Are Keyless Cars Hackable?
Does your car have an old-school key that opens the door, or a new-fangled electronic push-button key fob that opens the door and also starts the car? If it's the latter, then it's most likely trivial for a thief with some inexpensive gadgetry to unlock your car and drive away. Here's what you need to know, and one easy way to protect against this hack...
The Problem With Keyless Cars
Nick Bilton, a reporter for the New York Times, keeps the key to his 2013 Prius in his freezer. He started this odd ritual after his car was broken into and ransacked three times. He even observed one of the burglars, who appeared to be a teenaged girl.
“I watched as the girl, who was dressed in a baggy T-shirt and jeans, hopped off her bike and pulled out a small black device from her backpack. She then reached down, opened the door and climbed into my car.” Bilton ran outside and the girl took off on her bike.
Bilton’s car, and millions of others, does not use traditional locks and keys. Instead, his key is a digital fob containing an RFID chip, battery, a simple computer, and an antenna. When the fob is within a few feet of the car, it can detect an encrypted code that the car transmits constantly. If the car’s code matches the one that the fob is expecting, the doors unlock. In some cars, the fob also allows the car’s engine to be started by pressing a button.
The car’s broadcast range is typically ten feet or less. But an inexpensive power amplifier can retransmit the car’s signal much farther, up to 100 meters in some cases. Bilton surmises that the girl had such a device, and used it to make his car “shake hands” with the fob that was sitting on his kitchen counter, 50 feet away from the car.
Once inside of a car, a thief can quickly program a blank fob with that particular vehicle’s code algorithm via the car’s on-board diagnostics (OBD) port. Luckily for Bilton, his teenaged thief did not have the sophisticated gear that would have let her steal his car.
Bilton started keeping his fob in the freezer because the metal surrounding the fob blocks radio signals, preventing the kind of shenanigans described above.
Three Minutes, Ten Years, Zero Action
A power amplifier is not the only way to hack a keyless entry and ignition system, Bilton learned as he researched the subject. Some thieves use laptops and sophisticated software to figure out a car’s code through brute-force methods. It can take as little as three minutes because the encryption used in keyless car entry systems is a weak 40 bits. That’s how soccer star David Beckham’s $100,000 BMW was stolen in 2006.
That’s right, electronic car thefts have been going on for over ten years. It is well known in the automotive and security research industries that just about any keyless car can be hacked in short order, and it’s been known for a long time.
But automakers don’t care; at least, not enough to do something about it. Bilton canvassed auto industry executives at a trade show, and found few of them knew about the security hole (or would admit to knowing). Those who acknowledged it downplayed the frequency of digital car thefts, which leave no evidence other than a lack of physical damage to the vehicle.
One Low-Tech, Inexpensive Solution to Keyless Car Hacking
Security experts say that car makers could beef up the security of the fobs for keyless cars, but don't count on it happening any time soon. For now, you'll need to take security into your own hands. Bilton’s freezer solution is not ideal; the lithium battery in a fob deteriorates quickly at sub-freezing temperatures. And you probably don't want a frozen fob in your pocket. Stashing it in the microwave might work, but I wouldn't risk the possibility of accidentally frying both the key and the oven.
Keeping your car in a well-lit area, preferably under obvious video surveillance, will deter most car thieves. A steering wheel lock is another deterrent.
But a simple metal box or even some aluminum foil would block the fob’s signal just as well, while keeping the fob at room temperature If you have a keyless car, you may want to use one of those simple and inexpensive measures to prevent what happened to Bilton.
Your thoughts on this topic are welcome. Post your comment or question below...
This article was posted by Bob Rankin on 2 May 2017
|For Fun: Buy Bob a Snickers.|
Are Your Devices Listening and Recording Everything?
The Top Twenty
Geekly Update - 03 May 2017
There's more reader feedback... See all 27 comments for this article.
Post your Comments, Questions or Suggestions
Free Tech Support -- Ask Bob Rankin
Subscribe to AskBobRankin Updates: Free Newsletter
Copyright © 2005
- Bob Rankin - All Rights Reserved
Article information: AskBobRankin -- Are Keyless Cars Hackable? (Posted: 2 May 2017)
Copyright © 2005 - Bob Rankin - All Rights Reserved