Relay car theft - Page 1
Forum section: electronics / general

author: fcb
author_rank: Super Contributor
timestamp: November 27, 2017, 09:46:59 am
content: http://www.bbc.co.uk/news/av/uk-42132804/relay-crime-theft-caught-on-cameraThis has been speculated on for at least 10 years. Now the evidence.So it's going to be a faraday cage for the car keys or buying a crook-lock.

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 27, 2017, 09:56:20 am
content: "To protect against this type of theft, owners can use an additional tested and Thatcham-approved steering lock to cover the entire steering wheel"LOL: Yes, I want keyless entry. Soo handy and trendy. just need to lug this 10Kg object around as well.

author: Kilo Tango
author_rank: Regular Contributor
timestamp: November 27, 2017, 10:06:41 am
content: I thought they used a code - hopping technique on keys so grabbing the signal and resending it wouldn't work. And don't you have to be pressing the key fob button to make it actually transmit ?.Ken

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 27, 2017, 10:17:55 am
content: For keyless entry, you only need to have a card in your wallet. No keypress required.And recording and resending is indeed protected by rolling codes. But simply amplifying the signal by a dumb repeater would work.

author: Jeroen3
author_rank: Super Contributor
timestamp: November 27, 2017, 10:24:36 am
content: Just have the dealer disable the feature. It's an option anyway.

author: Kilo Tango
author_rank: Regular Contributor
timestamp: November 27, 2017, 10:35:02 am
content: Quote from: cybermaus on November 27, 2017, 10:17:55 amthanks for that, I had missed that it was keyless entry.Mind you my Vaux meriva has keyless entry. You lock the car up at night, and come down in the morning to find that the front windows have wound down all by themselves, and if its raining the seats are soaking.Ken

author: Halcyon
author_rank: Unknown
timestamp: November 27, 2017, 10:41:37 am
content: Quote from: Kilo Tango on November 27, 2017, 10:35:02 amConsider it a "feature". It's a bit like your dog tearing up your clothing or toilet rolls when you're away then coming home tothatface.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: November 27, 2017, 10:58:03 am
content: Once out of range of the house/relay wouldn't the card immobilize due to lack of key? i.e. you find your car down the street?

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 27, 2017, 11:03:53 am
content: Based on the video not mentioning it was indeed found down the road, apparently not.Makes some sense in a way. You would not want your car to stall while in a highway tunnel because you already have a old bad card with marginal signal, and some EMI or pants-pocket-flexing just made the last bit of signal disappear. Once its running, its running, I guess.

author: ElektroQuark
author_rank: Unknown
timestamp: November 27, 2017, 11:35:23 am
content: I suppose the device acts now as the card.

author: fcb
author_rank: Super Contributor
timestamp: November 27, 2017, 11:37:03 am
content: Quote from: NivagSwerdna on November 27, 2017, 10:58:03 amNope. The most they do is bleep a dash warning at you that the key is out of range (this has happened a few times when one of the kids goes out to warm the car up, then I drop them off somewhere and they still have the keycard in their pocket) - it certainly doesn't shut down the car.The thieves must either be exporting the vehicles straight away or have a way of defeating the system/reordering keys when they have the vehicle in their possession. They look a bit to organised to just be taking them for a joyride.

author: coppice
author_rank: Super Contributor
timestamp: November 27, 2017, 11:52:34 am
content: Quote from: fcb on November 27, 2017, 11:37:03 amSafety wise I don't think you can stop an operating car if the card goes out of range. You can't have a car simply cut out on the motorway, just because a passenger pops the card somewhere well screened. You might disable the car the next time it comes to a halt, but that could be quite quirky and annoying in practice.

author: Red Squirrel
author_rank: Super Contributor
timestamp: November 27, 2017, 03:39:27 pm
content: I always knew all this wireless tech in cars was a bad idea. It COULD be done securely but we all know how most companies don't care about security when it comes to stuff like this.Interesting that it uses the keys though, so at least it shows there is SOME thought put into the design. You could probably put the keys in a lead box to protect yourself from this.

author: G7PSK
author_rank: Super Contributor
timestamp: November 27, 2017, 03:48:53 pm
content: Dont need a lead box a tin one will doo or just keep them in the fridge, that way no one will be able to grab them with a fishing rod through the letterbox.

author: Nusa
author_rank: Super Contributor
timestamp: November 27, 2017, 04:10:52 pm
content: Wrapping it in aluminum foil like a sandwich would do the trick as well.I notice the scanner guy had to turn around and do his job a second time after the guy got inside the car. Presumably a fresh interrogation of the key was required to start the car. The repeater wouldn't work as a key replacement on its own.

author: dexters_lab
author_rank: Unknown
timestamp: November 27, 2017, 05:46:09 pm
content: we have a keyless entry car too...i described how this type of repeater box attack works to my partner a few months ago and now she keeps the keys in a metal box in the bedroom

author: Jeroen3
author_rank: Super Contributor
timestamp: November 27, 2017, 05:55:02 pm
content: It's an amplifier. The key is a weak transmitter, when you amplify it the car thinks it's near enough to unlock.Then, when you start the car, the key won't be challenged anymore.You can then drive away and use your laptop to pair new keys anytime anywhere, as long as the engine is on.A lotof land rovers have been stolen this way.

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 27, 2017, 06:48:35 pm
content: Quote from: Jeroen3 on November 27, 2017, 05:55:02 pmIs that true? I have trouble believing that, especially the lighthearted "anytime anywhere" part of it.I am sure once they have full hardware access, they get around it. Desoldering flash chips if needed. But you make it sound like "as long as the engine is running, the car will accept all new keys" and I think that may may under-represent it a little. Either that, or the engineers at land rover have been really stupid, given that we are already past the recorded and played back signal age, so some security awareness has set it (its not the 90's or 00's anymore)

author: Jeroen3
author_rank: Super Contributor
timestamp: November 27, 2017, 06:55:52 pm
content: No, it's not like "click here to add key", it's more complicated. But basically: physical access is full access.

author: janoc
author_rank: Super Contributor
timestamp: November 27, 2017, 09:18:01 pm
content: Quote from: Jeroen3 on November 27, 2017, 06:55:52 pmDepends on the car. That Mercedes was likely shipped out to Ukraine/Russia right away. Other cars that have this kind of system - e.g. many new Renaults, Skodas, VWs - are mostly stolen to be taken apart for parts and resold because it is more profitable and safer like that. Nobody will bother with re-keying the ECU in such case.

author: Marco
author_rank: Super Contributor
timestamp: November 28, 2017, 01:19:09 am
content: It's so bloody silly, the silicon to do time of flight distance simulation would have added zero to the cost of manufacture. >10 year old cheap PICs can do it, so could they.There hasn't been justification to do proximity detection based on signal strength in decades, yet we still get systems which do so.

author: Halcyon
author_rank: Unknown
timestamp: November 28, 2017, 01:39:32 am
content: Quote from: coppice on November 27, 2017, 11:52:34 amYou'll find some cars will allow you to drive short distances initially (for example to move the car) but after that it won't allow you to re-engage the driving gears after you put it into park, without the key being present.

author: janoc
author_rank: Super Contributor
timestamp: November 28, 2017, 01:58:17 am
content: Quote from: Marco on November 28, 2017, 01:19:09 amToF is not going to be any more reliable given the usual distances these things work at. Those are nanosecond times. The possible errors (e.g. due to multipath or reflections) would be such that the window within which it needs to accept the signal would need to be fairly large. And I doubt someone is going to try to do a relay attack across a football field - in the typical case the keyfob is only few meters away behind a wall ...Most of these systems don't even do proximity detection based on signal strength - there is no need for it. Either the computer manages to interrogate the keyfob or it doesn't, with one antenna on the outside to open the doors and possibly another one inside that unblocks the ignition. The "proximity" part is only because of the very low power of the transmitter in the fob limiting the distance naturally.

author: bills
author_rank: Frequent Contributor
timestamp: November 28, 2017, 02:41:27 am
content: Ok you guys made me think about this(good thing) I did some tests, The range of the key fob is about .5 meter.test 1- aluminum foil- no response will not work the locks.2- anti static bag , no help fob works just fine.3- aluminised Mylar bag see #2.more tests to come.The car is a 2017 Ford Explorer.At this point I plan to store my fob under my foil hat until I figure a defense.Update A "passport guard" rfid shield worked as well as the aluminum foil, (rogue wallet co.)It is just a paper envelope ??I guess there is no need to alter my foil hat.

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 28, 2017, 05:09:36 am
content: Quote from: Marco on November 28, 2017, 01:19:09 amIt may be more complex.Sure, EM travel time on a pulse is easily done. But a simple responce pulse could be spoofed by the relay itself. So the relay would know when to dumbly pass the data, and when to generate a pulse. To be secure, you would have to be measure response time between an encrypted challenge-response pair.So a challenge token received (at least 64 bit, for a "minor" encryption, but I am sure people will yell about 256 or 512 bit) . Apply some public/private key encryption, in other word, processing time, and send the response back, again at least 64 bit.When a 1uSec calculation and packet length is involved, it is a whole lot more difficult to determine if it arrived in the correct 5ns window.

author: Halcyon
author_rank: Unknown
timestamp: November 28, 2017, 05:29:34 am
content: Quote from: bills on November 28, 2017, 02:41:27 amSimple, don't keep your keys by your front door like 95% of people do. Perhaps keep it in a drawer somewhere else in the house along with all the spare keys, in the unlikely event that the crooks can reach that far into your home with their gear (and not manage to be caught in the process), then multiple keys responding at the same is likely to confuse both their equipment and the vehicle security system.

author: G7PSK
author_rank: Super Contributor
timestamp: November 28, 2017, 08:29:30 am
content: What is wrong with having a button on the key that has to be pushed,or are people so lazy that even that is too much effort. If a button had to be pushed to get the key to transmit it would be no good standing outside the door with a relay unit.

author: Brumby
author_rank: Unknown
timestamp: November 28, 2017, 09:25:35 am
content: Quote from: G7PSK on November 28, 2017, 08:29:30 amThat's just too sensible as a concept.Probably got knocked on the head by a beancounter that found out adding a mechanical switch cost an extra 8.6 cents to the BOM ... and then justified by someone from engineering who said something about reliability of a mechanical component.

author: Halcyon
author_rank: Unknown
timestamp: November 28, 2017, 09:30:19 am
content: Quote from: G7PSK on November 28, 2017, 08:29:30 amTo be honest though, there are cases where it is handy. For example, grocery shopping. If I've got my hands full, I don't need to put bags down in order to grab the keys from my pocket (usually I just want to get the hell out of there). It's not always about laziness. Another example is I usually keep my phone, keys, wallet, laptop etc... all in my back pack which I take to work with me. To be able to unlock the door without going through my bag is great.

author: cybermaus
author_rank: Frequent Contributor
timestamp: November 28, 2017, 09:33:20 am
content: Soon this will all be over.A few more years and your car will recognize you and happily drive up to the shop entrance like a happy puppy because he felt alone when he was not allowed into the shop with you. You may even be able to train him to automatically open the booth.

author: G7PSK
author_rank: Super Contributor
timestamp: November 28, 2017, 09:52:33 am
content: My keys are clipped to my belt, it is easy enough to hold the shopping bags by the handles and reach down with the other to press the unlock button. If I have so much shopping I need both hands I take the trolley to the car. But to a large extent that is all a bit mote, most of shopping is on line and delivered now.

author: rbm
author_rank: Regular Contributor
timestamp: November 28, 2017, 12:33:04 pm
content: Car manufacturers need to add a second factor to get into the car. Possession of the key or key code is the only factor used today. These thieves proved that this can be defeated as easily as guessing a password can give access to an online account. A second factor needs to be present - a biometric such as fingerprint reader on the car handle or PINpad on the door with knowledge of a code to enter. Yes, it's inconvenient.

author: CJay
author_rank: Super Contributor
timestamp: November 28, 2017, 12:49:22 pm
content: Quote from: rbm on November 28, 2017, 12:33:04 pmFingerprint recognition would be difficult to make totally secure and if it was, is you car worth more to you than your fingers because I'm pretty sure that if the car was valuable enough there would be people ruthless enough to deprive you of it and a finger or two.

author: fcb
author_rank: Super Contributor
timestamp: November 28, 2017, 01:15:02 pm
content: Fingerprint is a big no-no.We looked into it as part of an automotive anti-carjacking project 10+ years ago. In the country concerned they even had cases of drivers being taken along for the first mile or two of the ride (then disposed of!!) in-case a particular anti-hijack system was fitted to a vehicle - can't think a professional thief would think twice about removing a finger.It'll probably be the car insurers that force a temporary solution to this problem, either by mandating you have and use a crook-lock (how will they prove it?), or you having to prove that you have had keyless entry disabled. Can't quite see them picking up the bill for long.

author: Marco
author_rank: Super Contributor
timestamp: November 28, 2017, 01:45:17 pm
content: Quote from: cybermaus on November 28, 2017, 05:09:36 amJust send an encrypted word first. The key decrypts that at leisure, then masks the pings with the decrypted word before ponging.On second thought though, with GHz range EM the pulses get awfully wide. If the attacker has a better discriminator than the key/car it might be able to "beat" light speed in a relay attack. Ultrasonic might be easier.

author: coppice
author_rank: Super Contributor
timestamp: November 28, 2017, 01:54:31 pm
content: When at home a lot of people sit really close to their car. If the car is in an integrated garage, or an integrated car port, the car might be less than 2m from the fob in your pocket when you sit in your lounge. Doesn't this cause lots of people problems with keyless entry cars remaining active for much of the time?

author: fcb
author_rank: Super Contributor
timestamp: November 28, 2017, 05:37:38 pm
content: Renault's keyless entry requires you to be quite close to the vehicle (I think they use LF to trigger a response and/or prove proximity, then VHF/UHF for the comms - the keycard will lock/unlock the vehicle when you press it from a much greater distance than the keyless entry system works). You also have to press a little soft-button on the handle to unlock the vehicle, just being close won't open unlock the door.I expect that the devices used by thieves in the video have an LF<>UHF relay built in, probably as well as a UHF<>UHF device - non-trivial stuff, probably only targeting BMW, Mercedes and Land Rover. Also,the video showed the units as quite big, and it looked like they had a backlit LCD display on them.

author: voltsandjolts
author_rank: Unknown
timestamp: November 28, 2017, 06:17:29 pm
content: List of affected vehicles on ADAC is quite long and not all posh brands either. Hell, even my car is on there, ha!https://www.adac.de/_mmm/pdf/Keyless_Liste-gepr%C3%BCfte-Fahrzeuge%20mit%20Motorr%C3%A4dern%2020171016_257944.pdf

author: janoc
author_rank: Super Contributor
timestamp: November 28, 2017, 07:29:33 pm
content: Quote from: fcb on November 28, 2017, 01:15:02 pmAlso most fingerprint readers are very easy to fool. Fingerprints are good to prove identity but (along with all biometrics) must never be used for access control/authentication - we are literally leaving them all over the place. And once compromised, you are screwed - a lost key can be replaced but fingerprint or iris patterns not. You could as well hand the keys to the thieves if you decide to use this.

author: janoc
author_rank: Super Contributor
timestamp: November 28, 2017, 07:42:20 pm
content: Quote from: fcb on November 28, 2017, 05:37:38 pmRenault is also known to be vulnerable - in fact, their system has been one of the first ones where these hacks have been demonstrated if I remember correctly. Just fewer people care, because Renaults are not likely to be stolen in this way - they are not exactly considered as premium cars and most are stolen to be taken apart and sold for parts, so nobody cares if the thief breaks a window/door lock and hotwires something. People buying expensive BMWs and Mercedes cars are much more likely to make fuss - and those cars are usually stolen on order to be resold because in the East they are (still) considered a status symbol.And for people trying to "improve" this by suggesting things like fingerprint readers and what not - keep in mind that the thief can always break a window, hook up an little box to the OBDII socket and drive off with your car, bypassing all these extra gadgets you put in. Most cars have no security whatsoever on the internal bus. Most is just security by obscurity, relying on the fact that the diagnostic messages are proprietary and not publicly available. All you need is a bit of info how to enroll a new key in the immobilizer/ECU - information that every dealer has and it is more than certain that some had it stolen (or exfiltrated by rogue employees).Either Mercedes or BMW has made it even easier for the crooks by making the CAN bus connection accessible from outside of the car so they can even save themselves the window breaking. All this has been demonstrated, just search Youtube ...This is far from a new issue, there have been mainstream press articles about it since at least the last year:https://www.techlicious.com/blog/hackers-keyless-entry-car-radio-tools/And researchers were raising alarm about it for several years now, pretty much ever since the keyless entry systems have been introduced.