Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Post by Dylan16807 » Sat, Mar 07, 2020, 10:57 PM UTC

garaetjjte wrote: post #31

robomartin wrote: post #19

One related and another unrelated though... First: Auto manufacturers ought to get together and agree on one common key + entry system standard. It can be a combination of physical key and remote key if necessary. The problem: If you have multiple vehicles (and many families do) you end-up with a keychain full of horrendously large and unnecessarily inconvenient keys, key-fobs, whatever. Some manufacturers seem inten…

>was always a game of chicken with cars entering in the other direction Uh, other direction? Almost always there are hoses from both side of pillar. Is it some regional thing?

Post by unnouinceput » Sat, Mar 07, 2020, 11:07 PM UTC

tialaramex wrote: post #44

unnouinceput wrote: post #32

Quote: "By contrast, the cloning attack the Birmingham and KU Leuven researchers developed requires that a thief scan a target key fob with an RFID reader from just an inch or two away." Story time: Back in 2005/2006 when I worked for Siemens Automotive on Immobilizer feature (was involved in Mazda and Ford projects) I got my hands on the highly secret crypto source...and much to my surprise I've seen they implemente…

Are you sure you aren't misremembering? DST40 https://en.wikipedia.org/wiki/Digital_signature_transponder used in Fords of that period is a Feistel cipher not a Vigenere cipher. Now, I wouldn't choose a Feistel cipher for this problem today but it certainly is not 1.5 centuries obsolete, this type of encryption wasn't even invented until the mid 20th century and a very famous example would be DES.

Post by chapium » Sat, Mar 07, 2020, 11:27 PM UTC

_iyig wrote: post #20

notlukesky wrote: post #17

The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.

>The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme: https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...

Post by 0xb100db1ade » Sat, Mar 07, 2020, 11:32 PM UTC

smcnally wrote: post #28

neuralRiot wrote: post #14

Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a “new” product.

I'm with you and not a good representative of the target market for keyless fobs. slovette and aetherspawn give good use cases for some benefits. I still ask how much of a real-world problem to be solved was sticking a physical key into a steering column? What were the stated goals for developing NFC ignition fobs en re drivers, manufacturers, and the automotive industry?(1) Apart from inevitable consequences like fr…

Post by OrgNet » Sat, Mar 07, 2020, 11:40 PM UTC

aluminussoma wrote: post #16

My reaction: Great! Reproducing these keys costs hundreds of dollars and a trip to the dealer. Maybe it can finally be affordable again. I'm less concerned about someone stealing my car. The local police department takes it seriously, no less because stolen cars are used to commit other crimes.