Car Thieves Arrested After Using Laptop and Malware to Steal More Than 30 Jeeps | Hacker News Reader

Car Thieves Arrested After Using Laptop and Malware to Steal More Than 30 Jeeps

abc13.com

131 pointsJerry281 comments

More details from this article:

http://www.houstonchronicle.com/news/houston-texas/houston/a...

Quote:

Berj Alexanian, a spokesman with Fiat Chrysler Automobiles, said officials know how the Jeep Wrangler was stolen. According to Alexanian, the thief broke into the vehicle and used a laptop to enter its VIN number in order to access the Chrysler database. Dealerships, repair facilities and locksmiths are usually the only ones allowed access to the database, which provides the code for key fob access. Once the thief enters the VIN number, he can re-program the car's computer so it will accept a generic key fob. The car will then start, and the thief is able to drive off.

So they had unauthorized access to the Chrysler servers. Possibly via a stolen laptop. Seems too easy.

Do they not have equivalent of 2FA? What if these were nukes?

"We are terribly sorry, Mister President. We did not expect them to steal the launch codes from the database. We will provide asylum for what's left of your country."

Why would Chrysler have nukes?

My first laugh of the day.

https://en.wikipedia.org/wiki/Ford_Nucleon - Not SOO far fetched

Meant as a parabole. If server access is that strong, could it be better protected by equivalent of 2 factor auth?

Also from WSJ, which isn't behind a paywall for me:

http://www.wsj.com/articles/thieves-go-high-tech-to-steal-ca...

Every once in awhile one of these articles pop up on a news site. People (read: non-technical audience) seem to enjoy reading about a mysterious method of stealing a car, detecting your laptop/ipad in the trunk, tricking an ATM to give free money, hacking your phone, etc, etc.

Reality is that this kind of theft never is as straightforward as the article tells you. In this case it required the thieves to break into the car first, then reprogram the key. The thief can't just walk up to the car and type some magic commands on a laptop and drive of. It requires him to break the lock/door/glass to get in first. That's about the same as how car theft was done in the early years: break in, hotwire the ignition, (bump)start the car. This "new" method even requires more time than hotwiring, so car manufacturers did actually make their cars harder to steal in some sense...

The "amplification attack" would be one of those "mysterious method of stealing a car", no?

https://www.wired.com/2016/03/study-finds-24-car-models-open...

> It requires him to break the lock/door/glass to get in first.

They pop the hood, apparently.

http://www.khou.com/news/crime/high-tech-thieves-crooks-usin...

The rest is all 'digital', no further use of force required.

Did you watch the video in that article? It doesn't seem to line up at all with the text of the article, oddly. You see the guy for a moment and then the video skips forward and he's sitting in the Jeep with the alarm going off. The alarm appears to have been going for a good couple of minutes.

Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

I think they have to have the key already, but still 'blank' That will likely open the door but it would normally raise the alarm, that's why they start under the hood first, to disable that.

After that the procedure would be fairly easy: open the door with the still unlearned key, learn the new key ID to the ECU (takes < 1 minute) using the laptop, after that you can start the car.

One handy tip I got from the police after my own car got stolen (a VW transporter camper) was that you should mask off a chunk of the VIN so thieves can't use the VIN to order keys that will fit the car (but that still need to be programmed in the ECU in order to allow a start).

Isn't it illegal to remove the VIN?

Here apparently it isn't if you mask it. That's not the same as removing it, but your local police might have a different opinion.

Whether or not it is effective is another matter (and that's hoping there is only one instance of the VIN on your car, there may be other, less obvious ones for instance bar-codes).

That's why they said "mask off" instead of "file off". On some (many? all?) cars the VIN is stamped on a plate that's visible through the windshield.

> Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

There are a fair amount of modern cars that don't actually require you to get into the car to pop the hood if you know what you're doing. On earlier cars[1] there was no latch inside the car.

1) they don't have the electronics for this stuff however - simple hot wiring will do

>wouldn't popping the hood require breaking into the car first

Short answer, it depends. There are a lot of very simple methods to bypass having to actually get in the car to pop the hood.

But unless they can remotely unlock the doors with their device, they will be breaking in at some point.

Being an experienced mechanic means you practically have all the skills needed to be a great car theif.

Jeep Wranglers have external manual hood latches, not sure which vehicle is the subject of the article though.

Jeeps used to have awful security, so the fact that these thieves had to take an extra step or two, rather than just jimmying door and bumpstarting the car, means they have actually increased security.

My neighbor had his wrangler stolen a few years ago. I wasn't surprised.

Depending on the car the hood can be released from underneath but it's a massive pain and requires contorting arms in unnatural ways.

If you are targeting a specific kind of car, like Jeeps, you can easily create a small device that will bump the hood open quickly and easily.

Breaking into a car isn't terribly difficult. My car you can get into with a tennis ball with a hole in it-place hole on lock and ram the ball. The hard part is typically not getting caught.

That has been debunked. And debunked again recently.

http://www.snopes.com/can-unlock-car-door-tennis-ball/

You can get into Ford Rangers of a certain year range by unscrewing the antenna and sticking it into little holes underneath the handle. You catch it on the lock rod and use friction to work it up. It was really helpful for me whenever I locked my keys in my truck. At first it takes awhile to get the trick of it, but by the time I traded it in, it only took me a few seconds.

I suppose I should have been worried that other people can do that too, but my truck never got broken into or stolen to my knowledge. Security through obscurity. I now drive a Mazda with key fob and push-button ignition. It's got its own vulnerabilities but I'll let the insurance company worry about that.

Some Ford Rangers[1] were pretty easy to enter from the small back window. A small flip and the latch opened.

My sympathies on the Ford Ranger if you had it in a climate with snow. I had 700 lbs of sand in the bed over the back axle and good snow tires (not studs) and still got stuck. Everyone I talked to thought those things were death traps.

1) along with the Mazda B4000 which was a Ford Ranger with a different paint job and grill - even said Ford Ranger in the door

"And malware"? Sounds like the only piece of software involved was the one the thieves were using, and it was doing exactly what it was supposed to.

Malware also does exactly what's it supposed to do.

That was surprisingly profound.

Yep. It just has malicious intent, but that's the intent.

I decided to look for the definition of malware and found several. I think I like Webster's the most. "software designed to interfere with a computer's normal functioning".

If your poor, like myself, and want to slow down a car thief, put in a kill switch.

Run the proper gague wire from the primary on the coil to a switch in the cab. The primary wires are the small wires on the coil. (I can't think of any reason the ECU would throw a trouble code.)

It gets more complicated if you have a separate distributor running to each cylinder, but there's always a point in the electrical system you can splice into, like the starting system.

When completed, just get onto the habit of turning the switch on off, and on.

(I have noticed a lot of old Japanese vehicles being stolen in the Bay Area. Go figure?)

I have a great theft deterrent on my truck and Bronco II: Manual transmission. Most people in my area under 25 years old don't have a clue how to start or drive one, and the Bronco won't let you start it without the clutch disengaged (so no push starting).

Of course, this varies by location; I'm in the US where manuals are being phased out[1]. When I was growing up it was the other way around; you had to request (and pay more for) an automatic if you didn't want the "standard" transmission.

[1] http://www.cheatsheet.com/automobiles/manual-transmissions-a...

Yeah i find it bizarre just how many automatics are in America, here in the UK, the only people who drive automatics are people who have difficulty mastering the skill of standard driving (ie a manual).

Where I'm from, you need to drive manual in driving school and pass the test. It's possible to do automatic only (e.g. for handicapped individuals) but then your license will have a remark forbidding you from driving manual.

A synchronized manual gearbox (not heavy duty vehicle or a museum piece) is really easy to drive. One lesson to learn the basics and another for hill starts is enough. Then it's just a bit of practice.

I like manual for snowy/icy roads, but after a few miles stuck in a stop-and-go traffic jam I'm ready to have an automatic transmission back.

There's no reason for manual really unless you do races or don't want to pay premium for auto. As I understand, there's no financial disincentive for automatic in America, hence most opt for the most convenient option.

Not for your ordinary city dwellers, but a manual transmission is nicer if you have to drive in adverse conditions (snow, ice) or tow a trailer in hilly areas, etc.

And it's just more fun to drive when you have complete control of torque going to the wheels under your right foot :)

I drive an EV now (after years of driving stick). No petrol car comes close in torque control, and it's just two pedals :)

My personal theory about the EV advantage in acceleration/torque control is that it's not really that much better than similar class petrol cars, but that when the car is completely silent, people don't have the same aversion to flooring the pedal. So it's effectively better.

I've raced my brother-in-law out of red lights a few times, him in a Nissan Leaf, me in a Peugeot 307 with a 1.6 110 hp petrol engine. I can keep up, but I have to stay above 3000 RPM throughout all gear changes, so it's really loud. Most people never drive a petrol car like that, you sound like an idiot boy racer.

The slightly better gas mileage? Though now with CVTs that are computer-controlled, they get better gas mileage than cars with standard/maunual transmissions.

For at least a few years now, even conventional "slushbox" automatics get better mileage than a manual transmission when in the same car.

Lower maintenance costs are usually mentioned as an advantage of manual over automatic, but slushboxes have been around for quite a while now. With routine maintenance and average use (meaning no launch control usage or burnouts), both types will last forever.

You can drive a manual very efficiently. My Forester has a display showing instantaneous efficiency. I can increase mileage by a third by paying close attention to it. But that means driving very conservatively, which I'd never do without the display to remind me.

Since I have bought a manual car, my efficiency has gone down by a ridiculous amount.

Fortunately the fun factor has gone up by the same amount so I don't care...

My truck has a towing transmission (SM465) with a low "granny" gear in the tradition 1st gear position. I never use that gear unless I'm hauling felled tree trunks around the property or something like that; it's needed to get the truck moving under such a load. I've heard that rock crawler types like to put that tranny in old Jeeps for precise control during four wheeling, and I can believe it. In that gear, I've crawled up a hill with a moderate load in the bed, with my foot off the accelerator.

Mostly though, I just enjoy the nearly zero maintenance (check fluids regularly of course, change clutch every 10 years or so) that a manual provides on an older vehicle. On newer vehicles like my Crown Victoria or my wife's Nissan Versa, the automatic just makes more sense. It's just as dependable as a manual, and only slightly more frequent maintenance (60k mile service intervals on both cars).

Funny you mention old Japanese cars, as mine was stolen (and subsequently found) just a few days ago.

90's era Japanese cars are notoriously easy to steal, and the only thing that stopped them was the immobiliser kicking back on. When they initially took it, the immobiliser was off thanks to a mistake on my part, but it automatically re-activates when the car is turned off.

To get it home after it was found, I actually started it with a plastic spoon thanks to the minor "productivity hacks" they had applied to it. Keyless start!

The window and door were fine, because all you need to get into the door is a coat hanger down the window sil.

Given enough time, I suspect they would have gotten through the immobiliser fairly easily, and I honestly don't think a kill switch would slow them down much either as to be convenient, they need to be in the cabin.

My last car had a kill switch, and it was a big red button underneath the steering column. They're going to figure it out, but it might slow them down enough to consider giving up.

Car alarms are next to useless, no one cares or checks, but a good immobiliser will at least push it past the "easy grab" realm of opportunity. Unfortunately not until after they've broken in, taken your stuff and broken your key barrel though.

I can start my '91 Toyota with the nail file on a swiss army knife.

All modern cars have individual coil packs. The way to do it is to intercept the signal to the starter or to the fuel pumps. Both are accessible from the cabin.

Older japanese cars are stolen due to the import tuner scene. The older hondas and nissans are easy to steal and sell in parts. A honda B18C engine still costs around $1000. This one is found in third generation acuda integras (gsr model). Even newer ones like the Honda s2000 get stolen for interior parts (seats and gauge cluster).

Yeah, a GSR around here doesn't last long before getting stolen.

A type R is even shorter lived. People steal those for all sorts of parts. The first one that comes to mind is the 5 lug hubs.

I die a little every time a Type R gets stolen. They are amazing cars. Its awful when people use them to modify their lesser chassis.

> (I have noticed a lot of old Japanese vehicles being stolen in the Bay Area. Go figure?)

Parts? Old Japanese cars are still on the road, running well. My son is driving my original purchase 1990 Honda.

> Old Japanese cars are still on the road, running well. My son is driving my original purchase 1990 Honda.

I recently moved out to the Bay Area from south Florida, and one thing that really struck me was how many y2k-ish cars were on the road looking practically new. I think it's mostly a matter of climate.

I would have loved to keep my 2000 Integra on the road, but the unholy combination of Florida's sun and humidity brought an early death to its paint, body, grommets and bushings. In contrast, I regularly see Integras in the Bay Area that look as though they could have rolled out of the factory five years ago.

My theory for that is different construction materials: cars built in the 1970s and 1980s become rust-buckets quite easily - but cars built after the mid-1990s use considerably better bodywork materials that don't need specialist care to maintain, especially a lot more plastic. I drive a 2013 Ford Focus and the entire front assembly is plastic - no way that's going to rust or corrode. I'm almost looking forward to selling it for a good price after the warranty expires.

Plastic has its own issues. Gets brittle exposed to sunlight. Cracks easy. Scratches very easily. Changes color over time. Can't easily be repaired. My old cars, the plastic parts are worse off than metal ones.

Adam Corolla recommends this method. He also recommends painting your car stereo bright orange with spray paint to prevent theft.

There's a cleaner way. You can use a battery terminal disconnect directly on the battery:

https://www.amazon.com/dp/B001N729FS/ref=cm_sw_r_cp_api_p1xP...

Personally, I drive an old diesel truck and it's as simple as disconnecting the fuel cut-off solenoid wire from the solenoid. Old diesels like mine are terrifically simple and really only have two wires: the starter positive lead and the fuel cut-off lead. The cut-off lead opens a solenoid that lets fuel flow to the motor. Remove power and it shuts the flow and stops the engine. The easiest way stop a completely mechanically injected diesel.

Please don't do this if your car has oxygen sensors, a catalytic converter or fuel injectors (basically all cars 1980+)

Why? Besides polluting more you're going to reset the car's ECU and it takes a few drive cycles in different conditions to properly tune the engine.

There are so many things that can affect the tuning, engine wear, fuel quality even the barometric pressure. If the car can't learn that (because it's designed to reset on power loss) you will probably be running a rich A/F mixture that can foul your O2 sensors and 3-way cat.

Install an alarm or get a car immobilizer. There is a RFID immobilizer on ebay for less than 10 bucks..

Yeah, I'm in favor of a fuel pump disable switch instead. Any passenger car with fuel injection will have an electric or electronic fuel pump, and splicing in a switch is fairly simple. Hide the switch where it's out of sight but easy to access by the owner and Bob's your uncle.

That won't work for a whole pile of cars, especially German ones. They will lose the throttlebody sync and you won't be able to get it out of 'limp' mode without some ODBII reset and re-sync magic.

Essentially the ECU will no longer know what position the throttlebody servo is in and to avoid engine damage it won't allow more than 1500 RPM or so.

Huh. Good to know, thanks.

I installed a battery disconnect on my 2006 Jetta when my mechanic couldn't figure out why the battery was draining overnight. There was a short somewhere.

I found someone to clean the sunroof drains (I had cleaned all the drains I could figure out) and the electrical problem went away. Bonus, the notorious Jetta foggy windows on start problem went away too.

Now, I'm hesitant to remove the disconnect switch because I don't know the root cause. But with your pro tip, I guess I need to resolve this one.

I learned this the hard way, I ended up driving 55 km to the nearest dealership in 'limp' mode trying to maintain enough speed not to annoy traffic around me. It worked but that was one of the most annoying road trips I ever made.

The weird thing is it does not happen every time you disconnect the battery, but when it does disconnecting it and reconnecting it does not clear the problem. Highly annoying. But a good way to learn new German words ("Drosselklappe...").

That seems like quite a hassle to pop the hood every time you're ready to drive the car, then pop it again when you're done. It also would prevent electronic locks from working.

Much simpler to install, for sure. But having a hidden toggle switch somewhere is a lot simpler for every day operation IMO.

And you'd have to reset your clock, and preset stations. Also the fuel trims the ECU is using would be wiped out.

That product is pretty cool though, I didn't know they existed. Makes sense for an RV or something you rarely use.

It is also not recommended for Euro cars like bmws. They are finicky.

Car batteries can explode from sparks... I wouldn't want to be disconnecting the battery every day increasing those chances.

https://www.youtube.com/watch?v=d_TnsHu2u4c

That won't work, my car had those on both terminals and the battery was flat. They brought their own battery and rigged it all back up. It might stop an opportunist doing his first theft though.

It would easier in a newer car to interrupt one of the leads to/from the ECU, which is already located in the cabin.

There's so many electrical systems in a modern car; interrupt just one and it's going nowhere.

Yes, my elder brother did it ~20 years ago. But isn't it the first thing a skilled car thief is looking for when a car doesn't start?

NFC + PI + Switch

"used pirated software"

So they did not pay for the crack tools they used? Bastards!

Poor thrives didn't k is what they got themselves into. They thought if caught they'd go away for simple auto theft. Now they will probably get charged with hacking (unauthorized use of a computer) under the CFAA and go away for a lot longer.

When I started writing this I was joking but the more you think about it there's a good chance they do get charged under the CFAA.

Maybe it was some special diagnostics software they stole from Chrysler first?

Untill the key generation scheme is cracked and it turns out to be md5 of the vin and use the last 10 keys (a la how wpa keys are generated for modems); now all you need is a smartphone, blank key and programmer and all cars of that brand can be easily stolen.

But it could be worse; BMW had a alarm systeem that would not go off if one of the front Windows were smashed; programmer hooked to the cambus allowed you to create a working key and drive off in under a minute...

I would love to be able to do this on my own car to reprogram spare keys myself without having to visit the dealership.

"Pirated software" is not the right term to use in this case.

We presume manufacturers of self-driving cars, or at least their fleet operators, will be liable for their coding mistakes. Why isn't Fiat-Chrysler responsible for the cost of this car?

This mentality is so weird to me. The thief is liable. And I'm happy it is this way, otherwise 3rd party locksmiths and garages wouldn't be able to work on your car.

Interestingly the law strikes a decent balance here. For example, the FTC can sue a company for 'unfair and deceptive business practices'. Exposing cars to insta-theft because you didn't secure your backend database could fall in that category.

Companies do have a duty of care if they are holding the keys to the castle, be it the keys to your car, or keys to your email or financials; they have to take reasonable precautions to protect the data, commensurate with the quantity and sensitivity of the data, and the cost and availability of technology to protect that data.

>That was the same story HPD heard over and over from several Jeep owners in the Houston area.

Looks like this was their main mistake.

Not sure why downvotes. I just pointed out that it was stupid for the thieves to perform their series in one small area, with distinct hand, again and again, drawing police attention. Especially stupid for a hi-tech thieves.

I think people thought you meant owning a Jeep in the Houston area was a mistake

Reply on news.ycombinator.com