News for hackers. Stuff that matters.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by LeonM on Saturday August 06, 2016 @05:51AM (#12237614)
Every once in awhile one of these articles pop up on a news site. People (read: non-technical audience) seem to enjoy reading about a mysterious method of stealing a car, detecting your laptop/ipad in the trunk, tricking an ATM to give free money, hacking your phone, etc, etc.

Reality is that this kind of theft never is as straightforward as the article tells you. In this case it required the thieves to break into the car first, then reprogram the key. The thief can't just walk up to the car and type some magic commands on a laptop and drive of. It requires him to break the lock/door/glass to get in first. That's about the same as how car theft was done in the early years: break in, hotwire the ignition, (bump)start the car. This "new" method even requires more time than hotwiring, so car manufacturers did actually make their cars harder to steal in some sense...

Re:Car Thieves Arrested After Using Laptop and Malware to St... by awqrre on Saturday August 06, 2016 @08:32AM (#12237893)
The "amplification attack" would be one of those "mysterious method of stealing a car", no?

https://www.wired.com/2016/03/study-finds-24-car-models-open...

Re:Car Thieves Arrested After Using Laptop and Malware to St... by jacquesm on Saturday August 06, 2016 @06:35AM (#12237677)
> It requires him to break the lock/door/glass to get in first.

They pop the hood, apparently.

http://www.khou.com/news/crime/high-tech-thieves-crooks-usin...

The rest is all 'digital', no further use of force required.

Re:Car Thieves Arrested After Using Laptop and Malware to St... by cdubzzz on Saturday August 06, 2016 @07:34AM (#12237775)
Did you watch the video in that article? It doesn't seem to line up at all with the text of the article, oddly. You see the guy for a moment and then the video skips forward and he's sitting in the Jeep with the alarm going off. The alarm appears to have been going for a good couple of minutes.

Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

Re:Car Thieves Arrested After Using Laptop and Malware to St... by jacquesm on Saturday August 06, 2016 @11:08AM (#12238342)
I think they have to have the key already, but still 'blank' That will likely open the door but it would normally raise the alarm, that's why they start under the hood first, to disable that.

After that the procedure would be fairly easy: open the door with the still unlearned key, learn the new key ID to the ECU (takes < 1 minute) using the laptop, after that you can start the car.

One handy tip I got from the police after my own car got stolen (a VW transporter camper) was that you should mask off a chunk of the VIN so thieves can't use the VIN to order keys that will fit the car (but that still need to be programmed in the ECU in order to allow a start).

Re:Car Thieves Arrested After Using Laptop and Malware to St... by deleted_soon on Saturday August 06, 2016 @11:33AM (#12238419)
Isn't it illegal to remove the VIN?
Re:Car Thieves Arrested After Using Laptop and Malware to St... by jacquesm on Saturday August 06, 2016 @11:44AM (#12238459)
Here apparently it isn't if you mask it. That's not the same as removing it, but your local police might have a different opinion.

Whether or not it is effective is another matter (and that's hoping there is only one instance of the VIN on your car, there may be other, less obvious ones for instance bar-codes).

Re:Car Thieves Arrested After Using Laptop and Malware to St... by kaikai on Saturday August 06, 2016 @11:38AM (#12238436)
That's why they said "mask off" instead of "file off". On some (many? all?) cars the VIN is stamped on a plate that's visible through the windshield.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by protomyth on Saturday August 06, 2016 @01:25PM (#12238936)
> Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

There are a fair amount of modern cars that don't actually require you to get into the car to pop the hood if you know what you're doing. On earlier cars[1] there was no latch inside the car.

1) they don't have the electronics for this stuff however - simple hot wiring will do

Re:Car Thieves Arrested After Using Laptop and Malware to St... by bfuller on Saturday August 06, 2016 @07:57AM (#12237820)
>wouldn't popping the hood require breaking into the car first

Short answer, it depends. There are a lot of very simple methods to bypass having to actually get in the car to pop the hood.

But unless they can remotely unlock the doors with their device, they will be breaking in at some point.

Being an experienced mechanic means you practically have all the skills needed to be a great car theif.

Re:Car Thieves Arrested After Using Laptop and Malware to St... by snsr on Saturday August 06, 2016 @07:57AM (#12237819)
Jeep Wranglers have external manual hood latches, not sure which vehicle is the subject of the article though.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by bfuller on Saturday August 06, 2016 @08:02AM (#12237827)
Jeeps used to have awful security, so the fact that these thieves had to take an extra step or two, rather than just jimmying door and bumpstarting the car, means they have actually increased security.

My neighbor had his wrangler stolen a few years ago. I wasn't surprised.

Re:Car Thieves Arrested After Using Laptop and Malware to St... by MertsA on Saturday August 06, 2016 @07:55AM (#12237815)
Depending on the car the hood can be released from underneath but it's a massive pain and requires contorting arms in unnatural ways.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by bfuller on Saturday August 06, 2016 @08:04AM (#12237830)
If you are targeting a specific kind of car, like Jeeps, you can easily create a small device that will bump the hood open quickly and easily.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by duaneb on Saturday August 06, 2016 @11:12AM (#12238362)
Breaking into a car isn't terribly difficult. My car you can get into with a tennis ball with a hole in it-place hole on lock and ram the ball. The hard part is typically not getting caught.
Re:Car Thieves Arrested After Using Laptop and Malware to St... by dghughes on Saturday August 06, 2016 @11:18AM (#12238383)
That has been debunked. And debunked again recently.

http://www.snopes.com/can-unlock-car-door-tennis-ball/

Re:Car Thieves Arrested After Using Laptop and Malware to St... by vinceguidry on Saturday August 06, 2016 @12:01PM (#12238547)
You can get into Ford Rangers of a certain year range by unscrewing the antenna and sticking it into little holes underneath the handle. You catch it on the lock rod and use friction to work it up. It was really helpful for me whenever I locked my keys in my truck. At first it takes awhile to get the trick of it, but by the time I traded it in, it only took me a few seconds.

I suppose I should have been worried that other people can do that too, but my truck never got broken into or stolen to my knowledge. Security through obscurity. I now drive a Mazda with key fob and push-button ignition. It's got its own vulnerabilities but I'll let the insurance company worry about that.

Re:Car Thieves Arrested After Using Laptop and Malware to St... by protomyth on Saturday August 06, 2016 @01:31PM (#12238956)
Some Ford Rangers[1] were pretty easy to enter from the small back window. A small flip and the latch opened.

My sympathies on the Ford Ranger if you had it in a climate with snow. I had 700 lbs of sand in the bed over the back axle and good snow tires (not studs) and still got stuck. Everyone I talked to thought those things were death traps.

1) along with the Mazda B4000 which was a Ford Ranger with a different paint job and grill - even said Ford Ranger in the door