Vulnerabilities like this lead to car thefts. Some models of cars are more susceptible than others, and the manufacturers seem unwilling to fix the problem. The insurance companies know which models are more trouble for them, and so they set higher rates for these, which punishes the driver/owner for something outside of their control.
My solution? Require the manufacturers of vulnerable models to pay the insurance on behalf of the driver/owner as long as the vulnerabilities go unfixed.
Do people not look at the operating costs before buying a vehicle? Do they really just negotiate a monthly payment and get surprised at the amount they have to pay for fuel/maintenance/insurance?
When I bought my most recent car I had a spreadsheet which projected fuel (whether that's gas, electricity, or gas+electricity) and maintenance costs (there was some ball-parking here) for a dozen different models based on our driving habits. Once the list was narrowed down a bit I did some online quotes at my insurance company to add that in.
There were no financial surprises when I bought the car.
Consumer Reports will also inform you of things like this in advance, if you look. (For this and 100 other reasons, It's worth paying for a digital sub.)
BTW, car keys (physical keys) are notoriously weak, generally susceptible to simple raking attacks. You can learn how to rake a lock in a few minutes, and the rake+tensioner itself costs around $5. And all cars include a physical key as a backup entry method. This was partially solved by adding another device that cuts off the engine, the immobilizer, which still allows the attacker to get in, but not to drive off.
> And all cars include a physical key as a backup entry method.
Which means you are safer with just keys rather than keys plus another way to open the doors.
> This was partially solved by adding another device that cuts off the engine, the immobilizer
If they key does not need to be physically inserted to start the engine (which is true in many cars) then that is liable to attack using the remotes too, right?
Funfact: in the past Ford and Volkswagen had only a number of different variations for the coding of the physical keys. So that you could open and start several cars with the very same physical key.
I assume that this was also true for other brands.
My mom amd my friends mom both drove toyotas, completely different models and many years apart. By coincidence the key for my friends moms car worked for my moms, for unlock and start, but, my moms could only unlock the other one.
Many fleet vehicles are still this way. The 1284x key, for example, can open a surprising number of things including many older police vehicles.
A few hundred dollars more on Amazon will net you a magic keyring that can open a surprising number of vehicles, buildings, control systems, and vending machines.
If you're into that sort of thing check out Deviant Ollam's physical pentesting videos on Youtube.
This happened to me! Friend had a similar car and at night they went to mine and the door unlocked but the car wouldn't start. The door only had a few pins it checked while the ignition used every pin. We compared our keys and sure enough one part of it was the same.
Fun fact: the same applies to common household locks. If you take your household key and try all the same-brand locks in your neighborhood (~50) you'll likely find a match. Don't actually do this, your neighbors will think you're causing trouble.
With practice raking doesn't take that much time and "usually" comes with the benefit of not tripping the alarm that the door was opened (because the car "thinks" the door has just been unlocked with a key).
<EDIT> Seems HN has different experiences with their cars then my own, So I'll concede the idea that the alarm doesn't trip when using the key. It seems the cars I've had in the past are the exception to the rule. </EDIT>
The thing is, in the real world, no one really looks twice when someone gets into a car unless they are using obvious brute force to get into the car.
My 2001 seqouia's battery recently died. I unlocked the car with the key and when I hooked up the jumper cables the alarm went off until I turned the ignition to on. I was surprised it was that good
I think that mechanical key behaviour depends on the car. I'm pretty sure my BMW sets off the alarm if I use the mechanical backup key, but it turns off when I put the key in the ignition slot.
Yeah, I think it is car dependant. But the car I use (gave up my own car, but the family has a shared "work horse" car we are all insured on.) is a 10 year old UK Ford fiesta and that car doesn't trip the alarm if the door is unlocked with the key, and its not the transponder in the key, cause one of the keys to that car doesn't have a transponder and the keys get mixed up from time to time (So you only know you have picked up the wrong key only when you insert the key into the ignition and the immobilizer light is a solid red light - 3 keys, one with a fob, 2 without a fob, one of which has a failed transponder chip in it, these two keys look the same and not one of us has been arsed enough to take both keys to the car, figure out which doesn't work and label it :-P).
(One day, when I can be arsed, I'll rekey the car and reprogram it with fresh transponders, but today is not that day!)
Put a piece of tape or some paint on the handle part of the no-transponder key so you don't mix it up any more. Less effort than the "full-arse" solution.
We keep saying we are going to do something like that, but we keep forgetting because we normally in "Go do task" mode when we grab the keys. Its not too much of an issue because we will normally grab the fob key, it only becomes and issue when one of us forget to put the fob key back when being done with the car.
But "reprogramming" a key (more like adding a key) on that model of ford just involves doing a dance with the fob key then inserting the key with the new transponder. So we plan to get all keys working on the car at some point. I was just going to order a new chip but my bother was complaining about the key barrel being a bit loose on him so just doing to replace everything at some point. Its just more about not being lazy about it :-P
Thing is, its what we call "the work horse" car of the family, it gets used about once a week to do tasks no one wants to do in their own cars (or when I need to do something in a car), so its not really a high priority thing to fix, but if we are going fix it might as well do it "right")
I had a non electronic key cut for my Jeep so I could zip tie it under the frame for emergency use. It will not start the engine, but does open the door locks. When I open the doors with it, the alarm goes off.
It is superior, but a lot more difficult to pull off. And what if raking takes just 5-15 seconds? Because that's how fast it often is.
And in either case you still need to deal with the immobilizer, and turn the core of the ignition lock. Unless your radio device is that comprehensive :)
Presuming its a modern car (and if we are talking about keyless entry/start we are), well then you just plug an "Emergency Start Device" into the OBD port or to the BCM module, and drive away. Heck a lot of these "Emergency Start Devices" can also unlock the car, but often involve pulling panels/lights from the car to get to the can bus to run the attack.
So that attack when done on its own is mainly left to stealing cars off drives at night rather than say from a supermarkets car park during the day.
For the time being, I just store my keys in a little cast iron dutch oven, sitting on top of the fridge.
It's extremely effective as a shield for the 125kHz LF wake-up signal, and I've been unable to elicit a response when they're in there, even with a relay setup that reliably wakes them up from several feet away otherwise.
I just don't understand why manufacturers don't follow Volvo on this - their keyless keys just go to sleep if they aren't moved for a few seconds, and they won't respond to any signal while sitting on a table for example.
That solves part of the problem, but doesn't help when you're in a supermarket or any other event where you're moving around.
My previous cars had keys that I could manually switch off and on, which is also not a full solution because it only works for people who take the effort to always do that, but at least it gives people to opportunity to complete prevent relay attacks.
All in all I'm not a big fan of key-less entry. Having to press a button on a key to gain entry can maybe be a bit of an annoyance, but in my opinion it's not a big deal compared to the advantage of completely preventing relay attacks.
My previous car(a Mercedes) had a very very simple solution to this - you clicked on the lock button twice and it just disabled the keyless entry entirely until you pressed any other button.
>>the advantage of completely preventing relay attacks.
From my understanding ToF sensors are good enough now to completely prevent relay attacks, the added time for the relay just adds too much of a delay and it gets rejected. I believe the newest range rovers use that, they went from being extremely susceptible to relay attacks to relay attacks against them being impossible.
BMW has a page describing the use of UWB (Ultra Wide Bandwidth) radio in key fobs and how it helps against relay attacks. In short it's because the wide bandwidth allows for very short pulses which lets them measure the distance between the car and the key, and using a relay will inevitably add distance and therefore time between the signal is sent and the reply is received.
The core problem is that older systems never proved distance in any rigorous sense, they only proved connectivity/liveness. Pretending that you're closer than you are is sometimes called in research "the mafia fraud attack".
I have a physical key which I physically put in a hole in the steering column. This means I know exactly where it is when I come to parking the car, and you need to physically have it in contact to drive the car away.
I had a car that unlocked as soon as you walked near with the fob. I hated this feature, because you were never sure if the car (with your expensive laptop in the boot/trunk) was actually locked. I ended up giving the key to a family member and getting them to walk a distance away, so I could try the door handle and check it was actually locked.
I’m honestly very surprised that you don’t see the appeal. Are there other things people view as conveniences that you don’t see the appeal of? E.g., keyless entry or remote lock?
Do they really, though? I don't know anyone who raves about how much more convenient button start is, they either dislike/distrust it or don't really care either way.
I absolutely rave about it. Every time I get a rental car that needs a cut key in an ignition cylinder it's a massive pain. I wouldn't buy a car that doesn't have push button ignition and would prefer for all cars I buy going forward to have phone as a key as an option.
For my personal cars I either use phone as a key or I'll keep the key fob in my bag. So I just walk up to the car, the car either auto unlocks or I press the button on the door, I get in, I press the button, and I go. When I'm done I just grab my bag and walk away and the car will auto-lock or I just press the door button. So smooth, I never need to really handle the key at all. It just stays in its specific pocket in my bag or it's just my phone in my pocket.
With a cut key, I walk up to the car. I need to fish around in my bag to grab the key. I then need to stick the key in the door and turn it, using care to not scratch the paint. I get in the car, need to insert the key, turn it and hold it long enough for it to start. When I'm done driving, I take the key out, grab my bag, and get out of the car. I then need to once again insert my key into the door once again being careful to not scratch anything, turn it to lock. Then I need to put the key away again.
And then phone as a key is incredibly nice, definitely my preferred way. I can easily leave the house for most errands with nothing but my phone on me. It's my car key, my payment method, my transit pass, my paperback novel, my portable music player, my camera, my maps, my communicator, all in one tiny package. Incredibly freeing compared to having to carry a bunch of junk in my pockets just to get groceries or whatever.
People with bulky keychains often just throw them in their bag or purse and it can be annoying to fish them out.
I personally put a very high value on having a minimal keychain and wallet since I rarely carry a bag with me. The goal is to someday live in a state with Apple Wallet drivers’ license support, in a house with NFC smart locks, driving a car with Apple Car Key, at which point I could finally completely jettison my keys and my MagSafe wallet. I don’t want to carry physical keys when I’m already constantly carrying a device with a Secure Enclave and biometrics.
Not sure why you're being downvoted, I'm exactly the same.
House locks are already electronic/automated, haven't carried a physical house key in year.
Cars use fobs, for newer vehicles there is no option for physical keys anyway.
When I leave the house I take my phone, plus the solo fob for whatever vehicle I am driving. I have no desire to have a ring of multiple physical keys and fobs with me.
Code-hopping remotes have existed for a very long time, and I am really surprised that it's not the case here. I have had cars that were made in the 90's that used keeloq, a technology from the mid 80's.
In fact, all of my door openers and car remotes have some form of code-hopping and it's certainly not because they were specifically chosen for that aspect.
Sure, there are attacks for code-hopping systems as well, but it's a completely different league.
If I have a towing tool for your car, be sure I have a Faraday cage too to block all your GPS trackers while I dismantle the car. Think big truck that is isolated from both sound and electromagnetism and I simply hack at your car with my wrenches, selling your expensive Tesla for parts.
Did a high school project on the jam and replay attack mentioned here: https://github.com/trishmapow/rf-jam-replay. Low cost SDRs have been a real game changer in letting the average Joe get started in this space. Good to see that more unis have courses with this type of hands on experimentation.
Broke a few of these for my old work -- HiTag2 and Megamos, some of the code&knowledge used for the attack is online&published, but neither can be used to actually break the ciphers as-is [1][2]. The issue used to be that the cipher employed needed to be low-power, fast, and reliable. With current technology, one could easily use AES, and no serious auto maker should be using HiTag2/Megamos. They were hand-rolled ciphers. The way AES is used (i.e. the protocol itself) could still be wrong, of course, e.g. allowing for replay attacks, etc.
[2] Used for various pre-processing that is useful (but not neccessary) to break Megamos, but _far_ from the actual attack: https://github.com/meelgroup/bosphorus/
I'm confused why this is still an unsolved problem. A simple cryptographic challenge with pre-shared keys + button press ought to make key fobs perfectly secure for all practical purposes. Is there something I'm missing here?
It requires two-way communication, which makes the system more complex, with all the negatives that come with it.
Cars are not very secure by nature: they have easy to break glass windows, and are made of relatively lightweight materials. The key system just needs to match that level of security, and AFAIK, attacks on the keyfob are uncommon compared to other, less subtle techniques.
The more complex and sensitive "PKES" system, according to the article already has a challenge-response system, but it doesn't help with relay attacks.
You have to be able to get new keys made without having an original to read. A database of vin, key would be too big of a target and would have to be shared with dealers anyway so they could program new ones. I'm not a security expert but it seems like it would really shorten battery life on the fob if you wanted to protect against replay attacks by adding a time sensitive value.
Key distribution is (as always) an important, but solvable problem. There are some tradeoffs involving centralization vs cost of replacement, but those apply generally, not just in this particular case.
As for replay attacks, that's where the button press comes in (like on a hardware security token) -- the key only responds to challenges within a second or so of a button press and the car sets a similar timeout for validity.
This adds complexity and with complexity there comes a price tag. That would make the key fob more expansive. It also adds higher power requirements this then comes with new requirements for the battery.
Re price tag: you can buy a smartphone for 100$. Surely it is possible to mass produce cheap key fobs with send/receive capability and a tiny crypto module.
Re power: Key fobs already do some form of crypto and broadcast. Adding reception capabilities ought not to be that power hungry.
And how that will protect you from repeater attack? I just steal your car while you are in mall with this just as easy, encryption or not. I don't care about the signal, just that I capture it, send it to my other device near your car and kaboom!, your car unlocked.
One thing I would’ve liked about an Apple car is the security. Imagine FaceID, secure enclaves and MFA. An iPhone on wheels would be immune to most, if not all, of these attacks.
Which makes you dependent on a third party, that doesn't necessarily have the motive to keep it updated.
Having a mobile as a secondary key is a better idea, my Polestar 2 has keys, but also an app that can use Face ID (or the equivalent Android security measure) to drive the car. Once the app is set up you don't need to carry the physical keys.
I imagine the same way you share a key for a HomeKit-enabled smart lock.
The only scenarios where one is so injured and/or drunk as to not be able to complete the non-rigamarolish process of sharing a HomeKit home key either by doing it themselves or walking someone through the process are ones where the key holder is so incapacitated that they would be unable to share a physical key.
All of that is someone irrelevant because Express Mode is enabled by default, so if you are unconscious all a person has to do is pull your phone out of your pocket and use it to unlock and start your car the exact same way physical keys work in that situation. It even works if the phone's battery is dead.
Also, every implementation of CarKit Car Keys I have seen is the same as HomeKit home keys: there is a backup. Either a physical key, PIN, fob, or card.
> non-rigamarolish process of sharing a HomeKit home key
I have not used homekit, but from some searches it only seems to be a non-rigamarole process to add someone as a homekit user if the other person has an apple device? Also, is the Internet required to enroll someone?
> ones where the key holder is so incapacitated that they would be unable to share a physical key.
I don't need to be conscious or my phone have battery (or reception) to have someone take a key from my pocket.
> Also, every implementation of CarKit Car Keys I have seen is the same as HomeKit home keys: there is a backup. Either a physical key, PIN, fob, or card.
I was responding to gp who wanted none of this as it all defeats the security they desired. A 1-factor physical authentication token as a backup would be suitable for nearly all edge cases I can think of. As long as the person carries it, but then we are at worst where we are today, at best I could potentially authenticate or add someone from afar.
I'm not saying that smart locks aren't useful, just that they can't only be "smart", which I assume you would agree with since you brought up things currently having backup methods?
They call 911, and they read the license plate number and the authorities send an override signal that turns on the car and only allows it to be driven to the nearest hospital that appears on the screen on the console. If they go off course, they have 30 seconds to get back on course before it coasts into a 5mph limp mode (to find a safe place to pull over) for 1 minute before it completely stops and shutsdown and locks them inside for the police to come get them.
Eh, the car will probably be self-driving at that point, so probably only the first half.
The last thing I want to see on any car is the ability for the government to just remotely hijack random cars. Not just because cops already and routinely abuse their privileges (imagine some crazy police officer doing that to their ex girlfriend!), but also because any such capability can and eventually will be abused by malicious actors. Think of the usual "for the lulz" trolls, organized crime rings involved in looting people, or nation-state enemies.
> By making adding an authenticated driver not a rigamarole, but easy and intuitive.
We'll have to agree to disagree. I don't believe that this will be possible in many situations. What if I'm not near my car? What if my phone is dead? What if my car's battery is dead and it needs jumped?
I'm also just cynical that the automakers or app developers are able to not enshittify the process.
What if when I set my wife up I added her as a user but not admin and now she can't share with someone without having to involve me, which may not be physically possible in all circumstances.
> They call you an ambulance.
You don't call an ambulance to take a drunk person home. Calling a taxi when there is someone able to drive is a waste of money and a huge inconvenience the next day to retrieve the car.
You also can't call an ambulance in the wilderness.
I also meant injured in a more broad sense. What if I just have a bad headache or migraine? I don't want to be fumbling with my phone or car electronics trying to navigate adding someone.
Vulnerabilities like this lead to car thefts. Some models of cars are more susceptible than others, and the manufacturers seem unwilling to fix the problem. The insurance companies know which models are more trouble for them, and so they set higher rates for these, which punishes the driver/owner for something outside of their control.
My solution? Require the manufacturers of vulnerable models to pay the insurance on behalf of the driver/owner as long as the vulnerabilities go unfixed.
Do people not look at the operating costs before buying a vehicle? Do they really just negotiate a monthly payment and get surprised at the amount they have to pay for fuel/maintenance/insurance?
When I bought my most recent car I had a spreadsheet which projected fuel (whether that's gas, electricity, or gas+electricity) and maintenance costs (there was some ball-parking here) for a dozen different models based on our driving habits. Once the list was narrowed down a bit I did some online quotes at my insurance company to add that in.
There were no financial surprises when I bought the car.
part of what helps is, at least, before buying a car, to get insurance quotes and then you see the true cost of THAT car
Consumer Reports will also inform you of things like this in advance, if you look. (For this and 100 other reasons, It's worth paying for a digital sub.)
For a good modern day automobile security system, at least in the US, get a car with a manual transmission.
BTW, car keys (physical keys) are notoriously weak, generally susceptible to simple raking attacks. You can learn how to rake a lock in a few minutes, and the rake+tensioner itself costs around $5. And all cars include a physical key as a backup entry method. This was partially solved by adding another device that cuts off the engine, the immobilizer, which still allows the attacker to get in, but not to drive off.
> And all cars include a physical key as a backup entry method.
Which means you are safer with just keys rather than keys plus another way to open the doors.
> This was partially solved by adding another device that cuts off the engine, the immobilizer
If they key does not need to be physically inserted to start the engine (which is true in many cars) then that is liable to attack using the remotes too, right?
Funfact: in the past Ford and Volkswagen had only a number of different variations for the coding of the physical keys. So that you could open and start several cars with the very same physical key.
I assume that this was also true for other brands.
My mom amd my friends mom both drove toyotas, completely different models and many years apart. By coincidence the key for my friends moms car worked for my moms, for unlock and start, but, my moms could only unlock the other one.
Many fleet vehicles are still this way. The 1284x key, for example, can open a surprising number of things including many older police vehicles.
A few hundred dollars more on Amazon will net you a magic keyring that can open a surprising number of vehicles, buildings, control systems, and vending machines.
If you're into that sort of thing check out Deviant Ollam's physical pentesting videos on Youtube.
> magic keyring
Are you talking about the "1284x FEO-K1 16120 222343 CH751 CH501 C346A C390A E114 " set?
This happened to me! Friend had a similar car and at night they went to mine and the door unlocked but the car wouldn't start. The door only had a few pins it checked while the ignition used every pin. We compared our keys and sure enough one part of it was the same.
Fun fact: the same applies to common household locks. If you take your household key and try all the same-brand locks in your neighborhood (~50) you'll likely find a match. Don't actually do this, your neighbors will think you're causing trouble.
What does Tesla have?
The thing is if you have time to rake a car lock, you can also just break the window if you're going to rob the interior.
The key fob attack is superior since no one looks twice if you walk up to a car, it unlocks from a hand held device and then you get in and drive off.
With practice raking doesn't take that much time and "usually" comes with the benefit of not tripping the alarm that the door was opened (because the car "thinks" the door has just been unlocked with a key).
<EDIT> Seems HN has different experiences with their cars then my own, So I'll concede the idea that the alarm doesn't trip when using the key. It seems the cars I've had in the past are the exception to the rule. </EDIT>
The thing is, in the real world, no one really looks twice when someone gets into a car unless they are using obvious brute force to get into the car.
Not true for most alarm systems. If the car is locked, then any opening without the key fob unlock button will trigger the alarm in my experience.
My 2001 seqouia's battery recently died. I unlocked the car with the key and when I hooked up the jumper cables the alarm went off until I turned the ignition to on. I was surprised it was that good
I think that mechanical key behaviour depends on the car. I'm pretty sure my BMW sets off the alarm if I use the mechanical backup key, but it turns off when I put the key in the ignition slot.
Yeah, I think it is car dependant. But the car I use (gave up my own car, but the family has a shared "work horse" car we are all insured on.) is a 10 year old UK Ford fiesta and that car doesn't trip the alarm if the door is unlocked with the key, and its not the transponder in the key, cause one of the keys to that car doesn't have a transponder and the keys get mixed up from time to time (So you only know you have picked up the wrong key only when you insert the key into the ignition and the immobilizer light is a solid red light - 3 keys, one with a fob, 2 without a fob, one of which has a failed transponder chip in it, these two keys look the same and not one of us has been arsed enough to take both keys to the car, figure out which doesn't work and label it :-P).
(One day, when I can be arsed, I'll rekey the car and reprogram it with fresh transponders, but today is not that day!)
Put a piece of tape or some paint on the handle part of the no-transponder key so you don't mix it up any more. Less effort than the "full-arse" solution.
We keep saying we are going to do something like that, but we keep forgetting because we normally in "Go do task" mode when we grab the keys. Its not too much of an issue because we will normally grab the fob key, it only becomes and issue when one of us forget to put the fob key back when being done with the car.
But "reprogramming" a key (more like adding a key) on that model of ford just involves doing a dance with the fob key then inserting the key with the new transponder. So we plan to get all keys working on the car at some point. I was just going to order a new chip but my bother was complaining about the key barrel being a bit loose on him so just doing to replace everything at some point. Its just more about not being lazy about it :-P
Thing is, its what we call "the work horse" car of the family, it gets used about once a week to do tasks no one wants to do in their own cars (or when I need to do something in a car), so its not really a high priority thing to fix, but if we are going fix it might as well do it "right")
I had a non electronic key cut for my Jeep so I could zip tie it under the frame for emergency use. It will not start the engine, but does open the door locks. When I open the doors with it, the alarm goes off.
It is superior, but a lot more difficult to pull off. And what if raking takes just 5-15 seconds? Because that's how fast it often is.
And in either case you still need to deal with the immobilizer, and turn the core of the ignition lock. Unless your radio device is that comprehensive :)
Presuming its a modern car (and if we are talking about keyless entry/start we are), well then you just plug an "Emergency Start Device" into the OBD port or to the BCM module, and drive away. Heck a lot of these "Emergency Start Devices" can also unlock the car, but often involve pulling panels/lights from the car to get to the can bus to run the attack.
So that attack when done on its own is mainly left to stealing cars off drives at night rather than say from a supermarkets car park during the day.
Push-to-start eliminates the need to turn a physical lock. They drop to zero security once their RF is broken.
For the time being, I just store my keys in a little cast iron dutch oven, sitting on top of the fridge.
It's extremely effective as a shield for the 125kHz LF wake-up signal, and I've been unable to elicit a response when they're in there, even with a relay setup that reliably wakes them up from several feet away otherwise.
Unrelatedly, I didn't realize "Dutch oven" had a non-fart-related meaning, thanks for the new word.
I learn something new here every day.
- I ain’t cut out to be Jessie James -You don’t go writing hot checks down in Mississippi - Dutch oven has a non fart meaning
haha, I think the fart connotation is just that you're trapped with the lid (blanket) on.
It all makes sense now.
I purchased some cheap key fob faraday bags on Amazon.
The bags work while I'm in the car.
I just don't understand why manufacturers don't follow Volvo on this - their keyless keys just go to sleep if they aren't moved for a few seconds, and they won't respond to any signal while sitting on a table for example.
That solves part of the problem, but doesn't help when you're in a supermarket or any other event where you're moving around.
My previous cars had keys that I could manually switch off and on, which is also not a full solution because it only works for people who take the effort to always do that, but at least it gives people to opportunity to complete prevent relay attacks.
All in all I'm not a big fan of key-less entry. Having to press a button on a key to gain entry can maybe be a bit of an annoyance, but in my opinion it's not a big deal compared to the advantage of completely preventing relay attacks.
My previous car(a Mercedes) had a very very simple solution to this - you clicked on the lock button twice and it just disabled the keyless entry entirely until you pressed any other button.
>>the advantage of completely preventing relay attacks.
From my understanding ToF sensors are good enough now to completely prevent relay attacks, the added time for the relay just adds too much of a delay and it gets rejected. I believe the newest range rovers use that, they went from being extremely susceptible to relay attacks to relay attacks against them being impossible.
Phone based keys leapfrogged this
Except phone based keys are terrible in many other ways
Your microwave oven also makes a good Faraday cage.
That's an expensive mistake waiting to happen.
BMW has a page describing the use of UWB (Ultra Wide Bandwidth) radio in key fobs and how it helps against relay attacks. In short it's because the wide bandwidth allows for very short pulses which lets them measure the distance between the car and the key, and using a relay will inevitably add distance and therefore time between the signal is sent and the reply is received.
https://www.bmw.com/en/innovation/bmw-digital-key-plus-ultra...
The core problem is that older systems never proved distance in any rigorous sense, they only proved connectivity/liveness. Pretending that you're closer than you are is sometimes called in research "the mafia fraud attack".
I believe this was ratified into a standard so it should show up in more new cars. https://carconnectivity.org/car-connectivity-consortium-publ...
I have a physical key which I physically put in a hole in the steering column. This means I know exactly where it is when I come to parking the car, and you need to physically have it in contact to drive the car away.
I don't get the appeal of keyless ignition.
I had a car that unlocked as soon as you walked near with the fob. I hated this feature, because you were never sure if the car (with your expensive laptop in the boot/trunk) was actually locked. I ended up giving the key to a family member and getting them to walk a distance away, so I could try the door handle and check it was actually locked.
This is as easy to break and and susceptible to theft as keyless, so what's the benefit?
I’m honestly very surprised that you don’t see the appeal. Are there other things people view as conveniences that you don’t see the appeal of? E.g., keyless entry or remote lock?
Do they really, though? I don't know anyone who raves about how much more convenient button start is, they either dislike/distrust it or don't really care either way.
I absolutely rave about it. Every time I get a rental car that needs a cut key in an ignition cylinder it's a massive pain. I wouldn't buy a car that doesn't have push button ignition and would prefer for all cars I buy going forward to have phone as a key as an option.
For my personal cars I either use phone as a key or I'll keep the key fob in my bag. So I just walk up to the car, the car either auto unlocks or I press the button on the door, I get in, I press the button, and I go. When I'm done I just grab my bag and walk away and the car will auto-lock or I just press the door button. So smooth, I never need to really handle the key at all. It just stays in its specific pocket in my bag or it's just my phone in my pocket.
With a cut key, I walk up to the car. I need to fish around in my bag to grab the key. I then need to stick the key in the door and turn it, using care to not scratch the paint. I get in the car, need to insert the key, turn it and hold it long enough for it to start. When I'm done driving, I take the key out, grab my bag, and get out of the car. I then need to once again insert my key into the door once again being careful to not scratch anything, turn it to lock. Then I need to put the key away again.
And then phone as a key is incredibly nice, definitely my preferred way. I can easily leave the house for most errands with nothing but my phone on me. It's my car key, my payment method, my transit pass, my paperback novel, my portable music player, my camera, my maps, my communicator, all in one tiny package. Incredibly freeing compared to having to carry a bunch of junk in my pockets just to get groceries or whatever.
I do not get the appeal either. You have to put something in your pocket and take it out occasionally.
> And then phone as a key is incredibly nice, definitely my preferred way.
Your phone becomes a point of failure for one more thing.
> Incredibly freeing compared to having to carry a bunch of junk in my pockets just to get groceries or whatever.
All I put in my pocket to buy groceries are keys and a wallet.
People with bulky keychains often just throw them in their bag or purse and it can be annoying to fish them out.
I personally put a very high value on having a minimal keychain and wallet since I rarely carry a bag with me. The goal is to someday live in a state with Apple Wallet drivers’ license support, in a house with NFC smart locks, driving a car with Apple Car Key, at which point I could finally completely jettison my keys and my MagSafe wallet. I don’t want to carry physical keys when I’m already constantly carrying a device with a Secure Enclave and biometrics.
A beautiful aspiration, until you lose or break your phone...
Not sure why you're being downvoted, I'm exactly the same. House locks are already electronic/automated, haven't carried a physical house key in year. Cars use fobs, for newer vehicles there is no option for physical keys anyway. When I leave the house I take my phone, plus the solo fob for whatever vehicle I am driving. I have no desire to have a ring of multiple physical keys and fobs with me.
Because it's a wild rube goldberg solution to a minor inconvenience.
My phone has a card, opens my car and my garage door. Haven’t had a trouble for years. Saved me hours from looking for each of those items separately.
Code-hopping remotes have existed for a very long time, and I am really surprised that it's not the case here. I have had cars that were made in the 90's that used keeloq, a technology from the mid 80's.
In fact, all of my door openers and car remotes have some form of code-hopping and it's certainly not because they were specifically chosen for that aspect.
Sure, there are attacks for code-hopping systems as well, but it's a completely different league.
The current gold standard for vehicle theft protection is:
IGLA system to block the CAN bus, LIN bus, and ODBII port. It also protects against key fob cloning/relay attacks.
+
A hidden physical kill switch that cuts off the fuel pump relay (the company 41.22 makes a drop in that doesn't require wire splicing).
+
A hidden GPS tracker with an onboard backup battery in the event the car battery is disconnected.
None of this stops someone with a flatbed from simply towing your vehicle away, but at least the GPS tracker will give you a window to locate them.
If I have a towing tool for your car, be sure I have a Faraday cage too to block all your GPS trackers while I dismantle the car. Think big truck that is isolated from both sound and electromagnetism and I simply hack at your car with my wrenches, selling your expensive Tesla for parts.
That's an issue once the tow truck gets where it's going, but the GPS tracker will record/broadcast the path there.
Did a high school project on the jam and replay attack mentioned here: https://github.com/trishmapow/rf-jam-replay. Low cost SDRs have been a real game changer in letting the average Joe get started in this space. Good to see that more unis have courses with this type of hands on experimentation.
So many Range Rovers are being stolen in the UK that the manufacturer has started contributing towards insurance costs: https://www.whatcar.com/news/range-rover-insurance-owners-to...
perhaps they should also contribute to a solution to the weak encryption?
Broke a few of these for my old work -- HiTag2 and Megamos, some of the code&knowledge used for the attack is online&published, but neither can be used to actually break the ciphers as-is [1][2]. The issue used to be that the cipher employed needed to be low-power, fast, and reliable. With current technology, one could easily use AES, and no serious auto maker should be using HiTag2/Megamos. They were hand-rolled ciphers. The way AES is used (i.e. the protocol itself) could still be wrong, of course, e.g. allowing for replay attacks, etc.
[1] Doesn't have some features which you need to use to actually attack HiTag2: https://github.com/msoos/grainofsalt
[2] Used for various pre-processing that is useful (but not neccessary) to break Megamos, but _far_ from the actual attack: https://github.com/meelgroup/bosphorus/
I'm confused why this is still an unsolved problem. A simple cryptographic challenge with pre-shared keys + button press ought to make key fobs perfectly secure for all practical purposes. Is there something I'm missing here?
It requires two-way communication, which makes the system more complex, with all the negatives that come with it.
Cars are not very secure by nature: they have easy to break glass windows, and are made of relatively lightweight materials. The key system just needs to match that level of security, and AFAIK, attacks on the keyfob are uncommon compared to other, less subtle techniques.
The more complex and sensitive "PKES" system, according to the article already has a challenge-response system, but it doesn't help with relay attacks.
yeah, this is what the article is describing as to what it was like in the early 2000s (assuming no moronic key reuse)
the problem is they "improved" the usability
it was safe when you had to push a button, but now roles are flipped so the car is the initiator (and doing it constantly)
the protocol is now subject to a whole entire extra set of attacks it was never designed to deal with
You have to be able to get new keys made without having an original to read. A database of vin, key would be too big of a target and would have to be shared with dealers anyway so they could program new ones. I'm not a security expert but it seems like it would really shorten battery life on the fob if you wanted to protect against replay attacks by adding a time sensitive value.
Key distribution is (as always) an important, but solvable problem. There are some tradeoffs involving centralization vs cost of replacement, but those apply generally, not just in this particular case.
As for replay attacks, that's where the button press comes in (like on a hardware security token) -- the key only responds to challenges within a second or so of a button press and the car sets a similar timeout for validity.
This adds complexity and with complexity there comes a price tag. That would make the key fob more expansive. It also adds higher power requirements this then comes with new requirements for the battery.
Re price tag: you can buy a smartphone for 100$. Surely it is possible to mass produce cheap key fobs with send/receive capability and a tiny crypto module.
Re power: Key fobs already do some form of crypto and broadcast. Adding reception capabilities ought not to be that power hungry.
Even Better, they can use a smartphone app. We already have a battery-powered device that can emit radio signals in various frequencies!
Battery life maybe? AFAIK most of the remotes works one way only, they don't have a receiver and very low processing power.
And how that will protect you from repeater attack? I just steal your car while you are in mall with this just as easy, encryption or not. I don't care about the signal, just that I capture it, send it to my other device near your car and kaboom!, your car unlocked.
How does repeating work if both the car and key use a code that changes every time, like 2FA app.
TOTP relies on synchronized clocks, which is far, far too complicated to work here.
We should just GPS track the cars and arrest the thieves.
Good luck when the car is stripped for parts within 24h
We could have the police work 24 hours also.
Only two lecture slide decks?
Did the professor get tired of uploading the material for students to review post lecture?
One thing I would’ve liked about an Apple car is the security. Imagine FaceID, secure enclaves and MFA. An iPhone on wheels would be immune to most, if not all, of these attacks.
Which makes you dependent on a third party, that doesn't necessarily have the motive to keep it updated. Having a mobile as a secondary key is a better idea, my Polestar 2 has keys, but also an app that can use Face ID (or the equivalent Android security measure) to drive the car. Once the app is set up you don't need to carry the physical keys.
And then how do I loan it to a friend without the rigamarole of adding them as an authenticated user?
What if I'm not able to add them as an authenticated user or authentic myself to let them drive, e.g. I'm injured or very drunk?
I imagine the same way you share a key for a HomeKit-enabled smart lock.
The only scenarios where one is so injured and/or drunk as to not be able to complete the non-rigamarolish process of sharing a HomeKit home key either by doing it themselves or walking someone through the process are ones where the key holder is so incapacitated that they would be unable to share a physical key.
All of that is someone irrelevant because Express Mode is enabled by default, so if you are unconscious all a person has to do is pull your phone out of your pocket and use it to unlock and start your car the exact same way physical keys work in that situation. It even works if the phone's battery is dead.
https://support.apple.com/en-us/118271
Also, every implementation of CarKit Car Keys I have seen is the same as HomeKit home keys: there is a backup. Either a physical key, PIN, fob, or card.
> non-rigamarolish process of sharing a HomeKit home key
I have not used homekit, but from some searches it only seems to be a non-rigamarole process to add someone as a homekit user if the other person has an apple device? Also, is the Internet required to enroll someone?
> ones where the key holder is so incapacitated that they would be unable to share a physical key.
I don't need to be conscious or my phone have battery (or reception) to have someone take a key from my pocket.
> Also, every implementation of CarKit Car Keys I have seen is the same as HomeKit home keys: there is a backup. Either a physical key, PIN, fob, or card.
I was responding to gp who wanted none of this as it all defeats the security they desired. A 1-factor physical authentication token as a backup would be suitable for nearly all edge cases I can think of. As long as the person carries it, but then we are at worst where we are today, at best I could potentially authenticate or add someone from afar.
I'm not saying that smart locks aren't useful, just that they can't only be "smart", which I assume you would agree with since you brought up things currently having backup methods?
> And then how do I loan it to a friend without the rigamarole of adding them as an authenticated user?
By making adding an authenticated driver not a rigamarole, but easy and intuitive.
> What if I'm not able to add them as an authenticated user or authentic myself to let them drive, e.g. I'm injured or very drunk?
They call you an ambulance.
In the future?
They call 911, and they read the license plate number and the authorities send an override signal that turns on the car and only allows it to be driven to the nearest hospital that appears on the screen on the console. If they go off course, they have 30 seconds to get back on course before it coasts into a 5mph limp mode (to find a safe place to pull over) for 1 minute before it completely stops and shutsdown and locks them inside for the police to come get them.
Eh, the car will probably be self-driving at that point, so probably only the first half.
Aren't authorities notoriously unable to get into Apple products unless allowed?
The last thing I want to see on any car is the ability for the government to just remotely hijack random cars. Not just because cops already and routinely abuse their privileges (imagine some crazy police officer doing that to their ex girlfriend!), but also because any such capability can and eventually will be abused by malicious actors. Think of the usual "for the lulz" trolls, organized crime rings involved in looting people, or nation-state enemies.
> By making adding an authenticated driver not a rigamarole, but easy and intuitive.
We'll have to agree to disagree. I don't believe that this will be possible in many situations. What if I'm not near my car? What if my phone is dead? What if my car's battery is dead and it needs jumped?
I'm also just cynical that the automakers or app developers are able to not enshittify the process.
What if when I set my wife up I added her as a user but not admin and now she can't share with someone without having to involve me, which may not be physically possible in all circumstances.
> They call you an ambulance.
You don't call an ambulance to take a drunk person home. Calling a taxi when there is someone able to drive is a waste of money and a huge inconvenience the next day to retrieve the car.
You also can't call an ambulance in the wilderness.
I also meant injured in a more broad sense. What if I just have a bad headache or migraine? I don't want to be fumbling with my phone or car electronics trying to navigate adding someone.