Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BMW, Audi and Toyota cars can be unlocked and started with hacked radios

telegraph.co.uk

Post reply on HN
Print view View original

51–60 of 118 posts

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#51

Post by anon4 »

agumonkey wrote: post #23
hellbanner wrote: post #21

Earlier quoted context omitted.

Sorry to hear that. Reminds me of a "best of craiglist" post where a "free washing machine" was left untouched for weeks.. but as soon as a price went on it, it was stolen that evening.

Harsh reality : cable locks below 4cm diameters are useless (only useful for young kids I guess). Even fat 2kg cable lock are useless, anyone can rob a bike in a street, the bolder the easier. I'm still waiting for a cheap bike gps 'self powered' tagger so I can use a bike again.

Or do what the Japanese do: every bike has a serial number etched into the frame and is registered to you (similar to a car). If your bike is ever stolen, the police can trivially find it by the serial number and return it.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#52

Post by MertsA »

mcpherrinm wrote: post #33
xenadu02 wrote: post #18

Earlier quoted context omitted.

Lots of ways. The ECU only goes into pairing mode if it gets a valid challenge-response from the manufacturer. If put into that mode, it provides a nonce encrypted with its own pairing mode public key that only the manufacturer knows (could even base-64 encode it and show it on screen to let people do this over the phone). You could make it two-phase where it requires the first response within 5 minutes of starting,…

That doesn't fix this exploit at all: This is merely an analog device amplifying other radio waves. The only way to secure against the described exploit is to measure round-trip-time from the car -> key -> car and ensure it's under, say 5 light-meters: aka 16 nanoseconds, plus the carefully calibrated time it takes the key to compute its response. 16 nanos is a very short amount of time, and it'll be tricky to measur…

>perhaps moving it around (as would happen as you walked with it in your pocket).

One attack vector is stealing cars out of a supermarket parking lot. You just wait for someone to drive up in the model car of your choice and have your accomplice discreetly follow them into the store. When your accomplice texts you that they are at the bread aisle/back of the store you can just steal with impunity knowing that a bystander will see no difference between the actual owner who has the key in his pocket and you with your relay device in your pocket. You also know that your victim is in the back of the store and that they can't get within sight of you before you're already long gone.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#53

Post by bcook »

XorNot wrote: post #47
bcook wrote: post #14

Earlier quoted context omitted.

Speaking from experience (locksmith), you cannot download the skills required to use a slim jim. Well, you kinda can, being that there are books/catalogs that show you where the lock's internal mechanism is, but being able to manipulate it requires more than simply pressing "exploit car radio".

You also can't download antennas, SDR hardware or a partner to run the other side of the wireless theft operation.

My critique was regarding tools vs skills.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#54

Post by jakub_g »

Pardon my ignorance: so how those key fobs work? They have no buttons and the car is automatically opening/closing itself based just on the proximity? That would mean I can not have my car closed when I am drinking beer in a garden over the street, which would be totally nuts, so I guess it's not how they work?

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#55

Post by nikatwork »

mirimir wrote: post #34
nikatwork wrote: post #25

Earlier quoted context omitted.

I've always wanted to build a spring loaded 30cm titanium spike that would shoot from the seat pole through the seat if not disarmed. Obviously completely illegal, but a satisfying mental exercise.

"this bike is a pipe bomb" https://farm4.static.flickr.com/3277/3011586006_42403e0788.j... It was a folkie punk band ;) With that promotional sticker. I had one, but didn't put it on my bike.

In most first world countries that sticker would just get your bike taken by the police instead of a thief.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#56

Post by edelans »

jakub_g wrote: post #54

Pardon my ignorance: so how those key fobs work? They have no buttons and the car is automatically opening/closing itself based just on the proximity? That would mean I can not have my car closed when I am drinking beer in a garden over the street, which would be totally nuts, so I guess it's not how they work?

I guess they just inverted the concept of the remote control key.

Remote control key : you push a button on your key (the transmitter), it sends a signal to a receiver in your car, your car authenticates the key (probably a request/response challenge involving some crypto), and opens the door.

Now if you swap the transmitter and the receiver : you put the transmitter button in your car door's handle, and you move the receiver to your key: you have your magic key fob.

From what I understand, the security relies on the fact that the power of the radio signals emitted by the transmitter and receiver are very low, so the range of usage is limited to a few meters. The thiefs and researchers exploited this by amplifing the radio signals of both communicating devices to extend the range up to 90+ meters.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#57

Post by Shivetya »

majormajor wrote: post #7
sebular wrote: post #5

Not my BMW, it's 25 years old and the driver's side door doesn't unlock even if you use a key :P All jokes aside (although it's true about my car), it just seems like a fundamental truth that digitally-secured systems always provide convenience at the cost of, well, security.

It's worth noting that non-digitally-secured cars (pre chip-in-the-key tech) provided very little security themselves. Slim jims, hotwiring... The wireless bit does seem like a big regression over non-wired digital security, though.

Not only this but many cars of the same make had very little variation in their keys meaning that on a dealer lot or even a very busy mall there was a chance you could unlock or start; rarely both; a car other than your own.

Personally I had seen this twice in action. First was back in the early nineties I could unlock my friends Escort GT with my key and he could unlock my EXP. Neither could start it. Now my Aunt and Uncle had a Ford Windstar and Mercury Sable. The Sable key could start the Windstar but not unlock it. My Aunt found this out the hard way after a trip to the store where she could not get back in the car.

Now my BMW motorcycle uses a keyless ignition but you have to stand so close that I am not sure how well the hack will work. As in close I mean nearly rubbing up to it and only from the left side, from the right if they key is in the pocket away from the bike it won't recognize. There is an emergency key which is an little plastic type that has no power of its own, you can start the bike provided you find that magical point near the dash it actually works; by that I mean it took me and the dealer five minutes to get it to work

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#58

Post by edelans »

thisrod wrote: post #30

I've never used this type of key, and I don't known if I would have noticed the flaw. But, um, nineteen different manufacturers gave drivers devices that try their best to unlock the car every minute of every day, and not one engineer asked what could possibly go wrong?

I guess things like this just happen. How many people where involved in using and testing something as critical as openSSL ? Still, heartbleed was discovered more than 2 years after the flawed code landed in production !

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#59

Post by TheSpiceIsLife »

mappu wrote: post #24
rashkov wrote: post #15

Earlier quoted context omitted.

Cool. What's it like having a 25 year old car? Why'd you choose to stick with it as opposed to getting something newer?

My car is about 20 years old. In my country it's far more normal to buy a cheap car outright (say 2.5k USD) rather than get a lease or a loan for a new car (say 25k USD). There's nothing wrong with it, i'm not sure why i'd want a newer one.

Hi from cross the Tasman! My daily driver is a 1988 Mazda 323 hatchback. It cost me $900 and had just had the autotrans reconditioned and a new radiator before I bought it. I recently put new front break pads in and will do the rear breaks shortly.

For my own personal, and endless, amusement: I paid more for my phone than I did my car.

Re: BMW, Audi and Toyota cars can be unlocked and started with hacked radios

#60

Post by andreamazz »

Qantourisc wrote: post #35

"How can I protect my car?" Some keys have a "sleep" mode. For Toyota: hold down the lock key, press the unlock key twice, the key should blink 2 times, short pause, 2 times (total of 4 blinks).

This kinda defeats the convenience of this kind of key free systems though.
Post reply on HN