Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BMW, Audi and Toyota cars can be unlocked and started with hacked radios

telegraph.co.uk

Post reply on HN
Print view View original

21–30 of 118 posts

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#21

Post by hellbanner »

agumonkey wrote: post #11
superuser2 wrote: post #9

Earlier quoted context omitted.

In the "Win" column for digitally-secured systems, the electronic immobilizer basically eliminated auto theft. The cars that are still stolen in significant numbers are the last model-years to not have immobilizers. Car door locks are immaterial anyway, since any thief is just going to break a window. The immobilizer matters, certainly, but even an immobilizer vulnerable to sophisticated attackers is doing two orders…

This article reminds me that I thought old busted stuff were less likely to be stolen. That's why I was pretty confident my very low grade, rusty, ugly single-pedal [1] bike would be safe for a day. Some guys proved me wrong, ripped my far too weak cable locks and did whatever they wanted with what was valuable of that bike (5$ for the metal frame ? the rest was plastic). [1] wear made left pedal unscrew itself over…

Sorry to hear that. Reminds me of a "best of craiglist" post where a "free washing machine" was left untouched for weeks.. but as soon as a price went on it, it was stolen that evening.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#22

Post by majormajor »

bcook wrote: post #14
majormajor wrote: post #7

Earlier quoted context omitted.

It's worth noting that non-digitally-secured cars (pre chip-in-the-key tech) provided very little security themselves. Slim jims, hotwiring... The wireless bit does seem like a big regression over non-wired digital security, though.

Speaking from experience (locksmith), you cannot download the skills required to use a slim jim. Well, you kinda can, being that there are books/catalogs that show you where the lock's internal mechanism is, but being able to manipulate it requires more than simply pressing "exploit car radio".

I never had much problem breaking into my old 80s Toyota truck with a clothes hanger back when I was a new driver who would occasionally lock himself out of his car, but valid point - I know 90s cars especially made it a lot harder.

Window smashing is still an option, though!

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#23

Post by agumonkey »

hellbanner wrote: post #21
agumonkey wrote: post #11

Earlier quoted context omitted.

This article reminds me that I thought old busted stuff were less likely to be stolen. That's why I was pretty confident my very low grade, rusty, ugly single-pedal [1] bike would be safe for a day. Some guys proved me wrong, ripped my far too weak cable locks and did whatever they wanted with what was valuable of that bike (5$ for the metal frame ? the rest was plastic). [1] wear made left pedal unscrew itself over…

Sorry to hear that. Reminds me of a "best of craiglist" post where a "free washing machine" was left untouched for weeks.. but as soon as a price went on it, it was stolen that evening.

Harsh reality : cable locks below 4cm diameters are useless (only useful for young kids I guess). Even fat 2kg cable lock are useless, anyone can rob a bike in a street, the bolder the easier.

I'm still waiting for a cheap bike gps 'self powered' tagger so I can use a bike again.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#24

Post by mappu »

rashkov wrote: post #15
sebular wrote: post #5

Not my BMW, it's 25 years old and the driver's side door doesn't unlock even if you use a key :P All jokes aside (although it's true about my car), it just seems like a fundamental truth that digitally-secured systems always provide convenience at the cost of, well, security.

Cool. What's it like having a 25 year old car? Why'd you choose to stick with it as opposed to getting something newer?

My car is about 20 years old. In my country it's far more normal to buy a cheap car outright (say 2.5k USD) rather than get a lease or a loan for a new car (say 25k USD).

There's nothing wrong with it, i'm not sure why i'd want a newer one.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#25

Post by nikatwork »

agumonkey wrote: post #23
hellbanner wrote: post #21

Earlier quoted context omitted.

Sorry to hear that. Reminds me of a "best of craiglist" post where a "free washing machine" was left untouched for weeks.. but as soon as a price went on it, it was stolen that evening.

Harsh reality : cable locks below 4cm diameters are useless (only useful for young kids I guess). Even fat 2kg cable lock are useless, anyone can rob a bike in a street, the bolder the easier. I'm still waiting for a cheap bike gps 'self powered' tagger so I can use a bike again.

I've always wanted to build a spring loaded 30cm titanium spike that would shoot from the seat pole through the seat if not disarmed. Obviously completely illegal, but a satisfying mental exercise.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#27

Post by TwoBit »

ratsbane wrote: post #26

A lot of models were not mentioned in that list: Audi A8, any Mercedes, etc. I wonder if they just weren't tested or if the hack doesn't work with them. (And if that's the case, what is different about those models?)

almost certainly those models are affected too. The Audi A7 wasn't listed, but it's 90% the same as the A6.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#28

Post by kileywm »

proksoup wrote: post #6
pmille5 wrote: post #3

The auto manufacturers (and for that matter all the "IoT" creators) couldn't give two shits about protecting consumers. Building security into this stuff is trivial and a responsibility.

Could you say more about those things they should be doing? I'm naive but it doesn't seem trivial to me.

The car could log the signal strength of all successful auth attempts from the key fob and determine an acceptable range. Anything outside of the acceptable range could then require use of the mechanical key (for those fobs where the mechanical key is built in) as a precaution.

Fobs could require a 'wake up' key press after a certain duration of inactivity.

Fobs could have a physical switch on them, enabling an airplane mode.

These ideas all give up some manner of ease-of-use.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#29

Post by TwoBit »

big_al337 wrote: post #12
pmille5 wrote: post #3

The auto manufacturers (and for that matter all the "IoT" creators) couldn't give two shits about protecting consumers. Building security into this stuff is trivial and a responsibility.

How would you prevent this type of attack while retaining the keyless start and entry feature? (just curious)

The simplest defeat is to require the key ping round trip to complete in N microseconds, where N is sufficiently low. Researchers have demostrated that this is a practical solution.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#30

Post by thisrod »

I've never used this type of key, and I don't known if I would have noticed the flaw. But, um, nineteen different manufacturers gave drivers devices that try their best to unlock the car every minute of every day, and not one engineer asked what could possibly go wrong?
Post reply on HN