A surprisingly simple way to foil car thieves

All that trouble, rather than run to NAPA to spend $12 on the thermo-switch that would be easier to install than hacking into the A/C controller. Yeah, I've known some dads like that.

And even I wouldn't do something that stupid.

The slushbox would shift into high gear and lug the engine unless you drove it like you stole it. The ignition didn't really need the keys unless you purposefully locked the steering column The exhaust split down the middle, giving the car a great sporting growl, and last but my favorite, the radio would often lock itself to the particular station and volume you were last playing. Sorry mom, hope you like metal at 11!

It's possible that some other manufacturer may try it again in the future, but the hit to Hyundai/Kia's reputation has been substantial.

There are aftermarket immobilizers systems as well, that also use cryptographically bound keys.

> Modern cars also have new vulnerabilities: https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...

If car manufacturers can fuck up implementing today's immobilizer systems, what makes you think they won't fuck up implementing the rube goldberg contraption? Why do we have to switch to it just to get a non-broken cryptographic implementation?

Also those were Humvees taken from Iraqi personnel.

This one is nothing more than a relay on the battery line. Simply find the relay and bridge it. Problem solved. Might take you a few hours to dig under the dash to find the damn thing, but once you do 'problem fucking solved'.

The tanks that were stolen belonged to the Iraqi armed forces, not the US Army.

can be picked

>The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographical signing won't help.

AFAIK the attack you describe only applies to keyless entry systems (ie. you can open and start a car without having to pull your key out), which is related but not the same as an immobilizer. Transponder keys without keyless entry systems still exist on today's models, and is the default on most cars unless you opt for an upgrade.

>However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute.

That helps against someone cloning your key while you're at your desk, but it seems way easier to clone the key while the driver is walking away from the car? That way you know which car to steal and don't have to follow the victim into the building, which might be secured (eg. office building with badge system). Measuring RTT time and/or trilateration (multiple antennas inside car) should be much more reliable.

The full fix is time of flight measurement but as I understand it that's still beyond cheap electronics.

Or just.. you know press a button when you want to unlock your car.

Now I'm wondering how hard it would be for the thieves to shake the ground outside the house enough to fool the motion sensor...

I don't get why it's not a keypad and relay though. Sounds like a complex solution to a fairly simple problem. I might be missing something though.

Edit - ah it's intended to work with many other options like controlling indicators or wipers or something - so you choose some pattern that is your password.

Not if your brand is one of the ones known to be easy to steal. I doubt I’d buy a Hyundai in the future given my understanding of their reputation as easy targets.

Maybe it's different for very high-end vehicle thieves, though.

It seems relay theft could be 100% prevented by measuring the response time, and capping it to whatever is the equivalent of say 100 meters + processing time in key fob.

I'm having trouble visualizing that part, unless it refers to steering-wheels of the past with a lot less material. Wouldn't a piece of hacksaw blade also be much less effective, without the rest of the hacksaw to provide tension?

For the device in TFA, I don't see what prevents a thief from just bypassing the thing with a jumper from the battery + terminal.

Prior to that I had lived in LA from 1966 on and got around on foot and on my bicycle and city buses.

I drove that giant Buick — I mean it was HUGE, both in terms of length and width as well as weight — for about five years, the final 2-3 of which featured a caved-in non-functional driver's side door resulting from having been T-boned by a little old lady who ran a stop sign.

No worries: I'd just hop over the side or use the passenger side door.

After the crash I never worried about theft.

Also, amusingly, when I was on freeways, cars in adjacent lanes would quickly move away.

Beyond that, I don't see the "simplicity" argument for analog. You're already messing with the vehicle's wiring. CAN bus is easily accessible from the passenger compartment. Or, running an extra data wire takes 10 minutes. Short-range RF can be easily secured in this application too.

Plus, on many newer cars, USB charging ports are displacing 12 V outlets, so it's not even all that future-proof.

It's not that I'm desperate to dislike this design, but I'm struggling to see the qualitative improvement over a billion aftermarket designs that most people just kinda don't use...

Stripping an security system is also doable, via the can-bus attacks we see of late, but more personalized can just be to replace the ECU. In many cars this can be done in less than 15 minutes.

Car shopping as presented in gone in 60 seconds is somewht common - ask people on any enthusiast forum and you'll see.

Miatas in Bay area, stolen for the hard top/car itself. Skylines Honda Civics - just spare parts basically, though if it's a mint enough model I can see people vin swap because 2000's Honda S2000 - mint models reach 30K now, so it's own market.

And that's just from what I've kept up* in.

Now would someone pull up to someones garage, open that, and drive out? Probably not - but alot of people do drive cars to a parking space for work, or if they live in a condo - have shared/communal parking, and such.

And to add an extra layer of paraonia, it is very inexpensive to attach a GPS/Air tag to a car and track it - within a week or two you can see a pattern of where it goes, for how long and what amount of time its standby.

The VIN number is also viewable from the windshield, meaning if the thief has any sort of connection - they could even just order a replacement key thats preprogrammed with a base code and potentially just turn up to the car and drive away.

But for opportunistic theft, yes - keys left within car/visible and then stolen but there are many different type of thieves for different markets. For unique/"antique" cars or any cars that were in the first three gran turismo - being targeted is a very big thing now in the community.

But also, bricks through windows are equally not difficult and not expensive, though they do leave a bit more evidence. When my neighbors have been burgled, this is the preferred method of entry I've seen.

No, not really. A large part of the security of locks comes from most people not knowing that they have the tools and skills to open them. It's like if everyone taped their door shut, and we depended on most people not knowing that tape is easily removed.

My kid accidentally locked us out of the house the other day by twisting the knob lock on our garage door. Turns out we never got a key for that lock when we bought the house - oops! And we didn't have keys for the back door, for complicated reasons. No worries, I took my wife's key ring and used the key to her parents' house to open our back door. In my experience, most keys work in most locks, if you just apply a light turning force and then rake the key in and out a bunch of times, ending with the key sticking all the way out except for a millimeter or two.

Good locks are expensive, but they also last a long time. And nearly unpickable is good enough. There is wall of window next anyway that then becomes much easier.

But Americans know that this (a pre-shooting checklist) isn't a reason for door locks for every American. And I'd guess it only is for a small minority of Americans.

>You can shoot someone that rams your door to open it.

So somebody destroys a door and that entitles you to take their life?

I think in both situations you should just refrain from shooting at all. Seems to work in most of the rest of the world..

but you need to tuck that shit up under neath in the dash or wherever the ECU is, and that doesn't solve any issues because it's still just one wire to short out. You need something tucked up underneath you can use wireless transponder so theres nothing obvious preventing it from cranking.

Keyless cars top the list for most stolen cars across the UK, with around 93% of all stolen vehicles in 2020 being taken without vehicle keys.

I have a buddy who had an old Ford in San Francisco. Once in a while he'd get in the car in the morning and notice that it felt .... strange. He couldn't put a finger on it. Then one day he had to get to work a little early and showed up at his car much earlier than normal. He found a guy sleeping in his drivers seat. Needless to say, both were startled and the homeless dude ran off, leaving a big bunch of keys behind in a keychain. Those were "master" keys to get into a whole slew of older vehicles.

We already do stuff to prevent crimes. The cars have locks, alarms, cryptographic key fobs, tracking, cameras etc. etc.

None of that works.

Adding a new layer of security is surely not going to help. That's my point. The resources are better put elsewhere.

(Also, their device is supposed to be tamper proof. That sounds more difficult)

But they might be funding for marketing costs and other soft expenses. Nice project and a great jaunt for a year or two. I’m sure they will learn a lot. Good for them.

The real screwy thing here is it’s like they did no market research or customer testing here. There are already a multitude of cheap, sophisticated, highly effective solutions in this segment that are much less user hostile than this gadget seems to be .

The SaTC does have a Transition to Practice (TTP) option. However, this research is CORE (see the text "CORE" in the project title [2]). The objective is to write research papers.

[1] https://www.nsf.gov/pubs/2022/nsf22517/nsf22517.htm [2] https://www.nsf.gov/awardsearch/showAward?AWD_ID=2245223&His...

The only way something like this gets traction is “as seen on TV” marketing to naive consumers, and I have no interest in building for that market.

But don’t be talking down on my car. That’s just not cool.

That beast is the workhorse of the farm and it gets the job done.

None of the windows roll down though and it’s hot as hell inside, so it discourages unnecessary use, saving the planet.

It rarely sees pavement but it drags what needs to be dragged and it pulls the utility rigs out after they deliver to us.

And great if you thing that those voltage fluctuations are gonna be consistent. Eventually some switch will corrode and then the person's wiper switch won't fluctuate the voltage properly. Nobody will want to reset their clocks using this every time they get in the car. Your break-in alarm won't work with the battery disconnectred. Car manufacturers will be pissed that you're disconnecting the battery because they can't get your telemetry and the car can't update while you're not int it. And then when you have problems, this will be the first thing ripped out of the car by your mechanic. This whole concept is flawed, and anybody with basic car or electronics knowledge will stay away from this thing because they can do it themselves.

And here's the kicker... anybody who doesn't have basic knowledge won't be hooking this thing up to their battery. They are terrified of even touching the battery. Congratulations on your marketing BS, but it's clearly not thought out from a common sense perspective at all.

They are claiming that the novel part is using voltage fluctuations to unarm the immobilizer and claiming that it requires less installation since the signaler device can plug directly into the cigarette outlet. A wireless relay requires the same cuttoff relay installation as their “new” idea, but is even more convenient because you don’t have to install a bodged together keypad on the cigarette lighter, and short your electrical system to cause voltage fluctuations.

They have blown through 1.2mm in grant money and their product is a bunch of prototype parts from a $50 arduino starter kit. It isn’t polished, it isn’t ready for consumers, it is a single prototype.

I guess the idea of causing voltage fluctuations is novel, but they sort of reinvented a $30 wheel for 1.2 million.

https://a.allegroimg.com/original/03e206/1de3f26447d79428246...

Optional extra on Series 1 Citroën XMs, an immobiliser keypad programmed into the engine ECU. It cost about 100 quid in 1990 money, on a 40 grand luxury car. Most V6es and 2.5 diesels had them, few 4-cyl petrols or 2.1 diesels had them.

There's no need to spend $1.2M developing something that's already existed for a long time. This was actually a development of a similar keypad fitted to most Citroën CX Turbos, from the mid-1980s. The idea is nearly 40 years old.

It's inexpensive proven technology, and it works well.

But good for them. They will learn a lot.

Transponder keys aka immobilizer systems.

All those Kias being stolen in the US are being stolen because the US does not mandate any form of immobilizer, and thus Kia on their cheapest models didn't include one.

Canada mandates immobilizer systems. Guess where the whole "Kia boys" phenomenon isn't a problem?

This is one of many examples of how our "democracy" isn't working. The vast majority of the US populace would agree that an immobilizer system which prevents a car from being started with a screwdriver is a good thing.

Every time it's been proposed in congress, the automotive lobby has told congress how very expensive it would be for them (and by very expensive, we're talking probably less than $100 per car.)

The expense to society (the owner losing their likely sole means of transport to work, health care, social activities and suddenly having a massive expense), police response to do something (er, just collect the report, I guess), the lost productivity, emergency services, and medical costs of people injured (victims or perps) from joyriders...all that goes unmentioned, because nobody's spending money to put someone in front of Tommy Tubletone from chucklesville to tell him that it'll cost everyone less to mandate the things.

Consider that ABS was not mandated in the US until 2012, along with traction control.

Compared to a lot of european "socialist" countries, we have much worse alignment between public opinion and legislation, and it's because of how powerful lobbying and corporate election funding is here, and a pervasive, insidious effort to portray anything other than wild-west free-market attitudes as "communism."

Or are they slurping funds for other aspects of the uni's operations?

You might need to lay out your whole road map for the first grant, but but that entire grant only covers 6mo or whatever.

This wasn't done. Well, it wasn't done by these researchers, but it has been done countless times before by other people. This research is a joke.

Edit: I've realized the dropbox comment reference is an appropriate reference, but in the exact opposite way you're suggesting. All the ignition interlock switches already on the market are dropbox. This researcher is the one saying "look what I can do with rsync."