Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys • Hacker News Board

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#141

Post by kweks » Mon, Mar 09, 2020, 7:47 AM UTC

ProZsolt wrote: post #124

kweks wrote: post #113

Earlier quoted context omitted.

Apologies if this reply seems a little pedantic; your reply is mostly correct, but there are some large shortcuts. MIFARE is not a card type, it's more a family of cards in the 13.56MHz space, produced by NXP. There are multiple cards under the banner of Mifare, including: - Mifare Classic 1/4k - UID + Storage space, with individual keys and crypto. Suffers/ed from multiple vulnerabilities. Used mainly in cheaper hot…

Do you have any resources on how to secure Mifare Classic against cloning? I thought it's inherently insecure.

You can't secure Mifare Classic directly, it's totally broken.

The best solution is to assume that a card's encryption is or will be broken, and build a system around it.

That is to say, store encrypted or signed data on the MIFARE card.

VIGIK is a French system that uses RSA signed data in MIFARE cards which has not been cracked to date.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#142

Post by wpietri » Mon, Mar 09, 2020, 3:18 PM UTC

beatgammit wrote: post #94

wpietri wrote: post #82

Earlier quoted context omitted.

I'm not seeing the problem. Your suggested title makes it sound like they could clone all the keys from those manufacturers which isn't true. And if you inserted a word like "some", my first question would be, "Well, how many?" To me "millions" is useful in conveying it isn't just a niche issue, but it isn't everything, either.

Why not include a percent? Are we talking about 10% of cars, or more like 80%? Is it mostly recent cars, or are cars from several years ago also affected? It's not a terrible headline, but it could also be improved.

It could be improved if that data were available. But it's not in the article, and it wouldn't be easy to gather. So I think we should stick with reasonably achievable choices.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#143

Post by chapium » Thu, Mar 12, 2020, 5:59 AM UTC

tialaramex wrote: post #64

chapium wrote: post #55

Earlier quoted context omitted.

Doesn't this require the attacker to have the keys?

The relay attack (which is not what this article is about) relies on an erroneous idea in the design of keyless entry and keyless ignition systems. Signals from an RFID device don't travel very far. So, (here's the error) if the keys can receive and respond to a signal from the car they must be very close to the car. But signals can be relayed. Crook A stands next to your car. Crook B walks up to your front door. Cro…

I think what I am unclear about is how the crook gets the signal. Is it as simple as recording it once and using it again later? Does they key change between uses?

Otherwise the attack seems arbitrary. If my key keeping bowl at home physical security is compromised I have someone in my house.

I generally dont leave my keys out anyway, but a nefarious plumber/home contractor could potentially gain access.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#144

Post by fyfy18 » Sat, Mar 21, 2020, 5:48 AM UTC

kweks wrote: post #113

fyfy18 wrote: post #105

Earlier quoted context omitted.

What you are describing is basically MIFARE, which is commonly used by transport cards. Rather than just being an ID, the card is responsible for storing and deducting the balance, and often stores other things like trip history. The allows them to be used without a internet connection on the ticketing machine (e.g. on a bus). There have been vulnerabilities found in older versions, but as far as I know, later versio…

Apologies if this reply seems a little pedantic; your reply is mostly correct, but there are some large shortcuts. MIFARE is not a card type, it's more a family of cards in the 13.56MHz space, produced by NXP. There are multiple cards under the banner of Mifare, including: - Mifare Classic 1/4k - UID + Storage space, with individual keys and crypto. Suffers/ed from multiple vulnerabilities. Used mainly in cheaper hot…

Thanks for the explanation! Regarding the storing value on the card, one notable deployment that does work like this is the London Oyster card. These were first rolled out in 2003, so getting a reliable internet connection everywhere they were used wasn't possible.

When you topped up online (I haven't lived in London for a few years, so don't know if it still works like that) you had to select which station your top up would be applied to, then overnight that station would download a list of topups, and apply it to your card when you touched in or out next. So at the time there was no real time connection to a centralised database.