Skip to content

WARNING Remote locking vulnerable to attack

Featured Replies

BE WARNED, KEEP YOUR KEY FOBS SECURE AND DON'T LEAVE ANY VALUABLE ITEMS IN THE CAR AT NIGHT.

Last night my car was entered and raided. Fortunately no damage was done and no valuables taken. I tidied the car up and was about to drive off when I saw 3 police people  coming down the road so I ran across to tell them. They were there because I was the 6th person in the street to report their car had been entered that night. Until they said that, I had assumed that I had left the car unlocked but I don't think 6 people would have left their cars unlocked. Later I met a friend who lives near by and she told me that there is a wave of thefts from cars in the area, all the cars undamaged. She told me that it is possible to buy a device on EBay that scans your key fob if is in range and allows the bad guy to unlock the car easily with no noise or damage. All the cars had been treated in the same way i.e. the car thoroughly searched and all the items not worth taking put in a tidy pile on the passenger seat, just like happened to my car.

The recommended precaution is to not leave the key fob  on the windowsill inside the front door, like I always did until today. Keep the fob as far as possible from the front of the house  and in a capped tin or wrapped in foil. I am worried though, my fob seems to be exceptionally powerful, it's got more range than my WiFi. 

I know from the other victims in the street that this vulnerability is not limited to Skoda but I am annoyed that these key fobs seem to have such easily-broken security.

Has anyone got any suggestions about how to improve security?

Disable Keyless locking. Its in the manual somewhere iirc. Most pointless invention ever.

Newer keys go to standby if they are not moved for certain time. The only way they scanned your key is when you were moving away from your car. 

I purchased a faraday pouch and ķeep the keys in that. They are quiet inexpensive. Bought on line.

57 minutes ago, xman said:

Disable Keyless locking. Its in the manual somewhere iirc. Most pointless invention ever.

It's a fine invention, just be mindful of it and if you keep your keys close to the car put them in a metal box at home, that's it. It's not like the car becomes impossible to enter without keyless entry, it still has a physical lock.

Relay theft is widespread and well publicised. As mentioned above it’s easy to disable KESSY when locking car. And you can get 2 faraday pouches to keep your keys in when at home for well under £10.

 

20 minutes ago, zetzet said:

It's a fine invention, just be mindful of it and if you keep your keys close to the car put them in a metal box at home, that's it. It's not like the car becomes impossible to enter without keyless entry, it still has a physical lock.

 

Saves pushing a button. How did I ever live without that?

 

Battery lasts 6 months instead of 15+ years.

 

Risks easy theft of car, nip to the shop, jump out and while waiting to pay the man, hey your car is gone! No, I forgot, jump out, pull my faraday pouch out, unzip it, put the key inside, zip back up, place on pocket. So much easier and quicker than pressing a button.

 

I wonder at what point insurance companies say that car was started with a key and so won't pay out.

12 minutes ago, xman said:

 

 

 

Risks easy theft of car, nip to the shop, jump out and while waiting to pay the man, hey your car is gone! No, I forgot, jump out, pull my faraday pouch out, unzip it, put the key inside, zip back up, place on pocket. So much easier and quicker than pressing a button.

 

If you press the lock button on the remote, then touch the KESSY lock indent on the door handle, KESSY is disabled. Easy enough to get into the habit of doing, especially when parking in a dubious area.

faraday pouch is one of the solution and i have it for long time , but thats nothing if u dont keep your keys in the boxes during the night . Its very easy to open the car .. so be smart , use faraday box for 2 keys 

 

https://www.youtube.com/watch?v=0AHSDy6AiV0   the system work identical today . 

 

 

Edited by bolix

Ok instead of just pressing one button, do a quick risk assessment of the area, if you are not happy then press the button on the remote then touch the KESSY lock indent, whatever that is. And what indication is given that my touch was successful?

 

Wonderful stuff, I wonder how many people know that or do that?

It's been a problem on fords for quite a while. I've seen a fair few people starting to use crooklocks on the steering wheel for the first time in about a decade. Most people I know who've got a new van have had deadlocks put on. 

32 minutes ago, xman said:

Ok instead of just pressing one button, do a quick risk assessment of the area, if you are not happy then press the button on the remote then touch the KESSY lock indent, whatever that is. And what indication is given that my touch was successful?

 

Wonderful stuff, I wonder how many people know that or do that?

 

Better option on the Mk4 is to just switch it off permanently via the infotainment. I'd switched it off before pulling away from the dealer on collection day. 

Or, with full KESSY tap the lock indent twice. Need to press the key button to unlock.

6 minutes ago, sneal said:

Or, with full KESSY tap the lock indent twice. Need to press the key button to unlock.

The Octavia must be different from previous versions/ models, as tapping the KESSY indent or pressing the remote lock button twice always disabled the deadlock and turned off the alarm interior monitoring.

Tell if this is correct , a tealeaf can enter your car unlocking using a gizmo but cant drive away?

 

Q2 ive always wanted to know this. I leave my car running and nip into a shop for one min with my key in pocket. ( Disclaimer here , i dont think the Octy will keep running when im out of range) 

A thief jumps in and drives away. Will the car just cut out , grind to a halt or will it keep running. Imagine if the car was taken on the motorway and the thief gets away at high speed with no key in the car

 

 

7 minutes ago, Greezy56 said:

Tell if this is correct , a tealeaf can enter your car unlocking using a gizmo but cant drive away?

 

Q2 ive always wanted to know this. I leave my car running and nip into a shop for one min with my key in pocket. ( Disclaimer here , i dont think the Octy will keep running when im out of range) 

A thief jumps in and drives away. Will the car just cut out , grind to a halt or will it keep running. Imagine if the car was taken on the motorway and the thief gets away at high speed with no key in the car

 

 

The car checks if the key is inside. Some cars can be stolen via canbus, but I think all new models aren't vulnerable to that.

As I understand with all keyless stop/start systems, not just keyless entry, that if the engine is still running, you can continue to drive until you physically stop the engine, (or maybe if stop/start switches off the engine when you pull up say at the traffic lights) so yes anyone can drive the car away, if they can get into the car and the engine has been left running.

 

However, leaving a car engine running while on a public highway, not in control of a seated driver is illegal and your insurance company would refuse a payout if your car was stolen in those circumstances

2 minutes ago, zetzet said:

The car checks if the key is inside. Some cars can be stolen via canbus, but I think all new models aren't vulnerable to that.

 

MK8 Golf is vulnerable to CAN bus, so by extension, so is MK4 Octy.

29 minutes ago, GiantKiwi said:

 

MK8 Golf is vulnerable to CAN bus, so by extension, so is MK4 Octy.

Are you sure? A lot of modules are locked with sfd, pretty sure the key programming would be one of those.

  • Author

Original poster, my car is not kessy, just remote open/lock control by remote fob buttons . There is no option to to turn it off. 

1 hour ago, xman said:

As I understand with all keyless stop/start systems, not just keyless entry, that if the engine is still running, you can continue to drive until you physically stop the engine

I can confirm that this applies with Jeep's keyless ignition.

59 minutes ago, SoupDragon said:

Original poster, my car is not kessy, just remote open/lock control by remote fob buttons . There is no option to to turn it off. 

Well then your car didn't get scanned. Why did you even start this thread? 🤣

13 hours ago, sneal said:

Or, with full KESSY tap the lock indent twice. Need to press the key button to unlock.

 

Sorry folks, I didn't get that quite right. Lock with the key then touch the sensor to deactivate KESSY temporarily.

 

 

KESSY.jpg

At least a good car thief might sort the Software Faults before moving the car on. So as long as they are not breaking it for parts and the car is recovered it might be better than when stolen.    Pity that the communications with the car is not great so unless an aftermarket tracker is fitted it can not be located. 

Edited by roottoot

Pretty much all vehicles can be opened, tweaked and driven away using non-destructive methods... Indeed, there are people who specialise in this sort of thing though many have a legitimate business employing such methods, mainly when you forget/lose your key.

What keeps the thieves away is how much of a pain in the backside the methods are, and how much money they'd lose by using destructive methods to acquire your motor.

A security measure may be a slight, mild or even moderate inconvenience (look at motorcycle chains, disclocks and the like), but it's probably far less of one than having to walk home in the piddling rain and freezing cold because someone easily nicked yer wheels...

 

Create an account or sign in to comment

Recently Browsing 0

  • No registered users viewing this page.

Important Information

Welcome to BRISKODA. Please note the following important links Terms of Use. We have a comprehensive Privacy Policy. We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

Account

Navigation

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.