Car key 'relay' attack caught on CCTV | Hacker News Reader

Car key 'relay' attack caught on CCTV

bbc.co.uk

54 pointstankenmate65 comments

That's why at night I keep my keys in a metalic pouch that blocks all signals. I've tried and the car doesn't recognize the key even if I hold the pouch right next to the sensor, so it must be doing a good job. I'd highly recommend doing that if you have a keyless entry system installed in your car.

Edit: This specific one if anyone is interested in protecting themselves: https://www.amazon.co.uk/gp/product/B01HETGX00/ref=oh_aui_se...

Which manufacturers are affected?

Edit - this seems to be exploiting the "convenience unlocking" feature, whereby you can unlock the car by having the key in a pocket and standing next to the door. Similarly the car will also allow starting the engine if the key is detected inside of the car, so this too can be done via a relay. But you'll need to have the key continuously present to drive, so I guess the whole scheme would involve a flatbed/tow truck around the corner.

Edit - I guess one can stretch the relay tether by planting the key-side relay on site, next to the garage door, and have it talk to the car-side counterpart via cell connection.

Also as far as countermeasures go - one would probably be to have the key shut down completely it detects no motion for N minutes. Or just have a physical Off switch on it.

The car in the video is a Mercedes.

Not sure if there exists any decent counter-measures.

Other than the asymmetric encryption we've had since the 1970's?

Encryption isn't the issue, the whole concept is. All this is is a range extender.

Oh, right. Damn. So it fakes the presence of the key by merely extending its range? This is not good.

Store your car keys in a Faraday cage?

I do this (a key fob bag with foil). Some cars can disable the regular broadcast from the car too. Then you have to press the button on the key to open the doors.

Latency measurement from car side?

Wouldn't help: the latency to the relay box is at least as good as having the physical key nearby.

That can't be true, because the request/reply still has to travel all the way to the key and back.

If the receiver is accurate enough(we're talking nanosecond precision) then you can absolutely tell if the key is 1m or 10m away, so a relay wouldn't help at all.

From the video it seems that the car was parked in front of the house and they just amplified the signal coming from the key inside the house. So not exactly a relay attack. The latency increase must be really low.

There are distance-bounding protocols[0], but I don't think anyone has implemented them in something as small as a car key yet.

[0] https://en.m.wikipedia.org/wiki/Distance-bounding_protocol

NFc and wireless credit cards urgently need to implement something like this...

It's only a matter of time till NFC credit cards get read with a high power reader and proxied across a cell connection to steal money from someone hundreds of miles away from the thief.

How about having a button on the keyfob, that unlocks and locks the car?

Then you don't need to worry about the relay-attack, don't need to worry that you car unlocks just because you walk past it, and don't need a steering lock...

At some point you have to ask yourself, why not just use a real key? The "inconvenience" of having to insert the key can't seriously outweigh the issue of forgetting your key in your car (because it was in the wrong bag), driving away from the key. Or the security issues. Or the added cost.

I just don't see the appeal even if it worked perfectly. I'd rather pay extra to have it removed.

Normal keys are notoriously unsafe and get worse over the years by continuous use (grinding of the locking pins). You can also cover the locking mechanism completely inside the door so no fishing for the lock handle can be done via the window or cracks in the handle.

The 'easy unlocking' feature is idiotically simple to fool as shown. Almost the same as in the late '90s when you could just cycle through the ~2-10k combinations on the fobs.

My advise would be: use the buttons on the key and disable the easy-unlock feature which can usually be done either in the car's settings or at the garage.

' ...why not just use a real key? '

Because they break into the house to get the key. It's happened to a few people I know - one time they used a wire hook through a partly opened window.

Police on the tv here (nl) this morning suggested storing your keys wrapped in aluminum foil...

Shouldn't there be some kind of simple disable switch?

You might still want keyless entry during the day for routine shopping trips and such but for parking the car overnight you can live without it; and probably sleep a lot better too.

You can - I happen to have a Mercedes, so I know as a fact that you can just double-click the lock button on the key to disable the contactless feature completely - the car can then be only unlocked with a physical button press on the fob.

I keep my key in a metalic pouch every night as a countermeasure, works just as well.

However, there's one concern with it - if a thief tries to steal your car using the relay attack and fails, will they break in and try to steal the physical key(which might lead to confrontation and people getting hurt). It's a risk either way.

A faraday cage key fob holder. Will remove the convenience of just keeping the fob in your pocket though.

Not requiring an explicit (or at least conscious) action on the part of the user seems to be the flaw in the process.

The countermeasures would appear to be:

* blocking the signal using some kind of Faraday cage to store your keys

this relies on changing user behaviour, and not forgetting; kinda removes some of the “convenience” factor

have some kind of disable switch on the key fob, in which case there’s not a huge difference to a regular remote lock/unlock button

* expanding the range of frequencies the key fob uses to try and defeat the range extenders

this likely has regulatory issues, and is probably easy to just update the hardware to cope with (if it doesn’t already)

have the car do some kind of latency measurement on the challenge/response radio message exchange; given that light travels at 1ns per foot (ish!) the car will have to accurately and precisely measure only a few nanos difference, and not suddenly stop working because of nearby radio echoes in a concrete car park (or whatever)

how close to the car is “convenient” to have it unlock automatically? 2 feet (driver standing by car)? 20 feet (kids running ahead to get into car)?

* some kind of “parked up at home” mode so that the first unlock of the day requires a button push

loses some of the convenience again

got to remember to set it (some kind of car locking button again...)

* you could have a second type of “anti-key” that you always leave at home, and when in range of this key the car won’t unlock keylessley

easy target to block in the arms race or car theft

easy to misunderstand as a user

less convenience

I had thought you offered a thorough exploration of the possible countermeasures, but you missed jgrahamc's suggestion below of adding an accelerometer to the fob. Only unlock when motion is detected. What are you thoughts? Seems that keys are incredible idle when sitting on the kitchen counter, and never perfectly idle when walking to approach your car.

I think that’s a neat idea. In my defence, I might put that under the some-kind-of-switch-to-turn-it-off category but only in hindsight ;)

Like latency-measurement though I wonder how robust it would be to the vagaries of modern life both in terms of reliability - potential moving parts - and in the face of user expectations - “I keep having to jiggle my keys to open my door” or worse, the dreaded “it doesn’t work!”. Where doesn’t work == doesn’t work how I think it should.

The relay attack is very old and is very commonly used to steal all kinds of cars, here in Europe it's mostly Toyota.

You do not need the key to be present in the car once it's started up. It's a feature of all key-less cars. For example, one would not want the car to suddenly stop if the key's battery dies on the go.

So, once you start the engine, it will run. It will complain and beep if the key is not present in the car, but it will run.

They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome. A more convenient way is to store your key in a special keyless key protector "pouch" when you're not driving your car, which is basically a Faraday Cage, blocking it's signal.

If the key battery dies, there is a spot on the dashboard that is NFC-equipped, so you just need to get the key next to it and it will ID regardless of the battery state.

> It will complain and beep if the key is not present in the car, but it will run.

Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.

Your assumption is incorrect. It will run until the car is turned off. If it behaved as you're assuming it would be wildly unsafe, imagine someone inadvertently dropping off a passenger who has the key with them in a purse or jacket pocket, then stopping briefly on a bridge without shoulders, or a railroad crossing.

So now when you are on the highway you need to suddenly search your bag for the key so you can insert it.

> Have you checked that? My assumption was that it will shut down the engine once the speed drops to zero.

Not in any implementation I've heard of (and it would be quite dangerous and irresponsible). Actually, one story I've heard from pretty much everyone I know owning a keyless car is that the driver drops of a passenger that unknowingly had they key all along (typically a spouse). The driver then drives along, fills up for gas or make some other stop and then can't start the car anymore because the key is with the long gone passenger.

An anecdote, but my car (2015 fit) does keep running when the key is removed. It'll complain, but keeps running until you turn it off.

this is standard requirement in case your key fob just breaks down while you are on the highway for example

>They suggest to use a steering lock to avoid this, which would indeed help, but it's quite cumbersome.

atleast in my non-keyless car the steering lock is quite easy; pull key, rotate steering wheel until lock, done.

Once you've done it a couple times it becomes second nature.

I believe they are talking about aftermarket steering locks that fit onto the steering well such as https://i.imgur.com/C2rIjyq.jpg

They were fairly common in the U.K. Back when car security was even worse as it is right now.

The non keyless steering locks can usually be defeated with a few swift hammer blows to the lock cylinder to dislodge the locking pin from the steering column.

Now that’s not to say these after market locks are “secure” as they two have their weeknesses (cut the steering wheel and slide the lock off, use of cheap locks on the device, etc) but they give a visual deterrent to people just driving past and deciding to take your car.

>The non keyless steering locks can usually be defeated with a few swift hammer blows to the lock cylinder to dislodge the locking pin from the steering column.

My Opel had a definitely safer construction, IIRC the entire thing is welded together so you can't unlock the steering lock without taking apart the entire locking mechanism with a welder halfway into the motorblock.

Of course it's not 100% but it should defend reasonably against people trying to steal the car who don't own a blowtorch and 3 hours of unobserved welding at my car.

«But you'll need to have the key continuously present to drive»

Not true. Virtually all "keyless ignition" cars let you continue to drive when the key is suddenly no longer detected as present in the car.

I verified this myself on my 2012 Audi S4, driving 1 km away from home without my key.

Think about it. It would be too dangerous if the car suddenly shut down the engine eg. when the key's battery dies or when some random persistent R/F communication failure occurs.

Yep. I've had a situation where I was driving on the motorway and suddenly my car decided that my key was no longer in the car(which obviously was still in my pocket) - and a warning was shown on the dash, but the car continued running. Imagine if it shut down while doing 70mph on the motorway!

Interestingly, for many people here, the solution to the problem is even more technology.

Is there a study demonstrating that more advanced keys actually reduce stealing ?

Add an accelerometer to the key and only transmit when moving.

I had a '94 Corvette that did this. Probably to save on battery life. There was a tiny ball that moved around in the key fob. The fob wouldn't transmit the "hey, I'm here" signal unless it was moving.

Not sure what the tech was. Not an accelerometer per se, but still motion detection that worked pretty well.

Perhaps a strain gauge (https://en.wikipedia.org/wiki/Strain_gauge), a primitive sort of accelerometer that has been around for donkey's years.

If it is a ball it probably is a ground plate on the bottom and top with sense connector plates on the edge of the box where the ball is in. The ball moves around and if it gets a connection (ground to sense) a counter gets increased and a time gets reset and since you are moving the thing usually moves around and make some connection when braking/accelerating/steering. You need bumpy roads though on longer trips on the highway. Dirt cheap, but unreliable. Straingauges (in my experience) generally need to be tuned for every gauge which makes them somewhat more expensive.

Oh, I think I misread my parent's comment. On my fob, it was purely to unlock the doors when you approached the car. It didn't involve itself with the ignition or running of the car. That was still an old-school key (but with the tiny improvement of a known resistor ohm-age in the key itself†)

† http://ricksfreeautorepairadvice.com/gm-anti-theft-systems-o...

One of those may have been involved somehow, but there was definitely a rattling ball in there you could hear if you shook it. I'm having trouble finding images of how it worked, but many car forums discuss the "small gold bearing in a cylinder" that's used in the fob.

Unfortunately, Google wants to show me links to buy stuff. It's getting impossible to find "standalone" web pages these days.

Tiny ball of mercury that moved inside a glass bubble. The glass has tiny contacts on the inside and the mercury would short circuit at least two at a time. It would detect sudden moves. This is one type of tech that worked like that but maybe not exactlly like yours.

Probably similar to your description, but it was a solid ball that rattled. The enclosure was metal as well I think, though maybe some sort of laminated shell with alternating contacts?

I'm really trying to find a diagram of it, but my searches aren't yielding much.

Ball motion detectors (or shake/tilt switches) work as you describe. They typically have several metal rods on which the ball will rest on two at any given time. The impossible combinations (too far away to span with the ball) are often bridged together for simplicity. Detection is done by monitoring for changes in the connectivity between 3 or more contacts.

Wow, this is probably the best solution here. Should be cheap and perfectly effective.

There is a startup from ETH Zurich [1] which develops technology to make relay attacks impossible. In short, they are developing a method to make the key proove its within a certain distance of the car. Some of the tech behind it: https://arxiv.org/abs/1404.4435

[1] http://www.3db-technologies.com/de/Anwendungen.3.html

Question: who buys these stolen cars, and would having a tracker on one solve the problem?

From experience I know that when it comes to computers, at least in San Francisco, even if you know the exact address where 20+ stolen computers are at, the police will not engage. Are most police similarly hesitant to track down stolen cars, or is that just a weird SFPD quirk about ignoring theft?

in Europe they are often sold in parts like spare parts, it is then much easier than selling the complete car

At least for motorcycles I know you also make more money selling in parts. Of course this ignores the work spent disassembling...

Well the work might not be that much, eg

  http://prev.dailyherald.com/story/?id=377183

Three technicians with handtools vs a Honda Civic => six minutes

Video: https://www.youtube.com/watch?v=3hhNwcaEwHI

Then you can track it all the way to the shipping container

In the UK if you have a tracker fitted the police will absolutely go and check it out immediately after reporting, they are pretty efficient at it. What the thieves started doing though is they take the car to a car park several miles out and let it sit there for a week, without spoiling the thief's position - if the car is still there after a week it's good to take. A lot of tracker-fitted cars are recovered this way, they are usually found just sitting in parking lots, not in some dodgy garages.

What are these trackers? Can you give an example? Are they GPS transmitters?

Yes, so they are basically GPS receivers with a GSM module, constantly broadcasting the location to a central server. They usually have their own battery backup in case the main battery is removed, and have a VHS broadcaster so the vehicle can be found even underground or in a container. For example:

https://www.trackerfit.co.uk/tracker-locate.html

I have a service called "MercedesME" in my car and that provides real-time location of the vehicle at all times by using the built-in GSM modem in the car - but stupidly, in the UK it's not classified as a "tracker" for insurance purposes so having it does not get you an insurance discount.

What if i put my car keys in the microwave ?

Too extreme. If I understand correctly how it works any metalic enclosure will work. Tinfoil!

Both of these seem way more complicated than using the buttons to open doors (i.e. disabling the easy unlock feature) - but I probably just missed the sarcasm again ;)

Just yesterday a friend was showing me the video where his white Mercedes was stolen in London in the exact same way! I guess someone made good sales on those relay boxes...

> West Midlands Police crime reduction team, said: "To protect against this type of theft, owners can use an additional tested and Thatcham-approved steering lock to cover the entire steering wheel

We've come full circle. Tech has advanced so much that you need a physical lock to backup your technical lock.

Reminds me of the rubber hose method. Trouble decrypting his 2048 bits of encryption? Just whack him with a rubber hose til he gives you the password. [xkcd ref]

https://xkcd.com/538/

(it's a wrench rather than a rubber hose)

Reply on news.ycombinator.com