Weak security in our daily lives
everything2.com
everything2.com
The reply has always stuck with me: if ones objective is to steal something of value, then picking or hacking a lock -- or a desire to be undetected - is outweighed by a necessity for speed."
If you are trying to break into a car to take something out of it -- or take the car itself -- then a glass breaker or even a brick will turn your 20 to 30 minute hack into a 3 second breech. Besides, they will know someone was in there when they realize everything is missing, whether you picked the lock or not. So minimize risk, not detection.
Even with modern systems i think that there are alot of security issues. Keyless Entry Systems for example in theory allow you to drive off in a car without having the key present (atleast thats true for many VW models). You can basically open, start and drive off if the owner is nearby. Does anyone know how complex is it to crack those wireless key things ?
This is what they look like: http://www.ford-taurus.org/taurusinfo/G3/G3Keypad.jpg
edit: wording
Seems to be a security vulnerability all by itself, to me. I'm not sure I see the appeal.
'Convenience.' That is all. US'ians are notoriously lazy and require convenience everywhere. Convenience overrides security and often convenience overrides safety.
It's surprising how many devices and service businesses have been created to allow people to continue to be lazy under the guise of "increasing productivity" - 'You just keep sitting on your backside at your desk and we'll run your errands!'
There are probably cultural trends as to where different groups make the trade-off (I've never dug into it), but the principle is the same everywhere.
You could put all of your money and attention into guarding your stuff, if you so chose, and guarantee that the work required to defeat your security was far greater than any potential benefit. Never take your car out of its concrete bunker.
Or you can ignore security in favor of convenience -- always leave your car key in the ignition, and thus never be locked out accidentally, never fumble to find your keys in a large bag, never drop your keys in a snowbank....
But obviously most people try to fall just on the side of "safe enough that no one will steal my car", depending on how high they perceive that risk.
For a car keypad entry -- if trying all of the possible combinations would take 20 minutes, that's probably not any less secure than driving a slightly older car with a fairly-easily pickable lock, and in return you will never accidentally lock your keys in the car again.
I don't think I'd go for the keypad lock on a new car, but I have locked my keys in my car twice in my life, and it's really annoying.
One of those times there was a three-year-old in a carseat, inside the locked car... fortunately it was the loaner, sitting in the parking lot at the mechanics (where my normal car was being repaired).
The first time it happened I was driving an old car, and I was at the grocery store... so I went back in, bought a screwdriver & coathanger, and broke into my own car in about a minute. In that security context, having a keypad would have been convenient without adding anything to the security risk whatsoever....
001122334455667788990246813579258369147032949727651
07182162805263064098753937431738420861950415485960
This paper is particularly in depth and interesting: http://www.autosec.org/pubs/cars-usenixsec2011.pdf
Of course, their exploits are a bit more complex and involve various side channels and hardware vulnerabilities, while the keypad issue can be executed by someone just typing in numbers with their fingers.
The first time I did this it took me ten-fifteen minutes. (now it takes 30 secs) I disagree with the argument that anyone fiddling with a lock for twenty minutes is going to attract attention, I wasn't bothered and I was in a busy urban parking lot with lots of passers-by.
Few seem to know about it, if anyone's used it to get in my truck in the 7 years I've owned it I haven't noticed.
I'm somewhat curious if it would be possible to push a kind of needle/wire through the buttons and automate key presses via electronic signals instead of a physical push.
If they don't, these keyless entry pads have just set back car security by about about 15 years.
The better fix would be a substantial cooldown (maybe a minute's worth) after inputting a failed code, which would be sufficient to ward off a brute-force attacker while still allowing the owner access even if they miskey it a few times.
Lockout after X attempts (as another comment mentioned) is a terrible idea, because that makes it a simple DoS mechanism.
But forcing a delay, for example, is tricky -- how do you notify the user that they're in a delay period? Or when the delay period has ended and they can try again after a mis-key?
There don't even seem to be LEDs to work with.... If they keys light up, that's easier (e.g., flash the key lights for 10 seconds if they enter a wrong code before they can start over).
That said, agreed with the above: anywhere someone fiddling with the lock for 20 minutes would go unnoticed, a brick would go unnoticed too. I highly doubt a car has even been stolen through hacking the keypad lock in this manner.
Those that I have seen have this plastic covering that allows some tactical feedback (a small pop under the finger.) And people are lazy and don't change codes. So the plastic wears and even comes off, leaving the silicone exposed on the numbers that are used. Well beyond smudges, and much shorter than this 20 minute code.