Can they do Honda, please?
Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
21–30 of 144 posts
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#22Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.
The keys this article is talking about aren't (necessarily) keys you don't have to "Pull out of your pocket". What's "smart" about them is that the car's immobilizer technology talks to them before agreeing to let the vehicle be driven.
Hence the article says thieves would be able to "hot wire" a car after using this attack. You can't (if manufacturer's did their job properly) "hot wire" modern cars like you see in a movies, the computer overseeing things doesn't let it be driven anywhere just because somebody jammed a screwdriver in a hole and taped some wires together.
Keyless entry and keyless ignition are entirely different technologies that have a different problem (relay attacks) which has been covered a long time ago and has numerous quite different solutions from this.
This article is about the all-to-common situation where somebody cut too many corners and left themselves open to a pretty easy cryptographic vulnerability. (Some) Car manufacturers did a crap job of making the "smart" key that disables the immobilizer actually secure, and bad guys can use that to clone such a key and drive off in your car. If they didn't also copy the mechanical shape of the key (which would be more effort) they can smash the lock just as they would have in the 1980s to steal a car. Some of them might even remember stealing cars in the 1980s and not need to learn a new technique.
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#23The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.
It should be a construction approximately: first DHE and then the car challenging the fob to MAC a unique message. Exponential backoff after every failed attempt for that token (fob).
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#24Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.
I disagree, when you’ve got 4 kids and both arms full of groceries, when the doors open automatically or even unlock on their own it’s a godsend. I’d even say it’s probably saved some lives as the kids race to get in and out of the parking lot instead of waiting on me to shuffle around for the keys, dropping bags in the process, and then chasing each other around in blind traffic.
How much of an inconvenience would it be if your car gets stolen having 4 kids and both arms full of groceries in contrast to placing the bags on the floor for a second?
I have this smart key thingy too and I keep it in one of those RFID pouches. Since I don't have to use the key to start the engine, I feel the whole thing became more of a problem than it was before. You at least always knew where the key is and where to put it. Now it sometimes slids down the seat, or is in my jacket that I wanted to leave in the car or the engine/electric is not on/off because pushing the button does several things. It became an inconvenience and the few times I really used the automatic open feature after deliberately taking out the key out of the pouch to profit from it are negligible.
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#25Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.
I disagree, when you’ve got 4 kids and both arms full of groceries, when the doors open automatically or even unlock on their own it’s a godsend. I’d even say it’s probably saved some lives as the kids race to get in and out of the parking lot instead of waiting on me to shuffle around for the keys, dropping bags in the process, and then chasing each other around in blind traffic.
> when you’ve got 4 arms arms full of groceries
Damnit, speaking of unwanted features...
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#26One related and another unrelated though... First: Auto manufacturers ought to get together and agree on one common key + entry system standard. It can be a combination of physical key and remote key if necessary. The problem: If you have multiple vehicles (and many families do) you end-up with a keychain full of horrendously large and unnecessarily inconvenient keys, key-fobs, whatever. Some manufacturers seem inten…
Phone as fob is more or less here. Probably watches too.
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#27Earlier quoted context omitted.
I am married to someone who has lost her keys several times so far. Upgrading from a car with a $50 fob to one with a $200 fob was not fun.
https://www.thetileapp.com/en-us/store/tiles/pro If she loses her keys just once it pays for itself many times over.
I assume this person must be losing their keys in public or somewhere unknown. Otherwise their house must have quite the bonanza of keys waiting for them.
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#28Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.
I'm with you and not a good representative of the target market for keyless fobs. slovette and aetherspawn give good use cases for some benefits. I still ask how much of a real-world problem to be solved was sticking a physical key into a steering column? What were the stated goals for developing NFC ignition fobs en re drivers, manufacturers, and the automotive industry?(1)
Apart from inevitable consequences like from this article, are benefits outweighing other intended, unintended, and inevitable consequences like these for most people?
- Forgetting car keys more often per new learned behaviors
- Fob batteries dying
- Replacing lost / broken fobs is more costly in time, money, and hassle
- Leaving fobs in the car more often
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#29The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.
It should be a construction approximately: first DHE and then the car challenging the fob to MAC a unique message. Exponential backoff after every failed attempt for that token (fob).
Exponential backoff could DoS someone from opening their own car.
Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys
#30One related and another unrelated though... First: Auto manufacturers ought to get together and agree on one common key + entry system standard. It can be a combination of physical key and remote key if necessary. The problem: If you have multiple vehicles (and many families do) you end-up with a keychain full of horrendously large and unnecessarily inconvenient keys, key-fobs, whatever. Some manufacturers seem inten…
> fuel tank port on the same side
I want to believe this is to be able to spread the use around both sides of the pump without pulling the pump hose over/around the car. In some gas stations there's no easy way to turn the car around the pump.