Hacker News Reader

Comment by Down_n_Out | Hacker News Reader

Nothing new, has been going on for a while now. Market is already providing your own "cage of Faraday[0]" for your fob. [0]https://www.amazon.com/faraday-cage-key-fob/s?page=1&rh=i%3A...

View on HN

I use these Faraday cage pouches for my new car keys (I got the two-pack listed "Amazon choice" in the above link) and they are excellent. As far as I can tell anyhow - my car hasn't been stolen (yet!) and if I keep the key in it's pouch I can neither open the doors or start the engine even if I'm right next to the vehicle.

An added bonus, it also makes the keys much more comfortable to have in a pocket, holds them in a fairly flat orientation - and stops them from scratching a phone!

I've had these. They worked for a while. But then I guess the metalized fabric wore through or something, because after a while they no longer kept the car from starting.

The smallest ones I could find would actually hold two fobs, but when filled were large and uncomfortable enough in my pocket that I preferred to just keep the fobs naked.

I still haven't found a good solution that actually works for keeping passive fobs secure while they are actually in my pocket.

Since most car manufacturers seem to be vulnerable (to my knowledge), I assume all or most buy the same COTS keyfob + electronic lock product. Much like Takata airbags or Bosch ECUs.

Being a step away from the problem probably helps keep that OEM manufacturer from strapping in and solving it. They don't feel any pain from it.

Before the keyfobs become poplar there were transponder keys with embedded RFIDs. While still attackable, they aren't actively pinging their car and revealing their presence like the fobs do.

> Before the keyfobs become poplar there were transponder keys with embedded RFIDs.

Tesla is using an NXP Athena OS based smartcard that uses the Java Card 2.2 platform for it's NFC Key on the Model 3.

The vulnerability is pretty much inherent to the idea. No amount of encryption can protect you from a relay attack. The only foolproof mitigation is to enforce a short round trip time to ensure the fob is actually close to the car, but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds.

As long as the fob's own delay is very consistent, I don't see why you couldn't time the signal.

Edit: there's a discussion down the page somewhere. The issue seems to be that (for power reasons) they use low-freq radio, on which it's hard to get timing accurate enough for 10m distance changes.

I disagree. A physical switch on the key itself which opened a circuit to the decryption key would mean the key would need to physically be in the possession of the driver.

“The idea” here refers to having the key operate automatically without having to manipulate it. If you require the driver to push a button on the key, the problem is trivially solved.

This eliminates all of the convenience of keyless entry/start.

And what problem does keyless entry/start aim to solve?

It is a convenience feature -- you don't have to fish your keys out of your pocket/handbag and press a button to unlock your car doors or to start the car. So long as you have the key somewhere on you (bag/handbag/pocket), you can unlock and start the car.

It’s really pretty impressive too. I once tried (accidentally) to lock my key in the trunk of my car and it refused to close the latch.

Is getting your keys out of your bag or pocket really that hard? In comparison to the security risks?

To think of it another way: before keyless entry was a thing - how many people were thinking 'damn I wish I didn't have to get these annoying keys out of my pocket?'

To think of it yet another way: How many people buy the upgraded trim on their car mainly for the keyless entry?

(Not having a go - genuinely curious)

Like with anything to do with security and convenience, there is always a trade off (longer passwords are more secure but harder to type, etc...). I don’t think this is a big enough security issue right now for car manufacturers and insurance companies to really do too much about.

I used to have a car without this feature and it was sort of annoying for 5 seconds each time I have to unlock the car. I do get annoyed when I get a rental without this feature too.

Additionally, this also helps when I am carrying bags or other large items with two hands. I can simply make a kicking motion at the bottom bumper of my car and the trunk will open automatically instead of me having to put the bags down and fish for my keys.

I agree that it is minor and not a real deal-breaker, but it is a nice to have.

Isn't "keyless entry" basically same concept as "not locking a door"? You can trivially implement it on every vehicle without using any electronics at all.

Uh, no? When you touch a door handle when the car is locked, the car will try to detect a keyfob near the door and then unlock itself when the keyfob is detected. The car won't unlock if a keyfob is not detected.

I suspect many people will happily give up such a convenience if it means they won't have their cars stolen so easily.

You suspect that the average person is going to give up a convenience that benefits them multiple times daily to ever so slightly mitigate the risk of an incredibly rare problem? I do not agree.

i'm a very technical person and I also wouldn't give up the convenience of keyless entry. that is what insurance is for.

That’s what we had 10 years ago.

And apparently what we had 10 years ago was better as people couldn't steal your car without touching it.

Embedded devices can be laggy at times.

More efficient for the car to estimate the distance and power of the transmitter.

You’ll just estimate the distance and power of the relay. Roundtrip delay is the only thing you can’t fake.

The relay could emulate a reasonable power output, but that requires more precise measurements and would discourage thieves.

Can't you stop the car if the key is not present in the car? I guess the thieves could fake it with long distance transmission of the signal, but that would be more difficult and the further the car drives away from the actual key, the easier if becomes to detect the timing delay.

No. Safety-wise you can't just shut the engine off and lock the steering because the RF connection to some keyfob is wonky.

These thefts have been going on for years and they will not stop until key-less go is dropped or changed such that the key requires interaction (like every higher security transponder has for, like, always).

Obviously you would not use that absurd shutdown procedure. You'd give a warning and tell the driver that the engine is going to shut off in X minutes, and after X minutes you decrease its max speed to 10 km/h for Y minutes before shutting down completely. Cars already do way more dangerous stuff if you assume that arbitrary components fail.

It also depends on the reliability. You could also say that you can't just shut the engine off if the electrical contact in the keyhole is wonky.

Some links at https://en.wikipedia.org/wiki/Distance-bounding_protocol

Is it true that encryption cannot proetect from a relay attack? If the encrypted payload is passed based on some kind of pre-shared secret (pairing) then each message should be unpredictable to a third party right?

The third party doesn’t need to predict it, just repeat it. The relay doesn’t need to understand or modify the message, just pass it along.

If the message is encrypted with some time component and a pre-shared secret then it is protected from a replay attack no?

Yes, but a replay attack is quite different from a relay attack.

Hm, good point. I guess I don't really know how these systems work. I assumed there was some kind of rotating value but I have no reason to believe this. Based on these attacks it seems the keys are really just sending the same signal every time. That appears to be a real shortcoming of the design.

The modern ones send a unique value each time, so capturing the transmission and playing it back is useless. But that doesn’t save you from an attacker that just amplifies the signal and otherwise lets the two ends communicate normally.

I think you’re not understanding the attack. It could be a unique, unpredictable signal every single time and the relay attack would work just fine. The devices intend to use distance to prevent this, with distance determined by strength of signal. The relay captures the challenge, passes it to the fob and then passes the response back to the car, boosting the signal if necessary. The timing on this is fast enough that it is within the tolerance of the system. As long as these devices are acting as proximity sensors and your fob isn’t electromagnetically isolated, this attack will work. No amount of key rotation will help.

Ok yes, I was confused. Thank you for spelling that out for me, now I understand what is happening.

"but with the short distances involved that means the fob has to generate and transmit a response within a few nanoseconds."

And the challenge-response pair must be different for every transaction, otherwise the thief can easily grab a SDR with tx capabilities, get to the car and ask for a transmission, record the spectrum, then go near the car owner door, transmit the car challenge and record the key fob response, go back to the car, wait for another challenge transmission and time the response accordingly. Not even need for a second thief.

Yeah this has been a thing for years in the UK. Myself and my wife put our keys into a metal lunch box in the hallway which mitigates this problem, which was prompted by both next door neighbours getting their cars broken into.

Top Gear did a thing on this during their one road trip: https://youtu.be/-aU09WT5rXg fast forward to the 3 minute mark

Exactly. Luckily i've got a Kia which nobody wanted to steal, but it's definitely a well known attack vector. A car on one side got stolen, the other side 'just' had stuff stolen from it.

Wait until bad weather. I had an utterly clapped-out Jeep Cherokee stolen one cold-as-hell winter night. Sure enough, found two neighborhoods over... a fair walking distance from where the last late night bus would have dropped someone off. So, yeah, a stolen beater is just fine when it's freezing cold outside...

Good point. We've got a new (year old) Kia Ceed, and a 15 year old Ford Focus. I'd imagine if somebody needed a ride they'd just take the Focus. Either way we've got the cameras outside which, along with the fact we don't have a Jaguar or a BMW outside probably makes us less likely to be turned over.

Reply on news.ycombinator.com