BMW, Audi and Toyota cars can be unlocked and started with hacked radios

Post by pandaman » Thu, Mar 24, 2016, 6:55 AM UTC

mcpherrinm wrote: post #33

xenadu02 wrote: post #18

Earlier quoted context omitted.

Lots of ways. The ECU only goes into pairing mode if it gets a valid challenge-response from the manufacturer. If put into that mode, it provides a nonce encrypted with its own pairing mode public key that only the manufacturer knows (could even base-64 encode it and show it on screen to let people do this over the phone). You could make it two-phase where it requires the first response within 5 minutes of starting,…

That doesn't fix this exploit at all: This is merely an analog device amplifying other radio waves. The only way to secure against the described exploit is to measure round-trip-time from the car -> key -> car and ensure it's under, say 5 light-meters: aka 16 nanoseconds, plus the carefully calibrated time it takes the key to compute its response. 16 nanos is a very short amount of time, and it'll be tricky to measur…

Post by qrybam » Thu, Mar 24, 2016, 7:07 AM UTC

zurn wrote: post #40

This seems the obvious threat model when thinking about a "no action requred" wireless token, same thing as contactless payments and RFID passports etc. To be secure against this type of attack, such a device has to be designed assuming the adversary controls the nearby radio spectrum and can do relaying and MITM. To control for distance, a speed of light based latency limit might work, though I don't know how cheapl…

Post by kobayashi » Thu, Mar 24, 2016, 7:12 AM UTC

fernly wrote: post #13

This was covered in depth on the Security Now podcast in May 2015 (Transcript [1]). The Passive Keyless Entry and Start PKES system relies on the assumption that if the car can "hear" the key, the key is in close proximity. Normally that's true but it is technically trivial to build a radio system that picks up and amplifies the car's continuous "ping" transmissions. So the key, which might be in your pocket in a res…

Post by beachstartup » Thu, Mar 24, 2016, 7:25 AM UTC

agumonkey wrote: post #11

superuser2 wrote: post #9

Earlier quoted context omitted.

In the "Win" column for digitally-secured systems, the electronic immobilizer basically eliminated auto theft. The cars that are still stolen in significant numbers are the last model-years to not have immobilizers. Car door locks are immaterial anyway, since any thief is just going to break a window. The immobilizer matters, certainly, but even an immobilizer vulnerable to sophisticated attackers is doing two orders…

This article reminds me that I thought old busted stuff were less likely to be stolen. That's why I was pretty confident my very low grade, rusty, ugly single-pedal [1] bike would be safe for a day. Some guys proved me wrong, ripped my far too weak cable locks and did whatever they wanted with what was valuable of that bike (5$ for the metal frame ? the rest was plastic). [1] wear made left pedal unscrew itself over…

Post by csours » Thu, Mar 24, 2016, 7:31 AM UTC

pandaman wrote: post #42

mcpherrinm wrote: post #33

Earlier quoted context omitted.

That doesn't fix this exploit at all: This is merely an analog device amplifying other radio waves. The only way to secure against the described exploit is to measure round-trip-time from the car -> key -> car and ensure it's under, say 5 light-meters: aka 16 nanoseconds, plus the carefully calibrated time it takes the key to compute its response. 16 nanos is a very short amount of time, and it'll be tricky to measur…

My car seems to be able to tell if the key is inside or outside pretty accurately so I think it can already figure out the distance to the key (though might be using something like RFID for that, which is not very secure).