Hacker News Reader

Comment by LeonM | Hacker News Reader

Every once in awhile one of these articles pop up on a news site. People (read: non-technical audience) seem to enjoy reading about a mysterious method of stealing a car, detecting your laptop/ipad in the trunk, tricking an ATM to give free money, hacking your phone, etc, etc.

Reality is that this kind of theft never is as straightforward as the article tells you. In this case it required the thieves to break into the car first, then reprogram the key. The thief can't just walk up to the car and type some magic commands on a laptop and drive of. It requires him to break the lock/door/glass to get in first. That's about the same as how car theft was done in the early years: break in, hotwire the ignition, (bump)start the car. This "new" method even requires more time than hotwiring, so car manufacturers did actually make their cars harder to steal in some sense...

View on HN

The "amplification attack" would be one of those "mysterious method of stealing a car", no?

https://www.wired.com/2016/03/study-finds-24-car-models-open...

> It requires him to break the lock/door/glass to get in first.

They pop the hood, apparently.

http://www.khou.com/news/crime/high-tech-thieves-crooks-usin...

The rest is all 'digital', no further use of force required.

Did you watch the video in that article? It doesn't seem to line up at all with the text of the article, oddly. You see the guy for a moment and then the video skips forward and he's sitting in the Jeep with the alarm going off. The alarm appears to have been going for a good couple of minutes.

Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

Depending on the car the hood can be released from underneath but it's a massive pain and requires contorting arms in unnatural ways.

If you are targeting a specific kind of car, like Jeeps, you can easily create a small device that will bump the hood open quickly and easily.

Jeep Wranglers have external manual hood latches, not sure which vehicle is the subject of the article though.

Jeeps used to have awful security, so the fact that these thieves had to take an extra step or two, rather than just jimmying door and bumpstarting the car, means they have actually increased security.

My neighbor had his wrangler stolen a few years ago. I wasn't surprised.

>wouldn't popping the hood require breaking into the car first

Short answer, it depends. There are a lot of very simple methods to bypass having to actually get in the car to pop the hood.

But unless they can remotely unlock the doors with their device, they will be breaking in at some point.

Being an experienced mechanic means you practically have all the skills needed to be a great car theif.

I think they have to have the key already, but still 'blank' That will likely open the door but it would normally raise the alarm, that's why they start under the hood first, to disable that.

After that the procedure would be fairly easy: open the door with the still unlearned key, learn the new key ID to the ECU (takes < 1 minute) using the laptop, after that you can start the car.

One handy tip I got from the police after my own car got stolen (a VW transporter camper) was that you should mask off a chunk of the VIN so thieves can't use the VIN to order keys that will fit the car (but that still need to be programmed in the ECU in order to allow a start).

Isn't it illegal to remove the VIN?

That's why they said "mask off" instead of "file off". On some (many? all?) cars the VIN is stamped on a plate that's visible through the windshield.

Here apparently it isn't if you mask it. That's not the same as removing it, but your local police might have a different opinion.

Whether or not it is effective is another matter (and that's hoping there is only one instance of the VIN on your car, there may be other, less obvious ones for instance bar-codes).

> Wouldn't popping the hood also require breaking a window or otherwise getting in the car to pull the release?

There are a fair amount of modern cars that don't actually require you to get into the car to pop the hood if you know what you're doing. On earlier cars[1] there was no latch inside the car.

1) they don't have the electronics for this stuff however - simple hot wiring will do

Breaking into a car isn't terribly difficult. My car you can get into with a tennis ball with a hole in it-place hole on lock and ram the ball. The hard part is typically not getting caught.

That has been debunked. And debunked again recently.

http://www.snopes.com/can-unlock-car-door-tennis-ball/

You can get into Ford Rangers of a certain year range by unscrewing the antenna and sticking it into little holes underneath the handle. You catch it on the lock rod and use friction to work it up. It was really helpful for me whenever I locked my keys in my truck. At first it takes awhile to get the trick of it, but by the time I traded it in, it only took me a few seconds.

I suppose I should have been worried that other people can do that too, but my truck never got broken into or stolen to my knowledge. Security through obscurity. I now drive a Mazda with key fob and push-button ignition. It's got its own vulnerabilities but I'll let the insurance company worry about that.

Some Ford Rangers[1] were pretty easy to enter from the small back window. A small flip and the latch opened.

My sympathies on the Ford Ranger if you had it in a climate with snow. I had 700 lbs of sand in the bed over the back axle and good snow tires (not studs) and still got stuck. Everyone I talked to thought those things were death traps.

1) along with the Mazda B4000 which was a Ford Ranger with a different paint job and grill - even said Ford Ranger in the door

Reply on news.ycombinator.com