Key Fobs hacked??? - Page 1
Forum section: electronics / projects

author: Co6aka
author_rank: Unknown
timestamp: December 06, 2014, 04:20:17 pm
content: Locally (NYC) there's a recent rage of breakless-ins going on; no signs of forced entry, damage, etc. I've been hit three times in the last two months, and this last time after gaining entry it seems they may have connected to the CAN bus. Fuse panel was down plus signs that someone was digging around under the dash. PD brought in a forensics team to dust and search, which seems VERY unusual for a petty car break-in and theft. (No prints except for mine -- no I wasn't sleep-walking!) All over the neighborhood people are insisting their car was locked, but persons-unknown are just opening the door and or windows like they own the vehicle. In a nearby neighborhood one night every or almost every car on the block was opened. Cops also said that's what everyone has been reporting, high end vehicles, low end vehicles, anything that uses a fob.After discussing this locally, it's wondered if the aim was to add another fob to the car so that it could be stolen or stolen later, so that's what I'm going to investigate stat.Besides all the stuff found via Google/etc, has anyone heard anything solid?

author: lapm
author_rank: Frequent Contributor
timestamp: December 06, 2014, 05:51:33 pm
content: Well it has computer in it, someone out there knows how to hack it... That's the problem, computer should be unaccessible from outside..

author: Marco
author_rank: Super Contributor
timestamp: December 06, 2014, 06:24:55 pm
content: Anything is possible, but what's more likely is that they are jamming the fobs and a lot of people simply do it while walking away and don't notice it didn't work.

author: SNGLinks
author_rank: Regular Contributor
timestamp: December 06, 2014, 06:29:20 pm
content: http://www.thisismoney.co.uk/money/cars/article-2812962/How-car-thieves-use-hi-tech-scanners-reprogramme-electronic-keys-steal-luxury-cars.html

author: Richard Crowley
author_rank: Super Contributor
timestamp: December 06, 2014, 07:33:22 pm
content: Those vehicle manufacturers who rely on electronic/wireless methods of security/entry/ignition control, etc. are naive if they think those things offer sufficient security for high-value things like vehicles. If I had a high-value vehicle (I wish!) I would install a "random" (i.e. unpredictable) 3rd party alarm/disable system to encourage the bad-guys to move on to somebody else's softer target.

author: Co6aka
author_rank: Unknown
timestamp: December 06, 2014, 09:04:43 pm
content: Quote from: evb149 on December 06, 2014, 08:23:41 pmNissan (what I have) and the dealer are screamingly-silent re the whole matter. Neighbors tell me the same re their (different) makes. My gut tells me "official" people know something is up but know to keep silent. I made a service appointment for early next week; we'll see. Meanwhile I'm going to implement some "tripwires."

author: saturation
author_rank: Super Contributor
timestamp: December 06, 2014, 11:53:53 pm
content: Its a known problem, the US insurance industry warns about it. Other posts detail how it can be done, and its not limited to just some brand of vehicle, the technique is generic [ and this is aside from the Black Hat conference demo early this year]. Its probably more important over the next few months as cars could be filled with holiday gifts.Currently, the most common issue is theft of vehicle interior contents, i.e., bags, phones, laptops, rather than the vehicle itself, which requires another code. Chances are access to the CAN bus was attempt to obtain the engine start code or the true door-unlock codes if the initial breakin was via a spoof. The thief MO thereafter is to return to your neighborhood weeks or months later for a periodic check of vehicle contents worth taking.https://www.nicb.org/newsroom/news-releases/nicb-warns-against-new-break-in-threatThe codes are stored in the ECU but the spoof can be repeated on the new ECU unless some new protocol was developed by the supplier of the AKE system.I still use mechanical locks and an immobilizer system with a key lock as secondary security. The push-to-start system removes the mechanical component and relies entirely on an electronic key for security even if one didn't have a wireless AKE system.

author: Marco
author_rank: Super Contributor
timestamp: December 07, 2014, 01:21:02 am
content: Quote from: SNGLinks on December 06, 2014, 06:29:20 pmUgh, so basically they made a skeleton key device for police/locksmiths/etc and they thought that wouldn't get resold and/or reverse engineered ... bloody morons. I hope they get sued for damages. We need to make hidden backdooring of products a crime IMO.The obvious right way to handle this is first telling customers this mechanism exists and second by having the police/locksmith call into the car manufacturer with their credentials and the cars serial number (and this need to be logged with the log available on request by the car owner) after which the manufacturer sends them a one time code they can use to unlock/start the car (should probably let the code work until the original key is used with the vehicle again). Problem solved securely.

author: Co6aka
author_rank: Unknown
timestamp: December 07, 2014, 04:09:15 am
content: Yet another award winning design from "JFB Engineering" ("Just F'ing Brilliant")Another thought discussed here is that jumping power to a circuit or circuits that aren't powered when the vehicle is off might come into play.Since this has been mostly happening at night, among a couple of other things, I'm going to run a thin tether from my garage to the vehicle, to tie it into my home alarm system; on its own zone, chime alert when disarmed, and wake-the-dead mode when armed. Won't help anywhere else, but so far all accesses have been in my driveway and parked blocking my driveway. Now I'm only parking IN my driveway. (If I get an alert then Mister Mossberg can pump up the volume.)ALSO, while out walking my dog earlier, I spoke with two people from the neighborhood; on the same night I was last "opened" two other vehicles on my block were also opened, and on the next block over three cars were opened.

author: Co6aka
author_rank: Unknown
timestamp: December 07, 2014, 04:29:41 am
content: Quote from: Marco on December 06, 2014, 06:24:55 pmNope. Not what's going on here. These vehicles were locked. In my case, since the rash of openings started I've been making sure mine was locked when returning home from my dog's last tour of doody, and it was LOCKED.The second opening occurred in mid-afternoon about a month ago. I was parked blocking my driveway. Was a nice day so I took my dog out for a long walk; walked right up to the vehicle and past it on our way out, and all was fine. Returned about an hour later andbothfront windows werehalfway down and all four doors were unlocked. Console and glove box were open, and a pill bottle with about $10 in quarters was missing.

author: Co6aka
author_rank: Unknown
timestamp: December 07, 2014, 04:34:00 am
content: http://www.motorauthority.com/news/1077452_car-thieves-go-high-tech-clone-nfc-fobs

author: amyk
author_rank: Super Contributor
timestamp: December 07, 2014, 05:25:17 am
content: Quote from: saturation on December 06, 2014, 11:53:53 pmAgreed, nothing better than physical security.

author: SeanB
author_rank: Super Contributor
timestamp: December 07, 2014, 05:43:21 am
content: Welcome to South Africa, where this has been common for a while. Of course the way that they typically defeat the system is to come with a gun and take you along, and hopefully they do not shoot you to remove the witness. Seeing as all luxury cars ( basically any car still on a bank loan) will have one of a few tracking companies tracking devices on board, and possibly a fleet management unit as well, they do want the device out.Was talking to a phone tech, he went into a shop on a call, needed a part and went out literally 2 minutes after parking and the van was gone. Called the tracking and they told him where it was and how fast it was going. They got the tracker 20 minutes later hanging in a tree. This was on a vehicle with locks, gear lock and high security immobiliser installed. There have been quite a few cars stolen from where I live, despite armed patrols, high traffic and visible police ( who mostly do so while reading the paper inside the van with the engine running to keep the AC on).Wireless only is easy to defeat, as electronics are cheap. Physical key needs the expensive machinery of a locksmith to make a new key, unless you are really good with some needle files and hand drills, and can get the blank keys. Not too difficult, I have made keys that way before, but it takes a lot of time and needs tools that are not portable or fast.

author: Marco
author_rank: Super Contributor
timestamp: December 07, 2014, 06:15:22 am
content: Quote from: SeanB on December 07, 2014, 05:43:21 amCheap electronics don't break encryption algorithms ... if you design these fobs properly and you don't build in poorly secured backdoors (anything which a dealers can bypass with some offline tool is poorly secured) I don't see how you are going to defeat even something simple like synchronized counters, let alone TOTP. Of course when even something used in banking like NFC is broken by design (ie. the N of nearness is not guaranteed by design, though it could easily have been) expecting any electronic security to be designed properly might be overly optimistic.

author: SeanB
author_rank: Super Contributor
timestamp: December 07, 2014, 06:38:55 am
content: As most of those keyfob systems are made by a single manufacturer, you only need to do one to do all.

author: NiHaoMike
author_rank: Super Contributor
timestamp: December 07, 2014, 07:07:00 am
content: Quote from: saturation on December 06, 2014, 11:53:53 pmA few charged high voltage capacitors would be a good workaround for the issue. Apart from the obvious of leaving them where a curious thief would likely get zapped, you can reconnect the OBD port to some in order to destroy the hacking device.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: December 07, 2014, 08:03:00 am
content: Bad idea - they will cut your seats or something like that in retaliation.Here in Vancouver I noticed that people try to leave cars open but leave nothing inside or some change maybe. It is sort of "reciprocal" behavior as in "I hate you, but thanks for not smashing my car's window". They use piece of porcelain from spark plug to break the glass () which is pretty quiet and sometimes don't even check if door is not locked, doh!. It is a hard choice for those who like to keep tons of junk in their cars.

author: Seekonk
author_rank: Super Contributor
timestamp: December 07, 2014, 11:48:24 am
content: I saw a similar thing on a car forum with keyless entry. Person said he had locked his keys in the car. A helpful stranger walked up and asked if he could help and that he worked for a car dealership. Within two minutes the door was open. This was a four digit code with a five button key entry. Each button was used for two numbers.I had bought a vehicle with keyless entry of the same make. To create your own code you had to take off a panel to get the factory code on the box first. I noticed a simple repeating pattern. There are likely no more than a half dozen factory codes that follow two or three patterns. The message is simple......Nothing is safe in your car.A few years ago the news was about a box you could buy that would send out all the garage door opener codes. They would just drive through the suburbs and wait for a garage door to open. Besides garage stuff, many people do not lock the door access to the house.This summer I bought a good size well known electronic safe at an estate sale. Door was locked but not closed. Manufacturer had a web site and they would supply the code for $4. I figured since the door was open I could remove the back cover and maybe get the code off the circuit board. There was no electronics back there. I was on the front of the safe under plastic. But it was easier than that. Remove the battery door and there was easy access to a wire from the unlatch solenoid. Connect that wire to the battery neg and the door opened. Good thing I only bought the safe for the fire rating.

author: Yago
author_rank: Frequent Contributor
timestamp: December 07, 2014, 12:54:33 pm
content: A couple of questions;In the vid, the chaps gizmo seemed to have communication to the car without much fuss.Was their something I missed, or was the communication unsecured?IE are their checks that the toolkit is a genuine one, or does the car talk to anything that shouts to it?I am also wondering about the common practice of manufacture codes, or emergency service codes being put in place without owner consent or knowledge.Is it actually legal, or is it that it is something yet to be challenged in a court somewhere?It has been done for alarm systems on building for years, but nothing in the first world will get the people screaming like messing with their cars!! (the world is that loony, sigh.)

author: saturation
author_rank: Super Contributor
timestamp: December 07, 2014, 01:34:10 pm
content: For the OP, for safety its better to have the AKE system disabled and use only the manual keys to open your doors and I hope, start your vehicle. That thief basically has a key to your car and knows which one it works on.Since all cars from mid-2000s in the USA have immobilizer ignition systems, the hacker could also have stolen the RFID IDs from your ECU but can't start the car without copying your mechanical key. So at best, they have only half of the key.Alas, replacing at least 2 transponder keys simultaneously, wiping the ECU transponder codes, and disabling the AKE system can cost a lot as only dealerships have the codes to erase the ECU data.@yago, unfortunately, CAN bus standard has no security layer, its wide open. That's the reason so much fuss is made in the press about car hacking, to warn manufacturers to encrypt and restrict entry to automotive electronics. Manufacturers can provide any security measure they wish as AFAIK there is no current standard.The only safeguard owners have is that the CAN bus must be physically accessed by a hacker. If you provide a wireless mode to any ECU function, such as through AKE, then you provide an easy access for them to work on breaking through its security; sadly, most fobs are allowed to challenge the AKE of a car indefinitely until the car opens, whereas in most security we know users are allowed 'X' attempts at a password before it disables itself for some time; this can't be done in wireless keys. Likewise, if you have a built in cellphone system like ONSTAR in your vehicle, users provided worldwide access to a vehicle protected only by a security layer that many are demonstrating to be insufficient for mission critical electronics.

author: Marco
author_rank: Super Contributor
timestamp: December 07, 2014, 03:23:18 pm
content: Quote from: saturation on December 07, 2014, 01:34:10 pmIf dealerships have it criminals have it.

author: Yago
author_rank: Frequent Contributor
timestamp: December 07, 2014, 05:21:05 pm
content: Quote from: saturation on December 07, 2014, 01:34:10 pmThanks for explain Saturation!Can't believe they use such a system, it's almost begging for trouble.If one was to design a system for training car thieves, you know not too rough, walk them through the principles without real challenge... it would be that AKE system.

author: Alexei.Polkhanov
author_rank: Frequent Contributor
timestamp: December 07, 2014, 07:42:34 pm
content: I don't see why do you have to secure CAN itself? If your key FOB can respond to a challenge from ignition controller then it is like your smart card - response sent back from FOB only valid for that single time. Obviously you can pop up the hood and replace ignition controller but you will need like 30-45 min. There is no reason to add more security to your car because if thieves really want YOUR car then they can just tow it away while you are eating your dinner at the restaurant or steal your keys.

author: SeanB
author_rank: Super Contributor
timestamp: December 07, 2014, 08:06:05 pm
content: Quote from: Alexei.Polkhanov on December 07, 2014, 07:42:34 pmReplace ECU with one you already have key for is around 3 minutes tops, using nothing more than a spanner. Here you buy a special cage for the ECU that encloses it in a steel box that needs extra time and tools to undo, and which also allows use of a lock.

author: BennVenn
author_rank: Regular Contributor
timestamp: December 07, 2014, 09:46:32 pm
content: Hi everyone,5yrs ago a mate lent me his new car (I probably shouldn't disclose the manufacturer). I had just got myself a Usbee logic analyser and thought I'd capture a stream from the FOB. The packets are single use and as you would expect, a used packet cannot be reused. However, If you capture 2 consecutive streams you can replay them and unlock/lock the vehicle (a standard lock/unlock press sends more than one packet on a key press). It seems the receivers counter is re-initialised if 2 or more valid consecutive packets are received.I built a little AVR and Tx/Rx device which would record incoming packets and if a repeated packet is detected it will send out the lock and panic button press packets.I took the time to contact the manufacturer and they said they were not aware of this security issue and would pass on my findings. I'm curious to see if the latest models have the same issue. I do know that the IC used in the FOB is not limited to this one manufacturer and my 2014 model SUV (different manufacturer) uses the same IC (and brand ECU) Sounds like a project for a rainy weekend.

author: marshallh
author_rank: Unknown
timestamp: December 07, 2014, 09:55:49 pm
content: Denso is the vendor for many of these systems.... Almost every car uses their parts

author: BennVenn
author_rank: Regular Contributor
timestamp: December 07, 2014, 10:12:09 pm
content: These particular IC's would only be found here in Aus due to the freq they operate at. Unless the PLL multiplier is programmed with the key. The onboard RF path is tuned for 433mhz so perhaps its country specific.

author: Falcon69
author_rank: Super Contributor
timestamp: December 08, 2014, 12:26:08 am
content: I didn't read but the first post.But I have to say.....I had a..well, co-worker, that worked at a car stereo alarm place many years back (actually, it was my friend/roommate's brother). My roommate was also in on it, as I later found out. I moved shortly after I heard his wife and sister one morning bragging to friends how they purchased a bunch of stuff on a stolen credit card her husband had gotten from one of their 'outings' that previous night.While installing high-end stereos and alarms on peoples cars, he would often install an alarm cutoff switch somewhere outside the vehicle where it was hidden; i.e. up behind the splash panel in a fender well. He would make a note about the address of the customer.Several weeks later, the customer would be back into the store complaining why the alarm didn't work when it should have and that his multi-thousand dollar stereo, and sometimes the expensive alarm, was stolen one night while his vehicle was parked outside his home.This happens alot more than people think. Crooks are everywhere. Make sure you check the car over very good after you get it back from a car stereo place.

author: GEuser
author_rank: Frequent Contributor
timestamp: December 08, 2014, 12:18:37 pm
content: Saw this on a Tv news report last night .http://www.perthnow.com.au/news/western-australia/perth-car-owners-to-get-gps-trackers-to-fight-thieves/story-fnhocxo3-1227147152907?sv=63d8af96034a467a5292edd69c9d1b20&nk=497cce3abbdd8eae72bee4a0f58ef1b3#itm=newscomau%7Cnews%7Cnca-news-most-read-state%7C1%7Cperthnow%7Cindex%7Cnational-western-australia&itmt=1418040669894Basically they are giving free 1000 gps tracking devices away in the hope that (in the advert) that if a car is pinched it just could be one of those 1000 and it'll guarantee one will be caught at it immediately they say .On the tv it was a Blacknight? or Black ice? small device .edited> just found it a Black Knighthttp://www.bk-gts.com/shopre-edited , I could not find a video repeat , another storyhttps://au.news.yahoo.com/thewest/a/25705771/gps-trackers-to-cut-car-theft-in-perth/

author: leppie
author_rank: Frequent Contributor
timestamp: December 08, 2014, 12:33:10 pm
content: Quote from: SeanB on December 07, 2014, 05:43:21 amInterestingly, SA customs wont let you import a blank key. I wanted a new fob cover for my Merc, and had to provide all kinds of proof before they released it several months later. Sadly, the replacement was not 100% compatible and in the end could not even use it...

author: saturation
author_rank: Super Contributor
timestamp: December 08, 2014, 12:58:18 pm
content: As the prior posts with links from my last show, many of your car theft issues can be reduced or even solved by removing or disabling your advanced keyless entry systems.http://www.theguardian.com/money/2014/oct/27/thieves-range-rover-keyless-lockingThe immobilizer is effective, its a 2 technology key: electronic and mechanical, so a thief needs to defeat 2 different unrelated systems. But then the thieves, if they really want your vehicle, will either steal your key outright or resort to a car jack.It has a flaw, over time the ECU memory which stores the key code can be corrupted, so your registered key can be deregistered, and you can't start the car. The solution is register at least 2 or more keys, and always keep the second key available.New car mechanical keys are much more precise and difficult to cut, you need a 'laser' cutter which is not a laser just a small table top precision router to cut keys over the old style grinder design.It can create keys in 3 axes, x,y,z: that is a key with peaks, valleys and side indentations. If you look carefully at a mechanical car key made for vehicles since 2005 and compare it against your door key you'll notice that the ridges have no sharp edges and make very subtle transitions from one direct to the next.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 08, 2014, 02:08:30 pm
content: Amazing how poorly all this has been implemented - e.g. the spate a while ago where people could smash a window, plug into the OBD and add a new key.What moron designed a system that allowed a new key to be added while the system is armed - idiotic.Pretty much any "genuine" need to do stuff like reprogram keys by dealers to deal with lost keys can be done via physical access control that's hard to do "on the street", as well as maybe some delays - e.g. need to access something, which makes the lights flash randomly for 30 mins before allowing a key to be added.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 08, 2014, 02:10:14 pm
content: Quote from: saturation on December 08, 2014, 12:58:18 pmOf course a patented profile means nobody can make a copy

author: saturation
author_rank: Super Contributor
timestamp: December 08, 2014, 04:00:21 pm
content: ... I think that key technology is patented, but that example just demos features that car keys try to do, tumbler cuts in unusual axes or depths.Here is an academic paper that gives an overview of the AKE procedure and a summary of various hacks.https://eprint.iacr.org/2010/332.pdfwww.isoc.org/isoc/conferences/ndss/11/slides/2_1.pdfIf access is restricted some websites offer the paper for free, google the title:"Relay attacks on Passive Keyless Entry and Start Systems"I forgot one quick thing anyone can do is pull the battery so the AKE radio is disabled then reconnect as needed but make sure your car will tolerate having the battery pulled; some cars can take a long time to reboot systems and some vehicles may not start until it systems give an OK.For example, in some newer economy Mazdas like the 2 or 3, the TPMS & the traction control require 5min to initialize then you need to turn the steering wheel to lock extremely right then left to turn off the traction control error light, then drive the car over 15 mph for 15 min before the TPMS error light will go off.Safe Holidays, all.Quote from: mikeselectricstuff on December 08, 2014, 02:10:14 pm

author: Rigby
author_rank: Super Contributor
timestamp: December 08, 2014, 05:36:20 pm
content: has anyone reversed the two-way communication between keyfob and car, for any make or model?for my hyundai, when i push a button, the keyfob sends out a signal to the car and the car responds, then the key sends another signal, and the car does whatever it's supposed to do according to the button I pressed.I don't have the equipment (or maybe I do, an SDR dongle) or the expertise to work out what data is going back and forth, but I'd love to know.

author: free_electron
author_rank: Super Contributor
timestamp: December 08, 2014, 07:09:50 pm
content: Quote from: saturation on December 07, 2014, 01:34:10 pmso essentially everyone has them..a code is only secure if known by you and only you.QuoteNot true. There is such a thing as secure links over CAN.CAN is only a transport layer much like MAC adresses deliver packets from to. What is in the packet may be protected by encryption/handshakingThe same is done on CAN.Keeloq and the other known keyless entry systems have all been hacked using massive rainbow tables years ago.one of the problems is that the network in the car is not physically partitioned. the odb connector lets you sniff anything and everything. That should be stopped. ODB should give you only a copy of the stream and only a copy of relevant messages. odb should be one way as well. anything injected on the port is not passed to the real bus.

author: Rigby
author_rank: Super Contributor
timestamp: December 08, 2014, 07:58:30 pm
content: The ODB connector is how a technician talks two-way to the ECU, though. Reset fault codes, firmware upgrade (assumed) and so on.

author: Rigby
author_rank: Super Contributor
timestamp: December 08, 2014, 08:02:29 pm
content: Besides, as part of the ODB 2 spec, it must be accessible (in both directions) by the customer (car owner.)It can be secured and be read/write.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 08, 2014, 08:19:12 pm
content: Quote from: Rigby on December 08, 2014, 08:02:29 pmAnd it doesn't have to be accessible when the security system is armed.

author: BennVenn
author_rank: Regular Contributor
timestamp: December 08, 2014, 10:07:01 pm
content: Quote from: mikeselectricstuff on December 08, 2014, 08:19:12 pmUnless the service center needs to replace a lost key. . .

author: Rigby
author_rank: Super Contributor
timestamp: December 08, 2014, 10:23:54 pm
content: There are ways to keep security, keep read/write rights in the customers' hands and keep it secure. Arguments otherwise are ill informed.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 08, 2014, 10:28:19 pm
content: Quote from: BennVenn on December 08, 2014, 10:07:01 pmMost cars come with 2 keys, so the other can be used to disarm.There would be plenty of ways round that. Even something simple like having to open all the doors & wait 15 minutes.

author: BennVenn
author_rank: Regular Contributor
timestamp: December 08, 2014, 10:37:33 pm
content: Yes, our new car did come with two keys, only one had the FOB, the other was just the key with the close proximity transponder to deactivate the immobiliser. As far as I know, the OBD port is free to poke and prod but actually reading or writing to the ECU's flash requires multiple security keys for different regions of flash. This on its own provides enough security to prevent re-mapping (on the hobbiest level and even most tuning shops - without purchase of licenses and software) and certainly re-pairing a new set of keys. Also, a single key cannot be added, all keys must be added at the same time as the flash is erased before written (from previous experience with replacing damaged FOB's)It would be interesting to know the real reason someone would bother getting access to an OBD port during a break-in (and with the engine off!)

author: VK5RC
author_rank: Unknown
timestamp: December 09, 2014, 12:18:42 am
content: Seriously isn't the biggest issue is you can tow a car pretty easily, a police friend indicated if you own a 'world' car, ie sold in multiple continents, and is worth a modest amount, it gets towed, put in a container sent overseas and stripped for parts.

author: saturation
author_rank: Super Contributor
timestamp: December 09, 2014, 12:25:41 pm
content: Yes, couldn't agree more, freee-.As there is no standard for security or encryption it varies from make to make. The dealerships may not actually have codes for access to the deep layers of the ECU; this is in one part of its security layer, "security by obscurity" and hopefully some true technicality.Most ECU programmers available to the general public today are to access what is allowed for general automotive use, and yes, there is no security here you plug and play its open to all:http://www.cardone.com/products/electronics/electronics-products-service-plus/cardone-service-plus-flash-2-all-makes-reprogrammerThe deep layers involve the AKE system, air bags, brakes etc., which is taboo to the open market.Yes, I did mention that manufacturers can provide their own security layer, whatever that may be. But just how secure it is no one knows because its not open to scrutiny like a standard. It might explain why some makes of vehicles are hacked more easily than others.What the world needs is a standard, so the protocol(s) is-are assured to be secure by careful analysis.A summary of the work in progress:http://cache.freescale.com/files/automotive/doc/white_paper/AUTOSECURITYWP.pdfQuote from: free_electron on December 08, 2014, 07:09:50 pm

author: G7PSK
author_rank: Super Contributor
timestamp: December 09, 2014, 03:01:18 pm
content: No reason why the manufacturers cannot keep a security code that is required in order to program a new key fob. To be able to do it from the can bus alone is stupid. If I were the OP I would buy myself a crook-lock and a wheel clamp,that way the only way to take your car is with a low loader.When The battery was changed on my previous car it was discovered that I did not have the security code for it, I had the car from new and the pre sale cleaner removed the stickers with the number. to get the number I had to go to the main Chrysler dealer and they had to contact the manufacturer for the code, if that was the same for the car itself it would remove the crooks from the loop.

author: Seekonk
author_rank: Super Contributor
timestamp: December 09, 2014, 04:34:36 pm
content: I find it interesting that the window is found down. If you can unlock the door, why spend time lowering the window? Sounds like access is through the window control system. Then they have access to door unlocking.

author: Rigby
author_rank: Super Contributor
timestamp: December 09, 2014, 04:53:19 pm
content: I wonder if this ... how far away is the actual key fob when the attackers succeed in gaining entrance? Are they just stimulating the existing two-way communication and letting the actual key fob and car go about their normal authorization?For example:I have a little thief box that signals the car that I've pressed the unlock button on a legitimate key fob. I push a button that spoofs this message to the car from the thieving tool.The car then asks for the key fob id, to know that the fob is the authorized one. Let's say the car is only going to respond to a key fob with ID 0x2345.If the actual legitimate key fob is in range, it will receive this message and it might respond with the proper ID, because it's the legitimate key fob. It responds with "0x2345."The car thinks, "key fob is legit; I'll unlock the doors," then does so.If that's what's going on then this is a very clever little hack, and it could be remedied relatively cheaply by car manufacturers by adding a TINY bit of logic to the key fob hardware so that it doesn't respond to any communication from the car unless a button has been pushed in the last 100ms. It might even be a simple firmware upgrade to existing fobs.

author: BennVenn
author_rank: Regular Contributor
timestamp: December 09, 2014, 09:51:34 pm
content: Quote from: Seekonk on December 09, 2014, 04:34:36 pmThat sounds likely. I had a first gen Holden Astra (Opel motor) which only had the one key and liked to lock its doors with the keys inside. The easiest way in was to use a coat hanger to hook the wiring loom between the rear door and the pillar to get access to the central locking wires. You could unlock all four doors this way. Quick and easy. This would set the alarm off on a new car, but activating the window motor wouldn't.My girlfriends Jeep would lock its doors if you closed the tailgate while the engine was running. Countless times the keys would get trapped in the back with a load of groceries. We would pop the bonnet (no lock on a jeep) and pull the fuel pump relay. The engine would die and doors would unlock. There is almost always a way to get in