#554

E-Theft Threat Guide

CYB

Cyber Security

A growing number of intelligent systems and technologies are being installed in vehicles today, with moreplanned for installation in the future. While those innovations seen in the HMI and infotainment systems aremost commonly noticed and marketed by OEMs, they also extend to safety and security. These features are
now present across multiple vehicle segments and include, most notably, keyless entry. A function that sees
the user's smartphone or key fob used to unlock the vehicle.

TABLE OF CONTENTS
Introduction
The Basics

The rate at which these technologies are being installed and becoming more common within the industry,
however, also increases the risk of electronic vehicle theft (e-theft). This sees a variety of electronic tools anddevices used by criminal groups around the world that take advantage of built-in systems in order to steal
vehicles.

What’s New
Outlook
Next StepsThe E-Theft Threat Guide identifies the range of methods that play a role in the theft of vehicles today. Theft
tools and devices are extensively profiled on a number of topics - including their source, cost, and the type oftheft they enable. Likewise, the models that have reportedly been stolen using these methods and tools are
similarly profiled. The impact of these tools on vehicle theft worldwide is evaluated by their functionality,compatibility, and availability.

Contact Us

RELATED SBD REPORTS
Digital Key Guide - 712
This guide tracks the latest offerings of digital key,which uses a smartphone to lock/unlock and start
the car. from OEMs in the three major regions. Also
tracked are the features and pricing models of eachsystem as well as the technologies used to producethem.

COVERAGE

FREQUENCY

PUBLICATION FORMAT

PAGES

1NACHINAEUROPEANNUALLYQUARTERLY

ONE-OFFPD F

POWERPOINT

EXCEL

ONLINE

35

#554/ E-Theft Threats Guide

Key questions answered> What are the current
electronic theft methods
used to steal vehicles?

This research supports> Which models are affected bya specific theft tool?
PRODUCT PLANNERS> How does theft impact
the desirability or
insurability of a vehicle?

Do I have access?

E NGINEERING> How available are those tools
to buyers?
Portal access

Portal access
C-SUITECYBE R

View Excel Data Sheet Sample
E-Theft Threats Guide
For a comprehensive list of brand-level data on e-Theft tools, including cost,type, availability & compatibility>10,000
datapoints>290 tool details
coveredModels affected andwebsite links

554 – E-Theft Threat Guide

Contents
Electronic Theft Threat Guide
Introduction ≫4

The Basics ≫6

What’s New? ≫15▪ Latest Tool Trends▪ Tools Overview▪ Go Deeper

Outlook ≫29▪ Future Trends

Next Steps ≫31

Contact Us ≫35

Total number of pages - 35

Introduction
Key questions answered in this report and chapter overviews

Contents PageContents
Page

Contact Us

About SBD

About SBD

Contact Us

Introduction

Introduction
The Electronic Theft Threat Guide is designed to be a fully searchablereference tool and catalogue of the various devices available, designed toovercome standard fit security systems. The Excel Spreadsheet is acomprehensive list of current devices, what they are designed to do, what
the seller claims they can do, and how much it costs. The spreadsheet
lists the vehicle brands, models, and where possible, the model year thateach tool claims to overcome or program.

The guide is designed to allow engineers, designers, investigators, andstrategists to better understand the type and breadth of tools and devices
currently available to overcome vehicle security systems. The tools listed
can either bypass systems, program keys/ECUs, re-write commands ordata, or re-flash vehicle firmware.
SBD Automotive designed the guide to highlight the tools and devices that
operate on the latest or the most targeted brands and models. It focuses
on tools and devices that are sold through known and ‘trusted‘ tool
developers, sellers and resellers. In this case, the term ‘trusted’ means
tools that are sold by sellers that do not exaggerate a tool’s capabilities or
knowingly make false claims. All the chosen sites and sellers have been
selected by SBD because of the known capabilities of the tools or throughresearch carried out by SBD Automotive. The guide deliberately does notclaim to include every tool or device available, as many of these are copies
of tools already included or, cover model ranges or systems that are notcurrent or considered relevant.
Note: SBD Automotive has not tested the majority of tools in thisdatabase to verify their effectiveness. SBD Automotive does have an
ongoing theft tool test program and if you require further information on
thetools
being
tested,pleasecontact
usbyemail:info@sbdautomotive.com

SectionContent
Introduction to the history and the demand for this type of tool.
How did different major global events and the introduction ofspecific legislation, drive demand for these types of tools?

The Basics

Conclusion: The requirement for a separate service andmaintenance solution, along with a need for tools to bypass orlegitimately circumvent vehicle security systems, has led to theemergence of an aftermarket tool landscape.
What are the latest tools? Profiles are provided of the latest tools
and bypass trends. There is also an overview of how theaccompanying spreadsheet can be used to go deeper.

What’s New?

OutlookConclusion: The segment describes a blend of both traditional
physical tools and modern electronic/software tools.

SBD’s view on the future trends of E-theft, including if newtechnologies and control features are being introduced into theautomotive sector (such as UWB, biometrics, smartphone appsetc)) may be exploited.
It will also look at some of the new features and options being
included in the E-theft tool market, such as ‘Pay as You Go’purchase options.
Conclusion: This section discusses SBD’s viewpoint of ways
developer will choose to evade UWB(Ultra-Wideband).

Go Deeper

Can SBD help you with any unanswered questions?

66

Example slides
from the report

The Basics

Evolutionary factors of tool development
1990s

2000s

2010s

Mandatory immobilizers
in EuropeTools for theindependentmarket

Cal. Senate Bill
No. 1542(2006)

Although immobilizers are goodat preventing theft, thetransponder keys used to control
them made getting a
replacement or additional keys
very expensive. Since electronicengine immobilizer systems weremade mandatory in the 1990s,
locksmiths and independent
service engineers were looking
for new methods to allow themto continue to supply keys totheir customers.

By the early to
mid-2000s, there
were alreadyseveral companies
and individuals
supplying lowercost multi-brandtools, software,
blank keys andcoding information
however, thesemainly covered
older models.

CA SB 1542 (Legislation)
Legislation to allow a vehicle owner or family member(through a registered locksmith) to access information topermit the production of replacement key or similar device.
This legislation was introduced in California but in essence
was adopted across the US(EU) Repair &MaintenanceRegulation(EU) Repair & Maintenance Regulation“Access must include in particular the unrestricted use of theelectronic control and diagnostic systems of a motor vehicle,
the programming of these systems in accordance with thesupplier’s standard procedures, the repair and training
instructions and the information required for the use ofdiagnostic and servicing tools and equipment”
The passing of this regulation was meant to prevent theOEMs from introducing anti-competitive practices andcompelling customers to return to them for servicing andmaintenance. However, it also prevented OEMs fromrestricting access to security components and information.

2020s

Right To Repair Act
in the USA
Along with Repair and Maintenanceregulations that compelled OEMs to give
freelancers the same levels of access totools, components and data as theirdealership networks; it also stated thatdiagnostic tool suppliers should haveequal access to coding and firmware
information to allow them to develop
service tools. Although the legislation
was introduced with the best intentions,
it inadvertently made it much easier fortool developers to access system dataand components to allow them toreverse engineer solutions.
In 2022, New York became the 1st state
to pass this law on electronic devices,
followed by Massachusetts & Minnesota.
California took upon the act in 2023,
awaiting it to take effect in 2024.

88

The Basics

Theft Tool Trends
The use of Smart key systems (passive entry and passive startsystems) has most definitely changed the way cars are being
stolen. Where vehicle ignition and start systems used to rely on amechanical Steering Column Lock, the majority of newer models
use electronically controlled steering or transmission locks,
controlled from an electronic signal. For the thief, this means they
only have to overcome the electronic command to, unlock thedoors, de-activate the alarm, unset the steering lock and start thecar.
The most well-known method to carry out this type of attack is touse a Relay Tool. This allows the thief to relay the key’s signal
over a larger distance, fooling the car into believing the key is
within range and requesting an unlock and/or start request. Thesetools have been developed over the years to cover multiple brands,
be more reliable and lower in cost (early versions cost in the regionof 50k Euro but are now as low as 8k Euro). Interestingly, Keyless
Repeater have introduced a new tool as part of their line up, that islimited to 3 uses. The purpose of this is so that purchasers can pay
a lower price as a trial, if they like it, they can upgrade the tool
over internet for an additional cost.

9

Many newer models are fitted with a so-called ‘sleeping key’countermeasure or the vehicle is fitted with Ultra Wide Band or
Angle of Arrival time of flight technology. These technologies aregood countermeasures to Relay Attack, and nobody, as far as
SBD are aware, has successfully developed a tool to overcome
them yet.
9The Basics

E – Theft Tools and their functionality

Relay Attack

Code Grabber

Relay attacks consist inintercepting andpotentially storing thesignal the vehicle’ssmart key fob.

The code grabber is a
device used to captureand store the codedsignal transmitted by a
key fob.

On a basic level, theattack is carried out by
2 thieves, one standing
near the car and theother near the smart
key fob.
Thief 1 transmits asignal to the car andthen relays theauthentication reply tothief 2. Thief 2 sends
this signal to the key
fob and then relays the
reply to thief 1, whouses it to unlock andstart the car.

This signal is thensimply replayed to
unlock the vehicle or isused as a sample topredict the correct code
(often by using thesystems algorithm)

KeyProgramming
Key programming
consists of connecting a
dedicated device to thevehicles on-board
diagnostic (OBD II)
port or, via the system
network (CAN, LINetc.)
Specific software isthen used to add orprogram a keyfob ortransponder chip to thevehicles immobilisersystem.

Transponder
Transponders are small
RFID devices,
sometimes encased inglass or carbon but,
more recently, fitted to
the keyfob PCB.
Transponders aredesigned to store andtransmit a coded signal
after responding to acorrect know challenge

These tools aredesigned to Read,
Write and Programtransponders so they
can be used todeactivate vehicle
security systems.

SecurityControl
Security control section
covers other tools anddevices designed tocarry out a range or a
specific action.
Features include:• Immobilizer reset
and/or bypass• Unlocking centrallocking• Disabling the alarm• Read and write data
to/from EPROM or IC• Read, decode orbypass PIN code1010

What’s New?

Overview

Tool Overview
Tool Name

Compatible Brands

VendorDiagnostics Software
Toyota / Lexus / Scion Key Programmingfor Lexus 2022+ (TN016)
Features

Functionality

UNLOCK
STARTOBDCANWIRELESS

Price

Works with AVDI
Key programming
Possible with all keys lost
Compatible with specific
Lexus models including
2023+ model year andnewer

950

Example Compatible Models
Compatible Model••••

Abrites

KeyProgramming

Description

Tool Image
Model Year

Lexus LS

2018+

Lexus NX

2023

Lexus RX2023

Lexus RZ

-Lexus UX

2018+

1111

What’s New?

Overview

Tool Overview
Tool Name

Features

Functionality

STARTOBDCANWIRELESS

KeyProgramming

LonsdorChevrolet Suburban•Price1,200

Transponder

Example Compatible Models
Compatible Model

Description•

Global version all in one key programmer
K518 ProUNLOCK

Compatible Brands

Vendor•There are many more compatible
brands. Please check the attached
Excel for more.

Key programming for
remote and smart keys
Perform functions suchas reading and writing
EEPROM chips, CPU main
control chip operations,and reading EEPROM pin
codes.
Special functions include
reading, writing andcopying key transponders

Tool Image
Model Year2021-2023

Hyundai Sonata

2023+

Kia EV62022+

Toyota Prius

2023

Toyota RAV4

2019-2023

1212Request the priceContact Us

Contact SBD Automotive

Do you have any questions?
If you have any questions or feedback about thisresearch report or SBD Automotive’s consulting services,
you can email us at info@sbdautomotive.com or discusswith your local account manager below.
Envelope with solid fill

info@sbdautomotive.com
Book a meetingBook a meeting

Logo
Description automatically generated

14USA

Garren Carr
North America
garrencarr@sbdautomotive.com+1 734 619 7969

UKGermany

Luigi Bisbiglia
UK, South & West Europe
luigibisbiglia@sbdautomotive.com+44 1908 305102Andrea Sroczynski
Germany, North & East Europe
andreasroczynski@sbdautomotive.com+49 211 9753153-1

India

China

Japan

SBD China Sales TeamChina
salesChina@sbdautomotive.com+86 18516653761

SBD Japan Sales TeamJapan, South Korea & Australia
postbox@sbdautomotive.com+81 52 253 6201
14