Car Immobilizers Easy To Crack

Car immobilizers are easy to crack? Guess what else is easy to crack? Your skull, if I catch you trying to steal my car.

Anti-theft devices found on millions of cars are vulnerable to a "trivial" attack, say security researchers. Vehicles made by 26 separate car firms including Volkswagen, Porsche and Honda use the "weak" security system. The researchers first released their findings two years ago but legal action prevented publication.

It's sad that they aren't using decent encryption on key/lock for a 20k-200k car. My password for most websites is 120-256 bit (lower occurs when the sites have limited # of chars or small characters sets (e.g. just alphanumeric)

I'm not surprised by this. Car makers got so used to security through obfuscation protecting their proprietary ECUs(which was never that good to begin with) that they never stopped to question security when they moved different technology into more areas of the automobile. "Good enough" seems to be their battlecry.

I suspect it will take someone getting badly injured because their car got hacked by some asshat who forced it into a wall to get the industry to do anything worthwhile. Why bother fixing something and make it more secure when you can just unleash your overpaid lawyers? "Oh what's that? We're being sued because our stupidity caused someone to get injured? Again? Well we better do something! The stockholders won't be happy about that!"

It sounds like you'll need to snoop on the car owner turning on their car a couple of times, break into the car, have a physical key that is accepted by the vehicle and then also have the encryption key.

Meh, a pro thief would just tow a vehicle. Meanwhile, even these weak immobilizers have greatly reduced car thefts:

http://www.nytimes.com/2014/08/12/u...-went-out-of-fashion.html?_r=0&abt=0002&abg=1

SLee said:

It sounds like you'll need to snoop on the car owner turning on their car a couple of times, break into the car, have a physical key that is accepted by the vehicle and then also have the encryption key.

Meh, a pro thief would just tow a vehicle. Meanwhile, even these weak immobilizers have greatly reduced car thefts:

http://www.nytimes.com/2014/08/12/u...-went-out-of-fashion.html?_r=0&abt=0002&abg=1

Click to expand...

Yeah... so this is lame.

I read the article and it sounds like you have to have close proximity access to the key and car while it is being started.

Why not just knock the owner out and take the keys to steal the car? Much faster/easier than befriending them and then taking rides with them a couple times in order to get the encryption key, etc.

cyclone3d said:

Why not just knock the owner out and take the keys to steal the car?.

Click to expand...

I'm reminded of the xkcd comic about using physical torture instead of a massive password cracking cluster to get the password out of somebody.

It's probably a very clever technique but there are much more practical ways to steal a car.

SLee said:

I'm reminded of the xkcd comic about using physical torture instead of a massive password cracking cluster to get the password out of somebody.

It's probably a very clever technique but there are much more practical ways to steal a car.

Click to expand...

True, but in this day and age weak security needs to be addressed. They need to fix the underlying problem - which is sloppy programming and lazy implementation. Weakness in electronic security is a world-wide problem in every industry.

cyclone3d said:

Yeah... so this is lame.

I read the article and it sounds like you have to have close proximity access to the key and car while it is being started.

Why not just knock the owner out and take the keys to steal the car? Much faster/easier than befriending them and then taking rides with them a couple times in order to get the encryption key, etc.

Click to expand...

Er.. Say you have a car I'd like to steal and I don't know you. I could attach the device to your car... Say on the underbody. Collect it later and /win.

canna said:

Er.. Say you have a car I'd like to steal and I don't know you. I could attach the device to your car... Say on the underbody. Collect it later and /win.

Click to expand...

The problem with that is that the range on the key fobs is about 1" if that.

I have two keys on a keychain. One has the chip in it, the other was meant for just opening the doors.. same exact cut.

If I try to use the one without the chip in it, it will not start the vehicle... and it is maybe 1/2" further away from the receiver than it normally would be.

Much like the animal identification chips.. the reader has to be in super close proximity for them to read the chip.

cyclone3d said:

The problem with that is that the range on the key fobs is about 1" if that.

I have two keys on a keychain. One has the chip in it, the other was meant for just opening the doors.. same exact cut.

If I try to use the one without the chip in it, it will not start the vehicle... and it is maybe 1/2" further away from the receiver than it normally would be.

Much like the animal identification chips.. the reader has to be in super close proximity for them to read the chip.

Click to expand...

Not sure about keys with chips, but teh FOBs they're discussing work from further away than that. I'm not sure if they have multiple readers on a car (say one at the door and another inside the cabin), but either way, the key can be sitting in the passenger seat (probably in the back seat) and you can start the car.