American media at it's best!

http://ir.atmel.com/releasedetail.cfm?ReleaseID=665225

Where Atmel announced a new transponder chip & microcontroller, which do, indeed, use 128-bit AES. This is from 2012 though, so I'm not sure how widely adopted this particular chip is, or if other, older chips are in widespread use that are 128-bit AES.

But even if everybody is using 128-bit AES, all that means is that the actual encryption itself is probably essentially unbreakable. But, as well all know, cryptographic systems are more than just the raw crypto algorithm. All sorts of systems which use crypto are eventually found to be insecure, so this whole thing should still come as little surprise (well, to people like us anyway. To the average cop, maybe this all sounds like black magic).

I agree with you that this crypto system failure, not an algorithm exploit.

A make of USB drive enclosure that claimed to be using AES 128 bit encryption, but it turns out that wasn't for the data.

How do you know at the RF level that its challenge based, and how do you know that the exploit is not operating in some .gov override mode like "I am NSA, open right now" mode.

I used to operate a computer that had a rack mount lock where its extremely well known (to some, anyway) that the mfgr shipped every unit with a tumbler that could be opened by a key cut to "XX2247"

I could encrypt the key cutting code XX2247 for you with 128 bit AES, or maybe 2048 DSA, but its not going to help very much.

It might be buggy enough that a random out of limits response might open it.

Soooo... what to do with an extra set of keys to your buddy's car? Muwahahahaha... gaslight[1] him, of course! So me and a couple of other buddies would randomly drive to where he worked, and take his truck and do little things... change the direction it was facing, or move it about 3 spots over in the parking lot, or fiddle with the presets on his radio.

For like a month, he was spazzing out over this, while we all did our level best to keep a straight face when we were with him. He was convinced it was his brother messing with him for quite a while. Needless to say, he was a bit pissed when we finally broke down and told him and gave him his keys back. But man, what a laugh riot for a time...

[1]: http://en.wikipedia.org/wiki/Gaslighting

How many times do we have to go over this? Crypto is hard to do right.

ECB: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation...

The larger point here is that most keys probably aren't using AES to start with, and there's probably some other vulnerability in the overall system.

I'm sure there are vulnerabilities all over the place, but it would make even more sense if it happened to an AES system, because people would let their guard down because super-duper industrial strength encryption will take care of everything.

I didn't mean using it was brain dead, i mean using it without knowing the implications might lead to (accidentally) using it in in a brain dead way. For example, I could see them implementing the protocol and testing it without crypto and then simply adding crypto on top of it without thinking about the crypto portion.

In other words, the superlatives don't match the reality.

This is the worst possible design, and not far from what late 90's cars use. Even though it is the dumbest possible solution it still works reasonably well, because you have to have access to the key to start the car. You can clone the key in a second, but you still must get within inches of the key.

For example your hypothetical protocol is grossly insecure. Keys transmit signals over dozens of feet, not inches. All an attacker would have to do to attack your hypothetical protocol would be to capture one exchange. Then he can XOR the challenge with the response to obtain the 32-bit secret, allowing him to clone the key!

I was under the assumption that we are talking about proximity keys. Old ignition keys use RFID, but a broken encryption system. They are still secure because the range is a few inches. Newer cars with unlock from the pocket / push to start, use challenge based auth and strong encryption.

Click to unlock fobs use secure PRNGs. That is a separate discussion, and they are generally secure. Maybe this is what the reporter was talking about, but I assumed these cars had proximity keys. Even if this is what the reporter was talking about, they were not way off base, as this still falls in the "should be impossible" category.

However, this, "and should be hackproof", is faulty. Nothing is ever inherently secure, though it might be relatively secure at a given moment and circumstance.

It's easy to characterize this as the ignorance of American media. However, this kind of "should be X" is common for anyone, be they journalists, ordinary folk, or technologists. We all have expectations about reality and feel shocked or bitterly disappointed when the expectation falls apart.

Versus the amazing quality of Chinese or Russian media? Brazilian media? Romanian media? Or maybe it's the French that have outstanding journalistic integrity and never make mistakes!

I imagine it might be stupider, like maybe there's a way to induce the unlock button or motor to trigger via induction or something. Though I'm pretty poorly informed about that kind of thing scientifically and am likely completely wrong.

It's a fair point, but I don't know that I'd take that at face value. That could have just been a subjective assessment that got repeated as fact. Without us having access to the actual videos or the raw numbers, it's hard to say.

So I don't think it's clear that these thieves are using any of those techniques.

Sure, and I'm not saying it's 100% certain that this is exactly how the thieves are operating.. just pointing out that it's well known that modern cars are vulnerable... if there are additional, as yet unreported vulnerabilities, would anybody be surprised?

I imagine it might be stupider, like maybe there's a way to induce the unlock button to trigger via induction or something.

That actually strikes me as semi-reasonable, without having research the matter in any depth. Where were you on the night of January 12th, when a black Suburban was stolen ...

While those links to may be useful to shed light on this type of crime, they do little to confirm the method that these thieves are employing. Hence, there is mystery.

I don't see how you can say that is "unrelated". Even if our "mystery" thieves aren't using those exact exploits, there is NO "mystery" that hackers have demonstrated the ability to break car remote systems. But the article and the quotes from the police make it sound like the police are just staring at the wall, drooling and going "duuuhhh huhhh huhhhh... how'd they do that.. duhhuhhhh huhhhhh." Now that's probably not literally the case, but the article makes it sound like nobody has even the slightest clue that this stuff is possible, or how it's done. And that's just not true.

It's almost as if the news has some sort of agenda!

If TFA had given some more context, and said "exploits which would allow this type of access were shown at a recent hacker conference, and some cars have known exploitable vulnerabilities... but we don't know if this crop of thieves are using that or a newer, unpublished exploit" then it would, IMO, have been a better article. Instead, it leaves people with the idea that this whole concept (hacking cars) is something brand new, unknown, and unexpected. And it's not.

So you have a device that can open random car doors in seconds? Do you know where to get one? Do you know anyone who has one?

The police apparently don't (and the police almost certainly know far more about crimes and how they are performed than you and most other HNers do). A guy who specializes in car electronics exploits doesn't.

So yes, this is a mystery. The counter-argument seems to be some variation of the too-common world-weary-haughtiness that spreads like an infection on HN.

Bank closes at night like always. The next morning the manager arrives and finds everything seemingly as it was, but when they look in the safe all of the money missing. Would that qualify as a mystery? Even though people have been robbing banks for centuries, even breaking into safes? Yes, of course it would, though I'm sure there'll be that guy who'll point out the obvious that somehow someone got in the safe.

You've been at this "random car" thing over the whole thread.

But there no indication that these thieves can steal random cars in the sense of any car they choose. Thieves have stolen particular cars and the cops might not know the connecting thread but there's no situation where the thieves passed a "show us a random car and we'll use our device to steal it" challenge and that would be the kind of hard evidence you'd need for a "these guys can steel any car" rhetoric.

But how about Honda -- do you have a remote door unlock exploit that can do what is being discussed on just Honda vehicles?

No, and I haven't claimed to do so. You're just setting up straw-men and attacking them now, and I don't know for what purpose. I've already said that I was talking in terms of a general sentiment that I think I detected in TFA, and not the specifics of this batch of incidents.

Of course, elementary school science is enough to figure out that if you bought a jar of apple juice from the store, replaced some of the contents with hot goat urine and shook it up before fully closing the lid again, as the air inside cooled it would pull the clicker back down. And you could return it to the store.

But if I read an article about mysterious tampering with "unopened" products in local grocery stores, I hope the police (and particularly, food packaging or food security experts) wouldn't be so baffled about it when discussing it with reporters.

Exploits have been demonstrated by researchers, but are mostly pretty make/model specific.

Certainly, I'd bet that every car with bluetooth/wifi integrated has some sort of flaw whereby it might be possible to use that to bridge to the cars Canbus and request a door unlock. That doesn't mean that these are easily exploitable by individuals willing to commit petty theft.