Hacker News Reader

Comment by pmjordan | Hacker News Reader

I'm confused. The article seems to be about the ignition key mechanism, yet claims no trace of forced entry, which is unrelated. Surely you need to unlock the car doors and disable the alarm/immobiliser before you can drive off with it? Or are we assuming people leave their cars unlocked?

Also, once you've driven the car away, you'll have to find another way of starting it in future; relaying still needs some kind of physical access (albeit at 8 metres distance) to the original key.

(I'm aware of broken crypto in some wireless keys, which is purely an implementation issue - you can make these secure. That's not what this article is about. Quote: The attack works no matter what cryptography and protocols the key and car use to communicate with each other.)

View on HN

The "keys" in question are the ones that magically unlock the car when you are "close." The attack is a "man in the middle" attack that basically fools the car into thinking the owner is nearby when he isn't, so the car unlocks and enables the ignition.

Apparently, once the ignition is enabled, you can drive off without needing the key "nearby" (interesting experiment, I'll have to try that next time I get a "keyless entry" rental). Once you can drive off, the car is pwned - you can strip it for parts (chop shop) or fully defeat the key/ignition security away from prying eyes.

In my car you need the RF signal from the keyfob to be nearby to open/start it. Once the engine is running, it will keep running until you turn it off, or it runs out of gas, even if the keyfob is not present.

If you turn the ignition off and it can't "see" the key, it will give you a warning message on the display cluster and you have something like 20 seconds to re-start the car before you're locked out.

Oh, I see. All the wireless car keys I've seen need a button to be pressed to unlock the driver's door.[1] I'll have to watch out for buttonless keys when buying a car next, it seems a pretty unsafe concept in itself, e.g. loitering hijacker getting in the car before you do/with you, etc.

[1] You usually need to press the button a second time to unlock the remaining doors. There's also often a separate button to independently unlock the boot. A typical procedure is therefore: open boot with the relevant button, put shopping inside, close boot, take trolley back to the stand, walk back to the car, unlock only the driver's side, get in, lock door with button from the inside, drive off.

Some cars, like my VW, require the key fob to be in the car or the immobilizer shuts the car off after a very short distance. I believe all VW cars have this now, even the ones without keyless entry/ignition. This of course just slightly complicates the hack.

On my parents Prius there is some logic involved in weather or not the doors unlock automatically. If you open the driver's door it will unlock automatically, the other doors will be locked. If you open a passenger door all doors on the car are unlocked. Either way it is always possible to unlock at least one door with out hitting a button. The car can start as long as it can see the key and will keep running even after the key has been removed.

Reply on news.ycombinator.com