Hacker News Reader

Comment by toyg | Hacker News Reader

I keep seeing this problem (and likely suffered from early attempts a few years ago, when my car was effortlessly broken into), but nobody seems to be talking about solutions. What's the answer? It would be nice if I could ask about this when I get a new car in a couple of years.

* Is it about making the exchange more computationally complex, so it can't be just replayed? I guess that would require some sort of clock in the key?

* Have 2FA with something like a phone? Like requiring TouchID on the phone to confirm when you press the key.

View on HN

Why don't they put an on-off switch on the fob? Better yet, when the vehicle locks, send a turn-off signal to the fob. Then you'll have to press a power button to reactivate it.

That's running exactly contrary to the feature that's implemented and abused: The car should unlock when the owner comes within radio distance. So the key must be on and transmitting - and it's that signal that gets relayed. It's not a replay attack, basically the signal just gets amplified to trick the car into believing that the key is close.

Right, so when you put the fob in your pocket to leave, you activate it, and it stays active until you've completed your trip and you lock the car. But while it's resting on your nightstand or kitchen counter, it's inactive. Or is there something I'm missing?

Don't broadcast the signal used for ignition at all, and require key insertion, even if you have keyless entry. Simple solution.

2FA defeats the purpose, but you could have biometrics directly on the car instead of a broadcast signal.

A good start, though once someone has physical access to the OBD port, all bets might be off: https://www.extremetech.com/extreme/132526-hack-the-diagnost...

> What's the answer? It would be nice if I could ask about this when I get a new car in a couple of years.

http://www.disklokuk.co.uk/shop/disklok

A working distance-bounding protocol would address it.

I think ultimately you would be relying on a 3rd party evaluation of the systems automakers are using because salesmen aren't going to have a useful knowledge of the specifics.

Why not just have fob activate itself only when it is moving (like when carried by owner towards the car) vs sitting still at home?

fobs don't come with accelerometers? Or are you saying the car is doing this calc based on timed signals from fob? That would be open to spoofing as well...

Reply on news.ycombinator.com