Ask HN: How do u protect car fob? | Hacker News Reader

Ask HN: How do u protect car fob?

7 pointsA4ET8a8uTh04 comments

I think it is a mildly weird question, but this also may be the right place to ask this. Wife's new car has a fob and, well, it is convenient, but I also saw stories about guys getting close enough to garage and somehow taking off with the car anyway despite fob seemingly staying with owners. I am assuming fobs are just being copied over the air somehow, but I never really looked into it that closely.

Is there a way to prevent that? Are there steps you can take?

View on HN

From the attacks I know about, they work by jamming the fob signal so the attacker can record it, but the car doesn't receive it. They need a couple of attempts from your fob for the scheme to work. If you (or your wife) ever tries to unlock the car and you have to press the fob multiple times, when you get into the car, press lock and then unlock on your fob. This should make your unlock command the latest in the car's memory, invalidating any captured by someone else. You can also do it each time you exit your car: lock, unlock, lock. The main thing is for the lock, unlock, lock sequence to happen when you're too close to the car for anyone else to jam your signal.

I'm not a cryptographer or anything but if I was to design a scheme like this I think I'd have some kind of challenge/response protocol where the fob would send a request to unlock, the car responds with a random number it wants signed, the fob signs it and then the car unlocks. The challenge would need to be suitably long and also probably incorporate the current timestamp into it to resist replay attacks.

I'm thinking that the fob has a public/private keypair on it, and the car needs to trust the public key of the fob, which would be done by the factory or the owner when buying another fob.

I expect if this system were to be correctly implemented with suitably strong key strengths it would be very hard to crack.

I guess it's not too cheap to do that but surely schemes like these already exist right? I'm guessing it's on high-end cars only.

I've never actually owned or looked at buying a car so I don't know what's on the market.

On recent vehicles where the car unlocks when the fob is in proximity, they use relay attacks, retransmitting the signal from the fob from radio closer to the vehicle.

This seems to be a reasonable discussion of it:

https://www.comparitech.com/blog/information-security/what-i...

Would putting the car fob in a faraday bag help?

Reply on news.ycombinator.com