191–200 of 449 posts
Earlier quoted context omitted.
What vehicle do you have?
Mine too! But only because the battery on my fob died and I am too poor now to replace it. Frankly I kinda like it that way, it makes me more conscious or the damn fob (I used to just drop it anywhere in the car).I have a Tucson 2011 FWIW
Earlier quoted context omitted.
Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
No, it is not reasonable for the car to stop suddenly without the key. Even if it stops by going into an emergency limp mode, this could seriously endanger the occupants by leaving them in a dangerous traffic situation, a dangerous location, or with other issues. This is why every car company has examined it and chosen to not do it. This feature actually saved huge inconvenience for us once. While visiting the other…
> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. It's a poor design for the system to take any access-escalating action without an explicit command from the user that initiates a secured transaction that is resistant to MITM. It's poor design to assume that the range is based on raw signal…
Requiring user iniciation seems like the adequate solution here...
I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.
A simple on/off button on the fob would work, and probably extend the battery life by a few years.
As well as taking away much of the convenience advantage that passive fobs have over active-only fobs (most fobs already can be actively used, as well as passively.)
Earlier quoted context omitted.
My Tesla requires a pin to drive like a phone
That was rolled out in a recent update, right? I think the over-the-air updates is one of the big advantages that Tesla has right now. They can respond quickly to critical vulnerabilities like that. I wonder how fast other car manufacturers are going to catch up? Volvo recently announced that they are working on an Android based system, but it's not going to be rolled out before 2020.
> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. It's a poor design for the system to take any access-escalating action without an explicit command from the user that initiates a secured transaction that is resistant to MITM. It's poor design to assume that the range is based on raw signal…
RTT measurements can give proof-of-proximity (due to relavity), but I think they're quite hard to get right (you'd need nanosecond RTT resolution in a cheap keyfob) -- I think analog signal repeaters would't add significant RTT. It's not impossible though, GPS decoders work in a similar fashion. Requiring user iniciation seems like the adequate solution here...
I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.
I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.
A simple button on the fob (rather than in the car) that you must press to open the doors and to start the engine would mitigate the attack. No need for coupling
Yes, reverting from passive-supported to active-only remote entry/start would eliminate the attack by eliminating the feature on which it is based. OTOH, the handsfree nature of passive remote entry is a major selling point.
I imagine improvements to the key fob could be made that would require a mechanical coupling with the car in order to start it. That would circumvent this attack.
> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. It's a poor design for the system to take any access-escalating action without an explicit command from the user that initiates a secured transaction that is resistant to MITM. It's poor design to assume that the range is based on raw signal…
But there are better solutions. I've heard about a car maker (I think it was BMW, but don't quote me on that) that put an acceleration sensor in the key fob. It would only broadcast the signal while the key fob is moving.