Hacker News Reader

Comment by elif | Hacker News Reader

Why bother intercepting, decoding, and encoding your own signal when you can just use a big antenna and MITM the fob and the vehicle and convince them they are closer than they really are?

View on HN

I find it wild how pervasive passive keyless entry is. Completely form over (security) function.

I wouldn't be so quick to say that - it's unquestionably more convenient than old-fashioned transponder keys in a few really important ways. You can't lock your keys in the car, you don't need more than one free hand to open a door (and sometimes not even that), and you don't need to deal with a massive bundle of keys jangling against your knees.

tumber locks are built on even more hopes and dreams than security.

proper PSK cryptographic locks can (and are) implemented for cars already, just not all cars.

Honestly... As an end user, I prefer convenience over security in my everyday life. I have insurance for the rare instance someone steals it.

The same goes for my house. I could live in a concrete bunker with no windows and steel doors, but I would much rather live in a home with large windows and a door with a crummy deadbolt.

The risk of someone stealing my car or breaking into my house is low. If that risk increases (and thus the area's overall quality decreases), I'll move to a different location.

Ultimately, if it were a severe problem, wouldn't insurance premiums reflect this?

They do. Try to get a Range Rover insured in the UK. You’ll struggle.

Interesting, I searched and that seems accurate, it doesn't seem to be the case here in AU though from what I've seen.

These keyless systems enable these cars to be broken into really easily. I’ve had friends see thieves operate in pairs, one by the front door, one by the car, and effectively use repeaters between the house and the car to unlock his Range Rover, and then drive away with it, in under a minute (as captured by his home security system).

The question then becomes more of a value proposition / opportunity cost. If you can steal any keyless car trivially, why wouldn’t you target the vehicles that can net you the greatest return?

Why steal a Prius when you can steal a Evoque?

Having had it on my last few cars, I wouldn’t go back.

what kind of consumer level antenna can forward/amplify key fobs (in the gigahertz range, no?) without causing excess “signal to noise” ratio that the car can detect?

It's a super common form of theft in the UK at the moment. Not sure exactly what equipment they are using but it's clearly consumer level.

One example: https://youtu.be/uxzm_6SYBFo?si=BSav_oEKiFBT8cf8&t=41

I think your conception of the sophistication of all this is a good deal too high. Fobs are extremely low power devices with truly terrible (undersized) antennas. Fabricating a digital repeater to produce a modest amplification is not difficult. The high frequencies involved are a benefit to the attacker because a high gain antenna remains reasonably portable. The active bits are low cost, widely available COTS digital transceivers and MMICs; the same stuff the fob and vehicle is made from.

A obvious countermeasure for such attacks would be to have the car measure the RTT between the car and fob, exchanging some cryptographic credential. If it takes too long the fob is too far away and/or an attackers repeater is adding delay.

isn’t the car keyless go system the transponder and the key fob the receiver or vice versa?

Typically the fob is the transponder. The fob has a tiny battery: frequent transmissions would rapidly kill that battery. The car has an ample battery, so it transmits periodically and detects the responses from the fob transponder.

For the purposes of a "relay attack" this doesn't actually matter: all else being equal you could devise a relay system that works regardless of the roles of car and fob in the protocol.

Reply on news.ycombinator.com