Live data from Hacker News

Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

bbc.co.uk

41–50 of 66 posts

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#41

Earlier quoted context omitted.

What do you mean by “the start-stop nonsense” as opposed to using pedals? I don’t have a newer car.

OP is likely talking about the system that automatically shuts down and restarts the combustion engine when you come to a complete halt. This is meant to reduce emissions and fuel comsumption.

What's the link between start and stop and pedals ? Isn't it seamless for the driver ?

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#42

Both my neighbours either side of my house had their cars stolen by this on the same night. One was a Jaguar, think the other was an Audi. They didn't touch my car even though it was newer, probably because it was a Kia. I am happy with my choice.

There's a common attack that boosts the wireless signal of proximity fob to trick the vehicle into unlocking & starting. Fob wireless systems should ideally redesigned such that the round trip time is precisely measured of only valid encrypted challenge responses that only the fob can answer. Spending a bunch of money on a luxury vehicle is usually idiotic and most people who do so usually can't afford it in proporti…

Yeah I know the attack model, it was just amusing they took the cars that were worth less (at market value) over the newer car that was less cool but worth more.

We put our car keys in a metal tin near the door now which stops all this anyway.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#43

A lot of new car "innovations" remind me of my issues with the newer iPhones and Macbook Pros (no headphone jack, thinness above all else, etc): I like having a physical key to start the engine. There was never any confusion in our household about "who has the keys" like there is now. I despise the start-stop nonsense. Let me use the pedals to start and stop. I don't need my car to broadcast a wifi signal. Etc etc et…

start stop for the engine when not needed is a welcome innovation though some brands handled it poorly when introduced. It does save fuel and when done well is seamless. I had this on a manual 2012 Z4 and loved it.

the wi-fi hot spot craze that manufacturers bought into never made much sense to me except as a revenue source for the same. I do know that GM though OnStar sells such services and they are seriously over priced, Onstar is near theft level just for monitoring services which is separate from data service!

As for keys, I love that my phone works as my key for my Tesla Model 3. For added security I can simply have PIN to drive setup in the car. Now some will say you lose security as all they need is your phone, well that is no different than just having your key too. I would be curious if the BT connection on the TM3 can be opened via signal boosting between phone and car. I do believe the optional key fob can be.

Now myself, though I had and tried it, I am not a fan of letting my phone take over the car UI no matter how dreadful a UI can be. I used it on my second generation Volt but in the end it really didn't not make much sense. First off, like I have found in my TM3 I really don't use much of the display or buttons while driving so any added features are moot. I did like that it would tell me my text messages, but some cars do that as well and let you voice transcribe replies.

The advantage for cars other than Tesla is that in those cars maps are never updated or only for money and infrequently. Let alone all other features.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#44

On my Mercedes key I always double click the lock button which entirely disabled the keyless features until I use the key again. Now the question is - is this actually safer? If some thieves arrive at my house to steal my car and their relay gadget doesn't work, are they going to give up, or are they going to break in and threaten me for the key? Now that's a question I don't like to think about too much.

Thieves don't want your car, they just want a car. If your car is too hard to steal they'll just take your neighbors instead.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#46
post #17
post #11

How would the victims quoted here have any idea if their cars were opened with a relay attack? Someone grabbed your bag? It’s more likely that you forgot to lock your car than that you were a relay attack victim. Especially if you were in such a bad state that one of you literally passed out at the airport. But also how are manufacturers still selling vulnerable cars? This seems like a class-action lawsuit waiting to…

Leaving the car unlocked wouldn't explain how they were able to start the car and drive off with it. Car missing + all keys accounted for in your house + no smashed glass = relay attack.

The people who have their bag stolen, did not have their car driven away.

That’s a valid question for the other victim, but I’m pretty sure cars are still occasionally stolen without the keys nearby by defeating the immobilizer.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#47

Earlier quoted context omitted.

OP is likely talking about the system that automatically shuts down and restarts the combustion engine when you come to a complete halt. This is meant to reduce emissions and fuel comsumption.

I don't get why people are so opposed to it, I love it and I drive a Mercedes-AMG. Fantastic feature in traffic.

I can't help but think that the extra wear and tear from start/stop cycles will end up exceeding the value of the fuel saved.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#48
post #22
post #5

The article doesn't support the headline. I don't doubt there are vulnerabilities, but the article didn't deliver.

It is clear what the vulnerability is. A lot of these remotes are susceptible to relay attacks. The car's challenge is being relayed into the house so the fob can respond. This response is relayed back to the car. The door just opens and you can start it and drive away. It is also trivial to be this attack by adding an accelerometer to the fob. If the fob isn't moving, don't respond to the broadcast from the car. You…

This attack can also be defeated by seeing how long the signal takes to respond from the fob so it knows how far away it is. Thieves can't get around the speed of light. Or use multiple antennas to triangulate the signal from the key fob.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#49

Earlier quoted context omitted.

Perhaps it make sense to place all your key fobs in a small Faraday cage while not in use.

https://www.fobguard.com/ They make them just for that purpose.

Would the fob still announce with the battery removed? A fob still works without the battery when put up-close to the start button.

Re: Some new cars at risk of theft by exploiting weaknesses in keyless entry systems

#50
post #28

A faraday car key bag costs about €20. And they work, I use one. But one has to be consistent and always put the key in the bag. Not a problem, really.

But... you shouldn't have to do this! It's an extra step, an inconvenience.

Yes, I agree. What’s the point of keyless access when one has to always take the key out of the faraday bag...

And I blame car manufacturers and dealerships for this. For introducing and advertising these features without explaining to less saavy buyers what are the risks.

Post reply on HN