Slashdot Mirror
Mobil SpeedPass, Various Car RFID Car Keys Cracked
44BSD writes "Crypto-enabled RFID products, including Mobil SpeedPass and various car keys, have been defeated utterly by Avi Rubin, et. al. Details are at rfidanalysis.org. An academic paper is also available."
Comment removed based on user account deletion
They apparently tested one of their devices at an actual Mobil station. Will the Ashcroft/Gonzales Army arrest these guys?
Pop the lock cylinder, insert screwdriver, turn, drive away.
Before the first time I had to do it, I could have sworn it was impossible to lose a key in 1" of fresh-fallen snow.
Why does the slashdot summary say the work was done by "Avi Rubin et.al." when Rubin was the 5th out of 6 authors on the paper? Why not say Steve Bono et. al., since he was the first author?
"The car keys aren't such a big deal, because you'd also need the key itself for the mechanical part of the lock." Not true, one of my cars has a function called "Keyless Go", just have a credit card type device on you and the car unlocks and starts at the press of a button. I am not sure if it using RFID though. No information on that. But it is using a similar technology for sure
So, 1 big screw-driver, 2 wooden shims, 1 coat-hanger wire and some cursing later, I can turn the engine off.
The quickest;
Always check for passenger door, back doors, a hatchback, trunk or sun-roof that are openI'm wondering.. when the RFID chips get a signal from the reader (eg: a mobil speedpass challenge/response), the speedpass obviously has to do some computation on the limited RF energy that its been given, and then return the answer.
I know vaguely how CPUs do these sort of calculations, but how do you HARD wire a system to do that on so little energy ?
Do the energy requirements go up w/ keysize ? The complexity of the circuits?
Do these things have some sort of static flash ROM ?
Seriously. Why would Mobil build and support an RFID system protected under a 40 bit key? I thought at the very least those speedpass systems had a 64 bit key.
I know that encryption isn't that important when true physical contact is involved (such as most credit cards, which have no encryption protection but are starting to get some with smartcards) but when it comes down to something that basicially broadcasts a credit card number, you would think that mobil would be a bit more concerned about it.
If I had a mobil speedpass I would be concerned, since a small device placed on top of a gas pump could easily passive eavesdrop on your speedpass and pass that information to would be criminals.
The car key, although just as disturbing, isn't as important to have a strong key since it would involve way too much work to basicially steal one car. To do it you would have to somehow read the signal from the key by bumping into the person leaving the car to active scan their rfid signal, (passive eavesdropping would not work well since it only sends the signal at startup when the person's going to be driving away) Decode it, and then use it to start the car once you bypass the physical key. It would be much easier and faster to steal a car without an immobilization system then to bypass it.
In Soviet Russia, Trojan exploits YOU!
The car does support multiple keys, so there must be a lookup table mapping physical keys to one time keys in there somewhere. So the car knows who last used the car last. It could make an interesting plot point in an episode of CSI.
Here's my question: Will this apply to toll road "speed passes" too? Does this mean that someone can charge up my account driving around all the tollways broadcasting my id? That could be a huge problem when we don't find that out until the bill arrives... and no verification to enter to make sure it's you (that would defeat the purpose of the speed pass). And a whole lot of time and money to go back and fix that system!
Chris
http://www.freeminimacs.com/?r=14620338
This is not how things typically work in my experience. In fact, it's not uncommon to have professional security audits done, and entire engineering teems know exactly what the problems are. After that, though, one of two things happens. Either somebody in marketing decides that good security practices are going to put customers off the product, or somebody in management decides they're going to look bad if the product is delayed and decides not to implement the security recommendations. When all is said and done, the product ships with crippled security.
It would hardly matter that SpeedPass type devices or RF car keys were cracked if you also needed a PIN to use them... But where's the convienience in that.
Actually, the Times story, which I wrote, came out at the same time as the RFID report from Hopkins was revealed.
"speaking only for myself since 1957"