Keyless BMW cars prove to be very easy to steal

> Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack.

Make the key changing process VERY slow, as in 24h+. If you really really lost your key you wouldn't mind leaving the car 24h at a mechanic but a thief would have a much harder time hiding a car that long. At least compared to 2mins at a dark parking lot.

Thievery comes in many forms. The ones who steal cars that aren't worth anything on the black market aren't really going to be the smartest or most well-connected. Street punks really, and in the US manual transmissions are incredibly uncommon. A hoodlum will only know how to drive stick if he/she has had access to one and someone to teach them. While manuals are more common on cheap cars and street thieves are more likely to drive cheap cars, they're still quite rare.

Basically, if you're a smart thief and you can't drive stick, you have something wrong with you. But then again, if you're smart and also a thief, there's something wrong with you. If you're smart and also a thief and also stealing a rusty, beat up, 5-speed, early-90's Japanese truck, you obviously want it more than I do. I could just buy another one for <$1000.

There is a difference, which is that a car is a physical thing.

Imagine that we had the current process. Except that every time a key gets reprogrammed, a record was made of which mechanic's key was used, and we have a mechanism to revoke particular issued keys.

This will not stop my car from being stolen. But we can identify which mechanic's key was used to do it, and I'm able to brick that car remotely.

You've just increased the cost of stealing a car this way, and reduced the cost of having it stolen. That may well be enough to convince thieves to move on to an easier type of target.

How about the following schema for adding a new key to the list of Authorized Keys when NO AUTHORIZED KEY IS PRESENT:

* the procedure requires a module produced and sold by the manufacturer() to any garage that can verify its identity and satisfy manufacturer's specified security requirements (e.g. owning a safe and having no history with local police);

each such module is unique. It contains unique public/private keys and its public key is singed by the manufacturer;

* the procedure of adding the key to the list of Authorized Keys requires the car (actually, its ECU) to only accept incoming requests signed by such modules whose public keys are signed by the manufacturer. When the key is added, the ECU stores:

the key info;

the module's unique ID (IMPORTANT);

timestamp + lat/long;

* if there are no old authorized keys present (very rare scenario, since most of the time the owners want to replace just one lost/stolen key, but not both), the ECU requires 15 minute grace period with the module attached at all times, during which the car is flashing its hazard lights and honks. It makes a small nuisance in the garage once in a while, but attracts enough attention in the middle of the night if somebody is stealing it.

Now, if the car is stolen and then recovered, the police would dump the list of authorization requests and identify the module used. If this module was stolen or copied, the garage who owned the module becomes responsible for the damage to the car's owner. The ID of the module is placed on the revocation list. The revocation list is broadcasted via Sirius/XM/FM/BMW Assist/OnStar/Intelsat/etc.

This allows independent garages working on the cars, but places enough responsibility on them for keeping the system secure, with the override mechanism in form of revocation lists.

This method would NOT prevent all types of thefts (thugs can put the car on the flatbed and do the swap in the middle of the desert, or they can swap the ECU unit completely, or do some manipulations with the stolen "good" key), but it makes it significantly more difficult to authorize a new key and drive away.

(*) in case the manufacturer ceases to exist, some other company (another car manufacturer, perhaps) inherits the master key and will be responsible for authorizing garages to do key management.

> the procedure requires a module produced and sold by the manufacturer

So now the manufacturer has yet another method of extorting would-be mechanics. You'd have to regulate pricing or aggressively prosecute attempts at anticompetitive tactics.

> in case the manufacturer ceases to exist...

And who goes to jail when the company folds and, in the fire sale, the master key is on a system that gets wiped when being transferred to the new owner? Key escrow sounds like a better idea to me. Perhaps legislation should specify the creation of a public agency, or maybe we could leave it to private competition.

As for the remainder of your points, I believe you're thinking in the right direction.