You can Google the phrase "car learning keyless remote control" and see tons of sites selling these for "legit" purposes as replacement remotes. I am sure not all of them work on all cars but I am sure the thieves simply figured out which ones work on which cars and just target those. And I agree, this is nothing new, a story about it pops up on the news every so often and the it seems like each time the Police are baffled. Maybe there needs to be a web site for the police that provides them with such information. If there isn't one already, there is an app opportunity for someone perhaps.
Police admit they're 'stumped' by mystery car thefts
81–90 of 139 posts
Re: Police admit they're 'stumped' by mystery car thefts
#82Earlier quoted context omitted.
How would you describe a challenge based authentication system that uses 128-bit AES? I find the reporter's description reasonable.
Does it use ECB (electronic code book)? Because that would be a system using AES that would be terrible. How many times do we have to go over this? Crypto is hard to do right. ECB: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation...
In the case of challenge/response with a single 128-bit block, I think ECB would be just fine. I can't imagine a car key needing to send multiple blocks (thus necessitating CBC, etc.).
The larger point here is that most keys probably aren't using AES to start with, and there's probably some other vulnerability in the overall system.
Re: Police admit they're 'stumped' by mystery car thefts
#83I never understood why keyfobs work in a UDP style, when communication between the remote and car would be infinitely better. For instance, instead of just sending "12345" and having the doors open since the code was expected, What about if the remote said "hey car, whats your random number" - the car then transmits back "54321" at which point the transmitter sends a hashed reply sha512(54321 + unique-random-id-set-p…
Wouldn't you then be able to determine the fob ID by recording multiple car "random number" requests and fob responses?
Make the nonce and the secret long enough, and you would have to break SHA512.
Re: Police admit they're 'stumped' by mystery car thefts
#84Earlier quoted context omitted.
That stuff really isn't necessary in much of the US (many non-urban areas... thought not all). I don't even always lock my car doors in some places. To someone who's not used to it, it's probably amazing how benevolent people and society really can be.
I lived in a town where if someone was running into a store for only a few minutes, they would probably just leave the car unlocked, with the keys in it, and the engine running.
In many jurisdictions, if the car was stolen and used in a crime, you could be charged for negligence.
Re: Police admit they're 'stumped' by mystery car thefts
#85Earlier quoted context omitted.
Nobody here has claimed to know exactly what exploit the thieves are using. But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. And that point is what seemed, to me, to be missing from TFA. If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have kno…
It's certainly unexpected by the general public.
The general public thinks that if you open a jar and the lid goes "pop" that means it hasn't been opened before.
Of course, elementary school science is enough to figure out that if you bought a jar of apple juice from the store, replaced some of the contents with hot goat urine and shook it up before fully closing the lid again, as the air inside cooled it would pull the clicker back down. And you could return it to the store.
But if I read an article about mysterious tampering with "unopened" products in local grocery stores, I hope the police (and particularly, food packaging or food security experts) wouldn't be so baffled about it when discussing it with reporters.
Re: Police admit they're 'stumped' by mystery car thefts
#86Anyone know how much compute time is needed to crack a new BMW or Audi remote?
Seconds I believe.
I have no source but I recall seeing a story where people were able to fake a BMW remote by plugging directly into the OBDII port on the cars and running a quick program on an attached arduino. As for remote access I'm sure its equally plausible to crack if you know the right steps to take.
Re: Police admit they're 'stumped' by mystery car thefts
#87The advice given in the article sounds ridiculous to my (brazilian) ears. - "Don't leave valuables in the car". Really? I'd have to deal with smashed windows every single day if I left anything that could possibly be of value sitting overnight (or for a few minutes in some places). Perhaps even an empty shoe box. And that's with tinted windows so dark they are not even supposed to be street legal. - "Keep your car re…
The tint on your windows probably contributes -- they can't see inside, so they break in just in case there might be something worth stealing.
Re: Police admit they're 'stumped' by mystery car thefts
#88Earlier quoted context omitted.
Does it use ECB (electronic code book)? Because that would be a system using AES that would be terrible. How many times do we have to go over this? Crypto is hard to do right. ECB: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation...
In the case of challenge/response with a single 128-bit block, I think ECB would be just fine. I can't imagine a car key needing to send multiple blocks (thus necessitating CBC, etc.). The larger point here is that most keys probably aren't using AES to start with, and there's probably some other vulnerability in the overall system.
It would be just fine, if you knew what you were doing when choosing ECB. I can think of plenty of brain dead ways you could accidentally use it if you thought that AES automatically protected you no matter how you used it.
I'm sure there are vulnerabilities all over the place, but it would make even more sense if it happened to an AES system, because people would let their guard down because super-duper industrial strength encryption will take care of everything.
Re: Police admit they're 'stumped' by mystery car thefts
#89Sounds a lot like the Chamberlain garage door gaping security hole: http://en.wikipedia.org/wiki/The_Chamberlain_Group,_Inc._v._... . The level of security of a car door is presumably a lot higher than that of a garage door, but the technology of using a rolling code is the same and the need to be able to (re)synchronize remote keys/fobs is also there. With the cars I own, there is a procedure in the operator's manua…
If they'd figured out how to invoke resync, the owners' keyfobs would stop working, which would be a dead giveaway.
Re: Police admit they're 'stumped' by mystery car thefts
#90Earlier quoted context omitted.
Oh, but according to SOMEONE (source for this claim is not given) "That code is encrypted and constantly changing — and should be hackproof." American media at it's best!
How would you describe a challenge based authentication system that uses 128-bit AES? I find the reporter's description reasonable.
"How would you describe a challenge based authentication system that uses 128-bit AES?"
How do you know at the RF level that its challenge based, and how do you know that the exploit is not operating in some .gov override mode like "I am NSA, open right now" mode.
I used to operate a computer that had a rack mount lock where its extremely well known (to some, anyway) that the mfgr shipped every unit with a tumbler that could be opened by a key cut to "XX2247"
I could encrypt the key cutting code XX2247 for you with 128 bit AES, or maybe 2048 DSA, but its not going to help very much.
It might be buggy enough that a random out of limits response might open it.