Cars and Key Fobs: Attacks on Car Remotes

Consumer Reports reporting is bought and paid for by the OEMs. They'll make a big issue out of nothing or minimize real issues depending on where the money is coming from. This goes back at least as far as the Samurai rollover scandal.

Pretty much all industry journalism where the journalists depend on being in the good graces of the manufacturers to get the access they need to make their content is like this.

> magic keyring

Are you talking about the "1284x FEO-K1 16120 222343 CH751 CH501 C346A C390A E114 " set?

OBS Ford F-150s do this and it's not common knowledge even among enthusiasts. The back 4 pins work the door, the front 6 or so pins work the ignition. A common problem is that the ignition barrel keyswitch dies and you have to replace it, but then you have separate keys for the door and ignition. I took the new ignition key to a locksmith and had him copy the 4 back pins from the factory key, and I was back to a single key!

I had a similar experience once when I drove a Prius. Walked out of the grocery store, hit the unlock button, got into my car, then wondered why the seat was too far forward - before realizing it was not my Prius.

Not true for most alarm systems. If the car is locked, then any opening without the key fob unlock button will trigger the alarm in my experience.

I had a non electronic key cut for my Jeep so I could zip tie it under the frame for emergency use. It will not start the engine, but does open the door locks. When I open the doors with it, the alarm goes off.

I think that mechanical key behaviour depends on the car. I'm pretty sure my BMW sets off the alarm if I use the mechanical backup key, but it turns off when I put the key in the ignition slot.

Presuming its a modern car (and if we are talking about keyless entry/start we are), well then you just plug an "Emergency Start Device" into the OBD port or to the BCM module, and drive away. Heck a lot of these "Emergency Start Devices" can also unlock the car, but often involve pulling panels/lights from the car to get to the can bus to run the attack.

So that attack when done on its own is mainly left to stealing cars off drives at night rather than say from a supermarkets car park during the day.

Push-to-start eliminates the need to turn a physical lock. They drop to zero security once their RF is broken.

It all makes sense now.

maybe so, but this would seemingly solve most of the problem with easy to implement tech

the real test is to find out if this effectively eliminated all fob hacks for volvo since they may not be faster than the tiger, they just need to be faster than everyone else...

My previous car(a Mercedes) had a very very simple solution to this - you clicked on the lock button twice and it just disabled the keyless entry entirely until you pressed any other button.

>>the advantage of completely preventing relay attacks.

From my understanding ToF sensors are good enough now to completely prevent relay attacks, the added time for the relay just adds too much of a delay and it gets rejected. I believe the newest range rovers use that, they went from being extremely susceptible to relay attacks to relay attacks against them being impossible.

Except phone based keys are terrible in many other ways

Why would you ever turn on your microwave without opening it to put something in it? It's not like an oven that has to preheat.

People lose wallets. People lose car keys.

My PaaK car has a backup passphrase to start it. I can be used in a pinch if my phone isn't working. I can't say the same if I lose my car key.

If I go on a long trip I'm likely to bring multiple car keys and multiple payment methods. This is still true if I'm doing PaaK.

Or if you don't tend to bring your phone with you to do a bunch of errands. If all my locks were tied to my phone, I'd have to fish it out of the drawer whenever I go anywhere. OP said he "constantly" carries his phone with him, so maybe not a problem for him. Am I the only person in the world who leaves the phone at home if I'm not planning to use it?

Because it's a wild rube goldberg solution to a minor inconvenience.

I love the entry on my '14 Jeep.

Walk up, put your hand in the handle, and it unlocks. Get in, press the button, and it starts. This is a fabulous "happy path" that is seamless.

Nothing happens without an actual action, but the actions are natural and organic to the task. The sensor is inside the door handle, combined with the key fob, and it just opens when you slide your hand into. It's a, truly, marvelous experience.

My keys stay in my pocket. Since I open the door for my wife anyway, it just works. (She can open the door, I just have to be close.)

Similarly, when we open the rear lift gate, it just opens. This also unlocks the rest of the vehicle (in contrast to if I push the gate open button on the fob, only the rear gate is open, not the rest -- which I find odd).

When leaving, I press a lock button on the handle to lock the car.

It's a great compromise, and works really well.

I absolutely rave about it. Every time I get a rental car that needs a cut key in an ignition cylinder it's a massive pain. I wouldn't buy a car that doesn't have push button ignition and would prefer for all cars I buy going forward to have phone as a key as an option.

For my personal cars I either use phone as a key or I'll keep the key fob in my bag. So I just walk up to the car, the car either auto unlocks or I press the button on the door, I get in, I press the button, and I go. When I'm done I just grab my bag and walk away and the car will auto-lock or I just press the door button. So smooth, I never need to really handle the key at all. It just stays in its specific pocket in my bag or it's just my phone in my pocket.

With a cut key, I walk up to the car. I need to fish around in my bag to grab the key. I then need to stick the key in the door and turn it, using care to not scratch the paint. I get in the car, need to insert the key, turn it and hold it long enough for it to start. When I'm done driving, I take the key out, grab my bag, and get out of the car. I then need to once again insert my key into the door once again being careful to not scratch anything, turn it to lock. Then I need to put the key away again.

And then phone as a key is incredibly nice, definitely my preferred way. I can easily leave the house for most errands with nothing but my phone on me. It's my car key, my payment method, my transit pass, my paperback novel, my portable music player, my camera, my maps, my communicator, all in one tiny package. Incredibly freeing compared to having to carry a bunch of junk in my pockets just to get groceries or whatever.

It doesn't take much to jam GPS, I'd imagine a small handheld device could easily do it. The GPS signal is already below the noise floor.

GPS jammers are less than $30 on Alibaba, truck drivers have been using them for over 10 years [1] to defeat their bosses tracking devices.

Multi-Band Jammers are $1000, burglary rings are using those to block all Wi-Fi, cell, GPS signals - check out this arrest report from last week in Pennsylvania [2]. If I was a high-end car thief, like in Gone in 60 Seconds, that's what I would use.

[1] https://www.theregister.com/2013/08/12/feds_arrest_rogue_tru...

[2] https://dauphin.crimewatchpa.com/lowerpaxtonpd/3730/cases/or...