Makes you wonder if you should start storing the key in a metal/RF shielded box at home...
https://pasteboard.co/HypzOWg.png
Here's a video of a relay theft (of a Merc) from West Midlands police in the UK...
https://www.west-midlands.police.uk/news/4544/watch-police-r...
Photo from a camera of attempted theft, from a UK Tesla owner...
Not a massive inconvenience.
I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
Edit: I looked up the patent. Here it is: https://patents.google.com/patent/US8930045. I understand that patents protect novel inventions and that under some standard this may be considered "novel". On the other hand, I myself have frequently used the technique of sending a signal, awaiting a response, and then using timing to derive the distance. It seems such an obvious application to this use case that there is nothing novel here.
Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again.
Seems like à solved problem really.
Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.
It's not that £30 is little money - it's that it's nearly impossible to secure a working terminal and then once you have that actually get any money out of it.
Technology can't solve everything.
That also means that relay attack is always going to work. So either accept the risk or disable the feature.
The scene of my car not being where it was supposed to be was so surreal that I did not even realize it was missing the first time when I walked out the trash. I basically walked around an invisible car.
Only when I wanted to leave the house and thought, well shouldn't my car supposed to be there did it dawn on me that something is amiss.
When I went to the police, the first thing they asked me was how far my keys were away from the car. My insurance was asking the exact same thing.
Remarkably the car was found when the police in our neighboring country stopped a driver under the influence of drugs.
Getting the car back (still ongoing) was so much hassle that I almost would be happier if it would not have been found.
It goes without question that all my keys are now stored inside a metal box when not in use.
I was a bit worried that the box does not shield the signal enough. The best way I could think of to test it was to put the key inside the box and hold the box to the steering column and try to start the car. It's probably not foolproof but I hope it is enough.
It's like the case where PIN numers on credit-cards where cracked but because noone knew it could be done people where assumed to have been negligent if the thief knew the code and automatically denied any compensation.
... until they caught the guys.
I'm very curious to know why was it was such a hassle? Unless the police were keeping the car as evidence in a truly major crime, why wouldn't they immediately give back your property?
As a background info. The car was stolen in Austria and 5 hours later stopped in the Czech Republic close to the border to Poland. It is a leased car, so there is also the leasing company involved in all decisions.
Since it seems to have been part of a bigger operation (several cars stolen over the weeks prior) a special unit working on this case got involved (from the Austrian police).
When I contacted the insurance they had me sign a waiver that I will also take back the car if it takes longer than a month to return it. This should have rang some alarms bells but I was still optimistic, after all I could have basically taken a train to the Czech Republic and drove back on my own.
Then it was week after week of people shoving the responsibility back and forth.
The Austrian police wanted to get the car to do a forensic analysis, and wanted it to be hauled back on a truck instead of driving. The insurance company flat out told them no, because it is to expensive.
Then I had to send my key to Poland (kind of ironic since this was the intended destination of the car all along) because the employee of the company that would collect and return it was located there.
After 3 weeks the officer in the Czech police was on vacation (pro tip: don't let your car get stolen during the summer vacation period :) ). The following week the insurance company wanted to know if they can finally collect the car. The Czech police told them basically yes, but the Austrian police had not given their OK, and now the Austrian officer on the case was on vacation.
After the 4th week when everyone finally thought that it could be returned, the Czech DA said the< needed to wait a bit longer because they still needed it for the case against the thief.
Now it's week 7 and I at least have seen my car after it was hauled back to the car dealer where the insurance company has sent an adjuster to check what needs to be repaired (the y have cut the connection to the car telemetry unit and caused a few scratches on the front fender).
I am not yet allowed to drive it home since those things need to be repaired first.
So my expectation if that I will get it sometime later next week, which would then be 8-9 weeks in total.
This reminds me of the street cleaning hazing ritual most newcomers to Cambridge, MA go through. I was about to call the police and report a stolen car when I saw the street cleaning sign and realized the day it specifies was the present. Either way not a happy feeling.
They make "Faraday Bags" exactly for this purpose.
Only "they" do not certify them in any way (for several reasons, including the fact that there is not - yet - an accepted standard for measurement) and in any case a Faraday bag (in the sense of a mesh) may be very effective at a given frequency and almost transparent to another one).
A tin box should always outperform a Faraday bag in shielding RF.
JFYI: https://www.forensicfocus.com/Forums/viewtopic/t=3914/
However, in the long run I won't bet on workarounds to prevent the signal to be repeated, I will rather use one of those steering wheel locks that's brightly visible from the outside. That does not prevent someone from breaking into the car, but it will prevent them from easily driving away with it.
A security camera has also been placed there, so I hope overall it is enough of a deterrence
Is that really an issue? This isn't the first type of theft that doesn't require a break-in. Tow the car and there's no evidence either.
If you say it's been stolen then it's been stolen. File the police report and that's the end of that, no? Unless they have specific reason not to believe you personally (history of fraud), it'd be a crappy insurance company that would question it.
Back in early 201x I was asked to take a look at a certain car manufacturer's project proposal. They wanted to introduce keyless unlock and ignition to their line.
I got the spec and the proposal. There was no security - the number of possible signalling combinations was in low thousands and the system was completely open to trivial replay attacks. So I got back and laid out my concerns and requirements: unique keys per car, strong nonce and proper cryptographic setup to make replay attacks impossible. The manufacturer balked, claimed it was too expensive and we lost the project.
Less than a year later certain mr. Miller demonstrated the very same type of key-fob replay attack against a different manufacturer.