Police admit they're 'stumped' by mystery car thefts

Post by Zarathust » Wed, Jun 05, 2013, 7:54 PM UTC

zw123456 wrote: post #81

You can Google the phrase "car learning keyless remote control" and see tons of sites selling these for "legit" purposes as replacement remotes. I am sure not all of them work on all cars but I am sure the thieves simply figured out which ones work on which cars and just target those. And I agree, this is nothing new, a story about it pops up on the news every so often and the it seems like each time the Police are b…

Post by javert » Wed, Jun 05, 2013, 7:59 PM UTC

cglace wrote: post #54

javert wrote: post #53

Earlier quoted context omitted.

That stuff really isn't necessary in much of the US (many non-urban areas... thought not all). I don't even always lock my car doors in some places. To someone who's not used to it, it's probably amazing how benevolent people and society really can be.

In urban areas I don't lock my doors to avoid having my windows smashed for some change.

Post by mindcrime » Wed, Jun 05, 2013, 8:05 PM UTC

corresation wrote: post #92

mindcrime wrote: post #34

Earlier quoted context omitted.

Nobody here has claimed to know exactly what exploit the thieves are using. But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. And that point is what seemed, to me, to be missing from TFA. If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have kno…

But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. So you have a device that can open random car doors in seconds? Do you know where to get one? Do you know anyone who has one? The police apparently don't (and the police almost certainly know far more about crimes and how they are performed than you and most other HNers do). A guy who specializ…

Post by gboone42 » Wed, Jun 05, 2013, 8:17 PM UTC

VLM wrote: post #90

jcampbell1 wrote: post #19

Earlier quoted context omitted.

How would you describe a challenge based authentication system that uses 128-bit AES? I find the reporter's description reasonable.

"How would you describe a challenge based authentication system that uses 128-bit AES?" How do you know at the RF level that its challenge based, and how do you know that the exploit is not operating in some .gov override mode like "I am NSA, open right now" mode. I used to operate a computer that had a rack mount lock where its extremely well known (to some, anyway) that the mfgr shipped every unit with a tumbler th…

Post by finnw » Wed, Jun 05, 2013, 8:18 PM UTC

darkarmani wrote: post #88

isomorphic wrote: post #82

Earlier quoted context omitted.

In the case of challenge/response with a single 128-bit block, I think ECB would be just fine. I can't imagine a car key needing to send multiple blocks (thus necessitating CBC, etc.). The larger point here is that most keys probably aren't using AES to start with, and there's probably some other vulnerability in the overall system.

It would be just fine, if you knew what you were doing when choosing ECB. I can think of plenty of brain dead ways you could accidentally use it if you thought that AES automatically protected you no matter how you used it. I'm sure there are vulnerabilities all over the place, but it would make even more sense if it happened to an AES system, because people would let their guard down because super-duper industrial s…