New Cars Vulnerable To Wireless Theft

tkrotchko writes "In a story published by Technology Review, researchers have demonstrated multiple times that they can bypass the security of wireless entry and ignition systems to take a car without the owner's permission. As researchers in the article point out, car security systems will begin have a real impact to every day use if a thief can simply walk up to your car and drive it away. Although this article is light on technical details, a companion article shows how the researchers accomplished the security bypass. An interesting read, and certainly something that will no doubt be the subject of a new movie any day now."

Nor surprising ...

[gstoddart]

Apparently my mother in law used to have a civic with keyless entry ... in a small town of <30,000 there was another Civic of the exact same color which used the same code.

They found out one time at the mall that they could each open the other's car.

I bet there's not nearly enough uniqueness and security in these things.

Ross Anderson

[betterunixthanunix]

Ross Anderson's security engineering textbook discusses this problem, as well as how cryptographic systems like Keeloq might be attacked, and some other related topics. I am going to guess, though, that the manufacturer's view is that a thief with the technical skills needed to take advantage of these vulnerabilities is rare (not saying I necessarily agree) and that most thieves will just smash the window and try to steal the radio before the cops arrive (do people still steal car radios?).

Ghost Dog did it first

[elrous0]

This was how the lead character in Ghost Dog [imdb.com] stole his cars. Great movie, BTW.

relaying the wireless data?

[YesIAmAScript]

That's really weak. That's barely a security hole at all. Someone has to be near me to have a system to talk to my car key?

Also, the explanation article isn't an explanation at all, it talks about tire pressure monitoring systems and how to spoof readings from those to the dash. It also makes the mistake of saying that the TREAD Act requires you have a wireless tire pressure monitoring system. That's not true at all, the requirements for tire pressure monitoring can be done completely passively by monitoring the effective circumference of the tire (rotation speed) and is done so in many makes.

Re:Nor surprising ...

[Colonel Korn]

Apparently my mother in law used to have a civic with keyless entry ... in a small town of <30,000 there was another Civic of the exact same color which used the same code.

They found out one time at the mall that they could each open the other's car.

I bet there's not nearly enough uniqueness and security in these things.

Last week I drove a friend's late-90s Nissan in Mountain View. It's got a plain old mechanical key. On my way out of a store I walked up to a sedan of the same color, unlocked it, and then realized it wasn't even a Nissan. I confirmed that the key worked by locking it again from the outside before fleeing a couple aisles to the correct car.