It’s an old story. As fast as the good guys can invent new technologies to make it harder for the bad guys to operate, the bad guys invent ways around them. For example, EMV chips in credit cards were supposed to make it harder for thieves to commit identity theft by copying your credit card. However, the chips are only effective when the card is inserted into a reader at the point of sale. This did nothing to protect against fraudulent online purchases, where the chips have no effect. So, identity theft (which is mostly driven by credit card fraud) has actually gone up since the chips were introduced, not down.
And so it is with keyless car ignition. One of the selling points of these systems is that it makes it harder to steal the car by hot-wiring or making a copy of the key. That’s because electronic chips in your key “tell” the car that the correct key is present. The car will only start when that key transmits the right frequency to the car’s immobilizer. So, unless a duplicate car key is correctly programmed to the car, it will not work. But bad guys don’t give up, they adapt. And, adapt they did – from hot-wiring to hacking. Here is one example of how car thieves are defeating your car’s transponder system.
There is a tool, dubbed the mystery device by the National Insurance Crime Bureau (NICB), that can unlock and start cars. It is an improved version of a device seen in 2013. The 2013 device allowed thieves to unlock car, and steal the contents. It did not, however, start the car. Now, the improved versions are back that will not only unlock your car, but start it, as well. The device accomplishes this quickly and easily using a method known as a relay attack.
The relay attack involves two devices, two people, and one vehicle. Remember, the signals that transmit between your car and its key fob are weak. That is by design; you only want the key fob to unlock and start the vehicle when you are nearby. The relay attack devices magnify the key fob’s signal so that it will transmit over a much larger distance.
Let’s imagine that you and your partner in crime see someone parking a car you want. You each have one of these mystery devices. The driver of the target vehicles gets out of the car, locks it, and goes into a store. You follow her inside, and your friend stands by her car. You stand close by and hold your mystery device near her purse. Your device reads the signal from the woman’s key fob, and boosts it so it can travel to your friend’s device near the target vehicle. His device then transmits the frequency to the car, which thinks the signal means that the key is present. This allows your friend to unlock and start the car. It’s really pretty simple. To make matters worse, these devices are available online and don’t cost a lot.
Most people don’t think beyond the idea of a car theft. That, in itself, is a nightmare for people to think about. So, let me take this to the next level. Once a thief is inside your car, even if he does not steal the car, he could be gaining access to your home as well. If your glove compartment is unlocked, the thief can open that and look for any paperwork, like an insurance card or registration form, that shows your home address. If you have a garage door opener, he can copy the frequency from that to another device (much like you use your existing garage door opener to program a button inside your car to open the garage door). Before you know it, this guy knows where you live and has a way to get into your home.
The best way to prevent car theft by someone using your car’s key frequency when you are out is by keeping your key in a Faraday sleeve. This is a special cover that blocks the transmission of various radio frequencies and would prevent a relay attack device from picking up the frequency from your key fob. This takes some of the convenience away from having the fob, as you will have to remove the key from the sleeve when you want to get back in your car.
At home, don’t leave your key near any windows, doors, or exterior walls. When you do, anyone walking around your home at night can use the relay attack device to pick up the frequency from outside your home. Or, store your key in a Faraday sleeve. These tips will help prevent a car theft from your driveway.