Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves boosting signal from key fobs inside homes to steal vehicles

cbc.ca

Post reply on HN
Print view View original

281–290 of 449 posts

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#281

Post by jjeaff »

jl6 wrote: post #242
entee wrote: post #212

Earlier quoted context omitted.

Could simply putting the thing in a foil/metal lined drawer in your entryway do the trick?

I do exactly this. I lined a cookie tin with foil, and tested it by holding the closed box (with the keys inside) next to the car. It didn’t unlock. Then I opened the box, and it did unlock. The box has to be closed (lid fully on, no gaps) or the car will still unlock. Of course this only foils overnight theft. I imagine it would be trivial for someone to follow me from a car park to a public location and sit next to…

I would imagine the signal emmitted from the fob is time sensitive. The codes should be invalid within a few seconds. If not, shame on them for such a terrible step backwards in security.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#283

Post by samstave »

makomk wrote: post #195
jakobegger wrote: post #171

Earlier quoted context omitted.

That was rolled out in a recent update, right? I think the over-the-air updates is one of the big advantages that Tesla has right now. They can respond quickly to critical vulnerabilities like that. I wonder how fast other car manufacturers are going to catch up? Volvo recently announced that they are working on an Android based system, but it's not going to be rolled out before 2020.

Yes, it was rolled out in a recent update - mainly in response to security researchers discovering they were using weak 40-bit crypto that had been broken back in 2005 that meant an attacker could just outright clone their fobs. They couldn't fix that in a software update so they stuck a PIN on as a patch.

Have there been any cases where a Tesla was under repossession and as such the delinquent owner was simply locked out of the car?

Or maybe where the Tesla auto drives itself to the nearest repo-man?

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#284

Post by pedrocr »

Kirth wrote: post #179
lozaning wrote: post #163

Earlier quoted context omitted.

A 9 year old BMW without the comfort access package.

My BMW did not come with such a fob slot but still required you to dig the key out to press the (un)lock buttons. Weird transition.

But that's the perfect fob! I keep it in my pocket and it has enough of a distinct shape I can press the buttons from the outside of the pocket. So I lock/unlock and open the trunk with no effort and yet am imune to this attack because a button press is always required. People I've driven were mistified how I was operating things because it's become so second nature you can hardly tell.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#285

Post by _trampeltier »

HorizonXP wrote: post #72

This happened to a family member of mine, here in Toronto. Lost their gorgeous M5. Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way." Sure enough, enough, key fob attack and thef…

That's no problem for the insurance company. Everybody has to pay a bit more, problem solved.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#286

Post by verelo »

My car was recently “broken into”, it’s a Mercedes C400, i thought it to be fairly secure so my assumption has been that i forgot to lock the car. I just double checked, and the car has an “auto-lock” feature and it is already turned on...so...did this happen to me?

I just want an off switch in my fob, so i can disable it at night. More fancy solutions would be a motion sensor on the fob to only power it when had recently moved, or for retrofits, this technology in a battery?

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#287

Post by brewdad »

Swizec wrote: post #260
nkrisc wrote: post #204

Earlier quoted context omitted.

Yes, I was making a joke, but I was also semi-serious. I personally wouldn't mind that the car unlocks based on the fob's proximity, but requires insertion of the key for ignition. I currently drive a 2009 car with the usual key fob and my biggest issue with it is not having to insert it to start the car, but unlocking the doors while my hands are full. Once I'm seated in the driver's seat I'm not carrying anything a…

My problem with modern cars is that there’s no good place to put the keys. They’re uncomfy in my pocket when sitting down and I’m too warm for a jacket with pockets. The old ignition hole was the perfect solution. You had a dedicated spot for your keys, you always knew where they are, were unlikely to forget them in the car, and it also happened to start your engine. Perfect

I thought that's what the cup holder is for. Of course, this doesn't solve the forgetting the keys problem.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#288

Post by nkrisc »

jamescostian wrote: post #249
nkrisc wrote: post #204

Earlier quoted context omitted.

Yes, I was making a joke, but I was also semi-serious. I personally wouldn't mind that the car unlocks based on the fob's proximity, but requires insertion of the key for ignition. I currently drive a 2009 car with the usual key fob and my biggest issue with it is not having to insert it to start the car, but unlocking the doors while my hands are full. Once I'm seated in the driver's seat I'm not carrying anything a…

> unlocks based on the fob's proximity Unfortunately, that would be vulnerable to theives unlocking your car and taking everything in it. For me, the biggest convenience of fobs is the ability to start the car and have AC on so that the car isn't burning/freezing when I get to it

If they're stealing your car like in this article, then that's already happening anyway. At least if it was unlock only and not ignition as well then you'd at least still have your car.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#289

Post by mulmen »

mikeash wrote: post #74
retSava wrote: post #37

Earlier quoted context omitted.

Since most car manufacturers seem to be vulnerable (to my knowledge), I assume all or most buy the same COTS keyfob + electronic lock product. Much like Takata airbags or Bosch ECUs. Being a step away from the problem probably helps keep that OEM manufacturer from strapping in and solving it. They don't feel any pain from it.

The vulnerability is pretty much inherent to the idea. No amount of encryption can protect you from a relay attack. The only foolproof mitigation is to enforce a short round trip time to ensure the fob is actually close to the car, but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds.

Is it true that encryption cannot proetect from a relay attack? If the encrypted payload is passed based on some kind of pre-shared secret (pairing) then each message should be unpredictable to a third party right?

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#290

Post by williamscales »

comboy wrote: post #272
frankus wrote: post #264

Earlier quoted context omitted.

Apple claims that they use time-of-flight for their "Unlock with Apple Watch" feature on macOS, so it seems like something that a car maker/supplier could pull off, especially if they're willing to throw dedicated hardware at the problem. That said, the fob is much more battery-constrained than a watch that you charge on a daily basis.

This is such an obvious solution that maybe some patents are the reason it's not implemented by every car manufacturer.

Indeed, the last time this attack vector came up on HN, it was pointed out that one company has patented using time of flight to validate keyless entry.

Here's the patent: https://patents.google.com/patent/US8930045

Post reply on HN