News for hackers. Stuff that matters.
Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by taeric on Thursday July 10, 2025 @05:24PM (#44525794)
I'm curious who you are routinely interacting with that they care about your car keys. :D

I do think the writing is on the wall for old fashioned keys, though? For one, they don't really give you that much protection. As laughable as poorly done key fobs are, a physical key is a pretty low bar as far as deterrence goes.

It can be annoying to consider, but cultural norms protect cars far more than anything else. Is why many in suburban areas can get away with having their keys in the cars at all times.

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by sugarpimpdorsey on Thursday July 10, 2025 @05:28PM (#44525824)
Keys have been chipped for > 30 years. The technology is proven, secure, and reliable. Kia and Hyundai learned this the hard way when they tried to shave pennies a few years ago.

Fobs just created another attack vector catering to people too lazy to take it out of their pocket or purse.

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by gottorf on Thursday July 10, 2025 @05:38PM (#44525890)
> people too lazy to take it out of their pocket or purse

Keyless start has another legitimate function besides laziness: it allows you to leave your car locked with the engine (and AC) running while a baby or dog is inside.

Of course, you can accomplish the same by having two keys with you; you decide whether that's another example of laziness. :-)

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by olyjohn on Thursday July 10, 2025 @07:06PM (#44526710)
My Ford from the year 2000 has a 5 digit keypad on the door. I can lock my keys in the car, leave it running, lock and unlock it without an extra key. I can grant anybody access by just giving them the code. I hated carrying the stupid bulky keyless entry fob in my pocket, and threw it in a drawer, so my keychain is very small. It still has a chipped key to turn on the ignition system and start the vehicle. It's vehicle locking perfection.
Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by sugarpimpdorsey on Thursday July 10, 2025 @06:23PM (#44526355)
It's not a legitimate function because the car will beep at you if you walk away.

Some aftermarket remote starts have this feature.

However, in many states it's illegal to leave a car running unattended.

Though one could argue in court the baby or dog could serve as the attendant. Having said that, leaving a baby or dog unattended, AC or not, is just stupid.

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by zamadatix on Thursday July 10, 2025 @05:59PM (#44526104)
Chipped keys have constantly fallent to cloning attacks and worse. The idea "you insert it therefore the whole system is secure" is backwards reasoning when the problem is the chips, protocols, and buggy security implementations themselves.
Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by sugarpimpdorsey on Thursday July 10, 2025 @06:20PM (#44526328)
Moving the goalposts. No chipped key car has ever been stolen by beaming some kit off AliExpress at it and simply driving away.
Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by throwing_away on Thursday July 10, 2025 @08:54PM (#44527381)
I bought kit that can do this off AliExpress.

Here's the repo: https://github.com/joelsernamoreno/EvilCrowRF-V2

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by zamadatix on Friday July 11, 2025 @09:06PM (#44538409)
I think the goalposts are solid but maybe there is some misunderstanding/disagreement of what's going on with the chipped physical keys vs fobs causing it to seem as if I must be trying to move them.

There were early generation keys for VATS/Pass-Key I/II style systems in the ~~80s-late 90s which weren't actually "chipped" but had some protection mechanisms mostly based around resistance. They were a bit useless in that they were very limited in possible values so even without a key one could just guess through them. Beyond that, there were also just cheap bypass modules https://www.the12volt.com/installbay/forum_posts.asp?tid=845.... Really, these were not much different than going after a normal physical key car because of the lack of actual chip. I don't think you were referring to these for these reasons, but I thought I'd cover them anyways.

Actual chipped-but-physically-inserted keys https://www.key4.com/gm-transponder-key-b111pt?srsltid=AfmBO... using chips like Hitag2 https://www.nxp.com/products/rfid-nfc/hitag-lf/hitag-2-trans... started to hit the market towards the late 90s. These still don't signal the chip communication through the metal of the key into the ignition though, they use 125 KHz RFID wireless transponders. The difference between these keys and fobs is, at most, the maximum range and they lack the buttons a fob would have. The underlying operation of the chip operate on the same principle though, there was no such thing as "wired"/"physically transmitted" chipped keys. As such cloning them was indeed as easy as buying some random RFID cloner and beaming it at someone's purse to then drive away. Of course the other attacks on the car systems themselves (i.e. without the key) also still exist but that's beside the point.

If you think you know of a chipped physically inserted key which you believe does not ultimately use an RFID transponder I'd be curious what make/model/year. Maybe there is just some key I've never heard of.

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by taeric on Friday July 11, 2025 @12:11PM (#44533865)
Apologies, I debated whether to add to this, as I don't even disagree that the fobs are largely uselessly easy attack vector.

My argument was also to the doors, though. Again, I got used to just leaving keys in the car at all times. I know movies make a cliche of the keys being above the visor, but I legit did stuff like that for a long time.

My grandparent's car didn't even need a key in the ignition to start. You could just turn it and have it get going for a while. He debated getting it fixed, but ultimately really liked how convenient it was.

My father had one of those vehicles with a keypad on the outside. I thought that was super convenient and quite nice. Especially good for traveling, as you didn't have to bother taking your keys with you.

And my argument was largely around norms. I don't like excessive punishment based societies, in general, but I also don't know why or how some grow to accept that some theft is just expected.

Re:Millions of Cars Exposed to Remote Hacking via PerfektBlu... by vel0city on Monday July 14, 2025 @10:10AM (#44560503)
If I need my key chipped, why bother having to stick the metal part in at all?