Its been a while since I read up on this issue in detail, but I thought I'd share some specifics as it does factor into some of the assumptions I'm seeing in the comments.

 

Firstly, exploiting this weakness doesn't require cloning fobs or decrypting anything - its actually a very simple attack that now known, requires zero technical knowledge and involves a cheap piece of easily acquired equipment.

 

In normal use, when you touch the handle, the car will send out a low frequency radio "ping". This only has the power to reach a short distance (say a metre), which is fine when the key is in your pocket. The fob receives the ping and responds by sending the unlock signal with its own, high frequency antenna. The car unlocks as intended.

 

The issue is that while the car's ping is only *intended* to be low range, there's nothing to ensure that's the case. A simple amplifier that's within range can receive the ping and amplify it out to a much longer range - enough to be picked up by your key inside the house. The problem then is that the fob's unlock signal isn't similarly constrained - its intended to be longer range to allow you to unlock your car from some distance using a button on the fob. The upshot is that by wandering up to a car holding a bag containing the small amplifier, a thief can simply touch the handle, the car's ping will be amplified sufficiently to reach your house, and if the fob is close enough for the car to receive the unlock signal, it'll open. No messing around, no fuss.

 

A misconception, and one that's perhaps particularly important on this forum, is that thieves aren't necessarily out to steal the car. Its a lot easier and lower risk simply to take belongings - they can be in and out in 10 seconds and no-one will be any the wiser, allowing them to go down a whole street easily enough. That may yield a lot less than stealing and selling a car, but doing so involves a whole lot more risk, as well as the necessary know how to sell it on, so if you're a small time thief which approach are you going to take? In that regard owning a less prestige car isn't going to keep you safe. Of course not leaving valuables in the car in the first place is a good idea, but that's not always possible.

 

Evidence of the wide spread use of this vulnerability had taken some time to build. Its very easy to put this down to the owner simply forgetting to lock their car, and its only by seeing the pattern that's emerged, combined with the proven vulnerability of these systems that we can see that such attacks are not uncommon - given how easy they are why would we expect otherwise.

 

The proper fix for this is for the system to more accurately measure the distance between the car and the key, rather than assuming its within the low range of the radio signal. They can do this by accurately measuring the time it takes for the fob to receive the signal from the car - as this is fixed based on the speed of light it provides a pretty fool proof way to know they're close. In the meantime turning off keyless entry entirely, or storing the key out of range or in a faraday bag is sensible.

 

I should add that NFC based contactless payment systems suffer from similar issues. Its true its not likely that anyone is going to deliberately try to spoof a payment as it would be pretty obvious with you standing there, but there are plenty of reports of payments going to cards that were way beyond the 2 inches its supposed to work to, again because radio waves are subject to anomalies in how they propagate based on numerous factors, and not only power levels.

 

Sorry for the long post, but thought some might find the details interesting.

Thanks for the info, much obliged, DC.

.......

 

Firstly, exploiting this weakness doesn't require cloning fobs or decrypting anything - its actually a very simple attack that now known, requires zero technical knowledge and involves a cheap piece of easily acquired equipment.

 

In normal use, when you touch the handle, the car will send out a low frequency radio "ping". This only has the power to reach a short distance (say a metre), which is fine when the key is in your pocket. The fob receives the ping and responds by sending the unlock signal with its own, high frequency antenna. The car unlocks as intended.

 

A misconception, and one that's perhaps particularly important on this forum, is that thieves aren't necessarily out to steal the car. Its a lot easier and lower risk simply to take belongings - they can be in and out in 10 seconds and no-one will be any the wiser, allowing them to go down a whole street easily enough. That may yield a lot less than stealing and selling a car, but doing so involves a whole lot more risk, as well as the necessary know how to sell it on, so if you're a small time thief which approach are you going to take? In that regard owning a less prestige car isn't going to keep you safe. Of course not leaving valuables in the car in the first place is a good idea, but that's not always possible.

 

-----

 

Thanks for that summary.

Over here, the thieves are out to steal cars. Recent experience in Ireland, is very much that they are. Two caches of cars have been uncovered by police in the last month.

Thefts are being done by well-organised gangs. All kinds of cars discovered - from M-Benz and Audi, to VW Golf, via Nissan Qashqai and Hyundai Tucson. Some high end stuff is being shipped out to eastern Europe and Africa, in containers, and lesser motors are being dismantled and the spares sold on. 

 

Someone mentioned about us having insurance on our cars - but frankly, I don't want the hassle.  I work in mental health sector and need my car to be outside the door, when I need it! Not that I'm working with emergencies, but certainly with vulnerable people. I just want to reduce the amount of things impinging on my getting to work in a timely way.  

 

http://www.independent.ie/irish-news/revealed-how-to-combat-car-thieves-latest-trick-34681875.html

 

http://www.breakingnews.ie/ireland/7-stolen-cars-recovered-in-operation-thor-752464.html

 

p.s. I'm guessing that was a typo at start of post - that you meant "low power radio ping" rather than low frequency. The frequency will be the same on both car and key. However, the power of the signal may differ though. So, the car emits a lower power signal than the key.  These thieves are then copying the car signal, and re-broadcasting it - in the hope that the key will be near enough to respond.

Edited 16 September, 20169 yr by Dithane

It is possible that the 'ping' from the car uses a lower frequency inductive loop type signal as these are usually much shorter ranged and the key needs to be much closer. An RF signal would travel more than the distance required. The system could even be coupling your body into the system via the door handle.

I haven't taken a key apart to see what aerial types are inside so cannot confirm my musings as fact. It should work though.

p.s. I'm guessing that was a typo at start of post - that you meant "low power radio ping" rather than low frequency. The frequency will be the same on both car and key. However, the power of the signal may differ though. So, the car emits a lower power signal than the key.  These thieves are then copying the car signal, and re-broadcasting it - in the hope that the key will be near enough to respond.

They do in fact use different frequencies. The car emits a low frequency signal in the region of 120 to 135 KHz - much like RFID uses. The fob then has a UHF transmitter (315 or 433 MHz) to give you the range to pop the boot or unlock it from range. I'm not sure that detail really helps us much, but it may be interesting for those so inclined, and I guess can help understand how certain mitigations might work.

I leave my keys hanging up in the utility room, if thieves want to steal my car they are welcome to it. I'd rather they just take it without having to resort to threatening me or my family with violence etc.

 

No matter what you do they will find a way round it.

I leave my keys hanging up in the utility room, if thieves want to steal my car they are welcome to it. I'd rather they just take it without having to resort to threatening me or my family with violence etc.

 

No matter what you do they will find a way round it.

 

Totally agree with the above. If they want it that badly they will take it.

I'd like to avoid Kessy.

 

Here's another Skoda options stupidity :

 

   I notice, only recently, that now you have to take Kessy if you want Canton as an option. Why ? Didn't used to. I doubt if it is an electrical reason, since you didn't before and I notice with other forced pairings, what you have take along with one option or another changes from time to time. Therefore it sounds like a croc to me, in this and probablt in many other cases too.

 

Four hundred quid on top of your six  - and worse security. How stupid.

This option bundling is really stupid. Regarding security, Kessy should be possible to disable it via coding - I will have to look into this.

But anyway, I would suggest the following (one or more at the same time):

- non-factory fitted car alarm

- stickers for car alarm (if non-factory car alarm is fitted, they MUST NOT be from that car alarm)

- hidden switch that prevents the engine to start

- mafia sticker on the car , though with Skoda I do not think that even the dumbest thieve would gor for that

 

And as already someone has mentioned: do not leave things in the car on visible places. Also DO NOT hide the things into the trunk after you have reached your destination. There could be thieves waiting and would see that you have packed your things into the trunk. So, I always prepare for my next destination. I leave inside the cabin only the things that I will take with me on the next location, everything else I pack into the trunk before I start.

 

And aynway, at least in Slovenia, Skodas are not really interesting for thieves. They are stolen mainly for parts and they are usually disassembled within hours.

Edited 25 September, 20169 yr by mtl