Rolling codes for large number of autos broken? - Page 1
Forum section: electronics / general

author: Cyclotron
author_rank: Unknown
timestamp: August 09, 2025, 12:28:45 am
content: While at Black Hat, I discovered some details about the described software for the Flipper Zero.https://cybersecuritynews.com/flipper-zero-darkweb-firmware/I have not received a copy yet, but if true, this will have profound implications for individuals who own affected vehicles. It also means that other rolling code systems may not be far behind.If you live in Canada, the police recommend leaving your keys by your door anyway, so it may not impact them as much.https://globalnews.ca/news/10359055/leave-car-keys-the-front-door-to-avoid-home-invasion-toronto-police/

author: Stray Electron
author_rank: Super Contributor
timestamp: August 09, 2025, 01:52:43 am
content: It sounds to me like the people of Canada need more of the U.S.'s 2nd Amendment Rights.

author: Halcyon
author_rank: Unknown
timestamp: August 09, 2025, 02:06:20 am
content: Quote from: Cyclotron on August 09, 2025, 12:28:45 amSo, instead of letting the crook steal your car remotely, they suggest putting your keys in a faraday bag, near the door, so the car thieves are essentially forced to break into your house, to steal the keys.Where is the logic behind this? Am I the only one who thinks this is completely idiotic? Why not be the victim of two crimes instead of just one.

author: Stray Electron
author_rank: Super Contributor
timestamp: August 09, 2025, 02:16:17 am
content: X2. I think that if you force the thieves to break into your house to get your car keys then they're going to help themselves to anything that they like while they're in there.I am not sold on the electronic locks that they're using in cars today. I want a dammed key that is a KEY and not some electronic gizmo that can be fooled with the cap off of an ink pen.

author: Cyclotron
author_rank: Unknown
timestamp: August 09, 2025, 02:40:53 am
content: Quote from: Stray Electron on August 09, 2025, 01:52:43 amIndeed, one of my work peers lives in Toronto and had to install those barriers that come up out of the ground on his driveway.

author: David Hess
author_rank: Super Contributor
timestamp: August 09, 2025, 03:45:56 am
content: Quote from: Stray Electron on August 09, 2025, 01:52:43 amThat was my first thought.My pickup is 2002 so has nothing fancy as far as security, but I am thinking of adding a defeat for the starter with a reed relay and magnet in the cup holder.

author: RJSV
author_rank: Super Contributor
timestamp: August 09, 2025, 03:56:46 am
content: Was just thinking about similar subject, as NFC started showing up as enabled (Android). The official description (AI summary,...Yawn) saying starting with describing MY CONVENIENCE, how lucky to be able to pay so effortlessly. I was simply wondering how THAT got pushed onto my personal system.The new phone has been pushing, maybe 4 separate 'updates' plus now the new NFC reaching out to (who knows where), along with some stupid game system update (never requested).But I admit; that message about how to 'avoid criminal engagement', by submitting to their intended theft, is a shocker.Maybe those with young children, should offer them up, NOW,, (to predators). Wouldn't want to piss them off, either....(That's my sarcastic fictional )

author: Haenk
author_rank: Super Contributor
timestamp: August 09, 2025, 06:28:41 am
content: Quote from: David Hess on August 09, 2025, 03:45:56 amWe had a similar idea when driving to Poland once a year, back in the 90s.There is a German saying "Kaum gestohlen, schon in Polen" - which roughly translates to "once stolen, it's immediatly brought to Poland". And that was very true at that time.So driving to Poland with a new German car was a very risky thing.The defeat device? A switch in the console built into an empty slot, looking like all the other switches - disabling the fuel pump.Sure enough, the car was broken into twice within two weeks, but cracking the steering wheel lock didn't work - the thieves just could not get the car to run

author: Cyclotron
author_rank: Unknown
timestamp: August 09, 2025, 02:28:11 pm
content: Quote from: Haenk on August 09, 2025, 06:28:41 amI've placed a white flag in the window. In the US this is often a sign of a disabled car. It may not work. But the car was still there when I came back the few times I did it. That was in the 80s/90s in LA.

author: tszaboo
author_rank: Super Contributor
timestamp: August 09, 2025, 03:28:22 pm
content: Quote from: Halcyon on August 09, 2025, 02:06:20 amIt wouldn't be a problem, because they stopped fighting crime anyway.Crime is only when you don't pay taxes, or say something that the state thinks is problematic. Then you are in trouble.Keyfobs: I think they do this intentionally. So they can eventually sell their stupid smart features subscription service for the car, which relies on having your phone with an app, and basically tracking you constantly. Like look at us, we tried, now give us all your data. And 40 bucks a month.

author: UnijunctionTransistor
author_rank: Frequent Contributor
timestamp: August 09, 2025, 04:48:38 pm
content: Quote from: tszaboo on August 09, 2025, 03:28:22 pmExactly.When I purchased my new Toyota RAV4 earlier this year, I haggled and haggled and haggled with the dealership about certain features and most importantly, the loan's interest. In the end I had to agree to a 3 year subscription to CarRx, which is basically a GPS tracking device, for US$400 upfront, which means about US$11 per month.But I don't plan to renew it. I immediately got buyer's remorse, although I did get the favorable financing terms. And I am told that I can get a small reduction in my auto insurance premiums.

author: themadhippy
author_rank: Super Contributor
timestamp: August 09, 2025, 05:17:11 pm
content: Quoteink cap? i remember the days when all you needed was 1/2 a tennis ball

author: tom66
author_rank: Super Contributor
timestamp: August 09, 2025, 05:55:52 pm
content: Quote from: Halcyon on August 09, 2025, 02:06:20 amBecause car theft is usually opportunistic. A thief wants to grab a car and get it to a fence/part it out asap. Many of them work for theft gangs who buy this equipment, and they have connections to get the cars out of the country or to strip them out and sell the parts.Make it a little bit harder for them and they'll not bother with your car, which is really what you care about. A thief that breaks in to a home risks arrest due to leaving additional evidence, being caught by the homeowner, perhaps being shot or otherwise depending on the area.It's the same theory behind CCTV. Just create that psychological barrier that you are being watched and may be caught from that evidence. So they'll go elsewhere.Quote from: Stray Electron on August 09, 2025, 01:52:43 amOr just a police force that actually deals with petty crime (a problem all over the world, not just located to Canada). And then deals with recidivism and getting people out of the loop of crime. Most criminals aren't fundamentally bad or incurable people, just in the wrong set of circumstances with crime as an easy solution. Resolve that problem and they don't offend again. Of course, there are a few percent who will continue to do it, and those need to be kept away from society, butin generalthis is true for the criminal population.

author: Benta
author_rank: Super Contributor
timestamp: August 09, 2025, 06:25:07 pm
content: Interesting.I've been studying the keyless entry/start issues.The first article is deliberately obscure and contains a number of red herrings. Perhaps a good thing, although "security through obscurity" never really worked.The second article can best be described as "total policing bankrupcy" in Toronto. Sad.

author: David Hess
author_rank: Super Contributor
timestamp: August 09, 2025, 07:05:18 pm
content: Quote from: Cyclotron on August 09, 2025, 02:28:11 pmI knew someone who would make a fake ticket to put under their wiper when they parked.Quote from: tszaboo on August 09, 2025, 03:28:22 pmThis happens with law enforcement in the US also. Arresting and charging lawful citizens is a lot safer than doing the same to actual criminals, who are more likely to respond with violence.

author: tszaboo
author_rank: Super Contributor
timestamp: August 09, 2025, 10:37:33 pm
content: Quote from: themadhippy on August 09, 2025, 05:17:11 pmThat was a hoax BTW. You cannot open a car with a tennis ball and the half a milligram of slightly pressurized air in it.Quote from: UnijunctionTransistor on August 09, 2025, 04:48:38 pmNice car, I really like the RAV4. When I was buying my Toyota, they wanted similar amount to update the GPS in it. I left it like that, I only sometimes end up in Germany if I want to go somewhere.

author: themadhippy
author_rank: Super Contributor
timestamp: August 09, 2025, 10:48:56 pm
content: Quoteyouve obviously never owned a vauxaul van

author: David Hess
author_rank: Super Contributor
timestamp: August 09, 2025, 10:56:22 pm
content: Quote from: tszaboo on August 09, 2025, 10:37:33 pmI fear having to replace my 2002 manual 2.2L inline-4 GMC Sonoma after following the trials and tribulations of modern engines and vehicles. The situation makes me wonder if it would be worth my time to buy an older vehicle, and refurbish and repower it.

author: Monkeh
author_rank: Super Contributor
timestamp: August 09, 2025, 11:28:01 pm
content: Quote from: Halcyon on August 09, 2025, 02:06:20 amPerhaps their thinking is that there are those who will use a relay attack to steal the vehicle, and you may frustrate them by blocking it. They then may decide to just leave, rather than make a lot of noise - the smart ones, say. Then there are those who aren't that sophisticated, and will just break in to find the keys. You'd probably rather they find them and leave than decide that now they've made such a racket, they have to find them, even if it means going through you to do it. Remember, the dumb ones are particularly dumb and fall for all the worst logical fallacies in rapid succession.Being that they're involved in investigating thefts and home invasions complete with injury or death, they may some data to support that. I don't have any either way.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 12:11:18 am
content: The obvious solution to car theft is MFA authentication. 2 factor....3 factor... whatever it takes.

author: wilfred
author_rank: Super Contributor
timestamp: August 10, 2025, 12:23:48 am
content: Quote from: Halcyon on August 09, 2025, 02:06:20 amThere has to be a flaw in that logic somewhere.I don't want to be the victim of any crime. I don't want to be choosing from a set of crimes to decide which are acceptable to me and which are not. I think I'd already become a victim of crime if I did that.Years ago before eye-level brake lights were a standard feature I bought an accessory set that mounted to the rear window. Someone broke in and stole them and a bit of change in the console. Thankfully it was a recent purchase and I'd emptied the console of over $600 in the previous car a couple months earlier. I didn't mind losing the $20 lights but $750 to replace the broken window glass made me wish I'd left the car unlocked.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 10, 2025, 12:43:22 am
content: Quote from: wilfred on August 10, 2025, 12:23:48 amI once had my Honda Civic wagon broken into. Rear side window broken, forget how much it cost me to get it replace.They made away with a grand total of $3 in bridge toll money.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 12:45:48 am
content: Common wisdom for airplanes was leave them unlocked, so they don't destroy the airframe for 5k worth of avionics.Of course, that situation is s little changed these days...

author: Cyclotron
author_rank: Unknown
timestamp: August 10, 2025, 02:55:19 am
content: In San Francisco, people often leave their windows down, doors unlocked, and sometimes even the trunk open, allowing thieves to take a look.The act of theft in these cases is called "bipping". No idea why about that one.The police either can't solve the problem or aren't willing to; at least that's my guess.https://abc7news.com/post/san-francisco-car-break-ins-oakland-why-not-to-leave-your-trunk-open/11341223/

author: neverendingstudent
author_rank: Regular Contributor
timestamp: August 10, 2025, 03:18:42 am
content: Well holy crap. At first glance I thought this would be sensationalized journalism about the fact that you can MITM a single code intercept from a rolling code fob (and only that one code if the car doesn't 'hear' it, and only for a single code broadcast) - but no, it looks like they actually broke the fob crypto or the crypto leaked. Just damn.I'm going to have to stop using the RF functions on my fob and actually lock/unlock with the physical key. That sucks!Edit: I should probably research to find out if only certain manufacturers or model years are affected.

author: Cyclotron
author_rank: Unknown
timestamp: August 10, 2025, 03:26:41 am
content: Quote from: neverendingstudent on August 10, 2025, 03:18:42 amYeah, I am aware of the rollback attack, and at first glance, I thought they were talking about that, but then I was given this link to read, and wow. If true, it's going to suck. I expect to hear more from a contact of mine this week. We'll see.

author: David Hess
author_rank: Super Contributor
timestamp: August 10, 2025, 07:24:02 am
content: The part I do not understand is how the rolling code cryptography could be implemented wrong. The crypto math almost always works.

author: tszaboo
author_rank: Super Contributor
timestamp: August 10, 2025, 08:39:36 am
content: Quote from: David Hess on August 10, 2025, 07:24:02 amFrom the description, it looks like they used the same private key on every single cars. Or something that's predictable enough that you can guess it in a short amount of time.So the car keys change their code every time, but the next code can be guessed.

author: tom66
author_rank: Super Contributor
timestamp: August 10, 2025, 08:43:27 am
content: From a single code it seems unlikely that you could guess where the car and key are. But many people press the unlock button or lock button on their keys several times, so perhaps that will provide enough codes to determine the position in the sequence in a non-ambiguous fashion.I also wonder what makes/models are impacted. Some may have very short repetition ranges, which could perhaps be 'cracked' by commodity hardware quickly. Others might be limited to high performance computers for cracking and so currently impractical. One issue is that locksmiths are sold the software to reprogram keys by manufacturers, so there's probably a lot of information out there for someone who wants to disassemble that software on the types of protocols in use. Assuming it's not cloud based -- one legitimate use of a cloud-based software package here is it would obscure the full algorithm. And whilst security by obscurity is frowned upon, for certain use cases, it's very hard to build a system that does not use some form of obscurity to achieve the intended security, whilst having all the features customers want (like being able to buy a new key for their car when they lose it.)

author: Haenk
author_rank: Super Contributor
timestamp: August 10, 2025, 11:07:53 am
content: Quote from: neverendingstudent on August 10, 2025, 03:18:42 amHaha, talk about my (vintage) Lexus. That "crypto" has been broken for who knows for long. The crooks only need your VIN (which is prominently displayed under the front window glass) and can calculate your remote unlock code, which opens the doors and disables the alarm. Then you can simply start the car using OBD. How genius is that!This made my Lexus one of the most stolen cars over a couple of years. Fortunately, it's now old and not fancy, so no one would bother stealing it. Still a great car though.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 10, 2025, 12:07:53 pm
content: Quote from: Haenk on August 09, 2025, 06:28:41 amA Polish friend of mine who used to work modifying cars to make them harder to steal used to say that it should take a car thief longer to defeat their anti-theft system than it takes him to install it (this may have been marketing to explain the per-hour charge). Their stuff would create weird faults after awhile, so the thief would apparently get away and then the car would stall and other odd things would happen. The end result was a theft-discouraging car rather than an attempt theft-proof car.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 12:21:40 pm
content: Quote from: 5U4GB on August 10, 2025, 12:07:53 pmWouldn't you hadn't to steal it first? How does the discouragement work?

author: NiHaoMike
author_rank: Super Contributor
timestamp: August 10, 2025, 12:26:32 pm
content: The biggest fail in recent times has to be Hyundai/Kia that didn't even check if the key is legitimate.Quote from: John Coloccia on August 10, 2025, 12:45:48 amI expect security to get tightened as there's now an actual market for "untrusted" aircraft parts - Russia.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 12:32:52 pm
content: I have to wonder how the rolling codes are implemented and why rollback works in the first place. Like, it sounds like they're cyclic as opposed to hashed. Or it's a crappy hash that has a reliably short cycle.I do also wonder why modern vehicles don't use a random challenge. That is more or less immune to attack, short of physically stealing the key, including jamming attacks (or any other MITM)

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 01:01:55 pm
content: Quote from: NiHaoMike on August 10, 2025, 12:26:32 pmCrappy counterfeit hardware has been working into the supply for decades now. You think you're buying a particular grade bolt, and instead you get something made out of cream cheese. Totally not surprised that it's getting more sophisticated.When I have a minute, and if I still have the pictures, I'll post the craziest counterfeit I ever personally saw.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 10, 2025, 01:26:17 pm
content: Quote from: John Coloccia on August 10, 2025, 12:21:40 pmIf the car refuses to start/move then it's a clear sign there's an immobiliser at work, so the thieves disable it and continue. If it sort of works some of the time then it appears to be a faulty car not worth stealing.

author: Cyclotron
author_rank: Unknown
timestamp: August 10, 2025, 02:31:02 pm
content: One of the most effective theft deterrents, some say.

author: Stray Electron
author_rank: Super Contributor
timestamp: August 10, 2025, 02:48:44 pm
content: A lot of the newer cars don't even have a place to put a mechanical key into the ignition. My wife's Sonata doesn't. Everything is done by RF. You can take the key fob apart and there is a small mechanical key in it but it can only be used to unlock the driver's side door and nothing more. The main car battery failed recently and the car refused to recognize the fob so we had it towed to the Stealership and they tried to tell my wife that the car NEEDED almost $5,000 in work. I bought a battery somewhere else and put it in and drove the car home. That's something that I'm now seeing with a LOT of modern cars, the battery appears to be working however the car completely refuses to recognize the fob. Now I tell people that if that happens or if you get a sudden weird electrical problem, replace the battery! A replacement battery costs a lot less than a tow trip to the Stealership and their diagnostic charge. And FAR less than all of the other work that they will try to tell you that your car "needs".I bought a MB recently and I did my research and I purposely bought an older model SL500 that does use a mechanical key instead of a newer model that uses RF.

author: Haenk
author_rank: Super Contributor
timestamp: August 10, 2025, 03:19:34 pm
content: Quote from: 5U4GB on August 10, 2025, 01:26:17 pmUnfortunately, this is no longer the case (as in: for many years now).Spare parts became so expensive nowadays, often cars are stripped from valuable parts when just being parked somewhere.I experienced that myself - my brother parked his broken (engine stalled, waiting for repair) VW Passat on our companies parking space - after a couple of days, the front grill was gone. At that time, those were traded for hundreds of EUR, so someone saw an opportunity.Same parking space - my wifes old (engine failed - see a pattern there?) Opel lost its side mirror. As the car was just waiting for the scrap yard to have it picked up, that was no loss, theft anyway.

author: themadhippy
author_rank: Super Contributor
timestamp: August 10, 2025, 03:34:19 pm
content: Quotesurprised they aint coded every part of a vehicle yet , your car wont start if you replace the wing unless you get it re coded by the main dealer.

author: Cyclotron
author_rank: Unknown
timestamp: August 10, 2025, 04:57:48 pm
content: Quote from: themadhippy on August 10, 2025, 03:34:19 pmIt's not far from that for sure. Anything that has a CPU, today's cars, having 30 to 100, are all usually coded to that specific vehicle. Replacing a part on a car with a used part can be tricky. Some can be recoded if you have the OEM codes, some can only be changed a limited number of times without involving someone who would fit in on this forum.OEMs often speak of these difficulties with pride as they claim they are theft deterrents. Any criminal enterprise can easily develop the skills and tools required to return parts to a "new" programming state. The OEMs just don't admit that the likely reason is to funnel more money to the dealer network.

author: tom66
author_rank: Super Contributor
timestamp: August 10, 2025, 08:36:43 pm
content: At least for European makes, only a few parts tend to be VIN-coded, like the head unit, but it's not uncommon to find configuration coding, so even if a part is not directly "theft protected", if it is not from exactly the same variant of vehicle, lots of functions will not work right. As an example, the VW Golf 7 comes in about 8 different variants and the head units between those are often not directly compatible without re-coding, with features missing if not coded correctly.

author: Monkeh
author_rank: Super Contributor
timestamp: August 10, 2025, 08:53:20 pm
content: Quote from: themadhippy on August 10, 2025, 03:34:19 pmThey've moved on. GM battery packs will blow the pyrofuse if the airbags go off. They do not sell the fuse, they do not sell the connector block the fuse goes in. It's inside the battery - those, they sell..

author: Benta
author_rank: Super Contributor
timestamp: August 10, 2025, 09:37:31 pm
content: Quote from: John Coloccia on August 10, 2025, 12:32:52 pmThe problem is that the challenge (or rather, activation) is transmitted on a 125 kHz carrier. There's not a lot of bandwidth there for advanced coding.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 10, 2025, 09:54:05 pm
content: Quote from: Benta on August 10, 2025, 09:37:31 pmThe beauty of a challenge/response is the comms aren't encrypted. It's literally...Here's a thing...you encrypt it and prove our keys match.Here's my response. Can haz car?You have to agree on a key, but that's what pairing is for. After that, unless you have a leaky hash, you get 0 information. Theoretically, you could MITM and happen to get the same challenge twice, but that's not real, and it's also easy to prevent for the last thousand challenges, say.For multiple fobs, you either store their keys, use the same key, or simplest is use a diversified key.But the comms are completely unencrypted.I only happen to know this because the industry I'm in has suddenly gone all in on cybersecurity, and we've had to do a deep dive to understand what's what. I have multiple projects where this is an issue.

author: tom66
author_rank: Super Contributor
timestamp: August 10, 2025, 10:27:03 pm
content: Quote from: Benta on August 10, 2025, 09:37:31 pmThe challenge-response can actually be quite small. If the key is large, you can ask for a 32-bit response to a 32-bit challenge and have essentially impossible odds of brute forcing it, especially if you limit the system to one challenge-response per second or so.

author: UnijunctionTransistor
author_rank: Frequent Contributor
timestamp: August 10, 2025, 10:53:33 pm
content: Quote from: Stray Electron on August 10, 2025, 02:48:44 pmIt is going to get worse, a lot worse. Watch the video and weep.https://youtu.be/Ax9FFuRmGoU?si=DJzEWvi0OdqVwPDF

author: TimFox
author_rank: Super Contributor
timestamp: August 10, 2025, 11:01:06 pm
content: Quote from: Stray Electron on August 09, 2025, 01:52:43 amCanada has about 35 firearms per 100 people, more than most countries, but less than the 120 firearms per 100 people in the USA (more than one per person, including infants).The mean Canadian household has approximately 2.5 persons.I was watching a Swedish TV cop show: the police had identified the make and model of the murder weapon, and were checking the registration lists for possible suspects.Seeing the huge number of owners, one cop asked, "What is this, the United States of Sweden?"

author: Benta
author_rank: Super Contributor
timestamp: August 10, 2025, 11:01:50 pm
content: I'm certain you're right about challenge/response systems and so on. I'm no expert myself.But remote entry is basically a one-way system, with the fob sending a (rolling) code to the car, and the car verifying the code accordingly.This has worked flawlessly for decades using simple UHF fobs, controlled by the owner physically pressing a fob button to lock/unlock. There's no way to manipulate this communication, you need to hold the fob in your hand (the "rollback" thing is possible, but impractical).The remotekeyless(RKE) entry/start system is basically the same, but with a nasty add-on: it has a LF (125 kHz) receiver that can virtually control the fob keys. This LF signal is emitted from the car when you touch the door handle etc. and activates the fob.The possibility of manipulating the fob from the outside is the real security risk, and is the basis of the relay exploits.The stupidest "comfort" function ever concocted.

author: Cyclotron
author_rank: Unknown
timestamp: August 11, 2025, 01:14:41 am
content: Quote from: TimFox on August 10, 2025, 11:01:06 pmOne of my favorite quips:“It’s in the Constitution, it says you have the right to bear arms, or the right to arm bears. Whatever the hell you want to do.” -- Robin Williams

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 01:39:08 am
content: Quote from: Benta on August 10, 2025, 11:01:50 pmI don't know what you're talking about. The rollback thing is a real thing today, and is a clear flaw in the scheme, and seems practical.If RKE has similar flaws, then that's stupid too. But it's not a flaw of the idea, comfort or not. It's a clear flaw of the implementation as there are implementations that have no such flaws.The idea that something is bad because it's for "comfort" is stupid, quite frankly. Ideas are good or bad because they're implemented properly, or not.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 11, 2025, 02:52:36 am
content: Quote from: Cyclotron on August 10, 2025, 02:31:02 pmAnother one is a car that parks up the road from here, painted in what looks like chalkboard paint, some sort of light pastel base colour and then lots of flowers in various colours all over it. It's (a) innately theft-discouraging and (b) pretty hard to resell once you've stolen it.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 11, 2025, 03:05:01 am
content: Quote from: tom66 on August 10, 2025, 10:27:03 pmThe problem with many of the "rolling-code" systems is that they're not challenge-response, it's just a response, and knowing valuenyou can derive all subsequent valuesn+1,n+2, etc. TOTP, time-based one-time passwords, RFC 6238, avoid this but vendors really like to roll their own. Even if you decided to use TOTP you'd need to use a phone or similar to generate it, the usual key fob doesn't have the necessary resources.Challenge/response is quite simple, you just need to remember to have the challenger auth themselves so you can't send as many queries as you want to the victim to build up an attack. So:Car: encrypt( VIN || random ) -> driverDriver: decrypt value, check VIN matchesDriver: encrypt( ( VIN || random ) XOR 0xFF ) -> car|| is concatenation. So the car identifies itself to the driver (key fob, whatever), and the key fob proves it knows the shared secret to decrypt the challenge and respond with the transformed challenge. An attacker who doesn't know the shared secret can never trigger a response from the key fob so can't use it as a query source, in crypto terms an oracle.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 03:22:01 am
content: That's not how challenge/response works.You're almost describing a diversified key, but kind of backwards. For a diversified key:- fob says "I'm serial number XYZ"- car derives the diversified key from the master key, and the serial number- car issues challenge. "Hash THIS"- fob encrypts with the diversified key and sends- car says, "Can haz car"...or actually, just unlocks in this case....or lets you drive off. Whatever.At some point, you've paired the car to the fob, which in this case means that you've given the fob it's diversified key based on the master key the car has. And thus, you can pair as many fobs as you want to the car, without anyone actually every knowing the master key....except the car.And if you have the car and can get the master key...well, you're car's stolen already, so oh well.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 11, 2025, 03:29:12 am
content: Quote from: TimFox on August 10, 2025, 11:01:06 pmFor an eye-opening look at this situation, take a look at Michael Moore's "Bowling for Columbine".Yeah, yeah, Moore's reputation as a social commentator is sketchy, at least according to some.But in this case his analysis was just spot-on.At one point in the film he's shown walking up to random houses in, I think, Toronto, knocking on people's doors and thentrying the doorknobs/handles. And in most cases those doors weren't locked!He brings up that point, that gun ownership in Canada was close to that in the US, maybe even higher at the time (the film was made in 2002).He then poses the question--without trying to answer it, leaving it up to the audience to think about it--why there was so much more gun violence in the US, given the similar proportion of guns in both countries. Without coming to a didactic conclusion. Great stuff.There is one very uncomfortable scene in the movie where Moore basically corners Charlton Heston and confronts him as the very proactive face of the NRA and proselyte of the "right to bear arms", at a point where Heston was a degenerated shadow of his former self. Some considered that to be grossly unfair, but I disagreed: after all, Heston had been aggressively campaigning all those years for something that a lot of folks here (the US) think might have something to do with our out-of-control rate of deaths by firearms, the main subject of the movie being the school shootings at Columbine.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 03:34:04 am
content: By and large people aren't shooting people for stealing their cars, anywhere in Canada or the US. I'm sure it's happened, because stupid people are stupid, but most people aren't stupid enough, and thieves aren't stupid enough to do it where they will get into a confrontation. So this is just a silly distraction.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 11, 2025, 06:32:05 am
content: Quote from: John Coloccia on August 11, 2025, 03:22:01 amSays who? Challenge-response is a general concept, not a specific protocol. In particular your form doesn't authenticate the car to the fob, which means it creates a perfect oracle for an attacker.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 11, 2025, 06:38:42 am
content: Quote from: Analog Kid on August 11, 2025, 03:29:12 amJust to clarify, was this with the occupants present or not? Most people around here don't lock their doors either (except at night), otherwise how would the neighbours be able to pop over for a cup of tea?

author: tom66
author_rank: Super Contributor
timestamp: August 11, 2025, 08:50:13 am
content: Quote from: Benta on August 10, 2025, 11:01:50 pmSome keyless systems are better.My car for instance uses UWB keyless, which means the car can determine the precise distance to the key and will not start if the key is not inside.I am able to physically test this - there is a sphere roughly 1.2m wide from the middle of the cupholder where the key will work. Outside of that, it will not, and it has about a 10 centimeter resolution from what I can tell.This is because it is measuring the actual distance to the key using an ultra high bandwidth pulse (which also contains the payload to prove the key is legit).Most RKE systems use RSSI measurement which means they are susceptible to "signal boosting" attacks. A few have added the feature that the key only transmits whilst moving which covers theft of the key data when left at home on a table, but is otherwise not great since the key can be cloned when you're walking away from your car e.g. at a supermarket.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 10:39:08 am
content: Quote from: 5U4GB on August 11, 2025, 06:32:05 amThere's zero value in authenticating the car to the FOB, unless you're imagining that a thief is going to be like, "Hmmm....I was GOING to steal this BMW, but I don't like the VIN, so I suppose I'll pretend I failed authentication."

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 02:14:45 pm
content: Quote from: 5U4GB on August 11, 2025, 03:05:01 amThe search space is suppose to be large enough that even knowing the constants and details of the algorithm, it is impractical to compute newer values. It is always a bad sign if secrecy of the algorithm is requires for security.QuoteOften (always?) the failure with challenge and response is insufficient randomness in the secret key, or sometimes weak secret keys.I probably should not be, but it always surprises me when designers do not consult with someone who knows cryptography, and do not even bother studying it to get some idea of what is required for a secure system. Bruce Schneier's Applied Cryptography costs $24 new.Quote from: Analog Kid on August 11, 2025, 03:29:12 amThe distribution in the US is very uneven though, with most of the firearms held by a smaller number of people, like me. Who does not have spares?QuoteI would have said sketchy as hell. Moore is both ignorant, and has an agenda. His talents are used for hit pieces, not objective reporting.QuoteIgnoring bias in reporting, which is a real problem in Canada, the UK, and Australia that results in underreporting of violence, a problem with that is that knife violence, or violence with any weapon, is similarly high in the US. How does the availability of firearms create more knife violence? It does not; the US has a violence problem, not a firearms problem.Most of the violence is associated with the part of the population with the lowest socioeconomic status, which itself is associated with specific racial types making it a politically incorrect subject no matter what is going on. Raise the standard of living of those with the lowest socioeconomic status to lower violent crime. Economists might know how to do this, but politicians sure do not, and it would not be in their interest anyway.Quote from: John Coloccia on August 11, 2025, 03:34:04 amShooting someone for stealing a car is also illegal, except maybe for Texas and one other state. People do get shot legally for home invasion and assault. At least in the US, thieves usually know better than to break into someone's home, and prisoner surveys revealed that an armed victim, especially in a home, was what they feared most. A civilian in their home is more likely to fear for their life or even panic than police who have rules and training to follow.

author: TimFox
author_rank: Super Contributor
timestamp: August 11, 2025, 03:14:03 pm
content: According to Prof Jens Ludwig of the University of Chicago Crime Lab, about 80% of US gun violence is not connected to “normal” crimes such as armed robbery, but due to escalation of personal conflicts and other non-productive issues.This is a complex quantitative issue, so I refer the interested reader to the non-handwaving details in his recent bookUnforgiving PlacesUniversity of Chicago Press 2025.He has serious suggestions to improve the situation, but believes that gun control as practiced in other developed nations is politically impossible here, so he looks for other possibilities. His book, following the tradition at the University is quantitative, looking carefully at actual crime statistics.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 11, 2025, 03:42:25 pm
content: Quote from: John Coloccia on August 11, 2025, 10:39:08 amThe reason why you want to authenticate the car to the fob is the one I gave in my earlier reply. If there's no mutual authentication then an attacker can use the fob as an oracle.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 05:58:22 pm
content: Quote from: 5U4GB on August 11, 2025, 03:42:25 pmThis is why you either use a diversified key, or have a separate key per fob, and then that is no longer possible.But it doesn't even matter in this case. If you have a key, it's pointless to mount an attack. Because you're got the key...so just use the key.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 06:16:05 pm
content: Quote from: TimFox on August 11, 2025, 03:14:03 pmI have a shelf full of books discussing gun violence, but they are all more than 10 years old at this point, so I just ordered the one you suggest.Quote from: 5U4GB on August 11, 2025, 03:42:25 pmI need touch up on my Applied Cryptography. How do you prevent a relay attack over an insecure channel where authentication was the only purpose, even when there is a full public key exchange?Usually these attacks require reading or changing the plaintext, like with a monetary transaction.Something you are, something you have, something you know ... hmm. This reinforces my original thought decades ago that RF key-fobs were a bad idea.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 11, 2025, 06:17:09 pm
content: Quote from: 5U4GB on August 11, 2025, 06:38:42 amOccupants present, who of course were a bit surprised at Moore's audacity at opening their front door, but polite nonetheless.The whole point was to show a major cultural difference between Canada and the US.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 06:32:43 pm
content: Quote from: Analog Kid on August 11, 2025, 06:17:09 pmThat cannot be applied to the whole US. We leave our doors unlocked but we are at the end of a mile long dirt cul-de-sac, our nearest neighbors are 500 yards away, and in a state with the least or almost the least gun control in the US. If we were 30 minutes away in Manchester, or in Concord proper, we would lock our doors. Meanwhile in the nice neighborhood were I lived in Missouri 30 minutes outside St. Louis, everybody locked their doors.I have carried a handgun since Missouri became shall issue in 2007, so moving to New Hampshire did not require me to change my habits. Twice in Missouri in incidents 7 years apart I was in situations where I "cheated the draw", and my potential accoster realized it and demurred. No shots were fired, and nothing was brandished.I have been thinking of working as a courier, so the question of vehicle security is on my mind; how do I leave my vehicle locked, but running and secure? I consider my personal security to be a solved problem.Quote from: Analog Kid on August 11, 2025, 06:17:09 pmThat is one of those cases where politeness is inappropriate; it sends the wrong message, unless it is understood as the threatening kind of politeness.Police knocking should get the same response; they are not there for your good.Locked doors only work on the honest.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 11, 2025, 06:37:52 pm
content: Well of course one cannot generalize about an entire country the size and diversity of the US. I don't think anyone here doesn't get that.But Moore was trying doorsin a major Canadian cityand finding them unlocked, for chrissakes. I think that stands as a pretty good marker of cultural differences betwixt the two countries.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 06:42:09 pm
content: Quote from: Analog Kid on August 11, 2025, 06:37:52 pmI think it indicates that urban Canadians are either ignorant of danger, or know that under their laws, resistance will only make things worse.I remember being the former when I was a young adult, and in retrospect I was lucky to not end in a morgue.Last year at one of the regular board gaming events we hold, half of us at the table were armed. If someone had opened the door and threatened us, it would have been like that Texas convenience store robbery that turned bad, for the robber.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 11, 2025, 06:44:48 pm
content: Quote from: David Hess on August 11, 2025, 06:42:09 pmSo how would that explain them leaving their front doors unlocked? That doesn't make sense to me.I doubt they would have been any more or less "ignorant of danger" than their counterparts here in the US.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 06:47:16 pm
content: Quote from: Analog Kid on August 11, 2025, 06:44:48 pmThat would be most of their counterparts in the US.They leave the door unlocked because they never consider self defense, because self defense is proscribed by the crown. They have preemptively surrendered. Aren't they being advised to leave their car dongle where it will be easily taken, rather than risk confrontation?

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 06:57:04 pm
content: Quote from: David Hess on August 11, 2025, 06:47:16 pmNow how much backlash am I going to face for pointing out that's absolute bullshit?

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 07:00:21 pm
content: Quote from: David Hess on August 11, 2025, 06:16:05 pmI'm not sure how a relay attack applies to cars? Did you mean replay attack?Anyhow, you don't exchange any keys to authenticate. The keys are set when you pair.Car creates random challenge, asks fob "encrypt this"Fob encrypts is and sends it back, proving that it's got the shared key.Super simple, but really effective. I don't know why it doesn't work like this.Replay is prevented because your space of random challenges is enourmous.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 07:01:34 pm
content: Quote from: Monkeh on August 11, 2025, 06:57:04 pmSelf defense in Canada requires an affirmative defense; prove that you did not commit a crime:https://lois-laws.justice.gc.ca/eng/acts/C-46/section-34.html

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 07:07:23 pm
content: Quote from: John Coloccia on August 11, 2025, 07:00:21 pmPreviously there were effective relay attacks. The new attack is much worse, but even if the new one is solved, the relay attacks are still available.QuoteMy point is that even if a full cryptographic exchange is performed, it would still be vulnerable to the earlier relay attack.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 11, 2025, 07:16:14 pm
content: Quote from: Monkeh on August 11, 2025, 06:57:04 pmNone from me.I think the guy you responded to is a borderline gun nut who sees everything through that lens.

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 07:19:42 pm
content: Quote from: David Hess on August 11, 2025, 07:01:34 pmWhich is not the same thing as 'proscribed'. Self defense is explicitlyallowed, under the condition that it is, indeed, self defense. In other words, you can't shoot someone for looking at you funny and then claim it was self defense and walk away no further questions asked. At first glance this is functionally the same as the US - as indeed it logically must be, or nobody could ever be charged with murder because they would only need to utter two words and be free.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 07:54:31 pm
content: Quote from: Monkeh on August 11, 2025, 07:19:42 pmYour distinction is without a difference if the defender will be arrested and face trial where they have to affirmatively prove it was self defense. The proscription is worded politely, but it is enforced with uncertainty and men with guns.I liken it to Illinois state constitution, where the exception to the right keep and bear arms swallows the rule, so Illinois has no right to keep and bear arms.Quote from: Analog Kid on August 11, 2025, 07:16:14 pmBut that is what you just did through a personal attack, so the answer is no, there will be backlash, but not by ME.

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 08:18:50 pm
content: Quote from: David Hess on August 11, 2025, 07:54:31 pmThis occurs in the US, also. If you shoot someone, you will be detained and questioned, if they cannot promptly ascertain clear self defense you will be facing a court. Again, you cannot just kill someone, claim self defense, and walk away.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 08:27:04 pm
content: Quote from: David Hess on August 11, 2025, 07:07:23 pmCan you explain how this applies to cars? Normally you're using this for credit cards.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 08:33:20 pm
content: Quote from: Monkeh on August 11, 2025, 08:18:50 pmIt does occur in the US, but not to the same extent. Some US states and jurisdictions are very opposed to self defense, and there is always the prospect of a politically ambitious prosecutor like Thomas Binger (Ritenhouse) or Angela Corey (Zimmerman) who will benefit politically whether they win or lose.Being detained is not the same thing as arrest, and in the US we have a right to not answer questions, and not answering questions cannot be used against us.With some exceptions which depend on state law, the prosecutor would have to prove that it was not self defense, which is considerably different than requiring the defense to prove that it was self defense. In some cases law enforcement can face sanctions for an arrest where they did not have probable cause to believe it was not self defense, or something like that.

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 08:40:51 pm
content: Quote from: David Hess on August 11, 2025, 08:33:20 pmAnd they have that same right in Canada.QuoteAnd in Canada, or here in the UK (it's all 'the crown'), they won't actually press charges requiring you to make a defense unless there's sufficient evidence to make such a conviction likely (oh.. same as in the US). This will require them toprove self defense is not a defenseif they take you to trial.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 08:42:23 pm
content: Quote from: John Coloccia on August 11, 2025, 08:27:04 pmI am saying that even the more secure version of this type of transaction, where identity is authenticated, is vulnerable to same attack. Increasing the cryptographic security, which was suggested earlier, is not a solution to the relay attack.The rollback attack is just a complete failure of an insecure implementation. I did not see any detailed about how this was possible, only that it is.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 08:43:07 pm
content: Quote from: Monkeh on August 11, 2025, 08:40:51 pmThat is not what the statute I linked says.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 08:47:45 pm
content: Quote from: David Hess on August 11, 2025, 08:42:23 pmCan you explain how a relay attack works for vehicles?

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 08:54:07 pm
content: Quote from: David Hess on August 11, 2025, 08:43:07 pmI think perhaps you should reread it a bit more carefully, and disabuse yourself of the false notion that people are guilty before proven innocent in other nations.

author: David Hess
author_rank: Super Contributor
timestamp: August 11, 2025, 09:16:36 pm
content: Quote from: Monkeh on August 11, 2025, 08:54:07 pmI read it, and read analysis of it to further understand it. In the past I followed the details of Canadian court cases which operated as I described.Quote from: John Coloccia on August 11, 2025, 08:47:45 pmA transceiver is used between the vehicle and key fob, located in the house, to extend the range of the key fob so that the vehicle may be activated from it. If the vehicle has pushbutton start, then this would also defeat RKE (remote keyless entry) where you would otherwise have to push a button on the fob, assuming that you could get inside of the vehicle?-Jokes on them, I have a carless key.-Or require that the fob be in physical contact with the vehicle for it to start. Perhaps via a specifically designed “fob slot”. And the fob could turn in the fob slot to actuate the starter instead of having to push another button. Hell, the fob slot could have several positions - one for off, one for start, one for run, and one for accessory - instead of an arbitrary number of short and long button presses on start buttons. And if the engineers wanted a bit more security, the fob could have uniquely cut “teeth” that would match depressions in the fob slot - so only that fob could turn and start the car!-This! This is genius! Manufacturers could make the fob “teeth” out of metal so as to prevent premature wear.

author: Marco
author_rank: Super Contributor
timestamp: August 11, 2025, 09:23:11 pm
content: Ultimately a problem of security through obscurity.These systems should have been based on an open standard.

author: Monkeh
author_rank: Super Contributor
timestamp: August 11, 2025, 09:34:27 pm
content: Quote from: David Hess on August 11, 2025, 09:16:36 pmAnd in how many of those did the evidence strongly suggest self defense would not be a valid defense? Those same cases will go to court in the US, and the result will be the same: The defense will have to make their argument as to meeting the criteria of self defense, and it will have to be successfully shot down by the prosecution.None of this makes self defense prohibited. There is no great boon to the process in the US - indeed being in the US simply makes you far more likely to need to defend yourself.And, well, seeing as you brought this up as 'the crown', here in dear old blighty a man had his home invaded and was confronted in his kitchen. The intruder ran onto the knife he held. He was arrested, questioned, his identity and ownership of the house determined, and released without charge. But hey, I keep hearing how self defense is illegal here, so that can't have happened.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 11, 2025, 11:21:20 pm
content: Keys don't turn themselves off with no movement?

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 02:36:42 am
content: Quote from: David Hess on August 11, 2025, 06:42:09 pmEither that or they live in a country that has rule of law and know they're safe with their doors unlocked. As we do here. I've currently got my front door wide open because it's sunny and lets the warm air in. Later this afternoon I'll close (but not lock) it when things cool off.The door has an electronic lock from a US company which has a problem in that it sometimes mis-reports its open/close status. They offered me a replacement model which has no ability to close it without it locking itself (you can't close the door and leave it unlocked), if this attitude is common in the US then it would explain my lack of success in explaining to them that I didn't want something that locks you out every time you close it.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 02:40:22 am
content: Quote from: Monkeh on August 11, 2025, 06:57:04 pmNot from me. Note also that I posted a polite, considered reply to a similar comment and carefully avoided using terms like "gun-toting paranoid nutcases" in it.Since this is now degenerating into a gun-control (or lack thereof) debate, maybe it should go into its own thread.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 02:42:45 am
content: Quote from: John Coloccia on August 11, 2025, 07:00:21 pmProbably a relay attack, relay the challenge to the fob and play back its response to the car. There are techniques like distance-bounding protocols and location-limited channels to counter this but they're too hard to get working compared to the level of threat involved.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 12, 2025, 02:46:11 am
content: Most locks are so bad anyway that it makes no real difference if they're locked or not.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 12, 2025, 02:48:47 am
content: Quote from: 5U4GB on August 12, 2025, 02:42:45 amI'm just surprised that keys don't go to sleep if there's no movement. Would seem obvious to me to do that, for security and battery life. I guess I just assumed they would.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 02:59:38 am
content: Quote from: John Coloccia on August 11, 2025, 05:58:22 pmYou don't have the key, what you have is a fob that acts as an oracle to allow you to recover the key. If the vehicle has to authenticate itself, the fob won't respond to any queries. If it just responds to anything you send it a query "hey, process this value using the secret key and give me the results". "Thanks, now process this value with the LSB flipped". "And now this value, same Hamming weight but different bit pattern". This is hardware-hacking 101, people have been extracting keys from hardware devices like this since pay-TV smart cards in the 1990s, which is why you always have the reader authenticate to the token before the token responds.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 12, 2025, 03:03:10 am
content: Quote from: 5U4GB on August 12, 2025, 02:59:38 amLet me rephrase. I used "key" twice to mean two different things (because I still think of my fob as my car keys). If you have the fob, you don't have to extract anything or mount an attack. You just use the fob and drive off.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 03:07:11 am
content: Quote from: John Coloccia on August 12, 2025, 02:48:47 amDepends on the tech, if it's NFC then there's no battery present so the concept of "sleep" is a bit fuzzy... however NFC devices are quite recent (compared to many fobs) and implement reasonably secure protocols designed and analysed by cryptographers and published for review so the problem sort of fixes itself in that case.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 12, 2025, 03:22:14 am
content: Quote from: John Coloccia on August 12, 2025, 03:03:10 amThe problem in this case is that the contactless part of the thing means that "having the fob" doesn't require physically having it, merely being anywhere within radio range. So an attacker can walk into a cafe, carry out the attack on any fobs within range while having a coffee, then go outside into the parking lot and see which car(s) they've now got access to. It's one of those things where the rush to add kewl tech made things less secure, not more. Another example is e-passports, you still need to insert them into a reader for them to be read so there's no benefit from the contactless tech, but they've also got NFC in there so an attacker can remotely read them (depending on how much extra stuff your issuing country has bodged on to make this harder to do, you can actually do this right if you put in the effort).

author: John Coloccia
author_rank: Super Contributor
timestamp: August 12, 2025, 04:05:20 am
content: Quote from: 5U4GB on August 12, 2025, 03:22:14 amA good random challenge makes that more or less not possible, and solid algorithms like AES don't leak.So it all has me scratching my head a bit because this has all been figured out for a long time now, and there's really no excuse for a bad implementation.

author: kite31
author_rank: Regular Contributor
timestamp: August 12, 2025, 04:12:49 am
content: From curiosity, I opened my car with the fob then left it outside the car while trying to start it. It declined, "no key", which is pretty much the converse of the fact that if I leave my key in the car then touch-locking on the outside will not work.This does not prevent an attacker who has opened the car from trying to reprogram via the OBD, as I believe can be done in at least some cases for key recovery.

author: AndyC_772
author_rank: Super Contributor
timestamp: August 12, 2025, 06:34:20 am
content: Quote from: John Coloccia on August 12, 2025, 02:48:47 amSome do, they contain an accelerometer and will switch off if they detect no movement for a period of time.You're right, it's an obvious and effective defence against relay attacks. It's just not universally adopted, though, because cost / incompetence / whatever.

author: themadhippy
author_rank: Super Contributor
timestamp: August 12, 2025, 11:36:33 am
content: QuoteRepeat sale.Car gets stolen insurance pays out you buy new car.Make them unnickable and you have to wait for the built in obsolescence to kick in before you get to sell a replacement.

author: Cyclotron
author_rank: Unknown
timestamp: August 12, 2025, 03:17:40 pm
content: This article about the attack also includes a video demonstrating the flipper code.https://gbhackers.com/flipper-zero-cracks-rolling-code-security-in-modern-cars/

author: AndyC_772
author_rank: Super Contributor
timestamp: August 12, 2025, 03:44:39 pm
content: Quote from: themadhippy on August 12, 2025, 11:36:33 amNo, that's just cynicism. If a car has a particularly high theft rate it becomes uninsurable and therefore unsellable. Just ask JLR.People buy new cars regularly for all sorts of reasons - changes in circumstances, or just a lease deal coming to an end after (say) 3 years.

author: David Hess
author_rank: Super Contributor
timestamp: August 12, 2025, 04:09:36 pm
content: Quote from: AndyC_772 on August 12, 2025, 03:44:39 pmThe simpler explanation is that car companies are cheap and do not care about security.The fiasco with stateless transmission shifter controls indicates that they do not care about human factors engineering and safety, so is it hard to believe they do not care about security either? Or reliability?

author: madires
author_rank: Super Contributor
timestamp: August 12, 2025, 04:24:16 pm
content: Hyundai Forces Ioniq 5 Owners To Pay for Closing the Game Boy Security Loophole It Created -https://www.autoevolution.com/news/hyundai-forces-ioniq-5-owners-to-pay-for-closing-the-game-boy-security-loophole-it-created-255765.html

author: Marco
author_rank: Super Contributor
timestamp: August 12, 2025, 04:59:34 pm
content: Quote from: John Coloccia on August 12, 2025, 04:05:20 amMitM is really hard to fix even if you want to.Managers who make stupid decisions like using unidirectional communication for the fob are also really hard to fix without physical violence.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 12, 2025, 08:03:30 pm
content: Quote from: Marco on August 12, 2025, 04:59:34 pm"MitM" = man in the middle, for those who didn't know (like me).Please explain initialisms. Too many post them and leave us scratching our heads.

author: Benta
author_rank: Super Contributor
timestamp: August 12, 2025, 11:02:05 pm
content: Quote from: John Coloccia on August 12, 2025, 04:05:20 amThat's because you still don't seem to understand car entry systems.The classic one-way-transmission fob with buttons is pretty much rock-solid, as you need to hold it in your hand to activate it.Rollback? sure but that requires you or an accomplice pressing the button repeatedly to get a number of rolling code samples that can be played back to the car, while at the same time ensuring that the car is out of range of the transmitter to avoid resynchronization.Possible, but impractical. If you already have the fob in your hand, why not just use it?The major security flaw was introducing the remote keyless entry (RKE) system as a major "Comfort" improvement. "Hey, look mum! When I put my foot under the back of the car, the trunk opens!" Ridiculous functionality, but hey! get it before your neighbour.RKE allows an outside radio signal to virtually press the keys on your fob.That's the attack vector.If someone sends a signal to the fob telling it to virtually press the "open" key, it will respond with the correct rolling code and the car will accept it.So how's the RKE fob activated?By an 125 (or 134) kHz (electro)magnetic field emitted from the car when either touching the door handle or putting a foot under the rear of the car. The fob has an always-on ultra-low-power LF receiverWhether this field is even modulated/coded, I don't know, but I'll test it someday. It probably has a simple coding scheme.The "security" of this system is that the magnetic field only has a radius of 1...2 m, so in theory the person holding the fob is standing right next to the car."Relay" aka "range extender" thefts simply detect this magnetic field, retransmit it to the accomplice at the house door where it's regenerated to (hopefully) activate the fob transmitter.As you see, the only "security" in this system is the limited range of the magnetic field, plus perhaps some weak coding.Shame on NXP engineering for pushing this lousy system onto millions of cars.Here's the NXP flyer:

author: John Coloccia
author_rank: Super Contributor
timestamp: August 13, 2025, 12:10:29 am
content: Quote from: Benta on August 12, 2025, 11:02:05 pmLet me stop you right there and correct you. I don't not SEEM to understand. I 100% absolutely don't understand modern car entry systems.It almost feels like I'd have to do extra work to roll my own authentication schemes instead of just using standard schemes. And I'll tell you right now, this is well outside of my wheelhouse. I follow the schemes that other people have figured out. I'm just kind of surprised this is a real problem, not some theoretical attack that could happen someday after you've spent enough time and money to just buy a fleet of cars instead.

author: 5U4GB
author_rank: Super Contributor
timestamp: August 13, 2025, 12:36:20 am
content: Quote from: David Hess on August 12, 2025, 04:09:36 pmThey do generally care about security, but they typically assign the job to automotive embedded engineers who aren't security experts. They know all about making things work under conditions that would kill most other electronics, but they're not crypto protocol designers. More recently they've been either getting in external folks or developing in-house expertise, but this hasn't always been the case.For people with too much time on their hands, grab a copy of Kaufman, Perlman, and Speciners "Network Security" and read chapter 9, "Security Handshake Pitfalls" (you may need to find an older edition, the 3rd edition isavailable onlinebut they seem to have removed this chapter which is a huge shame because it's one of the best ones in the book). This methodically goes through different authentication techniques, here's a protocol, here's why it fails, here's a fix, here's why that fails...Ah, the 3rd edition, linked above, has moved it to Chapter 11, "Communication Session Establishment".

author: 5U4GB
author_rank: Super Contributor
timestamp: August 13, 2025, 12:47:53 am
content: Quote from: Benta on August 12, 2025, 11:02:05 pmThat's only if you stick to the rules and use the cheapest, crappiest low-power radio and antenna you can get. Like Bluetooth, people have pointed out that with increased power and high-gain antennas you can get ranges measured in km. Chris Paget has done a pile of talks on long-range RFID hacking, thefirst Google hitmentions an actual range of 235 feet (something like 70m) with 10W into a 12dBi antenna, and a theoretical max range of 2.35 miles (3.8km) at 1500W, although whether the tag can respond at that range is another question.

author: Marco
author_rank: Super Contributor
timestamp: August 13, 2025, 01:31:30 am
content: Quote from: Benta on August 12, 2025, 11:02:05 pmDepending on how stupid the system is, interference and record twice, playback the first can work.

author: madires
author_rank: Super Contributor
timestamp: August 13, 2025, 01:53:04 pm
content: One of the classic key fob security nightmares is MIFARE (https://en.wikipedia.org/wiki/MIFARE).

author: Benta
author_rank: Super Contributor
timestamp: August 13, 2025, 05:26:07 pm
content: Quote from: 5U4GB on August 13, 2025, 12:47:53 amI didn't say anything about RFID. The activation signal is 125 kHz and inductively coupled. It'snota radio signal.Relay attacks receive the 125 kHz field and retransmit over UHF to the accomplice at the house door, where the 125 kHz field is regenerated.If you're interested, I attach a photo of the TX power inductor, in this case 400 uH from a BMW. Most cars contain four (or six) of these: One for each door, one for the trunk lid and one for inside the cabin (engine start).Also attached is the datasheet on the XYZ RX inductor for the fob.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 15, 2025, 12:38:19 am
content: Quote from: Benta on August 13, 2025, 05:26:07 pmThat's interesting. I never knew how they did the proximity detection.This really could all be fixed at the key-fob side with an accelerometer or even just way to disable it when you're home. Doesn't seem Like there would need to be a massive recall of autos, etc.edit:A side thought. For people that want a good 'ole key. Other than some VERY high security locks, it's pitifully easy to get into most locks. I can get on board with a contact electronic comm mechanism being more secure, but the mechanical key part of it is a complete joke for approximately 100% of locks out there. Some lock manufacturers are considerably less competent, or lazy...or just cheap, than others, but people who know how to get in are VERY good at what we do (and it's just not that hard), and people trying to keep us out have a VERY difficult job. Physical locks are just very difficult to make secure.

author: Analog Kid
author_rank: Super Contributor
timestamp: August 15, 2025, 01:12:39 am
content: Quote from: John Coloccia on August 15, 2025, 12:38:19 amHeh!Data point: my old trusty Toyota van, that could be easily started by sticking a pair of scissors (or <whatever>) into the ignition lock.Recognizing this "security weakness", I took to removing the battery every time I parked it for the night at my place.I'm trying to remember how many times it was stolen. Was at least 4 or 5.And then there was the time I started it up and heard this *horrible* noise.Looked underneath, and saw that my catalytic converter ("Cadillac converter") had been neatly sawn off during the night.Nothing like living in Oakland, CA in the mid-2000s.

author: RJSV
author_rank: Super Contributor
timestamp: August 15, 2025, 04:22:16 am
content: One acquaintance of mine kept getting comments, from his neighbors, that he was being followed (home), by some creepy looking fellows, so he began sleeping near his front door (loaded pistol ready)!Sure enough, the crims began busting the door, late night, and he responded. Dead invader. Local police did 'detain' him in actions, including full search of house, but left him alone after initial investigation revealed no criminal association between them.Could have been tragic, if not for the neighbors tip-off !

author: Benta
author_rank: Super Contributor
timestamp: August 15, 2025, 05:04:21 pm
content: Quote from: John Coloccia on August 15, 2025, 12:38:19 amThere's no proximity detection. That would imply constant (or at least periodical) 125 kHz TX.The 125 kHz TX happens when:1: someone touches the door handle (or the dimple on the handle).2: someone triggers the trunk sensor (you know, foot under car).3: the Start/Stop button is pressed.And then only from the relevant TX inductor.The fob accelerometer is actually implemented on most new cars today. But it doesn't solve the relay attack when you're sitting in a restaurant with the fob in your pocket.

author: John Coloccia
author_rank: Super Contributor
timestamp: August 16, 2025, 12:05:41 am
content: Quote from: Benta on August 15, 2025, 05:04:21 pmThat's interesting. Thanks for sharing your knowledge of this with us. I really did not know any of the details of how this worked. I guess proximity in the sense that I assume the signal is weak enough that it doesn't work when I'm just a couple of feet away from the car...which drives my girls nuts.I guess the real solution is a little switch, or something, on the fob that just deactivates that functionality. But it still doesn't seem like a huge recall. They can fix the fobs. I'm not sure how else you would do it, but if you have some thoughts I'd be interested in learning from it.

author: Someone
author_rank: Super Contributor
timestamp: August 16, 2025, 12:31:51 am
content: Quote from: John Coloccia on August 16, 2025, 12:05:41 amSome older vehicles had this already, I can remotely lock one of our vehicles with its remote requesting “do not unlock or start until physical key has been used in exteriorandinterior locks”Only used it once; when it appeared that there was some rf jamming being used, thatmighthave been an attack or just some rogue/faulty device nearby.

author: Sorama
author_rank: Frequent Contributor
timestamp: August 16, 2025, 06:03:20 am
content: Quote from: UnijunctionTransistor on August 09, 2025, 04:48:38 pmIt’s often a requirement if you take an all risk insurance.Depends on the value and type of car you bought.Like a P car.