Hacker News Reader

> What about a classical mechanical key?

can be picked

>The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographical signing won't help.

AFAIK the attack you describe only applies to keyless entry systems (ie. you can open and start a car without having to pull your key out), which is related but not the same as an immobilizer. Transponder keys without keyless entry systems still exist on today's models, and is the default on most cars unless you opt for an upgrade.

>However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute.

That helps against someone cloning your key while you're at your desk, but it seems way easier to clone the key while the driver is walking away from the car? That way you know which car to steal and don't have to follow the victim into the building, which might be secured (eg. office building with badge system). Measuring RTT time and/or trilateration (multiple antennas inside car) should be much more reliable.

The modern versions of these keys cannot be cloned, they are challenge response. So you need to relay the challenge from the key, and then relay the response from the key back to the car.

This is often used by thiefs who bring the relay close to the front door, hoping for the keys to be in a bowl or a hook near the door. Then they can open and start the car using the relay. The car then won't turn off when it loses connection to the key (because that is dangerous) which allows stealing of the car.

There are cases where this was done over much larger distance, but those attacks are more easily defeated by having tighter tollerances on the latency of the reply. The latency tollerance does not do much for the 'keys near the front-door' attack, which is what the 'stationary keys do not reply' solution is aimed at.

> The modern versions of these keys cannot be cloned

The persistent rumor, of course, is that this has been cracked for specific models from specific manufacturers, with the help of someone at the dealership, maybe someone who owes large amounts of drug or gambling money to local criminal syndicate types. "All" you'd need to do then is use a valid challenge response pairs off as a cryptographic oracle to brute force the challenge-response algorithm and recover the seed value computation algorithm for the key and the car. Then "all" you need to do is record a challenge-response pair from the real key talking to the vehicle, and maybe the VIN, in order to duplicate the key, in order to steal the vehicle.

If this has been been done, the algorithm and seed-value recovery technique have not been publicly shared over the Internet, so it's only a rumor that it's been done, but given how high-tech thieves are these days, I don't consider it outside the realm of possibility.

What isn't outside the realm of possibility is the Rolling-PWN attack, which can be done with a $32 device and has been demonstrated against 10 years of Honda vehicles, up to 2022.

https://rollingpwn.github.io/rolling-pwn/

That's the wireless implementation.

I've had cars with chips, with contacts, in the mechanical keys [1].

Seems like one solution is to go back to the good old days of physical intent.

[1] One implementation: https://www.uhs-hardware.com/cdn/shop/products/df4ddf21436c4...

> (because that is dangerous)

I've always wondered why the car doesn't warn the driver that there's 100 yards left before it will cut the engine (or limit it to idle), keep the power steering, turn on the hazards, and warn the driver that the vehicle won't continue to function because the key is not in range. Doesn't seem dangerous at all...

That's still dangerous, and it doesn't matter how far out you warn the driver. The moment the car cuts to idle, the driver will lose some control. Imagine this happens while you're in less-than-ideal road conditions and you need to be able to accelerate. And there are a lot of reasons that the key might lose connection to the car other than the 'not present inside the car' case, like for example, the keyfobs battery running out, or the driver dropping their keys into some kind of shielded bag (my car for example has problems sensing the key when it's in an insulated shopping bag that I have).

I think at most you could do something like have the car go into 'limp home' mode if it senses the key was never present in the car for some amount of time after the car is started.

I dropped my wife off downtown in her car and she had the key in her purse. The car did make a weird beeping noise as I drove away, but I had no idea what it meant and I was pulling onto the highway which would have been a bad time for the car to stop driving on me.

Picking a laser cut key isn't trivial. Even picking a standard house lock isn't trivial, especially not in the dark.

They don't clone the key, they use an antenna to amplify the signal from your key fob and then drive off. In principle you can do this by following someone, but much safer to do this at 2am at night. Similar to a one time password, the signal is only valid for a short period of time.

Bypassing the door locks is not as difficult as you think with the proper tools. See: https://www.youtube.com/watch?v=vLy65ASXuEQ

Standard house locks don't require picking at all - you can bump them in a few seconds in any light conditions.

The fact that the LPL does it, with or without a special tool, doesn't really say much about how easy it is. He is an _extremely_ skilled lockpicker, and the vast majority of thieves, even those with some lockpicking skills/experience, are not going to be able to do what he does, as fast as he does it.

I have no idea how hard it is to do with that tool. I myself have as close to zero lockpicking skills as it's possible to have while still having picked a lock (I messed with a friends clear practice lock one time). But just seeing the LPL do it gives almost no indication of how hard it is to replicate what he is doing.

Darkness doesn't have anything to do with anything. Once you get the tensioner and pick into the keyway you aren't using your eyes anymore, at that point it's all feel.

If you are that good a lock pick, you are better off as a locksmith. In real life the people send out to steal the car aren't the most talented and brightest, otherwise they would be running the operation safely from an office somewhere.

I spent maybe 2 hours with my first set of picks to unlock my first shitty masterlock padlock. An hour later I was through my front door deadbolt. It's not a hard skill to learn, especially when it comes to typical american door locks (pin tumbler). But this is all non-destructive. I used to keep a set of picks in my desk specifically to open up people personal rolling underdesk drawers/file cabinets, when they lost or forgot their keys.

My understanding that your average ignition is a little more complicated (or at least different .. wafer locks) circa 70s-90s and then they started adding radios and other things into the mix. I dunno, I've never tried to pick one of these.

Destructively bypassing your average old-school ignition is still something you can do blindly with a bent flathead screwdriver and some elbow grease in about 15 seconds flat. As is destructively bypassing any given door lock.. well not bypassing the lockper se, but instead the bolt/doorframe generally.

This is two factor auth but when the "thing you own" is the standard case.

I don't get why it's not a keypad and relay though. Sounds like a complex solution to a fairly simple problem. I might be missing something though.

Edit - ah it's intended to work with many other options like controlling indicators or wipers or something - so you choose some pattern that is your password.

> it's intended to work with many other options like controlling indicators or wipers

I think you're asking exactly the right question though - how is all this not just a more complex, less secure, shittier version of a keypad that you enter a 4-6 digit code on?

It is also not any better than any other immobiliser. Unless it's on the CANBUS talking securely to the ECU, thieves will likely just bypass the module physically if they have the time.

This coupled with a CANBUS integration with the ECU to prevent it from starting would be pretty good though, since no one can wirelessly collect the signals to spoof the code.

I don't think any of your typical car thieves are actually picking locks. For a traditional mechanical key ignition, generally they're going to break into the steering column and just hotwire the right connections together, or possibly jam a strong tool in the keyway and forcibly twist the cylinder depending on the design of the lock. Obviously that won't spoof a signal from a fob or other electronic signal, but it's why having a traditional mechanical lock on the ignition isn't really worthwhile. If the electronic communication is secure, a mechanical lock doesn't add value.

Maybe it's different for very high-end vehicle thieves, though.

Why not put a button on the fob, like old car alarms had? Car won't start unless button is pressed on the fob, enabling the embedded radio.

Not great from an accessibility standpoint. For anyone with any sort of arthritis/rsi type issues, doing two things with the same hand at the same time is anywhere between tricky and impossible.

Consider how annoying the modern cigarette lighter is for a non-smoker.

> The problem is relay theft, where thief's relay the signal of your fob key inside the house to the car via a simple antenna and amplifier system. Cryptographically signing won't help.

It seems relay theft could be 100% prevented by measuring the response time, and capping it to whatever is the equivalent of say 100 meters + processing time in key fob.

> However, this can be fixed by adding a motion sensor that makes key fobs go into a sleep mode when they have been inactive for a minute.

Now I'm wondering how hard it would be for the thieves to shake the ground outside the house enough to fool the motion sensor...

Most thieves try to be quiet to avoid detection. However, one should be open minded to new technologies, and the use of a loud jackhammer on the drive way sound like an excellent solution to this problem.

> The only reason this is not yet widespread as increased car theft is good for car manufacturers.

Not if your brand is one of the ones known to be easy to steal. I doubt I’d buy a Hyundai in the future given my understanding of their reputation as easy targets.

I don't know if that completely solves it. People keep keys in pockets.

The full fix is time of flight measurement but as I understand it that's still beyond cheap electronics.

Or just.. you know press a button when you want to unlock your car.

Doesn't the system already check the latency from key fob to car antenna? Better yet, you could use two antennas in the car, and triangulate the key fob.

The latency check is usually not sensitive enough to prevent a car being stolen from the drive-way from a relayed key that lies near the front door.

For reference 20 meters is about 66 nano-seconds.

Why not? A 2GHz is very attainable in modern CPUs and translates to 0.0005ns per cycle. This isn't theoretical either. 802.11mc[1] is a real standard and is accurate to 1-2m.

[1] https://en.wikipedia.org/wiki/IEEE_802.11mc

Aren’t you off by three orders of magnitude? 2GHz translates to 0.5ns per cycle. Or perhaps you meant to write ms.

Whoops, you're right!

UWB is augmenting Bluetooth for car keys solving this exact issue; The Car Connectivity Consortium came up with the Digital Key 3.0 standard that's available today, as implemented by some makes like BMW and the Hyundai/Kia group and Apple, and resists relay and replay attacks through precise ranging.

So, solvable?

Don't modern keyless fobs use something akin to TOTPs? A well kept clock can easily prevent relay attacks.