Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

DST40 https://en.wikipedia.org/wiki/Digital_signature_transponder used in Fords of that period is a Feistel cipher not a Vigenere cipher. Now, I wouldn't choose a Feistel cipher for this problem today but it certainly is not 1.5 centuries obsolete, this type of encryption wasn't even invented until the mid 20th century and a very famous example would be DES.

Instead of paying $100’s to rekey the car, I stuck the broken key into a machine at Home Depot. It cracked the encryption in a few minutes and produced a duplicate key. The brand on the replacement is “Ilco”. It’s bulkier than the OEM key, but it works great.

Anyway, I’m not at all surprised to hear the car uses an obsolete encryption protocol.

The lesson in 1052 sort of misses the point. LPL (his videos are a lot of fun by the way and I recommend them to anyone who is curious about lock picking) says:

> So, if you are installing an access control system like this it is really important to use one that only transmits encrypted data

This would defeat the ESPKey demonstrated, but of course that product exists precisely because it's all you need for common systems today. If "encrypted data" was common the ESPKey's successor would probably be a product that sits next to the reader and gets its own copy of the raw RFID signal. Not as convenient, and less fun for doing cool demos, but still plenty effective enough for crooks.

What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. That would actually fix the problem, because to get the current code a bad guy needs to steal the token and that's an ordinary physical security consideration that humans are used to dealing with. This way an ESPKey gets the one-time code you just used, but neither replaying it nor copying it to a card to try later will do anything useful.

Unfortunately this smarter token would be significantly more expensive. We saw with EMV cards (payment cards) that the smart and secure option (DDA with changing cryptograms) is expensive enough that providers would often rather take a risk and give you an insecure cheaper alternative which looks identical, especially if they believe regulators, courts etc. won't realise they took the cheap option and so the risk actually lands on their customers not on them.

Most popular card/fobs (95%+ of all I've seen) don't use challenge-response, but always transmit the same 26 bytes. I don't have to explain how "secure" is that.

I like how some Chrysler products handle this. You can buy a $50 fob online and program it to your car yourself. The catch is, you need two key fobs to do it. This is so the valet attendant (who only has 1 of your key fobs) can't make his own copy. So, you just have to plan ahead and do it asap when you get a vehicle and always keep 2 in storage in case you want to make another.

Whether or not these locks are made to be appropriately 'secure' is the difference between the owner and the manufacturer being liable for the result of criminal action.

Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme:

https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...

I want to believe this is to be able to spread the use around both sides of the pump without pulling the pump hose over/around the car. In some gas stations there's no easy way to turn the car around the pump.

Uh, other direction? Almost always there are hoses from both side of pillar. Is it some regional thing?

The key fob is still available if you want it. Tesla even allows adding and removing keys at home. It's an underrated part of the Model 3. Phone key could have been a disaster but they nailed it.

I no longer have to pry the key out of my jeans, or go looking for it in all my bags when I’m travelling.

Hence the article says thieves would be able to "hot wire" a car after using this attack. You can't (if manufacturer's did their job properly) "hot wire" modern cars like you see in a movies, the computer overseeing things doesn't let it be driven anywhere just because somebody jammed a screwdriver in a hole and taped some wires together.

Keyless entry and keyless ignition are entirely different technologies that have a different problem (relay attacks) which has been covered a long time ago and has numerous quite different solutions from this.

This article is about the all-to-common situation where somebody cut too many corners and left themselves open to a pretty easy cryptographic vulnerability. (Some) Car manufacturers did a crap job of making the "smart" key that disables the immobilizer actually secure, and bad guys can use that to clone such a key and drive off in your car. If they didn't also copy the mechanical shape of the key (which would be more effort) they can smash the lock just as they would have in the 1980s to steal a car. Some of them might even remember stealing cars in the 1980s and not need to learn a new technique.

Apart from inevitable consequences like from this article, are benefits outweighing other intended, unintended, and inevitable consequences like these for most people?

  - Forgetting car keys more often per new learned behaviors
  - Fob batteries dying 
  - Replacing lost / broken fobs is more costly in time, money, and hassle 
  - Leaving fobs in the car more often

Which is straightforward when you want to steal a particular vehicle because you know where it is and can easily follow its patterns.