Keyless entry car thieves

Among the new features you see in today's new car market, one of the most interesting ones is the fact you don’t have to use a key. Instead, your new car uses what’s known as a ‘passive keyless entry and start’ (PKES) device. It’s handy; if you hold down the unlock button all the windows drop, and you don’t need to even take the fob out of a pocket to open and start the car. How awesome is that?

Cars equipped with PKES periodically send out a low-powered signal, a sort of digital key that waits for a response from the key fob, called polling. The signal is broadcast about every 20 to 50 milliseconds, and if the fob responds with the correct response within a time limit, the doors will unlock. Sounds secure, right?

Not really. Criminals have worked out that they can take the periodic polling messages and retransmit them to wherever the fob is, and then sniff the response from the fob back to the car. The car will be none the wiser, so long as the response is within the expected timeframe.

2

These criminals have created a device that essentially amplifies the short one- to two-metre range signal that the car sends out to the key, while the signal the key sends back can travel hundreds of metres. If the key hears this amplified signal, it will transmit the open command, and the car will unlock.

The scariest part about this is that, since the criminals know that the owner can’t be more than a couple hundred metres away from the vehicle, it can now be opened as if the bad guys had the owner’s key fob.

Sure to make matters worse in coming years is the fact that you'll also be able to open your car using your mobile phone. Apps that allow you to program certain functions within your car are exploitable and this is something criminals are acutely aware of.

In 2011, a group of security researchers from the Switzerland-based ETH Zurich University examined the protection of 10 car models across eight manufacturers.

Surprisingly, they were not only able to gain entry into all 10 cars, but were also able to drive away with them, simply by intercepting and relaying signals from each car and their PKES.

Although it was also possible for the researchers to relay signals from the PKES back to the car, they often didn’t need to as the key’s signal can travel a few hundred metres. It also worked no matter what protocol or cryptology the manufacturer used.

The keyless entry movement is only getting more popular. Companies like Bosch are working on technology to ensure you'll never have to use a key again.

So what can you do to limit this risk? If you are really worried, you could always speak to the dealer about disabling keyless entry. Simply removing the batteries from the key fob also will render this form of attack useless. Utilising keyless entry systems that involve the physical press of a button allows for a bit of extra safety too.

When at home, it's advisable that you keep the keys away from the exterior of the house, and placing them in a sealed metal box might block some of the relay signal out.

Manufacturers develop software patches to fix these exploits as they become aware of them, and are starting to use proprietary ciphers – effectively their own set of electronic keys – in new models. However, as new technology develops, vulnerabilities continue to surface as cars age, and guides to the technology used to exploit vulnerabilities find their way online.

It’s just the start of a very large problem.

Crack of Doom

AS CARS become more connected, a group of concerned software programmers has called on new vehicles to carry a similar “cyber-security” rating to the ones they wear for fuel use and crash safety.

Last year, a pair of hackers at DefCom, the world’s most recognised cyber-security conference, showed how they could hack into a car’s systems and play around with its settings – although no one has yet done this remotely.

Vulnerable points of entry that researchers point to are Bluetooth phone connections, in-car wireless internet hubs, and features that integrate smartphones into the car’s dashboard.

Andrew Tadros is a proud Toyota 86 driver, and an IT security observer/enthusiast. If he's not breaking the Internet, he is on the track or back roads.

Sign up here to receive the latest round-up of Wheels news, reviews and video highlights straight to your inbox each week.