Thieves boosting signal from key fobs inside homes to steal vehicles

Re:Thieves boosting signal from key fobs inside homes to ste... by wsh on Wednesday December 05, 2018 @10:33AM (#18609096)

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car.

In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed.

The reply signal, at least, is uniquely coded to the car. The attack is to extend the range of the LF wake-up signal, causing a key stored away from the car to transmit a valid reply.

In some models, besides the transponder described above, the key also has a passive RFID tag, which works with a reader in the car to allow starting even if the battery in the key is dead.

(The article is wrong about the broadcasts, by the way; if the key transmitted continually, its battery wouldn’t last long.)

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by ryandrake on Wednesday December 05, 2018 @11:34AM (#18609789)

This is insane. Please tell me this is an option that non-insane consumers can get their car without. Fortunately I drive an old car so this does not affect me—yet. If I ever have to replace mine, this looks like yet-another-misfeature I’ll have to look out for to avoid.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by whyaduck on Wednesday December 05, 2018 @12:50PM (#18610603)

On many models keyless entry and remote start are options, rather than standard. If you park in a garage at night, then this particular attack isn't much of an issue.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by blacksmith_tb on Wednesday December 05, 2018 @01:50PM (#18611206)

I'm sure you didn't intend it that way, but "let them park in their garages" seems to imply the hoi polloi who don't have covered parking deserve to have their vehicles stolen...

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by blattimwind on Wednesday December 05, 2018 @01:32PM (#18611030)

It's standard with many "premium" brands (e.g. BMW, Audi, ...)

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by com2kid on Wednesday December 05, 2018 @02:09PM (#18611393)

My 2015 Kia has it.

It is pretty much standard across all cars now days, except maybe the very bottom of the line models.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by mdtancsa on Friday December 07, 2018 @01:41PM (#18630276)

Thankfully, the 2019 Honda Fit I got does not have this feature. The Sport model had it, and was one of the reasons I decided against it. Old school keyless entry via fob button and traditional key ignition

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by cfmcdonald on Wednesday December 05, 2018 @04:20PM (#18612682)

Whew, my 2014 Camry does not have it. Dodged the bullet.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by Shivetya on Wednesday December 05, 2018 @07:58PM (#18614423)

my Tesla Model 3 works by my phone being in range or swiping a key card. I am not sure if they are up to spoofing this method yet

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by cjjuice on Wednesday December 05, 2018 @10:59AM (#18609408)

Is there any type of encryption between the car and the key? Or are the signals always constant?

Could you just record the relay signal and play it back whenever, essentially replicating the key?

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by thebluehawk on Wednesday December 05, 2018 @11:28AM (#18609726)

Every run of the mill garage door opener using rotating keys or nonces to prevent replay attacks. I assume any fob design worth its salt would implement something similar.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by ehsankia on Thursday December 06, 2018 @03:12AM (#18616258)

https://www.youtube.com/watch?v=CNodxp9Jy4A

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by W-_-D on Wednesday December 05, 2018 @11:06AM (#18609485)

I believe a nonce is used to prevent replay attacks, but wouldn't be surprised if there are some fobs out there which are vulnerable to replay.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by Reason077 on Wednesday December 05, 2018 @11:07AM (#18609494)

It uses a challenge-response protocol, so you can’t simply record the signal and play it back.

[ Parent | on HN ]

Re:Thieves boosting signal from key fobs inside homes to ste... by lordnacho on Wednesday December 05, 2018 @06:01PM (#18613627)

It might not matter. If the point of the amp is to reduce the effective distance between the car and the fob, whatever messages are exchanged will look right to the car and the door will open.

[ Parent | on HN ]