Auto Smart Key Mystery Device Hacks into Cars

Doesn't it still take a physical key to start the car, even if door security has been breached?

OTOH, a remote start fob....

But then further OTOH, how about unlocking the steering column?

Maybe an auto broker could help out here?

The smart key system allows you to open your locked car door. You then sit in the drivers seat, push the brake pedal and push the start button. Then drive off like a regular car. The entire time, the key is in your pocket or your wife's purse.

When you leave the car, you touch a button on the door or a place on the door handle and voila! All the doors lock.

There are some versions that require the driver to turn a pseudo ignition lock cylinder - the key still remains in your pocket, but the physical act of turning a key must be done. I think it has to do with the ignition lock system. Nissan is one that comes to mind.

Most just have a push button vs a turning lock cylinder.

This article (see below) doesn't go into the details of coding, rolling codes, etc., but in the case of this particular hack even the hackers didn't need to know the technical details and it wouldn't have made any difference if they had.

What the Swiss researchers did was to greatly amplify the signal between the fob and the car, thereby using the fob's very own signal to break in. That's all. No coding, no encryption - none of that - was necessary at all. It works as long as both the fob and the car are in the general vicinity of the hackers' repeater. Normally the fob has to be very near the car - within a few score centimeters - for it to work. All the researchers did was to greatly increase that range. The fob isn't necessary to continue running the car, btw; this is so the car will not suddenly stall when, say, a fob's battery dies whilst driving on the interstate - making such fobs an even worse idea.

They were able to break in eight of the ten cars they tried. The article itself is dated 2011, so car manufacturers who don't know about this simple and extremely effective technique aren't paying attention:

http://jalopnik.com/5736774/how-hackers-can-use-smart-keys-to-steal-cars

The amplification hack has been known for a few years (I've heard about it since 2009). This new hack takes the signal from the smart key and stores it. It then transmits the correct code to the car, which allows the door to unlock and if it can get past the door lock, most times the car will start.

FYI, many manufacturers have an ap (you install on your phone or tablet) that gives you control of your car. You can unlock the doors, start it (to warm or cool before you get in). I've heard that Audi has a system that's almost ready for production that not only parks your car, but brings the car to you from a parking garage. It's suppose to be here on the 2018 A8 (maybe late summer next year). Self park 2018 Audi A8

How do you prevent someone from hacking into something like that?

Don't be so lazy, and don't buy such a system? Jeez, this is so difficult to figure out. (For some, anyway.)

If I (or my client) makes a choice to buy a car, because I like it, regardless of if it has a smart key, then how does that make me lazy? Jeez, I guess this is much more difficult to figure out, for those of us who aren't as smart as you, anyway.

These cars have rolling codes. The new mystery device can outsmart the rolling code.

The other idea you have sounds like a good one. A physical device (pads) located in the key that makes the key unique. The car can be programmed with the pad information, so the car will unlock the doors or start, only if the key and the car can communicate. I'm not sure if this already exists, but it's a great idea!

The other idea you have sounds like a good one. A physical device (pads) located in the key that makes the key unique. The car can be programmed with the pad information, so the car will unlock the doors or start, only if the key and the car can communicate. I'm not sure if this already exists, but it's a great idea!

Isn't that basically an RFID type key like my car has, I can have Master and Valet keys, but only a finite number of them. A Master Key is required to make the car accept a master or Valet key,

It does take about 20 minutes to program the key on the vehicle.

The Valet key cannot unlock the trunk or glove compartment.

I know there have been "chips" in keys for quite a while. The Toyota cars with the "fat" keys have chips in them. The other manufacturers have them as well. The problem is that the key transmits 32 bit or 40 bit code, which no only unlocks the door, but also allows the car to start. If the so called "pad" was the next level of protection - it would only be used to unlock the doors or start the car, but not both. Now that I think about it, the better way to go would be to use the "pad" to start the car, since its more important to block the starting of the car vs opening of the door.

Regarding the master key and sub keys. I was told that a new key can be made (without the car being present), only if at least one key exists. If all the keys are lost, the car must be towed to the dealer and a new set of keys will be programmed. A master key can be made using a valet key and vice versa.

Actually, Autobroker, they're both rolling codes. The difference is in how and when they're generated.

'...and the hash sufficiently obtuse...'

Aw, come on. That's not cool. Why do you feel it necessary to discriminate against smart/enlightened hashes?

All hashes matter.

Mobile apps can be hacked and commandeered. The more complex the scheme, the more potential attack vectors at the hacker's disposal. These apps will be hacked and cars will be stolen. Manufacturers cannot prevent such hacks; only forestall them, so long as they persist in exposing their wares to cybercriminals. Being on the defensive is always the weaker position, especially in cyberspace. Insofar as hackers storing and then repeating codes goes; it's really a step backwards. The Swiss' approach of using repeaters sidesteps the code scheme entirely.

Let's say they want to steal a Jag from a dealership. Two perps, each with one half of the repeater, the halves connected by microwave link. Perp #1 walks in the dealership and wanders around near where the fobs are kept, but not too close until Perp #2 is in position. Perp #2 is outside browsing the lot. He hangs around one car until he hears the door unlock as Perp #1 moves within range of the fobs inside. Voila! He makes off with the car and Perp #1 meets up with him later. Easy peasy. No alarms, no calling the police, no nothing but a stolen Jag - because that Jag's very own fob unlocked it and let the perp drive away.

I heard about the repeaters a while ago. You're correct about the operation and it does work. I believe the car needs to "talk" to the key fob also, so the signal needs to go from the key to the car, then from the car to the key (some sort of handshake operation).

The mystery device needs one person to operate it. My guess is that the device pretends it's the car and communicates with the key. It receives some sort of code from the key and stores it. Then when the device is brought near the car, the car thinks it's the key and opens the door and allows the car to start.

A blast of ammonia or chlorine to any such perpetrator might be effective, but you would have to let your car air out for a while afterward.

The car should have facial recognition and security questions....If it doesn't recognise you then it won't start, takes your picture, sends it to the police....

Good idea, but how would you valet park your car? Or loan it to a friend or co-worker? Hmmmm, but it would keep your kids from taking it for a joy ride - do kids still do this?

Yeah, then they'll have to take your head with them to steal your car. Maybe they could just skin your face and wear it, a la Lecter.

A system like this would need some legal warnings that people experiencing anaphylaxis may not be able to drive to get medical help and that for anyone severely battered their car may not provide an expedient escape route from their attacker.

Would you be able to drive someone how in their own car if they were inebriated without them sitting in the driver's seat? If so, car jacking would remain an option....and likely one a car the if might consider if they were desperate enough and knew such systems existed.

Facial recognition has problems with PHOTOGRAPHS...which is the real YOU?

I think there's a method that effectively jams the code being sent by the real transmitter and captures it. So, now the captured rolling code unlocks the car.

That's another system - the one where you manually push the lock/unlock button.

I heard that that "device" jams your keyless signal from reaching the car. The victim pushes the unlock button and it does nothing (signal being jammed). The victim thinks he didn't push the button hard enough, so he does it again. The device allows the second signal to go through and the car still thinks that the first code is still valid. At a later time or even date, the thief can hit the code (first one that was jammed) and the car thinks it's okay, so it lets the doors unlock. Once inside, the car will think the fob is okay and it will let the car start.

The reason this system won't work with smart keys is that most times the user doesn't push the button to unlock the door. The low frequency signal is short range and communicates with the car only when it's within a few feet of the car.

The problem exits to a degree with cars with remote keys as well, they are easy to crack with the right equipment, this is only an extension of such illegal activities.

The FOBs are to my mind even easier cracked than the older systems were, sadly.....I would not give sch a car house sorry, garage room myself!!!

For the more normal keys, (for many of us!) and if you are really worried, take the battery out of the smart key (not possible on all,some are sealed, some are rechargeable and get charged when driving, for example!), use the key as it was designed to be used, to open the doors.

Use the inside button to open the other doors, if turning the key does not do it!

The RFID chip (that most keys use) will still work with no battery. The car activates it.

I am sure that somewhere there are cars that cannot be so used as I have written, I have simply not seen them myself....

I hope this helps.

For the more normal sealed keys and those containing signal-powered RFID chips, one thing the Truly Paranoid could do is chuck the thing in a microwave oven and nuke it for a few seconds. Voila! Vintage key.

That will make the key useless, the RFID needs to be read by the car to allow the engine to start and continue running, on all my cars for many years now....

No RFID = no driving!!

Don't mix up the RFID part with remote door opening part, that is two separate bits in the key!! But maybe built together in some way and inseparable!

Thats why I recommended taking the battery out (if possible) as the RFID does not need the battery to be read by the car, when inserted in the ignition.....

Sorry, I did not make that clear enough before.

Look here:-

Radio-frequency_identification

Ah, okay. Thanks!

You're correct about the RFID not needing power. When a smart key battery goes bad, the owners manual says to put the fob near the start button and the car will start.

Taking the battery out would make the car very hard to hack, but it would also make operation of the car difficult.

I have a story about a Mercedes C230 (not a Keyless Go car). The Keyless Entry remotes work (verified by the dealer). The car can read the RF signal the FOB puts out. Somehow the signal gets lost between the receiver and the door lock module. So, the owner must remove the metal key from the fob (requires moving a small latch and pulling the key out) and insert it in the door to unlock it. The owner must then put the metal key back in the fob and then use the fob to start the car. This would be similar to removing the battery in a smart key.

You may have guessed that I'm the owner of the C230 and I'll tell you that it's a hassle to pull the key out every time I want to unlock or lock the doors - you'll understand the second part if you're a Mercedes owner with a bad fob. If I took the batteries out of our smart key fobs, it would be the same hassle.

I wish there were another answer.

I mentioned that what I had written was not for all cars. Mercedes being a good example as you clearly point out, thanks.

It will work with most cars that can remotely (usually within 25 meters) unlock doors using a button on the key. But also need the key for starting the car, to be inserted and turned.

Have a great day....

Would placing the Fob in a "safety" pouch, which is rf shielded, prevent a perp from scanning the code whilst you're out and about?

I am thinking a simple biometric touch sensor for the door handle and start button, ala iphone would be the easiest way to prevent theft and still have he "keyless" option.

biometric touch sensor for the door handle

We have a forecast low of 1ºF coming soon to a parking lot near here, and that is not as low as it will get this winter - we've seen -25ºF in past years. Want to be touching door handles in those temperatures?

LOL You're not supposed to be using your tongue!

I do see your point though.

Those older cars without such modern features perhaps?

Here a glove is used to protect the hands......

Here the politicians keep their hands warm by putting them in other people's pockets.

What if you loaned the car to someone or you asked someone to pick your car up? ie, can you go to my home and bring my car to me at xxx.

How to make a car key code grabber device,,or any combination of these words,,see Google.

More than a dozen apps available for this purpose.

Decoding / Recoding / Code recording / device's for sale, for less than $100.00.

Many you tube videos, how to hack a car.

Where to buy hacking device's.

Car hacking clubs.

Car hacking contests.

Car hacking training programs.

Did you have a Question ?