ask HN: Why do we still have replay attacks on our cars?

#22

Post by badpun »

rit wrote: post #21
giantg2 wrote: post #19

Earlier quoted context omitted.

Part of why insurance is so expensive is the mindset that insurance will just cover everything, leading to a lack of vigilance by some.

In point of fact, Insurance companies have been refusing to cover some of these Kia and Hyundai cars because they're "too easy to steal". The lack of immobilizer chip apparently is the culprit. https://www.cnn.com/2023/01/27/business/progressive-state-fa...

Yep, in my country (Poland), a couple years ago, the yearly insurance premium for some new models of Mazdas were reaching 25% value of the car. They were that easy to steal.

Re: Ask HN: Why do we still have replay attacks on our cars?

#23

Post by qmsdfjkc »

giantg2 wrote: post #20
qmsdfjkc wrote: post #5

Earlier quoted context omitted.

Actually the said car has a continuous internet connection, using a sim card, so I guess syncing time wouldn't be that difficult. Also I remember some Renault Espace in France which had a dongle but then you had to put it somewhere specifically in the car to start it. Adding an NFC/RFID chip could solve part of the problem maybe... But yes you are right this require maintenance.

If you had to put it somewhere specific, why not just put a key in an ignition?

Oh I don't know, it looked futuristic maybe? No idea

Re: Ask HN: Why do we still have replay attacks on our cars?

#24

Post by waste_monk »

rit wrote: post #21
giantg2 wrote: post #19

Earlier quoted context omitted.

Part of why insurance is so expensive is the mindset that insurance will just cover everything, leading to a lack of vigilance by some.

In point of fact, Insurance companies have been refusing to cover some of these Kia and Hyundai cars because they're "too easy to steal". The lack of immobilizer chip apparently is the culprit. https://www.cnn.com/2023/01/27/business/progressive-state-fa...

I cannot believe that modern (consumer) cars are being sold without an immobiliser.

Down here in Australia it's been a legal requirement since 2001 that vehicles be sold fitted with immobilisers, and our versions of the Kia and Hyundai models mentioned in the article you link to are not vulnerable to this attack.

The engineering work is already done, it is pure greed on the part of the manufacturer to leave it out.

Re: Ask HN: Why do we still have replay attacks on our cars?

#25

Post by Guest9081239812 »

nikau wrote: post #14
badpun wrote: post #13

Earlier quoted context omitted.

Why don't the producers just add a physical button you have to press in order to open the car? It sounds like much less hassle than remembering to store your keys in a proper container always. It looks like it's just marketed to lazy and uninformed people.

Because people value walking up to the car and just opening it vs finding the fob in their pocket and pressing a button, and that convenience outweighs the small risk their car gets stolen which is replaced anyway via insurance.

Why not just require motion from the key in the past 30 seconds for it to be active? If I'm walking to my car, the key is bouncing around in my pocket, so make it active. When it's sitting in a drawer in my house, it's not moving, so make it inactive.

Re: Ask HN: Why do we still have replay attacks on our cars?

#26

Post by deafpolygon »

qmsdfjkc wrote: post #16
deafpolygon wrote: post #6

Insurance.

I don't see really how insurance would profit from that. Now they have to give me the value of the car in money

It's not about insurance profiting from it. Carmakers are able to pass off certain things like this due consumers having more or less mandatory insurance on this.

Why do we lock our doors when it's proven doors don't stop thieves (putting aside the fact that locking does prevent people from just simply walking away)? Why haven't we improved our security systems? Because people will still buy homes, and insurance covers loss and damage in case of theft.

Without that, we would demand houses that are harder to break into. So it is for cars.

Re: Ask HN: Why do we still have replay attacks on our cars?

#27

Post by pajko »

nikau wrote: post #12
badpun wrote: post #11

I thought these attacks work on a much lower layer - by adding a repeater, which is essentially extending the range of your fob? I.e. they just pass the radio signals back and forth, without analysing their content at all. Can anyone confirm/deny?

Yes likely a relay attack, best way to mitigate is to store keys in a RF blocking container.

Worse. https://www.bleepingcomputer.com/news/security/hyundai-app-b...
Post reply on HN