Reverse engineering a car key fob signal • Hacker News Board

Re: Reverse engineering a car key fob signal

#61

Post by MuffinFlavored » Thu, Mar 14, 2024, 9:00 PM UTC

topspin wrote: post #47

MuffinFlavored wrote: post #25

Earlier quoted context omitted.

what kind of consumer level antenna can forward/amplify key fobs (in the gigahertz range, no?) without causing excess “signal to noise” ratio that the car can detect?

I think your conception of the sophistication of all this is a good deal too high. Fobs are extremely low power devices with truly terrible (undersized) antennas. Fabricating a digital repeater to produce a modest amplification is not difficult. The high frequencies involved are a benefit to the attacker because a high gain antenna remains reasonably portable. The active bits are low cost, widely available COTS digit…

isn’t the car keyless go system the transponder and the key fob the receiver or vice versa?

Re: Reverse engineering a car key fob signal

#62

Post by imp0cat » Thu, Mar 14, 2024, 9:04 PM UTC

0x457 wrote: post #53

gigel82 wrote: post #42

I wish car manufacturers would start making tiny (maybe RFID) remotes I could stick in my (minimalist) wallet. Alternatively, looking forward to a tiny Flipper-like (credit-card sized) that can achieve the same result. Seriously, the car fob is the largest thing in my pocket after the phone (thickness-wise at least).

I think what you wish is your phone to be your car key.

And you can already have that!

Re: Reverse engineering a car key fob signal

#63

Post by pajko » Thu, Mar 14, 2024, 9:06 PM UTC

JosephRedfern wrote: post #13

There's also a gnu-radio flow graph which serves a similar purpose: https://github.com/bastibl/gr-keyfob . Presentation here: https://www.fleark.de/keyfob.pdf

And there's a multiformat receiver block too: https://github.com/merbanan/rtl_433

Re: Reverse engineering a car key fob signal

#64

Post by swamp40 » Thu, Mar 14, 2024, 9:11 PM UTC

He decoded everything, but he didn't actually open a car door. He still has to defeat the rolling code. It's not like you can add 1 to it and resend it. From the outside world, the next rolling code should appear random.

Re: Reverse engineering a car key fob signal

#65

Post by 0x457 » Thu, Mar 14, 2024, 10:14 PM UTC

imp0cat wrote: post #62

0x457 wrote: post #53

Earlier quoted context omitted.

I think what you wish is your phone to be your car key.

And you can already have that!

Yes. However, I'm only aware of a Tesla that actually turns your phone/watch into an actual proximity key fob.

Not to be confused with what others do:

- open an app

- login again because devs can't figure out persistence between updates

- wait for thing to connect and load slow af UI

- click on unlock button in the app

- wait

- give up

- do not renew service after 1 year trial expired because it never worked

Re: Reverse engineering a car key fob signal

#66

Post by topspin » Thu, Mar 14, 2024, 10:29 PM UTC

MuffinFlavored wrote: post #61

topspin wrote: post #47

Earlier quoted context omitted.

I think your conception of the sophistication of all this is a good deal too high. Fobs are extremely low power devices with truly terrible (undersized) antennas. Fabricating a digital repeater to produce a modest amplification is not difficult. The high frequencies involved are a benefit to the attacker because a high gain antenna remains reasonably portable. The active bits are low cost, widely available COTS digit…

isn’t the car keyless go system the transponder and the key fob the receiver or vice versa?

Typically the fob is the transponder. The fob has a tiny battery: frequent transmissions would rapidly kill that battery. The car has an ample battery, so it transmits periodically and detects the responses from the fob transponder.

For the purposes of a "relay attack" this doesn't actually matter: all else being equal you could devise a relay system that works regardless of the roles of car and fob in the protocol.

Re: Reverse engineering a car key fob signal

#67

Post by fileoffset » Thu, Mar 14, 2024, 10:30 PM UTC

gigel82 wrote: post #42

I wish car manufacturers would start making tiny (maybe RFID) remotes I could stick in my (minimalist) wallet. Alternatively, looking forward to a tiny Flipper-like (credit-card sized) that can achieve the same result. Seriously, the car fob is the largest thing in my pocket after the phone (thickness-wise at least).

New BYD EVs come with a credit card sized NFC key which can be used to unlock and start the car...

Re: Reverse engineering a car key fob signal

#68

Post by sebk » Thu, Mar 14, 2024, 10:35 PM UTC

0x457 wrote: post #65

imp0cat wrote: post #62

Earlier quoted context omitted.

And you can already have that!

Yes. However, I'm only aware of a Tesla that actually turns your phone/watch into an actual proximity key fob. Not to be confused with what others do: - open an app - login again because devs can't figure out persistence between updates - wait for thing to connect and load slow af UI - click on unlock button in the app - wait - wait - wait - wait - give up - do not renew service after 1 year trial expired because it…

There's a standard for this using NFC and UWB, Digital Car Key; BMW has support for either 2.0 (NFC) or 3.0 (UWB) across their entire range. The Hyundai Motor Company group (Hyundai/Kia/Genesis) is starting to add support as well. See [1] for exact models (look for the little key icon). Several other makes are members of the Car Connectivity Consortium that standardized this protocol so it's reasonable to expect wider compatibility in the near future. The protocol incorporates significant countermeasures against relay and replay attacks like some that are mentioned in other comments here.

[1]https://www.apple.com/ios/carplay/available-models/

Re: Reverse engineering a car key fob signal

#69

Post by vel0city » Thu, Mar 14, 2024, 10:44 PM UTC

0x457 wrote: post #65

imp0cat wrote: post #62

Earlier quoted context omitted.

And you can already have that!

Yes. However, I'm only aware of a Tesla that actually turns your phone/watch into an actual proximity key fob. Not to be confused with what others do: - open an app - login again because devs can't figure out persistence between updates - wait for thing to connect and load slow af UI - click on unlock button in the app - wait - wait - wait - wait - give up - do not renew service after 1 year trial expired because it…

On my Ford I just walk up to it and it's unlocked and I can start it without taking my phone out of my pocket. I pretty much never carry an actual key on me.

Re: Reverse engineering a car key fob signal

#70

Post by dekhn » Fri, Mar 15, 2024, 12:19 AM UTC

MikeTheGreat wrote: post #55

bongodongobob wrote: post #39

Earlier quoted context omitted.

Realest comment here. I have a few drawers full of these kind of toys I used once and forgot about. Right next to my serial cables and bits of wire.

Your post inspired a random but genuine question: Does anyone have a good use for obsolete cables? Like, I've got some serial cables, some co-ax, a bunch of old TV cables, some audio cables. I tell myself I'm keeping them because if I ever need them I'll never be able to (or want to) buy them again. Moreover it feels like such a waste to throw them away. Maybe a makerspace could make use of them?

I'm holding on to my coax for a few more years and then getting rid of all of it (electronics recycling, probably). I am so looking forward to never using coax again.