This is even worse than a relay attack, since AFAIK those require being near the fob and there are other mitigations (even simple things like timing how long it takes to get a response). This attack essentially lets you clone key fobs permanently, not just start a car while the owner is on the other side of a parking lot. And the encryption would work a heckuva lot better if the attacker had to precalculate every challenge and response with, for example 256 bit AES keys instead of 40 bit keys with 24 bit responses.