Hacker News Reader

Comment by wsh | Hacker News Reader

Yes, it’s a feature, so you don’t have to remove the key from a bag or pocket to enter or start the car.

In typical designs, the car continually transmits a low-frequency (e.g., 135 kHz) radio signal to wake up any wireless keys within range. When a key receives this signal, it replies with a VHF (e.g., 315 MHz) signal, and the car unlocks or starts when a door is opened or the start button is pressed.

The reply signal, at least, is uniquely coded to the car. The attack is to extend the range of the LF wake-up signal, causing a key stored away from the car to transmit a valid reply.

In some models, besides the transponder described above, the key also has a passive RFID tag, which works with a reader in the car to allow starting even if the battery in the key is dead.

(The article is wrong about the broadcasts, by the way; if the key transmitted continually, its battery wouldn’t last long.)

View on HN

This is insane. Please tell me this is an option that non-insane consumers can get their car without. Fortunately I drive an old car so this does not affect me—yet. If I ever have to replace mine, this looks like yet-another-misfeature I’ll have to look out for to avoid.

On many models keyless entry and remote start are options, rather than standard. If you park in a garage at night, then this particular attack isn't much of an issue.

I'm sure you didn't intend it that way, but "let them park in their garages" seems to imply the hoi polloi who don't have covered parking deserve to have their vehicles stolen...

It's standard with many "premium" brands (e.g. BMW, Audi, ...)

My 2015 Kia has it.

It is pretty much standard across all cars now days, except maybe the very bottom of the line models.

Whew, my 2014 Camry does not have it. Dodged the bullet.

Thankfully, the 2019 Honda Fit I got does not have this feature. The Sport model had it, and was one of the reasons I decided against it. Old school keyless entry via fob button and traditional key ignition

my Tesla Model 3 works by my phone being in range or swiping a key card. I am not sure if they are up to spoofing this method yet

Is there any type of encryption between the car and the key? Or are the signals always constant?

Could you just record the relay signal and play it back whenever, essentially replicating the key?

I believe a nonce is used to prevent replay attacks, but wouldn't be surprised if there are some fobs out there which are vulnerable to replay.

It uses a challenge-response protocol, so you can’t simply record the signal and play it back.

Every run of the mill garage door opener using rotating keys or nonces to prevent replay attacks. I assume any fob design worth its salt would implement something similar.

https://www.youtube.com/watch?v=CNodxp9Jy4A

It might not matter. If the point of the amp is to reduce the effective distance between the car and the fob, whatever messages are exchanged will look right to the car and the door will open.

Reply on news.ycombinator.com