Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Police admit they're 'stumped' by mystery car thefts

today.com

Post reply on HN
Print view View original

71–80 of 139 posts

Re: Police admit they're 'stumped' by mystery car thefts

#71

Post by WiseWeasel »

DanBlake wrote: post #60

I never understood why keyfobs work in a UDP style, when communication between the remote and car would be infinitely better. For instance, instead of just sending "12345" and having the doors open since the code was expected, What about if the remote said "hey car, whats your random number" - the car then transmits back "54321" at which point the transmitter sends a hashed reply sha512(54321 + unique-random-id-set-p…

Wouldn't you then be able to determine the fob ID by recording multiple car "random number" requests and fob responses?

Re: Police admit they're 'stumped' by mystery car thefts

#72

Post by ewbuoi »

untothebreach wrote: post #13
wmeredith wrote: post #10

Earlier quoted context omitted.

You should be able to pull the fuse for the door locks; the mechanical lock buttons and key will continue to work. To find out which fuse, just Google "[car make] [model] [year] fuse diagram" and look for door lock actuators or similar.

Also, most (if not all) car user manuals come with a diagram of the fuse box.

Some even have a diagram of the fuse box in the fuse box.

Re: Police admit they're 'stumped' by mystery car thefts

#74

Post by hosh »

jcampbell1 wrote: post #19
jrochkind1 wrote: post #7

Earlier quoted context omitted.

Oh, but according to SOMEONE (source for this claim is not given) "That code is encrypted and constantly changing — and should be hackproof." American media at it's best!

How would you describe a challenge based authentication system that uses 128-bit AES? I find the reporter's description reasonable.

I too agree that this "That code is encrypted and constantly changing" is a reasonable description of an authentication system.

However, this, "and should be hackproof", is faulty. Nothing is ever inherently secure, though it might be relatively secure at a given moment and circumstance.

It's easy to characterize this as the ignorance of American media. However, this kind of "should be X" is common for anyone, be they journalists, ordinary folk, or technologists. We all have expectations about reality and feel shocked or bitterly disappointed when the expectation falls apart.

Re: Police admit they're 'stumped' by mystery car thefts

#75

Post by pyre »

DigitalJack wrote: post #61
mindcrime wrote: post #34

Earlier quoted context omitted.

Nobody here has claimed to know exactly what exploit the thieves are using. But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. And that point is what seemed, to me, to be missing from TFA. If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have kno…

It's certainly unexpected by the general public.

But not to the professionals (car thieves, police, etc).

Re: Police admit they're 'stumped' by mystery car thefts

#76

Post by jeffasinger »

javert wrote: post #53
outworlder wrote: post #49

The advice given in the article sounds ridiculous to my (brazilian) ears. - "Don't leave valuables in the car". Really? I'd have to deal with smashed windows every single day if I left anything that could possibly be of value sitting overnight (or for a few minutes in some places). Perhaps even an empty shoe box. And that's with tinted windows so dark they are not even supposed to be street legal. - "Keep your car re…

That stuff really isn't necessary in much of the US (many non-urban areas... thought not all). I don't even always lock my car doors in some places. To someone who's not used to it, it's probably amazing how benevolent people and society really can be.

I lived in a town where if someone was running into a store for only a few minutes, they would probably just leave the car unlocked, with the keys in it, and the engine running.

Re: Police admit they're 'stumped' by mystery car thefts

#77

Post by PeterisP »

dclowd9901 wrote: post #22
Fuxy wrote: post #15

Why is this so baffling a shocking? I think we all knew this was possible before anybody actually did it. It's not like their using proper crypto. It's the equivalent of a bad house lock give me some good lock picks and 60 seconds and I'm in so why is this so surprising?

From what they describe, it sounds like the locking systems use a system that works like a VPN key (this was actually surprising to me). Those seem pretty tough to crack, so why would this be any different?

Even if you use practically unbreakable encryption keys, there are a million things that you can fail in the whole cryptosystem and any one of them will make you vulnerable.

How are keys generated? What is the source of randomness? How are keys reset if needed? What are the manufacturer/service/guvmint backdoors in the keys? etc.

Re: Police admit they're 'stumped' by mystery car thefts

#78

Post by bsaunder »

DigitalJack wrote: post #61
mindcrime wrote: post #34

Earlier quoted context omitted.

Nobody here has claimed to know exactly what exploit the thieves are using. But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. And that point is what seemed, to me, to be missing from TFA. If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have kno…

It's certainly unexpected by the general public.

There's much that goes on in the technology world that surprises the general public that doesn't surprise people here. This is more of the same.

Re: Police admit they're 'stumped' by mystery car thefts

#80

Post by pavel_lishin »

Pxtl wrote: post #55
outworlder wrote: post #49

The advice given in the article sounds ridiculous to my (brazilian) ears. - "Don't leave valuables in the car". Really? I'd have to deal with smashed windows every single day if I left anything that could possibly be of value sitting overnight (or for a few minutes in some places). Perhaps even an empty shoe box. And that's with tinted windows so dark they are not even supposed to be street legal. - "Keep your car re…

Yup. In some places it actually feels best just to leave your car doors unlocked - then the thief doesn't have to smash your window before they root through your car and find it contains nothing of value.

A dumb thief may break a window anyway, rather than bother checking the door.

Or a vindictive one, for that matter.

Post reply on HN