Hacker News Reader

Comment by abcd_f | Hacker News Reader

Which manufacturers are affected?

Edit - this seems to be exploiting the "convenience unlocking" feature, whereby you can unlock the car by having the key in a pocket and standing next to the door. Similarly the car will also allow starting the engine if the key is detected inside of the car, so this too can be done via a relay. But you'll need to have the key continuously present to drive, so I guess the whole scheme would involve a flatbed/tow truck around the corner.

Edit - I guess one can stretch the relay tether by planting the key-side relay on site, next to the garage door, and have it talk to the car-side counterpart via cell connection.

Also as far as countermeasures go - one would probably be to have the key shut down completely it detects no motion for N minutes. Or just have a physical Off switch on it.

View on HN

The relay attack is very old and is very commonly used to steal all kinds of cars, here in Europe it's mostly Toyota.

You do not need the key to be present in the car once it's started up. It's a feature of all key-less cars. For example, one would not want the car to suddenly stop if the key's battery dies on the go.

So, once you start the engine, it will run. It will complain and beep if the key is not present in the car, but it will run.

They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome. A more convenient way is to store your key in a special keyless key protector "pouch" when you're not driving your car, which is basically a Faraday Cage, blocking it's signal.

If the key battery dies, there is a spot on the dashboard that is NFC-equipped, so you just need to get the key next to it and it will ID regardless of the battery state.

> It will complain and beep if the key is not present in the car, but it will run.

Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.

Your assumption is incorrect. It will run until the car is turned off. If it behaved as you're assuming it would be wildly unsafe, imagine someone inadvertently dropping off a passenger who has the key with them in a purse or jacket pocket, then stopping briefly on a bridge without shoulders, or a railroad crossing.

So now when you are on the highway you need to suddenly search your bag for the key so you can insert it.

> Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.

Not in any implementation I've heard of (and it would be quite dangerous and irresponsible). Actually, one story I've heard from pretty much everyone I know owning a keyless car is that the driver drops of a passenger that unknowingly had they key all along (typically a spouse). The driver then drives along, fills up for gas or make some other stop and then can't start the car anymore because the key is with the long gone passenger.

An anecdote, but my car (2015 fit) does keep running when the key is removed. It'll complain, but keeps running until you turn it off.

this is standard requirement in case your key fob just breaks down while you are on the highway for example

>They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome.

atleast in my non-keyless car the steering lock is quite easy; pull key, rotate steering wheel until lock, done.

Once you've done it a couple times it becomes second nature.

I believe they are talking about aftermarket steering locks that fit onto the steering well such as https://i.imgur.com/C2rIjyq.jpg

They were fairly common in the U.K. Back when car security was even worse as it is right now.

The non keyless steering locks can usually be defeated with a few swift hammer blows to the lock cylinder to dislodge the locking pin from the steering column.

Now that’s not to say these after market locks are “secure” as they two have their weeknesses (cut the steering wheel and slide the lock off, use of cheap locks on the device, etc) but they give a visual deterrent to people just driving past and deciding to take your car.

>The non keyless steering locks can usually be defeated with a few swift hammer blows to the lock cylinder to dislodge the locking pin from the steering column.

My Opel had a definitely safer construction, IIRC the entire thing is welded together so you can't unlock the steering lock without taking apart the entire locking mechanism with a welder halfway into the motorblock.

Of course it's not 100% but it should defend reasonably against people trying to steal the car who don't own a blowtorch and 3 hours of unobserved welding at my car.

«But you'll need to have the key continuously present to drive»

Not true. Virtually all "keyless ignition" cars let you continue to drive when the key is suddenly no longer detected as present in the car.

I verified this myself on my 2012 Audi S4, driving 1 km away from home without my key.

Think about it. It would be too dangerous if the car suddenly shut down the engine eg. when the key's battery dies or when some random persistent R/F communication failure occurs.

Yep. I've had a situation where I was driving on the motorway and suddenly my car decided that my key was no longer in the car(which obviously was still in my pocket) - and a warning was shown on the dash, but the car continued running. Imagine if it shut down while doing 70mph on the motorway!

Not sure if there exists any decent counter-measures.

Other than the asymmetric encryption we've had since the 1970's?

Encryption isn't the issue, the whole concept is. All this is is a range extender.

Oh, right. Damn. So it fakes the presence of the key by merely extending its range? This is not good.

Store your car keys in a Faraday cage?

I do this (a key fob bag with foil). Some cars can disable the regular broadcast from the car too. Then you have to press the button on the key to open the doors.

Latency measurement from car side?

Wouldn't help: the latency to the relay box is at least as good as having the physical key nearby.

That can't be true, because the request/reply still has to travel all the way to the key and back.

If the receiver is accurate enough(we're talking nanosecond precision) then you can absolutely tell if the key is 1m or 10m away, so a relay wouldn't help at all.

From the video it seems that the car was parked in front of the house and they just amplified the signal coming from the key inside the house. So not exactly a relay attack. The latency increase must be really low.

There are distance-bounding protocols[0], but I don't think anyone has implemented them in something as small as a car key yet.

[0] https://en.m.wikipedia.org/wiki/Distance-bounding_protocol

NFc and wireless credit cards urgently need to implement something like this...

It's only a matter of time till NFC credit cards get read with a high power reader and proxied across a cell connection to steal money from someone hundreds of miles away from the thief.

How about having a button on the keyfob, that unlocks and locks the car?

Then you don't need to worry about the relay-attack, don't need to worry that you car unlocks just because you walk past it, and don't need a steering lock...

At some point you have to ask yourself, why not just use a real key? The "inconvenience" of having to insert the key can't seriously outweigh the issue of forgetting your key in your car (because it was in the wrong bag), driving away from the key. Or the security issues. Or the added cost.

I just don't see the appeal even if it worked perfectly. I'd rather pay extra to have it removed.

Normal keys are notoriously unsafe and get worse over the years by continuous use (grinding of the locking pins). You can also cover the locking mechanism completely inside the door so no fishing for the lock handle can be done via the window or cracks in the handle.

The 'easy unlocking' feature is idiotically simple to fool as shown. Almost the same as in the late '90s when you could just cycle through the ~2-10k combinations on the fobs.

My advise would be: use the buttons on the key and disable the easy-unlock feature which can usually be done either in the car's settings or at the garage.

' ...why not just use a real key? '

Because they break into the house to get the key. It's happened to a few people I know - one time they used a wire hook through a partly opened window.

Police on the tv here (nl) this morning suggested storing your keys wrapped in aluminum foil...

Shouldn't there be some kind of simple disable switch?

You might still want keyless entry during the day for routine shopping trips and such but for parking the car overnight you can live without it; and probably sleep a lot better too.

You can - I happen to have a Mercedes, so I know as a fact that you can just double-click the lock button on the key to disable the contactless feature completely - the car can then be only unlocked with a physical button press on the fob.

I keep my key in a metalic pouch every night as a countermeasure, works just as well.

However, there's one concern with it - if a thief tries to steal your car using the relay attack and fails, will they break in and try to steal the physical key(which might lead to confrontation and people getting hurt). It's a risk either way.

A faraday cage key fob holder. Will remove the convenience of just keeping the fob in your pocket though.

Not requiring an explicit (or at least conscious) action on the part of the user seems to be the flaw in the process.

The countermeasures would appear to be:

* blocking the signal using some kind of Faraday cage to store your keys

this relies on changing user behaviour, and not forgetting; kinda removes some of the “convenience” factor

have some kind of disable switch on the key fob, in which case there’s not a huge difference to a regular remote lock/unlock button

* expanding the range of frequencies the key fob uses to try and defeat the range extenders

this likely has regulatory issues, and is probably easy to just update the hardware to cope with (if it doesn’t already)

have the car do some kind of latency measurement on the challenge/response radio message exchange; given that light travels at 1ns per foot (ish!) the car will have to accurately and precisely measure only a few nanos difference, and not suddenly stop working because of nearby radio echoes in a concrete car park (or whatever)

how close to the car is “convenient” to have it unlock automatically? 2 feet (driver standing by car)? 20 feet (kids running ahead to get into car)?

* some kind of “parked up at home” mode so that the first unlock of the day requires a button push

loses some of the convenience again

got to remember to set it (some kind of car locking button again...)

* you could have a second type of “anti-key” that you always leave at home, and when in range of this key the car won’t unlock keylessley

easy target to block in the arms race or car theft

easy to misunderstand as a user

less convenience

I had thought you offered a thorough exploration of the possible countermeasures, but you missed jgrahamc's suggestion below of adding an accelerometer to the fob. Only unlock when motion is detected. What are you thoughts? Seems that keys are incredible idle when sitting on the kitchen counter, and never perfectly idle when walking to approach your car.

I think that’s a neat idea. In my defence, I might put that under the some-kind-of-switch-to-turn-it-off category but only in hindsight ;)

Like latency-measurement though I wonder how robust it would be to the vagaries of modern life both in terms of reliability - potential moving parts - and in the face of user expectations - “I keep having to jiggle my keys to open my door” or worse, the dreaded “it doesn’t work!”. Where doesn’t work == doesn’t work how I think it should.

The car in the video is a Mercedes.

Reply on news.ycombinator.com