Apple tracking devices being used in thefts of high-end cars
toronto.ctvnews.ca
toronto.ctvnews.ca
It seems like that's the more important device here? It doesn't feel like there's much point having a unique key if you can reprogram the car without it.
"Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon.
But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information.
As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have.
So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars.
Maybe.
I hope…
While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor.
Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
Yeah, right. How would you do that? Have you ever bought a car?
When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks).
I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox).
Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
To produce even somewhat convincing cash, you will have to invest hundreds of thousands to procure a Heidelberg offset printing machine and learn how to operate it (and fix it, because presumably your forgery operation will not be able to take advantage of support contracts). This isn't a simple task, and banks will still catch your fake money.
This is the kind of equipment you'd be looking at to produce fake currency (at the low end) https://www.bloomberg.com/features/2016-counterfeit-money/im...
>And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
Of course, but the question at hand is whether or not the dealer asking for a title before providing new keys actually offers any meaningful security benefits or not. I believe that this is just security theatre.
>If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
Presumably the title doesn't play any meaningful part here. They could just call in with the VIN, no?
When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.
If they introduce a mechanism where the manufacturer only can unlock the car, it would mean that they will need to be involved in all kind of disputes people have over the ownership or usage of the car. You will also have people telling you that you don't own the car as with the case of the some agriculture manufacturers that lock down their systems against unauthorised repairs.
I'm more in favour of leaving the police work to the police, let's not integrate the law enforcement and manufacturers. There's already interest in disabling cars when authorities deem necessary. The problem here is that the authorities might not be or may not remain your favourites.
At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc.
Would this not stop whatever disputes over ownership you're referring to?
Then they will need to deal with stuff like "Toyota unlocked the car of a Putin critic", "Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died. They previously unlocked the car of Joe Rogan's girlfriend".
You also will have issues where the legal owner and the regular user are different people(i.e. father and son, romantic partners etc). Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years.
You will also have governments demanding you disable the cars of people who have problems with the regime. In Philippines the government might demand lock down the cars of LGBT people, in USA they might lock down the cars of people with debt.
Who knows? It makes the manufacturer part of the running the car just the way Apple and Google are part of running your phone.
I own X car, and key is lost/broken/whatever. I go to my dealership, show my ownership. They validate it with the systems they already have (again, at least in my country) that communicate with the ministry, and check my ID. Done. All handled at the local dealership level (where they are already familiar with local laws, so it's not onerous to follow local regulation).
>Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died.
Starting to get a bit out of hand with speculation, I think. I don't follow the logic with this one. If there is an emergency, emergency services would be called rather than Audi.
>Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years.
Dealership says "Please provide ownership documents". It's not a complicated thing or a novel concept.
Anyway, the idea is that you will have circumstances where unlocking the car would save somebodies lives but due to procedures not covering situations like this bad things will happen and people will blame the manufacturer. The way system works will be a constant debate.
I can make up millions of wild scenarios, as well. I'm sure a few will be true here and there.
However, I don't think speculating about a hypothetical person with a hypothetical abusive partner who is the sole emergency responder in a hypothetical world where corporate Audi is the only other solution (what about taxi, uber, neighbor, cop, etc.?) to a hypothetical medical emergency is worth discussing.
Car theft? Big deal, insurance covers it. You can put the car into a garage, you can install your own tracker, the police can find it and there are many other ways to to steal the car and even if the car is not unlockable the "selling the parts" business model can still make it a target for the thief.
What's the argument for leaving it to the manufacturer?
I'm not sure what you're arguing about anymore.
What does that have to do with centralized vehicle locking systems?
>simply be using the car formally or informally but it belongs to someone else
And why in these cases should someone be able to claim ownership of the car, when they are not the owner?
I'm wondering if I mistyped something, or miscommunicated something. My whole point, originally, was that it is not some incredibly difficult thing to prove that you own the car.
The comment that I originally replied to said:
>all kind of disputes people have over the ownership
And all I said was
>At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc.Would this not stop whatever disputes over ownership you're referring to?
Where that got lost in translation, I don't know.
However, I've never needed a title for any other purpose and I think the last car I traded in I actually had to get a new title because it wasn't in my file cabinet where it should have been.I certainly wouldn't expect to need one to get spare keys issued, the car inspected (though they need an insurance-stamped registration for that in my state), or anything else.
*Easily, but not necessarily quickly in the case where you need the document reissued or whatever.
I'm almost certain a car dealership would accept a death certificate if she needed another key made, but my point is - yes, even with an official document stating who is the owner, you can still end up in some weird edge case scenario.
What if your dad willed the car to someone else? I suppose a death certificate isn't evidence of being the successor.
If you are one of those edge cases, there are tonnes of unofficial garages which will happily make you a new key for money. The manufacturer - and by extension, they official dealerships - should never make keys for anyone but the legal owner.
But yeah, I specifically mean a situation where someone doesn't have a key, turns up with the car on a trailer and asks for the key for it - in that case yeah, why would a dealership unlock and provide you with a key for a random car that you can't prove ownership of? That would be just weird.
[0] https://smile.amazon.com/Autel-IM508-Advanced-Programming-To...
Edit: Another idea: I should throw an AirTag on my Catalytic Converter, and cover it up with a dark plastic so it looks like it's from the factory... That could be a huge YouTube video that could launch a channel. "I AirTagged my stolen Catalytic Converter!"
Edit: Also, you could always find your parked car!
The other thing I found was useful was throwing one in checked luggage. Not that I check luggage very often but it did tell me my luggage got transferred at a connection.
(Of course, the airlines' own tracking systems are increasingly making it easier to check directly.)
I wished I had AirTagged the bike I bought for my youngest daughter before she left for college. It was stolen within weeks of her arriving. (Made more painful because the bicycle I bought for her older sister a few years earlier too was stolen her first semester in college...)
The OBD-II port “locks” I could find with a quick search are >$100, and most are made of thin plastic. Oh, and there is often a second OBD-II port under the hood of modern vehicles.
If you’re actually worried about this, the best solution would be a hidden “kill switch” that prevents the vehicle from starting or driving away. Either a toggle switch that shuts off the electric fuel pump (in which case they’ll get it started and move it a few feet at most before it dies) or a momentary switch that prevents it from starting. Either of those can be installed by someone with basic electrical ability for <$10 in parts.
If you are guarding yourself against opportunistic theft however, then the above doesn't apply - install all kinds of gadgets that you can.
Part of that policy is having gap coverage. Nothing worse than having your recently purchased vehicle stolen while the deprecated value is way less than the financed amount owed so you wind up paying the bank for a car that was stolen from you. Same applies to wrecks.
A thief can have a pocketful of fuses.. a battery is a little harder to lug around.
If possible, park your vehicle in a locked garage as most vehicles are stolen from a driveway
Use a steering wheel lock, which will also work as a visual deterrent
Install a lock on your car’s data port. Police said the simple device can be purchased online and blocks access to the vehicle’s computer port"
1 - Be rich. Have an iphone.
2 - Be rich. Have a garage.
3 - Pretend this will help. It won't.
4 - Probably the only method thus far, that may be reasonable.
Is it supposed to create FUD around the dangerous world we live in now that we have AirTags?
Other scary technology listed in the article:
- the device used to factory reset the car - blank keys - a screw driver
I think you are correct.
To turn on my criminal mind: you driving around neighborhoods: a witness might notice you cruising around a few evenings ago and note your license plate (you'd have to go at night because during the day the cars wouldn't be there, you might have to go a few times to see what cars are available).
The AirTag/any tracking device is quite ingenous, just go to the mall carpark (no one will be suspicious, it's just someone at the mall) and have a better selection of cars at one place, plant the AirTags (riskiest part) and then wait. Even if they found it at home, you already know where the car can be found, and if you're worried the cops might be waiting, just wait a few more months, statistically the car will still be there.
For years, my friends and spouse derided my use of "the Club." After all, there are so many more technically sophisticated mechanisms to deter and prevent theft. Now, the irony is that the technology is redeployed in the service of the criminal rather than the owner!
Does the pendulum swing back the other way? In a world where all mechanisms of security are digital and criminals look for digital surfaces to attack, the ultimate trump card is a physical obstacle?
The best way to secure your car is to think like a thief. Look at it and ask yourself, "Is this a good target?"
Thieves evaluate the car through risk / reward but mostly risk. The cost of being caught is very high and opportunity cost is very low -- there is a lot of other cars available so there is almost never a reason to steal this particular one.
So naturally if they see any warning signs that this might be risky (even something like an out of place pulsing light) they might want to skip it for something else.
Thus, the best way to not have your car stolen is:
1) Do not drive expensive car (low reward)
2) Display something in your car that tells the thief you are determined owner and you will make the thief's life difficult (high risk)
3) Remove absolutely everything from your car that can be stolen. When I go on vacation (ie. car with foreign license plates more likely to have valuables in the trunk) I even removed the shelf above the trunk so that a thief can look and see the trunk is empty. (no easy, risk-free, alternative payoff)
4) Have an actual safety like a concealed switch that prevents the car from being started. Do not ever use anything that has visible elements -- the thief must try to start the car, see that it does not start and see that it is not easily possible to identify the mechanism that prevents starting. This should deter potential thief to try any further.
Totally gratuitous clickbait finger-pointing at Apple.
Yeah location trackers have always been a thing, but the same way Apple made the desktop computer mainstream (back in the 80's) and then again with smartphones, their AirTag is making location tracking mainstream, so now everyone can be a stalker or a car thief ;-) . Is it their fault? IMO not really, but, a little bit?
>Apple made the desktop computer mainstream
really isn't true. While Apple was one of the companies (see also Commodore, Tandy, ...) that first popularized home computers, it was really the IBM PC followed by its clones like Compaq that replaced terminals in offices.
Why do we have journalists reporting on things they know little about? Seems counter-intuitive doesn't it?
Because unless you're at a major publication (or other media) like the Wall Street Journal (or at least focused magazines), you being paid not much to report on and write quickly about a wide range of subjects.
:)
Based on stolen car reports, an older car is more likely to be stolen simply because it is much easier due to lack of anti theft mechanisms.
These cars are easy to steal, unlikely to be found and make good money as parts.
1.https://insurify.com/insights/updated-2020-the-10-most-stole...
Now granted the price of a cellular Watch ($329) is an order of magnitude higher than an AirTag ($29), but still pales in comparison to the street price of a high-end car.
The real story is them being able to use the data port to reset the car.