Using RTL-SDR to Open Car Doors (2016)

Post by netsharc » Sat, May 13, 2017, 7:13 AM UTC

weinzierl wrote: post #17

xgbi wrote: post #11

So, what is the solution? Implementing a PKI over between the key and the car? This would be quite nice, wouldn't it? -Key asks car to unlock and sends public key for recognition, -Car sends challenge encrypted with key Public key -Key sends back private-key-encrypted challenge Bing, authenticated.

This would prevent the attack but would be difficult to implement for existing car models. The car most probably lacks the hardware to send at 315 MHz. Not that the key had the ability to receive either, but that means that you'd not only have to replace the key fobs but do a full recall campaign with new hardware in the car.

Post by IshKebab » Sun, May 14, 2017, 1:48 PM UTC

ethbro wrote: post #37

IshKebab wrote: post #21

Earlier quoted context omitted.

You don't need PKI for this - the car and the key have pre-shared keys. All you need is to include a counter in the signal that is incremented for each button press. The car remembers the last counter value it receives and ignores any before that. Obviously the counter needs to be encrypted in some way but it's not exactly difficult. I'm kind of amazed this still happens in 2016. Or maybe it doesn't. The cars could b…

Assume you're getting downvoted instead of commented on because, as above poster pointed out, the weak point is the counter in any one-way scheme. Specifically when the car doesn't see a fob press but the fob is pressed (e.g. out of range / blocked). Thus, you have a broken keyfob if you ever press it outside the car's range (or require a "re-pairing" handshake to resynchronize the counters). Infeasible due to terrib…