In the attack described here: http://media.hacking-lab.com/scs3/scs3_pdf/SCS3_2011_Capkun....

the attacker has two devices communicating by radio. Device A is near the keyfob, and device B is near the car. Each is a repeater for the other: Whatever the car sends is picked up by device B and repeated by device A. Then the keyfob's response is picked up by device A and repeated by device B.

This type of setup will defeat both of your proposals. Triangulation won't detect anything out of the ordinary, because device B can be right next to the car. And the ultrasonic challenge/response can be defeated just like a radio challenge/response, using microphones and speakers on the repeaters.

I don't believe it's possible to do triangulation in anything like a remotely accurate fashion with anything that'll fit in your pocket.

I don't see how ultrasound helps matters at all. You just change the nature of what the attacker has to relay.

Ultrasound helps because the speed of sound in air is much lower than the speed of radio waves. This makes it massively easier to do distance measurements.

Rather than put an ultrasonic speaker in the fob, I'd put a microphone. The car would send an ultrasonic signal, and the fob would send a radio response indicating it heard it. The car could then calculate how far away the fob is.

Ultrasound also makes it massively easier to spoof distance measurements, because there's nothing that requires the attacker to use ultrasound for his own transmissions.

The speed of sound in air is about 1ms/foot, so if you're trying to measure proximity within 30ft, you're looking for a 60ms roundtrip delay, or 30ms for one-way. If the attacker has ultrasonic microphones and speakers connected with radio waves, that means he can spoof your fob from up to 9,000km away for roundtrip ultrasound, and 4,500km away for one-way, under ideal conditions.

The speed of light imposes difficult constraints in terms of how fast you have to respond, but at least the attacker can't outrun it (as far as anyone knows).

The description I saw of the amplifier attack said that the attacker put an amplifier near the car. This amplified the car's weak signal so it could reach the fob, which would then respond. The attacker does not have any equipment near the fob (and may not even know where it is).

If the car then did an ultrasonic distance check by emitting a coded ultrasonic signal that the fob had to receive, and then relay the code back to open the door, I don't see how the attacker would spoof that. Even if he has an ultrasonic microphone near the car, and an ultrasonic transmitter somewhere else, with a radio link to tell the transmitter what the send...how does he place the transmitter so that your fob will hear it?

If the attack is targeted against a specific individual, where the attacker knows both where the car is parked and where the individual is when away from the car, and the attacker can place equipment at both locations, then yes, I see that the attacker can get around ultrasonic distance measurement.

But for the most common case, where the attacker is at the car and has no idea where the owner is, it seems workable to me.

Right, I see, that makes sense and your idea would definitely help there. It wouldn't defeat a more targeted attack, but just defeating a simpler one could be worthwhile.