Hacker News Reader

Comment by rocqua | Hacker News Reader

The modern versions of these keys cannot be cloned, they are challenge response. So you need to relay the challenge from the key, and then relay the response from the key back to the car.

This is often used by thiefs who bring the relay close to the front door, hoping for the keys to be in a bowl or a hook near the door. Then they can open and start the car using the relay. The car then won't turn off when it loses connection to the key (because that is dangerous) which allows stealing of the car.

There are cases where this was done over much larger distance, but those attacks are more easily defeated by having tighter tollerances on the latency of the reply. The latency tollerance does not do much for the 'keys near the front-door' attack, which is what the 'stationary keys do not reply' solution is aimed at.

View on HN

> The modern versions of these keys cannot be cloned

The persistent rumor, of course, is that this has been cracked for specific models from specific manufacturers, with the help of someone at the dealership, maybe someone who owes large amounts of drug or gambling money to local criminal syndicate types. "All" you'd need to do then is use a valid challenge response pairs off as a cryptographic oracle to brute force the challenge-response algorithm and recover the seed value computation algorithm for the key and the car. Then "all" you need to do is record a challenge-response pair from the real key talking to the vehicle, and maybe the VIN, in order to duplicate the key, in order to steal the vehicle.

If this has been been done, the algorithm and seed-value recovery technique have not been publicly shared over the Internet, so it's only a rumor that it's been done, but given how high-tech thieves are these days, I don't consider it outside the realm of possibility.

What isn't outside the realm of possibility is the Rolling-PWN attack, which can be done with a $32 device and has been demonstrated against 10 years of Honda vehicles, up to 2022.

https://rollingpwn.github.io/rolling-pwn/

That's the wireless implementation.

I've had cars with chips, with contacts, in the mechanical keys [1].

Seems like one solution is to go back to the good old days of physical intent.

[1] One implementation: https://www.uhs-hardware.com/cdn/shop/products/df4ddf21436c4...

> (because that is dangerous)

I've always wondered why the car doesn't warn the driver that there's 100 yards left before it will cut the engine (or limit it to idle), keep the power steering, turn on the hazards, and warn the driver that the vehicle won't continue to function because the key is not in range. Doesn't seem dangerous at all...

That's still dangerous, and it doesn't matter how far out you warn the driver. The moment the car cuts to idle, the driver will lose some control. Imagine this happens while you're in less-than-ideal road conditions and you need to be able to accelerate. And there are a lot of reasons that the key might lose connection to the car other than the 'not present inside the car' case, like for example, the keyfobs battery running out, or the driver dropping their keys into some kind of shielded bag (my car for example has problems sensing the key when it's in an insulated shopping bag that I have).

I think at most you could do something like have the car go into 'limp home' mode if it senses the key was never present in the car for some amount of time after the car is started.

I dropped my wife off downtown in her car and she had the key in her purse. The car did make a weird beeping noise as I drove away, but I had no idea what it meant and I was pulling onto the highway which would have been a bad time for the car to stop driving on me.

Reply on news.ycombinator.com