Can you listen for the communication and play it back... range maybe. Put a sticker under the car door handle haha
Using RTL-SDR to Open Car Doors (2016)
41–50 of 53 posts
Re: Using RTL-SDR to Open Car Doors (2016)
#42Earlier quoted context omitted.
I wonder if there is any (even theoretical) authentication method that works with a one way communication channel and is not vulnerable to the attack described? Or maybe a proof that it isn't possible?
One thing that you can do with one way channel is to not use counter, but timestamp or preferably both at once. In this context it would require the keyfob to have reasonably accurate RTC which will certainly have some effect on battery life (which might be acceptable tradeoff given the fact that the CR2032 battery in VW's keyfobs seems to outlive the mechanical integrity of the receiver antenna on the car side). It'…
I don't think there's any reason to rely on a one-way channel. If the keyfob is in range to transmit, then it is definitely in range to receive (due to reciprocity); plus the car has a lot more electricity to spare.
There is fundamentally no reason why there can't be full authenticated PKI for keyfobs. It certainly isn't going to happen as part of a recall of current models, though.
Re: Using RTL-SDR to Open Car Doors (2016)
#43Does anyone know a good alternative for HDSDR for Linux?
I love GQRX. Use it a lot.
Re: Using RTL-SDR to Open Car Doors (2016)
#44Earlier quoted context omitted.
A simpler solution is that the car should not accept a "skipped over" code. This attacks works by jamming code A and storing it for later use. The car owner assumes a signal loss and clicks again, opening their car with code B. If the car knows to reject code B in the future, why can't it also know to reject code A?
This would break if you once press unlock while out of range of the car, unless you have some way to reset the counter - in which case you start creating complex stuff to handle complex situations.
Not necessarily. The car could accept future codes, but not an older one. Assume codes A through Z, you've used A, B, and C, then when out of range of the vehicle you send codes D and E (Or these are jammed and stored for later use). That afternoon, you return to your car and issue code F, now codes D and E are no longer accepted (Until you get so far down the line that looping becomes a concern)
Re: Using RTL-SDR to Open Car Doors (2016)
#45So, what is the solution? Implementing a PKI over between the key and the car? This would be quite nice, wouldn't it? -Key asks car to unlock and sends public key for recognition, -Car sends challenge encrypted with key Public key -Key sends back private-key-encrypted challenge Bing, authenticated.
I'd rather have to push a button on the key-fob then on the car...
Re: Using RTL-SDR to Open Car Doors (2016)
#46Hey author here, I have since removed the core information but left all the mechanisms to carry out the attack still. If anyone is interesting or have any questions I'll be here and Twitter.com/tech
There is no need to remove the info. We can talk about jammers in the USA. Here: cut a hole in the door of a microwave oven. That's a jammer.
Re: Using RTL-SDR to Open Car Doors (2016)
#47Hey author here, I have since removed the core information but left all the mechanisms to carry out the attack still. If anyone is interesting or have any questions I'll be here and Twitter.com/tech
There is no need to remove the info. We can talk about jammers in the USA. Here: cut a hole in the door of a microwave oven. That's a jammer.
Enjoy your subsequent trips to the oncologist.
Re: Using RTL-SDR to Open Car Doors (2016)
#48So, what is the solution? Implementing a PKI over between the key and the car? This would be quite nice, wouldn't it? -Key asks car to unlock and sends public key for recognition, -Car sends challenge encrypted with key Public key -Key sends back private-key-encrypted challenge Bing, authenticated.
A physical key ;) like we used to have.
This is vulnerable to high-resolution photograph and reproduction from that. Really it is a very analagous vulnerability to the one discussed in the article : an attacker in close proximity can get a good enough look at the key's secret to reproduce it.
Re: Using RTL-SDR to Open Car Doors (2016)
#49So, what is the solution? Implementing a PKI over between the key and the car? This would be quite nice, wouldn't it? -Key asks car to unlock and sends public key for recognition, -Car sends challenge encrypted with key Public key -Key sends back private-key-encrypted challenge Bing, authenticated.
This would prevent the attack but would be difficult to implement for existing car models. The car most probably lacks the hardware to send at 315 MHz. Not that the key had the ability to receive either, but that means that you'd not only have to replace the key fobs but do a full recall campaign with new hardware in the car.
Speaking of the car, it has a receiver scanning that band, it should just detect that there's a jamming signal, and somehow prompt the driver to use the physical key to get in. Do modern cars still have physical keys?
Re: Using RTL-SDR to Open Car Doors (2016)
#50So, what is the solution? Implementing a PKI over between the key and the car? This would be quite nice, wouldn't it? -Key asks car to unlock and sends public key for recognition, -Car sends challenge encrypted with key Public key -Key sends back private-key-encrypted challenge Bing, authenticated.
This would prevent the attack but would be difficult to implement for existing car models. The car most probably lacks the hardware to send at 315 MHz. Not that the key had the ability to receive either, but that means that you'd not only have to replace the key fobs but do a full recall campaign with new hardware in the car.
Speaking of the car, it has a receiver scanning that band, it should just detect that there's a jamming signal, and somehow prompt the driver to use the physical key to get in. Do modern cars still have physical keys?