Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves boosting signal from key fobs inside homes to steal vehicles

cbc.ca

Post reply on HN
Print view View original

61–70 of 449 posts

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#61

Post by cjjuice »

wsh wrote: post #46
snarfy wrote: post #6

> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. Why is it transmitting without the user pressing a button? Is that a feature? As you walk up to the car it automatically starts like magic? I'm not familiar with these newer cars.

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car. In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed. The reply sign…

Is there any type of encryption between the car and the key? Or are the signals always constant?

Could you just record the relay signal and play it back whenever, essentially replicating the key?

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#62

Post by Reason077 »

snarfy wrote: post #6

> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. Why is it transmitting without the user pressing a button? Is that a feature? As you walk up to the car it automatically starts like magic? I'm not familiar with these newer cars.

It doesn’t start automatically, but unlocks automatically as you approach the car. Tesla Model X even opens the door for you.

Newer vehicles are already mitigating this attack, eg by measuring signal timings. Signal relay introduces a delay which can be identified and rejected.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#63

Post by Tade0 »

hkai wrote: post #29
Tade0 wrote: post #24

It's useful to note that less sophisticated methods still work as well. I used to lease a 2015 Toyota Auris(facelift). One year into the lease someone broke into it smashing the rear-left window and just drove away.

Curious how they started it?

Probably via some trick that put the car into service mode. There's a gang in Warsaw that specialises in Toyota's.

I know late 2000s Rav4s could be stolen by thrusting a wire through the left-front mudguard and disconnecting something(not sure what) inside this way. There's a clip of a Russian demonstrating this technique somewhere on youtube.

All I found was shattered glass from the window.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#65

Post by mysterydip »

sofaofthedamned wrote: post #10
Down_n_Out wrote: post #3

Nothing new, has been going on for a while now. Market is already providing your own "cage of Faraday[0]" for your fob. [0] https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3A...

Yeah this has been a thing for years in the UK. Myself and my wife put our keys into a metal lunch box in the hallway which mitigates this problem, which was prompted by both next door neighbours getting their cars broken into.

Top Gear did a thing on this during their one road trip: https://youtu.be/-aU09WT5rXg fast forward to the 3 minute mark

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#66

Post by balabaster »

logfromblammo wrote: post #30
fabricexpert wrote: post #18

Earlier quoted context omitted.

2fa on a car would be a disaster. I can't wait to whip out my phone in the pouring rain, trying to unlock it while my hands are full and I have no signal.

Something you have: keyless fob. Something you know: numeric unlock code. Unlocking the doors could be 1FA, but moving the vehicle should require 2FA.

I used to have a numeric lock immobilizer on 3 vehicles starting way back in the early 90s. You had to dial in a 4-6 digit PIN code on a pin pad in the vehicle in order to enable the ignition. You'd need to rip the whole dash apart to enable the ignition to bypass it.

Were these types of immobilizers never a thing here?

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#67

Post by W-_-D »

cjjuice wrote: post #61
wsh wrote: post #46

Earlier quoted context omitted.

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car. In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed. The reply sign…

Is there any type of encryption between the car and the key? Or are the signals always constant? Could you just record the relay signal and play it back whenever, essentially replicating the key?

I believe a nonce is used to prevent replay attacks, but wouldn't be surprised if there are some fobs out there which are vulnerable to replay.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#68

Post by Reason077 »

cjjuice wrote: post #61
wsh wrote: post #46

Earlier quoted context omitted.

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car. In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed. The reply sign…

Is there any type of encryption between the car and the key? Or are the signals always constant? Could you just record the relay signal and play it back whenever, essentially replicating the key?

It uses a challenge-response protocol, so you can’t simply record the signal and play it back.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#69

Post by [deleted] »

cjjuice wrote: post #61
wsh wrote: post #46

Earlier quoted context omitted.

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car. In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed. The reply sign…

Is there any type of encryption between the car and the key? Or are the signals always constant? Could you just record the relay signal and play it back whenever, essentially replicating the key?

[deleted]
Post reply on HN