OT: Car remote fob cloning

My understanding is that some cars with key less entry have a key fob that transmits a signal, so unlocks the car whilst standing near it.

Because people are so lazy today they are unwilling to reach into their pockets for the car key, so the key for 'keyless entry' (which may be a card) periodically transmits in case it is near the car in which case the door will open, or rather, the car transmits and the key answers.

Actually, I don't suppose anyone ever asked for this feature, but the car manufacturers decided they could add yet another expensive luxury to the price. I would pay extra not to have it if I was buying a new car, but I doubt that it's an option in most cases.

They're doing a relay attack on the fob. Cars with keyless entry are always broadcasting and the fob replies if it hears the broadcast, which can only do so in range (a metre or two). The car sends out a 'challenge' and the fob replies with a 'response' - if correct the car unlocks and/or starts.

The thief smash the car window or stand next to it and throw a Bluetooth gadget into or next to the car. They are parked in a car/van nearby which has a beefy RF transmitter inside which is also within range of the Bluetooth gadget.

The car sends out the challenge, the Bluetooth gadget receives it and forwards it to the crim's laptop. The laptop then broadcasts it out using the high power transmitter in the van.

The fob receives it, and replies with the response. A sensitive receiver in the van receives the response and then resends it to the Bluetooth gadget. The Bluetooth receiver in the car then repeats the challenge and the car hears it and unlocks.

As far as the car is concerned this is all legit - the only difference is a slightly longer time than normal for the response to come back.

ie it's supposed to be (BT=Bluetooth):

Car: challenge -----weak RF------> fob Fob: response -----weak RF------> car

but the attack is:

Car: challenge --weak RF-> [BT gizmo] --BT--> [thief laptop] --strong RF--> fob Fob: repsonse --weak RF-> [thief sensitive receiver] --BT--> [BT gizmo] --strong RF--> car

Once the car is started, they drive it away to a remote garage where they reprogram the ECU with a factory 'virgin' flash dump and then they can program new keys against it.

Theo

There might be an option in the menus to disable that so that you always need to press a button to unlock. Mine also drops back to that condition after a period of non use to save power.

I find having the car automatically lock as I walk away to be reassuring, though it can be a problem if you then get to drive one where you do have to remember to lock it!

nib

The crims can buy the kit for €25,000, or rent it by the week ...

A lot of it is a quick B & E on the front doors inadequate locks and a grab of the keys often left in a very unsecure place.

Another trick is to read the signal when matey comes to unlock that car. And come back later and use that to unlock it.

I don't know how keyless ignition works, but my guess is that if the car can read the fob, so too can someone else.

All you need is to be near the car when it gets started - there will be a dialogue that can be recorded.

You can clone fobs from that. It's all staggeringly insecure which is why it cost tens of thousands to insure a luxury car in London...

The two London gangs that were busted had loads of computer cloning gear, false numberplates to look like minicabs at 3 a m. and IIRC a farm building in Essex to either strip the cars or prepare them with false paperwork & plates and ship them off to Dubai in containers covered by 'household furniture'

All of them were of 'asian' origin with the odd white techie.

Yes. That too.

Same principle as keyless start

But I THINK that what happens is the *car* sends a signal to the fob, wakes it up and it sends some kind of ACK back.

Well it is/was on Jaguar XFs - My friend has it, I dont,.

I don't think the fob is powered up all the time though.

I think there is enough RF energy emitted by the car to wake it up somehow.

That sounds about right.

For getting the 'car start' or 'automatic unlock' working.

Not sure it works for the 'press to unlock' fob. I think that can only be cloned from someone using it.

It's for cars with "comfort locking" i.e. you standby the car and it unlocks without pressing a button on the fob.

The car sends out a probing signal and if the fob hears that it replies. The car unlocks. Easy to defeat with something to pick up the probe signal amplify it so the fob hears it from a long distance away. The same is done to relay the fob signal back to the car.

Some fobs have movement detectors. When it's in your pocket the continuous movement keeps the fob awake so the challenge response works. If the fob doesn't move for 10-15min it goes to sleep until it is physically moved. This is much more secure as once you come home and put the fob somewhere it wont be moved and will be asleep.

The other problem is cars now send signals between all the different units (ECUs) using CAN or Ethernet. This means you turn on the lights and a signal goes to the lights ECU which sends a message to each light unit to turn on. Yes, it sounds like madness but saves on wires.

Criminals realised that if you removed say a taillight bulb, you could inject the "unlock" message and it would travel over the network and the car would unlock. Nowadays ECUs have firewalls so the "unlock" message received from anything other than the fob receiver would be ignored.

It all boils down to someone installed lots of complex electronics with many security issues and someone in manglement refused to authorise the cost of ensuring it was secure. The result is the triviality of stealing some makes.

That only works if they have cracked the rolling code. Otherwise recording the response to challenge N does not tell you enough to work out the response to challenge N+1.

However, if you break a window or jimmy the lock and get inside, some cars are still keyless start so the relay attack still works even if you never hacked the door locks. Others you have to put the key in the slot and the antenna is a few cm away, which is harder to do a relay attack as even standing on the doorstep of the house is not close enough to the keys inside.

Theo

Does have keyless starting?

That works..

That doesn't work. Its a rolling code.

That doesn't work. Its a challenge/response. You can't record and reply.

you can't clone a fob that way. Whilst many sites talk about "cloning" no "clone" or "duplicate" key is produced.

its not cloning gear, in that it does not allow keys to be copied. You don't need to clone the key. Once you have the car you can add or remove any key from the management system.

Not sure what the method is called? I think "remote relay" so you need a two-way conversation over a distance. One receiver/transmitter pair near the car that receives the challenge and retransmits it near the key. A second pair that receives the response and unlocks the car and ignition. Once started it won't stop as this could be dangerous if for example they key battery went flat on a journey.

Dave

My car has keyless entry but just walking up to the car will not open it, you either have to press the fob button or hold one of the front door handles for it to unlock. It will lock itself but that seems to be on a timer just walking away does not lock but will eventually lock after a short period.

Richard

OK, thanks. That is the only explanation I have seen that makes sense of how it is done. I was thinking of the incident shown the other night when the crim. waved his device around next to the wall of a house, and then it all worked, and he drove off in the car. What I couldn't (still can't!) understand is why a car needs to transmit all the time, it seems to be a major failure point. My fob is not keyless entry, but it is keyless start. I have to press a Start/Stop button as long as I have the fob with me. What I am not too pleased about is that, if I leave the car, the engine keeps running. If I had a choice, I would change that. I can't start the engine if the fob is outside the car, though.

IIRC, my car _will_ start without the 'key' being present, but only the one time. Don't ask me what the rationale is behind that.

In message <10fkdj6$27h91$ snipped-for-privacy@dont-email.me, The Natural Philosopher snipped-for-privacy@invalid.invalid writes

My car RF fob simply locks and unlocks the car, but it has a massive range of at least 150 yards. Absolutely ridiculous. However, might it not have some sort of a rolling sequence code, so simply capturing and re-using a single 'open' command won't work (unless the thief just happens to be very lucky)?

It's certainly possible

Yes, AIUI there are two kinds of fobs:

- 'keyless entry', which only work when you are close to the car - variations on keyless entry where they use your phone Bluetooth to establish proximity instead of a fob

- 'remote entry', which can have a long range because it only activates when you push the button. The long range is a 'feature' because it enables you to find a lost car in a carpark

- plus a mechanical backup key to open the door in case of flat battery

Unless we're talking cars from the 80s or whatever, I expect they all have rolling codes so you can't guess what the next code is. I believe some of the rolling code systems have been cracked (certainly for garage doors they have).

Once in the car there are then several ways to start

- mechanical start using a key

- start by putting the key or fob in a slot. The car chats using NFC to an RFID in the key body (typically this part of the key is unpowered). This can be combined with mechanical start (eg key turns over the engine but the immobiliser controls the fuel pump)

- 'keyless start', where the fob/phone/whatever only needs to be inside the car to start. I believe this needs the fob to be actively powered.

Theo

One wrinkle on that last bit. In my car, normally you can leave the key in your pocket while driving - this assumes the fob is powered. If the fob battery is knackered there is an alternative in that the fob can be placed in a specific place in one of the oddment trays, in which case I assume it uses unpowered RFID-type communication.

nib