Are Keyless Cars Hackable?
Does your car have an old-school key that opens the door, or a new-fangled electronic push-button key fob that opens the door and also starts the car? If it's the latter, then it's most likely trivial for a thief with some inexpensive gadgetry to unlock your car and drive away. Here's what you need to know, and one easy way to protect against this hack... |
The Problem With Keyless Cars
Nick Bilton, a reporter for the New York Times, keeps the key to his 2013 Prius in his freezer. He started this odd ritual after his car was broken into and ransacked three times. He even observed one of the burglars, who appeared to be a teenaged girl.
“I watched as the girl, who was dressed in a baggy T-shirt and jeans, hopped off her bike and pulled out a small black device from her backpack. She then reached down, opened the door and climbed into my car.” Bilton ran outside and the girl took off on her bike.
Bilton’s car, and millions of others, does not use traditional locks and keys. Instead, his key is a digital fob containing an RFID chip, battery, a simple computer, and an antenna. When the fob is within a few feet of the car, it can detect an encrypted code that the car transmits constantly. If the car’s code matches the one that the fob is expecting, the doors unlock. In some cars, the fob also allows the car’s engine to be started by pressing a button.
The car’s broadcast range is typically ten feet or less. But an inexpensive power amplifier can retransmit the car’s signal much farther, up to 100 meters in some cases. Bilton surmises that the girl had such a device, and used it to make his car “shake hands” with the fob that was sitting on his kitchen counter, 50 feet away from the car.
Once inside of a car, a thief can quickly program a blank fob with that particular vehicle’s code algorithm via the car’s on-board diagnostics (OBD) port. Luckily for Bilton, his teenaged thief did not have the sophisticated gear that would have let her steal his car.
Bilton started keeping his fob in the freezer because the metal surrounding the fob blocks radio signals, preventing the kind of shenanigans described above.
Three Minutes, Ten Years, Zero Action
A power amplifier is not the only way to hack a keyless entry and ignition system, Bilton learned as he researched the subject. Some thieves use laptops and sophisticated software to figure out a car’s code through brute-force methods. It can take as little as three minutes because the encryption used in keyless car entry systems is a weak 40 bits. That’s how soccer star David Beckham’s $100,000 BMW was stolen in 2006.
That’s right, electronic car thefts have been going on for over ten years. It is well known in the automotive and security research industries that just about any keyless car can be hacked in short order, and it’s been known for a long time.
But automakers don’t care; at least, not enough to do something about it. Bilton canvassed auto industry executives at a trade show, and found few of them knew about the security hole (or would admit to knowing). Those who acknowledged it downplayed the frequency of digital car thefts, which leave no evidence other than a lack of physical damage to the vehicle.
One Low-Tech, Inexpensive Solution to Keyless Car Hacking
Security experts say that car makers could beef up the security of the fobs for keyless cars, but don't count on it happening any time soon. For now, you'll need to take security into your own hands. Bilton’s freezer solution is not ideal; the lithium battery in a fob deteriorates quickly at sub-freezing temperatures. And you probably don't want a frozen fob in your pocket. Stashing it in the microwave might work, but I wouldn't risk the possibility of accidentally frying both the key and the oven.
Keeping your car in a well-lit area, preferably under obvious video surveillance, will deter most car thieves. A steering wheel lock is another deterrent.
But a simple metal box or even some aluminum foil would block the fob’s signal just as well, while keeping the fob at room temperature If you have a keyless car, you may want to use one of those simple and inexpensive measures to prevent what happened to Bilton.
Your thoughts on this topic are welcome. Post your comment or question below...
|
|
|
This article was posted by Bob Rankin on 2 May 2017
| For Fun: Buy Bob a Snickers. |
 |
Prev Article: Are Your Devices Listening and Recording Everything? |
The Top Twenty |
Next Article: Geekly Update - 03 May 2017 |
 |
There's more reader feedback... See all 27 comments for this article.
Post your Comments, Questions or Suggestions
|
Free Tech Support -- Ask Bob Rankin Subscribe to AskBobRankin Updates: Free Newsletter Copyright © 2005 - Bob Rankin - All Rights Reserved About Us Privacy Policy RSS/XML |
Article information: AskBobRankin -- Are Keyless Cars Hackable? (Posted: 2 May 2017)
Source: https://askbobrankin.com/are_keyless_cars_hackable.html
Copyright © 2005 - Bob Rankin - All Rights Reserved
Most recent comments on "Are Keyless Cars Hackable?"
(See all 27 comments for this article.)Posted by:
Don K Shardlow
02 May 2017
So, am I to understand that those of us who have keyless autos either carry the fob around in a steel box in our pockets or wrap it in aluminum foil? Like the proverbial mousetrap, the world will beat a path to the door of the guy that invents a better solution to this problem.
Posted by:
Walter
02 May 2017
How about a lockable key case like the car dealers use? An all metal one should work.
Posted by:
Richard
02 May 2017
I have a 2011 Hyundai Sonata Hybrid. Once started, you can walk away from the car with the digital key in your pocket. The car will chime for about 10 seconds then quits and the car stays running for anyone to jump into the drivers seat and take off. It would seem when one walks away with the digital key the car would shut down, not in the case listed above.
Posted by:
Mike
02 May 2017
How about a version of the foil-lined cardboard sleeve used to shield credit cards equipped with RFID chips? Passports and other items with RFID chips as well. Search Amazon on 'protectif' for a look at one line of such offerings.
Posted by:
Karen
02 May 2017
There are many RFID-blocking items on the market now and some are very fashionable. It doesn't have to be a metal case or aluminum credit card box. An internet search for rfid blocking will turn up ID cases, pouches, wallets, purses, and passport holders. Many are even available at local retailers. Bob - will these do the trick?
Posted by:
02 May 2017
On arriving home I put my wallet, phone, pocket change and key fob into a wicker basket by the door. Sounds like I need to upgrade to a metal box!
On the other hand, maybe I will let someone open the door and take my parking-meter change instead of breaking a window...
Posted by:
Wild Bill
02 May 2017
In re: "steering wheel lock", I once saw a news
video clip of a former thief showing how to deal
with "The Club". He took a hacksaw and cut the wheel to remove the device in less than a minute.
As his interest was in selling the car in parts
he was unconcerned about the wheel damage itself,
unlike those of us who pay for and own our "Pride
and Joys".
Posted by:
Kenneth Heikkila
02 May 2017
Not sure how many people offering these "solutions" actually has the latest key fob. I NEVER have to take my fob out of my pocket on my 2014 Subaru Forester. As long as I am in range, not much more than a meter from either front door or the rear hatch I just touch a spot on the door handle or the rear hatch to lock or unlock the doors or open or close the hatch. Putting it into anything that blocks the signal means that I might as well go back to a key that I have to take out of my pocket to do anything.
My solution is owning a car that while it meets all my needs living in a four season area is not nearly as desirable to thieves as a sports or luxury car. I also live in an area that while thieves certainly exist, very few if any are as industrious or intelligent as the big city thieves Bob describes above.
Posted by:
Kenneth Heikkila
02 May 2017
I also start the car with the fob in my pocket.
Richard with the Hyundai, my Subaru also will run without the fob in the car, but it is my understanding that it is not actually drivable without the fob in the car.
Posted by:
Bob Greene
02 May 2017
Exceptionally well-written article, and a reminder that with technological gadgets, "new" is not necessarily a synonym for "better".
Historically, car makers seldom voluntarily have adopted expensive measures for consumer benefit, especially after manufacture. That applies all too often to correction of even their mistakes which continue to cost individuals, directly.
Therefore the only practical protection is requirement that automotive OEMs enable two-key encrypted code for both the "ignition" and "disable ignition" functions. Welcome to the new Internet of Things.
Posted by:
David
02 May 2017
Don: " the world will beat a path to the door of the guy that invents a better solution to this problem."
It's called a key.
Posted by:
SysOp404
02 May 2017
My thanks for another great article. Also, to Bob W for his comment/suggestion on a Black Hole Faraday Key Fob Bag.
At least once every couple of weeks, I too, manage to activate a button on either of two vehicle fobs in my pockets. (Unlocking or locking a driver's side door is the most common result.) But I'm far more concerned when I find that a side door has opened on the minivan outside, unbeknownst to me (requiring two accidental presses.) How long was it open? Will a nasty storm be going through the next time? That bag sounds like a small, lightweight, portable solution to several issues.
Posted by:
Richard Dengrove
03 May 2017
I had the exact opposite problem with fobs. If the electrical system stopped, wouldn't you be locked in your car? That was one of the many reasons I passed on a Prius.
Posted by:
mike
03 May 2017
how bout a thumbprint scanner like they have on guns n laptops? how hard can that be?
Posted by:
Rube
03 May 2017
This calls for another corollary to Murphy's Law - Call it law of diminishing returns. The fob is a zillion times more complex than a 5 or 6 pin key-lock system. And costs way more. The fob does the same thing, but you can still lose it, it can still be stolen and if it breaks it costs a fortune to replace and you need to reprogram the car's computer to get it to work. Plus as Bob points out it can get hacked.
I am getting sick of high tech. IMO, with a few exceptions, high tech is just high hype - more stuff for people to buy that does not improve their lives, but makes it more complicated. Like glittering but useless toys that fascinate children.
Posted by:
mike
03 May 2017
useless glitter is what drives the worldwide economy. i say let em have all the toys they want.
Posted by:
Stewart
03 May 2017
"I am getting sick of high tech. IMO, with a few exceptions, high tech is just high hype - more stuff for people to buy that does not improve their lives, but makes it more complicated. Like glittering but useless toys that fascinate children."
Indeed, but the world is being dumbed down by too many people with more money than commen sense.
Posted by:
Stewart
03 May 2017
"My solution is owning a car that while it meets all my needs living in a four season area is not nearly as desirable to thieves as a sports or luxury car. I also live in an area that while thieves certainly exist, very few if any are as industrious or intelligent as the big city thieves Bob describes above."
Famous last words!
Posted by:
Des
03 May 2017
JUST A THOUGHT. :)
WHY, not use the knowledge of those reading to create a 'fob' that fits snuggly into the hand.
It would lie flat in the fingers, with the wrist turning to the left. The thumb on top.. (A golf club thingy :))
Where the 'thumb' depression is, have an indent to 'read' the 'thumbprint' of the holder.
By depressing the 'thumb depression' a scan is done of the thumb, if not correct, access NOT granted....
On the bottom side, (under the thumb & holder) there could be 2 or 3 buttons.(1,2 or/if 3..)
By selecting either/iether (lol) you, by use of your thumb 'authorize' the action on the buttons. : e.g.
1/. (top) 'Start car'.
2/. (middle) 'Unlock door'.
3/. (bottom) '????'.
By depressing the appropriate button on the bottom, (1,2 or/if 3..) and having the thumb give the okay, then the action, (1,2 or/if 3..) is activated.
:) Simples:)
**YOU own the 'fob', YOU own the 'control' of your Car. (or etc.!)**
~~CAN they yet scan and transmit a 'thumbprint'??~~
p.s.
I would like about 2 dozen of these please, when you make your 1st 'squillion' :)
Posted by:
Phil
15 Jun 2017
When I upgrade to a newer car I will simply buy an ammo box and store my key fob(s) in it while at home even though my car is usually parked in a garage.