Hacker News Reader

Comment by downandout | Hacker News Reader

From the article:

"One hacker holds a device a few feet from the victim's key, while a thief holds the other near the target car."

While this isn't awesome, it certainly limits the effectiveness. You would have to have someone waiting in a parking lot to follow the person, then another person waiting by their car.

I do have a question though...I assume these things work on challenge/response schemes. That means that even if the car is started and stolen, it could never be started again without someone tailing the owner 24/7, which makes this a neat but nearly useless hack. Am I wrong in assuming this?

View on HN

It's mostly about getting the car to a secure place where no one will question you when you start tinkering with it.

Trying to start it again and set off the alarm? No worries! Take as much time as you need to disable the alarm before trying to start it again. After all, no one is around to stop you.

Yes, if you park your car outside your house on the drive, and the key is in the house in a bowl by the door (for example) then they can steal the car in the middle of the night..

This is worse in the UK, as we have much less space, so things are much closer togeather (ie. the car, and the keys (where they are left overnight).

We now keep our keys in this bag[0] to (hopefully) prevent this. With the key in the bag I'm unable to unlock the car even with it right on the door.

[0] https://www.amazon.com/gp/product/B01HETGX00/ref=oh_aui_sear...

I repurposed an old silver cigarette case.

Exactly what you described:

https://m.youtube.com/watch?v=8pffcngJJq0

The West Midlands Police may want to ask you some questions.

Similar relay attacks have been made to work over longer distances and through various obstacles, like exterior walls and locked doors. From 2015:

“Mr. Danev said that when the teenage girl turned on her device, it amplified the distance that the car can search, which then allowed my car to talk to my key, which happened to be sitting about 50 feet away, on the kitchen counter. And just like that, open sesame.“

https://www.nytimes.com/2015/04/16/style/keeping-your-car-sa...

Seems like a simple fix would be to put an accelerometer into the key fob and turn off the radio if it hasn't moved in a minute or two.

Better solution is to determine fob distance based on response time rather than signal strength.

I was thinking exactly the same thing, speed of light is the only robust way to prevent the attack without hobbling the entire feature.. doubt it could be reliably retrofitted to an exiting design though, timing that precise probably requires additional hardware or at least hardware specifically designed for low jitter

It's an active field of research. You can learn more by starting here: https://en.wikipedia.org/wiki/Distance-bounding_protocol

Radio waves move at the speed of light.

Light can move about 300 meters in one millionth of a second. It's easy enough to find a store where the parking lot is well within that distance from the middle of the store.

So whatever system that goes into place would need to possibly have accuracy down to the 1us level or smaller.

In 1 μs light travels 300 m (984 ft) in a vacuum, or 225 m (738 ft) in air (roughly). That's not good enough.

1 nanosecond is about a foot. A 100MHz clock gives us a resolution of 10 ns, which translates to 2.25 meters away by light in air.

As a backup if your fob battery is dead, you could use inductive power in the door, or just use that to begin with (still with distance-bounding).

You can also have three antennas in the car, and have high speed electronics measure the RF delay as received on each antenna. From there the key can tell how far away it is from the car (similar to how GPS works), and it would only respond to the challenge when it is in the proper position.

A stolen car is usually worth more after it's been stripped for parts. The identity of a whole car is fairly well controlled via the VIN, but it's quite easy to make the parts of a stolen car disappear into the inventory of an apparently legitimate spare parts business.

It's likely also possible to steal cars out of people's driveways. We now keep our keys in Faraday bags because of this exploit.

Faraday lined pockets.

Once you have the car, a tame mechanic can get copies of the original keys and program them for the car no problem. Obtaining the car and securing it somewhere you're in control of it is the biggest part of the problem. Ordering keys and trying to get the car programmed while the car is in the wild is far more problematic.

Presumably the thieves are stealing cars that are still valuable to them after they lose access to the owner key.

Sell for parts, program a new key, replace the key, replace the computer, etc. There's lots of room for profit on a $40,000 vehicle.

Uh, you know what things like rims, catalytic converters, and airbags are worth?

Or you can make the transmitter piece an Internet-of-Thing, so it connects to the cellular network -- and leave the transmitter piece somewhere near the victim's house.

I feel confident that layering more technology layers on top of the already flawed design isn't going to fix this.

Making car keys an IoT endpoint on a cell network strikes me as one of the worst ideas ever. It is begging for exploits and failures.

Imagine the joy the first time the owner drives outside of cell tower data range and tries to re-start the car.

I think they were suggesting an improvement to the hacking tool.

Correct, I was talking about the hacking tool.

I am a he, btw.

>>Correct, I was talking about the hacking tool.

Oh, thank goodness! My faith in ycomb hackers is restored!

Now, I'm off to go work on my reading comprehension skills...

Once you have the vehicle, many models can have a new fob programmed by a friendly locksmith.

Reply on news.ycombinator.com