Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves boosting signal from key fobs inside homes to steal vehicles

cbc.ca

Post reply on HN
Print view View original

41–50 of 449 posts

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#41

Post by gambiting »

ams6110 wrote: post #36
gambiting wrote: post #27

Earlier quoted context omitted.

If you are processing data with nanosecond precision(which is not difficult with modern microchips) then you can tell the distance to the key by just measuring the number of nanoseconds elapsed since the request was sent(accounting for amount of time taken to calculate the response). If you can measure the time in nanoseconds that's good enough to tell the difference between the key being 1m and 10m away.

I think that assumes that all the processing the key fob does internally is reliable constant-time down to the nanosecond. I don't know if that's true but my first guess is that it's doubtful.

Well, those chips are designed for this one purpose and nothing else - it should be possible to design them in such a way that the encryption/decryption process always ends in constant time.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#42

Post by slantyyz »

z2 wrote: post #5

Two factor authentication for cars, here we come! Though, searching for this phenomenon shows articles at least 3 years old warning to get Faraday cages or otherwise wrap fobs in aluminum foil. But do they really transmit all the time, or do they contain accelerometers or something to prevent battery from being wasted?

Seems like it would be easier to just go back to traditional cut metal keys.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#43

Post by mrb »

gambiting wrote: post #17

I already put mine in a metalic bag for the night, or just press the "lock" button twice which disables the keyless entry system entirely. Manufacturers really need to hurry up and implement more accurate timing detection in the keys - it should be absolutely trivial to detect how far away the key is based on the response time, but for some reason manufacturers don't do this yet. Edit: I also know people who take the…

«it should be absolutely trivial to detect how far away the key is based on the response time»

It's not possible. A keyfob has a relatively slow R/F communication channel, less than 1 Mbit/s (at best) because it's constrained by power. Thus the "length" of a bit transmitted over the air is 300 meters or more. The receiver needs to demodulate "300 meters" of R/F signal to recover a single bit. A difference of +/- 10 meters when these thieves boost the signal across your front yard is therefore indistinguishable from R/F noise and not demodulable by the receiver. You can visualize this as a 300 meter bit that has a noisy beginning and a noisy end.

That's why the distance-bounding techniques (term we use in the field) used by car manufacturers are instead pretty primitive, such as measuring the strength of the R/F signal (which is easily defeated by a proper signal booster.)

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#44

Post by nkurz »

exabrial wrote: post #40

Can someone explain to me how keeping your keyfob in a faraday bag is supposed to increase security?

From the linked article:

Relay thefts

According to Bates, many of these thieves are using a method called "relay theft."

Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start.

"The way that the thieves are getting around this is they're essentially amplifying that low power signal coming off of the push start fob," he said.

"They will prey upon the general consensus that most people are leaving their key fobs close to the front door of their home and the vehicle will be in the driveway."

The thief will bring a device close to the home's door, close to where most keys are sitting, to boost the fob's signal.

They leave another device near the vehicle, which receives the signal and opens the car.

Storing the keyfob in a faraday bag blogs the signal and prevents the relay attack from working.

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#45

Post by post_break »

Ford is really bad with this. The Fiesta and Focus, you can program a new key with the ODB2 port in under 60 seconds. Blast the key with a booster, get inside the car, plug your laptop in, program a new key, drive off. People have had to lock the ODB2 port, disable it, put keys into aluminum foil (my method). https://www.youtube.com/watch?v=dvmSOEKfkug

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#46

Post by wsh »

snarfy wrote: post #6

> Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start. Why is it transmitting without the user pressing a button? Is that a feature? As you walk up to the car it automatically starts like magic? I'm not familiar with these newer cars.

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car.

In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed.

The reply signal, at least, is uniquely coded to the car. The attack is to extend the range of the LF wake-up signal, causing a key stored away from the car to transmit a valid reply.

In some models, besides the transponder described above, the key also has a passive RFID tag, which works with a reader in the car to allow starting even if the battery in the key is dead.

(The article is wrong about the broadcasts, by the way; if the key transmitted continually, its battery wouldn’t last long.)

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#47

Post by raverbashing »

It seems car manufacturers are eager to be "cool" but not thinking about the consequences of their actions

Center "touchscreen" consoles with awful usability, shifters that are not obvious (coupled with people that are too lazy to pull the parking brake) and now this

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#48

Post by wglb »

cameldrv wrote: post #12

The car manufacturers are going to need to incorporate a time of flight measurement into the key system. Obviously amplitude can be faked.

So the test for amplitude is aided by the fact that the signal strength received at the car increases by a factor of four if the distance is cut in half. Thus, you have a nice margin for setting your threshold.

With measuring the time, however, presuming that radio signal will travel on the order of one foot per nanosecond, you have much less of a threshold tolerance. If the unlock takes place within two feet of the car, that is two nanoseconds. If the key sits 20 feet away, that is a 20-nanosecond one-way travel. So this solution would need to be able to distinguish between a four nanosecond gap (round trip time) and a 40-nanosecond round-trip time.

Add to that the turnaround time in the car CPU which I would imagine to be some number of milliseconds, would 10 ms be reasonable?

Thus, the electronics in the car needs to distinguish between 10ms + 4 ns vs 10ms + 40ms. And given jitter in any modern CPU/memory/OS/electronics device, I would bet that the jitter totally swamps that.

(Keep in mind that this is a BOEC https://en.wikipedia.org/wiki/Back-of-the-envelope_calculati...)

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#49

Post by wglb »

mrb wrote: post #43
gambiting wrote: post #17

I already put mine in a metalic bag for the night, or just press the "lock" button twice which disables the keyless entry system entirely. Manufacturers really need to hurry up and implement more accurate timing detection in the keys - it should be absolutely trivial to detect how far away the key is based on the response time, but for some reason manufacturers don't do this yet. Edit: I also know people who take the…

« it should be absolutely trivial to detect how far away the key is based on the response time » It's not possible. A keyfob has a relatively slow R/F communication channel, less than 1 Mbit/s (at best) because it's constrained by power. Thus the "length" of a bit transmitted over the air is 300 meters or more. The receiver needs to demodulate "300 meters" of R/F signal to recover a single bit. A difference of +/- 10…

A BOEC here: https://news.ycombinator.com/item?id=18609103

Re: Thieves boosting signal from key fobs inside homes to steal vehicles

#50

Post by wglb »

gambiting wrote: post #41
ams6110 wrote: post #36

Earlier quoted context omitted.

I think that assumes that all the processing the key fob does internally is reliable constant-time down to the nanosecond. I don't know if that's true but my first guess is that it's doubtful.

Well, those chips are designed for this one purpose and nothing else - it should be possible to design them in such a way that the encryption/decryption process always ends in constant time.

Keep in mind that amplitude of signal is cut by four as the distance doubles. Elapsed time is linear with distance.
Post reply on HN