Hacker News Reader

Comment by astebbin | Hacker News Reader

Similar relay attacks have been made to work over longer distances and through various obstacles, like exterior walls and locked doors. From 2015:

“Mr. Danev said that when the teenage girl turned on her device, it amplified the distance that the car can search, which then allowed my car to talk to my key, which happened to be sitting about 50 feet away, on the kitchen counter. And just like that, open sesame.“

https://www.nytimes.com/2015/04/16/style/keeping-your-car-sa...

View on HN

Seems like a simple fix would be to put an accelerometer into the key fob and turn off the radio if it hasn't moved in a minute or two.

Better solution is to determine fob distance based on response time rather than signal strength.

I was thinking exactly the same thing, speed of light is the only robust way to prevent the attack without hobbling the entire feature.. doubt it could be reliably retrofitted to an exiting design though, timing that precise probably requires additional hardware or at least hardware specifically designed for low jitter

It's an active field of research. You can learn more by starting here: https://en.wikipedia.org/wiki/Distance-bounding_protocol

Radio waves move at the speed of light.

Light can move about 300 meters in one millionth of a second. It's easy enough to find a store where the parking lot is well within that distance from the middle of the store.

So whatever system that goes into place would need to possibly have accuracy down to the 1us level or smaller.

In 1 μs light travels 300 m (984 ft) in a vacuum, or 225 m (738 ft) in air (roughly). That's not good enough.

1 nanosecond is about a foot. A 100MHz clock gives us a resolution of 10 ns, which translates to 2.25 meters away by light in air.

As a backup if your fob battery is dead, you could use inductive power in the door, or just use that to begin with (still with distance-bounding).

You can also have three antennas in the car, and have high speed electronics measure the RF delay as received on each antenna. From there the key can tell how far away it is from the car (similar to how GPS works), and it would only respond to the challenge when it is in the proper position.

Reply on news.ycombinator.com