Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Police admit they're 'stumped' by mystery car thefts

today.com

Post reply on HN
Print view View original

121–130 of 139 posts

Re: Police admit they're 'stumped' by mystery car thefts

#121

Post by corresation »

joe_the_user wrote: post #110
corresation wrote: post #92

Earlier quoted context omitted.

But a lot of people are claiming (rightly) that general knowledge that these car systems have vulnerabilities is widespread. So you have a device that can open random car doors in seconds? Do you know where to get one? Do you know anyone who has one? The police apparently don't (and the police almost certainly know far more about crimes and how they are performed than you and most other HNers do). A guy who specializ…

open random car doors You've been at this "random car" thing over the whole thread. But there no indication that these thieves can steal random cars in the sense of any car they choose. Thieves have stolen particular cars and the cops might not know the connecting thread but there's no situation where the thieves passed a "show us a random car and we'll use our device to steal it" challenge and that would be the kind…

The police are concerned. Random self-proclaimed experts on HN say it's no big deal.

But how about Honda -- do you have a remote door unlock exploit that can do what is being discussed on just Honda vehicles?

Re: Police admit they're 'stumped' by mystery car thefts

#122

Post by jmspring »

Recent rental car in Italy - get the keys, head to parking lot, and search out car based on license plate on keys. Writing is dodgy, could mistake an 8 for a 9. Find car, electronic control unlocks it, yet key will not start car.

Head back to desk, slam keys down (person behind desk had previously shown a serious attitude to renters), get startled look and say "car doesn't work". After a bit of shock due to slammed keys and firm voice person says "colleague should be there" (he wasn't), pointed out "nope", responded with "oh, in 5 minutes".

Wander back out to car, electronic lock locks/unlocks care, but still doesn't start. "Colleague" shows up. Points out diff between 8 and 9. I mention "uh, car unlocked". He shrugged. Turns out the car was in a completely different/not visible (for the company) part of the parking lot. Both electronic locks and key worked in that vehicle.

Having an electronic system for duplicate cars (1 off in license plates) seems like a bad idea.

Re: Police admit they're 'stumped' by mystery car thefts

#123

Post by keithjia »

assuming the car remote is using some kind of asymmetric encrytion algo, doesn't this simply mean either A) somebody leaked the private key from the manu? B) encryption was done with lower enough bits so that it is brute-force breakable

They could have just asked any CS prof or student for the possiblities...

Re: Police admit they're 'stumped' by mystery car thefts

#124

Post by runamok »

I read a recent 2600 article that said it's fairly easy to procure (from overseas) a jammer to prevent the lock signal from reaching the car. It would not open the doors but instead stop them from locking so the would-be thief would later manually open the unlocked doors.

Re: Police admit they're 'stumped' by mystery car thefts

#126

Post by cheald »

gvb wrote: post #119
cheald wrote: post #89

Earlier quoted context omitted.

If they'd figured out how to invoke resync, the owners' keyfobs would stop working, which would be a dead giveaway.

The "(re)sync" mechanism allows you to add new keys without disturbing the existing keys.

Source? I've never encountered that. Every time I've ever reprogrammed a wireless entry remote, I've had to reprogram all of them at the same time. Garage door openers can store multiple keys, but I've never run into a car that will.

For example, from my Grand Prix's owner's manual:

> Each remote keyless entry transmitter is coded to prevent another transmitter from unlocking your vehicle. If a transmitter is lost or stolen, a replacement can be purchased through your GM dealer. Remember to bring any additional transmitters with you when you go to your dealer. When the dealer matches the replacement transmitter to your vehicle, any remaining transmitters must also be matched. Once your dealer has coded the new transmitter, the lost transmitter cannot unlock your vehicle. The vehicle can have a maximum of four transmitters matched to it.

And from the shop manual:

> Once the keyless entry receiver enters the programming/diagnostic mode, the programming of the first transmitter erases all previous transmitter programming information. You must then program all of the transmitters.

Re: Police admit they're 'stumped' by mystery car thefts

#127

Post by [deleted] »

corresation wrote: post #121
joe_the_user wrote: post #110

Earlier quoted context omitted.

open random car doors You've been at this "random car" thing over the whole thread. But there no indication that these thieves can steal random cars in the sense of any car they choose. Thieves have stolen particular cars and the cops might not know the connecting thread but there's no situation where the thieves passed a "show us a random car and we'll use our device to steal it" challenge and that would be the kind…

The police are concerned. Random self-proclaimed experts on HN say it's no big deal. But how about Honda -- do you have a remote door unlock exploit that can do what is being discussed on just Honda vehicles?

[deleted]

Re: Police admit they're 'stumped' by mystery car thefts

#128

Post by makomk »

DanBlake wrote: post #60

I never understood why keyfobs work in a UDP style, when communication between the remote and car would be infinitely better. For instance, instead of just sending "12345" and having the doors open since the code was expected, What about if the remote said "hey car, whats your random number" - the car then transmits back "54321" at which point the transmitter sends a hashed reply sha512(54321 + unique-random-id-set-p…

Having both a transmitter and receiver in the fob used to be a lot more expensive and bulky than having just a transmitter. It isn't really anymore thanks to advances in RF miniturization and integration, but when car keyfobs were first designed it mattered.

Re: Police admit they're 'stumped' by mystery car thefts

#129

Post by [deleted] »

jcampbell1 wrote: post #70
mrb wrote: post #62

Earlier quoted context omitted.

You have no proof that Honda/Acura use 128-bit AES. In fact, being familiar with some research in the security of electronic car locks, I would wager they do not use AES.

It doesn't really matter. Consider the dumbest possible encryption scheme: Car sends random 32-bit number to key. The key XORs the random number with some 32-bit number. ECU checks that the response is valid. This is the worst possible design, and not far from what late 90's cars use. Even though it is the dumbest possible solution it still works reasonably well, because you have to have access to the key to start th…

[deleted]

Re: Police admit they're 'stumped' by mystery car thefts

#130

Post by mrb »

jcampbell1 wrote: post #70
mrb wrote: post #62

Earlier quoted context omitted.

You have no proof that Honda/Acura use 128-bit AES. In fact, being familiar with some research in the security of electronic car locks, I would wager they do not use AES.

It doesn't really matter. Consider the dumbest possible encryption scheme: Car sends random 32-bit number to key. The key XORs the random number with some 32-bit number. ECU checks that the response is valid. This is the worst possible design, and not far from what late 90's cars use. Even though it is the dumbest possible solution it still works reasonably well, because you have to have access to the key to start th…

Look, your initial claim that the reporter is reasonable when saying that the protocol should be "impossible" to attack is completely unfounded. The details do matter.

For example your hypothetical protocol is grossly insecure. Keys transmit signals over dozens of feet, not inches. All an attacker would have to do to attack your hypothetical protocol would be to capture one exchange. Then he can XOR the challenge with the response to obtain the 32-bit secret, allowing him to clone the key!

Post reply on HN