Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves boosting signal from key fobs inside homes to steal vehicles

cbc.ca

Post reply on HN
Print view View original

361–370 of 449 posts

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#361

Post by andrewstuart2 »

tomerico wrote: post #255

I wonder how difficult it is to add some clock syncing and time-of-flight measurements to ensure a certain distance. If the speed of light is to fast, maybe using sound could work.

The speed of light shouldn't be too fast if the fob is just returning a ping. The car can almost certainly wake up the fob, ping it, then compute the distance. Unless my brief calculations [1] are too simplistic, a 2Ghz processor would have a resolution of increments of 15cm. That should be plenty of resolution to decide if the key is in a certain spot.

[1] https://www.google.com/search#q=speed+of+light+%2F+2+ghz

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#362

Post by andrewstuart2 »

williamscales wrote: post #290
comboy wrote: post #272

Earlier quoted context omitted.

This is such an obvious solution that maybe some patents are the reason it's not implemented by every car manufacturer.

Indeed, the last time this attack vector came up on HN, it was pointed out that one company has patented using time of flight to validate keyless entry. Here's the patent: https://patents.google.com/patent/US8930045

`ping`. They were granted a patent for ping. That seems ridiculous.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#364

Post by sulam »

mulmen wrote: post #341
mikeash wrote: post #321

Earlier quoted context omitted.

Yes, but a replay attack is quite different from a relay attack.

Hm, good point. I guess I don't really know how these systems work. I assumed there was some kind of rotating value but I have no reason to believe this. Based on these attacks it seems the keys are really just sending the same signal every time. That appears to be a real shortcoming of the design.

I think you’re not understanding the attack. It could be a unique, unpredictable signal every single time and the relay attack would work just fine. The devices intend to use distance to prevent this, with distance determined by strength of signal. The relay captures the challenge, passes it to the fob and then passes the response back to the car, boosting the signal if necessary. The timing on this is fast enough that it is within the tolerance of the system. As long as these devices are acting as proximity sensors and your fob isn’t electromagnetically isolated, this attack will work. No amount of key rotation will help.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#365

Post by gsich »

jjeaff wrote: post #266
jamescostian wrote: post #245

Earlier quoted context omitted.

The difference is that you can start up your engine (read: have AC on so that your car is the right temperature when you get to it) and also unlock the doors for others from far away If that functionality was encapsulated on a smart phone, that would be fine too.

My 2007 vehicle does this just fine. And any signal from the fob require a press of the button. These key fobs use rolling codes as well. So you would need to capture a button press while the remote is too far away from the car to receive it. Then replay it to the vehicle. Of course you still need the key to unlock the steering wheel and of you touch the break without inserting the key, the ignition cuts off. I'm not…

Or jam the signal with pseudo-random-noise. Afterwards you can remove the noise again and have the clear signal.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#366

Post by rovr138 »

Zamicol wrote: post #363

Why not triangulate the signal? I don't hear much about the speed of light being used for security, but it's applications are innumerable.

The attack uses 2 antennas. One next to the keys and one next to the car. It transmits the signal from both sides. The car thinks the key is inside/near.

Triangulating it won’t help. It thinks it’s there.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#367

Post by tasty_freeze »

mandeepj wrote: post #355

This is really strange and shallow thinking of some manufacturers. I have a 2009 car. It'd NOT start if I don't have my key fob inside the car.

I'm sure the car in these break-ins are like that too. The remote fob is inside the car, but they have an RF relay outside the car which proxies the keycode to the one inside the car.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#368

Post by opan »

sethammons wrote: post #359
thaumasiotes wrote: post #327

Earlier quoted context omitted.

> How does she unlock her front door? For many people, there's no need to unlock the front door because it's never locked. Having to lock your door just means you're living in a terrible neighborhood.

Growing up, we did not even have a key for our house. Lots of places around the US, there is no need for keys. It is really hard for some people to grasp the idea based on how and where they grew up. My wife grew up in a gang riddled area and will not abide unlocked doors if we are out and about.

My parents never locked the doors growing up, but I still lock the door of my own house. My parents never gave me a key when I was a kid, so it was probably left unlocked so I could always get back in. I'm not sure why they didn't just make sure we all had a key so they could keep it locked. That's what my roommates and I do at our place now and it works fine.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#370

Post by p1necone »

burtonator wrote: post #296
jamescostian wrote: post #116

Earlier quoted context omitted.

I'm not sure if this is a joke about old keys being better, but I'd argue you could have the benefits of new keys and old keys combined if you just made it so that new keys have to be inserted into some compartment inside of cars, where they are authenticated by those cars. You can imagine a fob with a USB that has a different authentication code than the wireless one it sends out, and unless the USB is plugged into…

I'm not sure why we can't have some sort of challenge response protocol to prevent MITM...

Challenge response prevents replay attacks, not real time MITM.
Post reply on HN