Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mobil SpeedPass, Various Car RFID Car Keys Cracked

Posted by ryuzaki0 on from the feeling-safe-yet dept.

44BSD writes "Crypto-enabled RFID products, including Mobil SpeedPass and various car keys, have been defeated utterly by Avi Rubin, et. al. Details are at rfidanalysis.org. An academic paper is also available."

155 of 240 comments (clear)

  1. CmdrTaco Cracked, Various Slashdot Editors Duped by Anonymous Coward · · Score: 4, Informative

    Car RFID Security System Cracked

    The best part of subscribing to Slashdot is watching CmdrTaco post multiple duplicates in a row, then giving up and posting a dupe anyway. Before this story, a dupe of the Super Bowl .com ads story was set to run. I had a ready made "Duper Bowl" joke, too.

    Hey Taco, when's the last time you read your own site? Oh wait, why am I asking, you'll never see this.

  2. Dupe... by daveschroeder · · Score: 3, Informative

    And the NY Times story from yesterday's slashdot story on this same crack by the same team.

    1. Re:Dupe... by drinkypoo · · Score: 1

      Well, they've never really been editors. I'd be perfectly happy if they'd just rename them to something else, because I think some of the dupe jokes are funny :)

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Dupe... by jswatz · · Score: 2, Interesting



      Actually, the Times story, which I wrote, came out at the same time as the RFID report from Hopkins was revealed.

      --
      "speaking only for myself since 1957"
  3. I'm defeated too by The+Ancients · · Score: 3, Funny
    ...and various car keys, have been defeated utterly by Avi Rubin

    Damn it. I feel so inferior. My car keys defeat me as soon as I put them down, and suddenly they're not there anymore.

    It's a conspiracy I tell you!

    --
    The Mothership
    1. Re:I'm defeated too by AndroidCat · · Score: 1

      How would Avi Rubin do against Godzilla then?

      --
      One line blog. I hear that they're called Twitters now.
  4. Well... by Anonymous Coward · · Score: 3, Insightful

    The car keys aren't such a big deal, because you'd also need the key itself for the mechanical part of the lock. The speedpass IS a big deal, because it's single-factor authentication, and people could go around charging gas to your account.

    1. Re:Well... by tomhudson · · Score: 2, Interesting
      The car keys aren't such a big deal, because you'd also need the key itself for the mechanical part of the lock.
      Nope, I've started cars and trucks with nothing more than a big screwdriver and some pounding.

      Pop the lock cylinder, insert screwdriver, turn, drive away.

      Before the first time I had to do it, I could have sworn it was impossible to lose a key in 1" of fresh-fallen snow.

    2. Re:Well... by eln · · Score: 1

      Actually, with cars such as the new Toyota Prius, you can open the doors and start the car (the ignition is just a button on the dashboard) if the car detects that the fob is near or in the car. There is no mechanical action involved.

    3. Re:Well... by tomhudson · · Score: 2, Interesting
      The hardest one I ever cracked was a Chevy Astro (the doors are thick, solid, etc.,, there's an anti-slim-jim plate in the door).

      Me: Where's the van.
      Bubba: Parked outside.
      Me: You locked it okay>
      Bubba: Yep.
      Me: Okay, where are the keys.
      Bubba: Umm ... in the van?
      Me: WTF?
      Keys in van, van running, close to quitting time, and getting dark fast.

      So, 1 big screw-driver, 2 wooden shims, 1 coat-hanger wire and some cursing later, I can turn the engine off.

      The quickest;

      Co-worker:I've locked my keys in the car. Can you break into it without scratching the paint?
      Me: Okay, give me a few minutes
      ... less than a minute later ...
      Me: Here's your keys
      Co-worker: How did you do it so fast
      Me: Your back doors were unlocked.
      Always check for passenger door, back doors, a hatchback, trunk or sun-roof that are open ...
    4. Re:Well... by Nogami_Saeko · · Score: 1

      I recall reading somewhere that the Prius uses a stronger form of the key (64 bit?). Unfortunately I can't for the life of me find the webpage I saw it on...

      Oh well, I have almost no concern my Prius will get stolen. Possibly broken-into (though I'm careful to never leave anything visible inside it), but not stolen.

      N.

      --
      "Nothing strengthens authority so much as silence." - Charles de Gaulle
    5. Re:Well... by nolife · · Score: 1

      The concept of these RFID keys is you still need the actual key regardless how you get the ignition switch to move. If the sensor does not sense the id of your key, it will not start. On cars such as this, many aftermarket remote starters require a second key with some wire wrapped around them to allow the car to start. I'm sure people have figured a way around that authentication also but it takes more then a large flat head screwdriver and a slide hammer.
      Of course this discussion has nothing to do with the SpeedPass ;)

      --
      Bad boys rape our young girls but Violet gives willingly.
    6. Re:Well... by ProppaT · · Score: 1

      This definately affects Saab's. The "key" isn't even really a "key" in the common meaning of the word. There's no teeth to the key. Just a transmitter that fits into a hole. Stick it in, turn, and the car starts. I'm assuming that I could do the same thing with my finger if something was transmitting the right code.

      --
      Wise men say, "Forgiveness is divine, but never pay full price for late pizza."
    7. Re:Well... by drseuss9311 · · Score: 1

      If you are the owner of one of these saab "keys" then I would like to inform you that your transmitter does have a key to it. It is inside the transmitter. Pull the top off and inside is a laser cut key to open the door if your battery in your transmitter dies.

      Think people.

      --
      ------ no thanks... I've quit
    8. Re:Well... by xgamer04 · · Score: 1

      Hmm, so the cars you've done this in have the same RFID security system that was mentioned in that article?

      --
      When you look at the state of the world, how can you not become a radical, liberal anarchist?
    9. Re:Well... by Glonoinha · · Score: 1

      I'm always amazed at how much faith people put in '64 bit' security. You realize that 64bit is a whopping 8 bytes (characters) don't you?

      If 64 bit is the 'stronger' version of the encryption I'm surprised that the regular version lasted as long as it did. Given a sufficent sample size and enough caffeine in my system I can occasionally crack 16 bit encryption in my head (using simple heuristic pattern matching; and it helps to know what I'm looking for.)

      --
      Glonoinha the MebiByte Slayer
    10. Re:Well... by a55mnky · · Score: 1

      Deciphering encrypted language/words is much easier than pulling the raw key from a crypto system - you can use statistical anlysis and heuristics to do so. The fact is most results using the incorrect key look wrong and can be discounted.

      In the case of these types of systems any key looks as correct as any other key.

      Additionally, a 64 bit key provides 2^48 more possible keys than a 16 bit system (a 16 bit system has 65,536 keys and a 64 bit system has 18,446,744,073,709,551,616 keys).

      --
      Where oh where has my Underdog gone?
    11. Re:Well... by Breakfast+Pants · · Score: 1

      You do realize that each bit doubles the amount of possibilities? Being able to crack 16 bit encryption in your head I would hope you do. 64 bit might not be sufficient for a lot of things, but it's not just "64/16"% stronger than 16 bit encryption; the fraction you are looking for is more like "(2^64)/(2^16)".

      --

      --

      WHO ATE MY BREAKFAST PANTS?
    12. Re:Well... by tomhudson · · Score: 1
      For those (I've been told , wink wink nudge nudge) a laptop running a DOS-baed program will work fine to do reprogramming, as well as roll back the digital mileage counter, etc (btw - a lot of auto importers/exporters have *that* program, so they can *cough cough* just make the switch between kilometers and miles ...

      ... and never believe the mileage on a used vehicle without first checking for wear and tear that doesn't match what you're looking at. And NEVER look at a car at night. You might miss some of the less obvious bodywork. Pay an old cynic a hundred bucks to eyeball it first.

    13. Re:Well... by grolschie · · Score: 1

      I am told that in the old days that a dinner fork was the tool of choice. Bend the two outside prongs away, and insert middle two prongs into the lock. Bingo, free car. Still works I guess, unless of course they have dual immobilizers (or a single one for that matter).

    14. Re:Well... by tomhudson · · Score: 1

      It's always easiest to just do a key swap (social engineering, same as shoulder sniffing for passwords) when you want to grab a car with an immobilizer, and don't want to take any time to futz around w. the door lock, etc.

    15. Re:Well... by ProppaT · · Score: 1

      Yes, this key lets you open the door. This key does not let you start the ignition. Thank you.

      --
      Wise men say, "Forgiveness is divine, but never pay full price for late pizza."
    16. Re:Well... by drseuss9311 · · Score: 1

      I did not imply that the key started the car. I just was informing that there is a key.
      Your Welcome.

      --
      ------ no thanks... I've quit
    17. Re:Well... by ProppaT · · Score: 1

      "Just a transmitter that fits into a hole. Stick it in, turn, and the car starts."
      Sounds like I implied it to me....

      --
      Wise men say, "Forgiveness is divine, but never pay full price for late pizza."
    18. Re:Well... by drseuss9311 · · Score: 1

      Sure. But the whole sticking it in and turning it is so... 20th century.

      My next car will start at the push of a button only when my keychain with my transmitter on it is within the vehicle.

      and it will have the voice of kitt from that tv show...

      you know the one i'm talking about.

      --
      ------ no thanks... I've quit
    19. Re:Well... by grolschie · · Score: 1

      What a great photo Tom. Captured the moment very well.

    20. Re:Well... by tomhudson · · Score: 1
      Considering that it was done just after he had his last drink of water (and slobbering all over, like always), and that I didn't have a chance to clean him up, because the vet had just called and moved up the time so that we had to leave *NOW*, ...

      Thanks. He's gone but not forgotten.

  5. Great use for RFID by lildogie · · Score: 2, Funny

    Maybe some form of RFID can help the editors avoid these duplicate articles.

    1. Re:Great use for RFID by jnelson4765 · · Score: 1

      Or RTFA...

      --
      Why can't I mod "-1 Idiot"?
  6. Sad. by WindBourne · · Score: 2, Insightful

    These companies take a bunch of average coders and then ask them to create a secure program/toy/whatever. They almost certainly do not get true expert help. Then lo and behold, it gets cracked. And I am willing to bet that top ppl are surprised.

    --
    I prefer the "u" in honour as it seems to be missing these days.
    1. Re:Sad. by Vellmont · · Score: 1


      And I am willing to bet that top ppl are surprised.

      I'm willing to bet they aren't. The system only has a very limited key length (40 bits) and anyone with half a lick of knowledge knows that a 40 bit key is vulnerable to offline brute force cracking.

      My guess is they knew the system could be pretty esily cracked, but combined with the very short range of RFID (I believe the researchers captured the key data on the order of several inches) it wasn't considered a major vulnerability.

      --
      AccountKiller
    2. Re:Sad. by JPriest · · Score: 1

      The sadder fact is that most companies like this employ hundreds of people that barely have a clue and only a few shining stars pretty much lead the way on new projects. A good engineer is worth 6 bad ones, sometimes they even make another $2/hour.

      --
      Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
    3. Re:Sad. by tomhudson · · Score: 3, Insightful
      The real reason is because anyone with brains will ask "What's wrong with the current system?"

      Speedpasses are not there for the benefit of the consumer, any more than the uscan at the supermarket.

      There's a debatable benefit for the key bugs for your car ignition - debatable because anyone can still steal/strip your car, and it gives people a false sense of security, as well as adding another layer to "what can go wrong now"...

      Speaking of which - Pontiac anti-theft radios. Leave your headlights on overnight, and you can't get a jump-start, because you have to re-code the radio first. Try that at -30 (and no, it wasn't me).

    4. Re:Sad. by ivan256 · · Score: 2, Interesting

      This is not how things typically work in my experience. In fact, it's not uncommon to have professional security audits done, and entire engineering teems know exactly what the problems are. After that, though, one of two things happens. Either somebody in marketing decides that good security practices are going to put customers off the product, or somebody in management decides they're going to look bad if the product is delayed and decides not to implement the security recommendations. When all is said and done, the product ships with crippled security.

      It would hardly matter that SpeedPass type devices or RF car keys were cracked if you also needed a PIN to use them... But where's the convienience in that.

    5. Re:Sad. by ScentCone · · Score: 1

      Speedpasses are not there for the benefit of the consumer, any more than the uscan at the supermarket.

      I'm sure you do much prefer standing in line at a cashier's counter behind the guy who's digging through is pocket for the extra twelve cents he needs to pay for the gas he just bought. Or, waiting, while the cashier swipes your card, prints the receipt, digs for a pen that three people with Sars have handled that day... I like the SpeedPass because it actually does save me time during my commutes and refueling. It cuts down on how long it takes people to cycle through the gas stations, cuts down on people idling their cars in line, wastes less receipt paper, and so on. You can probably even use one to by yourself an anti-corporate tinfoil hat!

      Surely you don't think that the SpeedPass introduces some sort of per-account scrutiny that using a credit or debit card didn't already? Or, would recognizing that out loud take some of the steam out of your anti-merchant tone?

      Oh: and the key bugs absolutely do cut down on car theft. Most hack jobs don't take place in place, but involve cars that are rapidly driven off to a chop shop where they're turned into parts. Sure, some cars are stripped in place, but those are the minority, and have more to do with parking in bad places that anything else.

      --
      Don't disappoint your bird dog. Go to the range.
    6. Re:Sad. by Igmuth · · Score: 1

      Just to clarify here, you are saying that the radio prevents the car from being jump-started, as an anti theft mechinism?

    7. Re:Sad. by plover · · Score: 2, Insightful
      The grandparent poster is correct, though, in that SpeedPass wasn't first designed to make your life easier: that's a byproduct of how the system works. I believe SpeedPass was first designed as a replacement for insecure, easy-to-forge credit cards. But being different, it turned into a marketing tool; something that made Mobil "more cool" than Amoco. Finally, speeding up the transaction at the pumps didn't hurt them any. But it really doesn't gain them any financial benefit except in terms of marketing.

      Replacing the existing mag stripe system is very important. Credit card theft losses today involve absolutely staggering amounts. Forging credit cards is almost child's play (or it would be if I were a child :-) There are professional crime rings that collect mag swipe data from dishonest restaurant employees, for example. And gas pumps are the perfect victim for forged cards. With no human to validate the little foil dove on the Visa card, any chunk of plastic with a mag stripe will do the trick.

      RFID was sold to Mobil as "difficult to forge." (Actually, it was probably sold as "impossible to forge", but that's sales lingo.) This is just the first public demonstration of a counter example.

      By the way, regarding time spent in lines: given a choice at Home Depot, I evaluate the lines this way: my first choice is self-checkout ONLY if no one's ahead of me; second choice, a cashier who knows what they're doing; and my dead-last choice is self-checkout waiting behind four idiots who collectively can't figure out how to put their barcodes under the lasers.

      --
      John
    8. Re:Sad. by dnoyeb · · Score: 1

      If you had read the article you would know that nothing has been cracked. And certainly not utterly...

      They just brute forced it. Thats not called cracking. Windows has numbers you can enter to authorize it. We don't call it cracked when you 'brute force' your way into ONE of those numbers, we call it cracked when you can generate them at will.

    9. Re:Sad. by tomhudson · · Score: 1
      Not quite; what I'm saying is that when teh battery is dead the radio "forgets" it's previous state (authorized) and defaults to "don't start the car". This is to prevent people from tricking the system by disconnecting the battery for a few seconds.

      So if your battery goes dead, you can't jump-start the car. You have to charge up the battery, then call the dealer and enter a code through the radio fron panel (or connect a radio whose code you already have, and enter THAT radio's code).

    10. Re:Sad. by LordKronos · · Score: 1

      I've never heard of that, but I just did some searching and indeed its true...at least for older models, around 2000 or so...I couldn't confirm exact numbers. But they seem to have fixed it in new years. Now it has the VIN# encoded into the radio, and if the radio's VIN doesn't match the cars computer's VIN, it shuts down the radio. Loss of power doesn't cause a problem any more.

      Thanks for your post...it was interesting to learn about this.

    11. Re:Sad. by ArtStone · · Score: 1

      How naive.

      Which way does a car company make more money - if their cars are stolen and wind up chopped into bits or if they are unstealable?

      Here's a hint - who pays the insurance premium to pay to replace a car that is stolen?

      The opposite argument of course would be that they -want- the cars to be hard to steal so there are no chop shop parts from stolen cars, and repairs to cars have -only- the manufacturer as a replacement parts supplier.

      --
      Final 2006 "Proof of Global Warming" US Hurricane Count -> 0
    12. Re:Sad. by tomhudson · · Score: 1
      Thanks for letting me know it's not a problem in newer models :-)

      (Damn 20-second rule inhibits posting a simple thank-you note - they should fix that, or at least realize that some of us are touch-typists)

  7. Comment removed by account_deleted · · Score: 2, Interesting

    Comment removed based on user account deletion

  8. Illegal under DMCA? by Anonymous Coward · · Score: 3, Interesting

    They apparently tested one of their devices at an actual Mobil station. Will the Ashcroft/Gonzales Army arrest these guys?

    1. Re:Illegal under DMCA? by tftp · · Score: 1

      Not if they duplicated one of their own keys.

    2. Re:Illegal under DMCA? by philbowman · · Score: 1

      Mod parent Naive :-)

      --
      Phil
  9. Just a matter of time by bird603568 · · Score: 1

    Ive said it would happen, thats why I don't ahve one. What's also a matter of time is the cars that have the remote start, so you could be in your house on a snowy day and turn your car on so when you get to it its aready heated up. I'm reallysupprised that they haven't been cracked by car theifs.

  10. Bye-Bye Karma by rel4x · · Score: 5, Insightful

    I'm probably going to get modded into oblivion for saying this.... But why don't people just not read dupes? I mean, it's not really hurting you that it's there...and some of us didn't see the first one, but see the second one. It just doesn't seem worth complaining over.

    --

    Before you mod me funny, think, perhaps I was insightfully funny?
    1. Re:Bye-Bye Karma by aardvarko · · Score: 1

      Because it's indicative of systematic neglect on the part of Slashdot's self-declared editors?

    2. Re:Bye-Bye Karma by rel4x · · Score: 1

      Because they don't know EVERY article on Slashdot? I'm sorry, I was under the illusion these guys ate and slept as well. And I would hardly call it systematic. I don't mean to troll or anything, but really, who's it hurting?

      --

      Before you mod me funny, think, perhaps I was insightfully funny?
    3. Re:Bye-Bye Karma by Dun+Malg · · Score: 1
      I'm probably going to get modded into oblivion for saying this.... But why don't people just not read dupes? I mean, it's not really hurting you that it's there...and some of us didn't see the first one, but see the second one. It just doesn't seem worth complaining over.

      Part of outrage is that it makes it clear that the editors don't bother to read the very "new accumulator" the work on. I sometimes miss a day or two worth of articles, but it's not my job-- they're paid to be editors. They're the only ones who absolutely should be reading slashdot at work every day, and apparently they're not even doing that.

      --
      If a job's not worth doing, it's not worth doing right.
    4. Re:Bye-Bye Karma by realdpk · · Score: 1

      There's a very limited number of articles posted in a day. I've had articles rejected, where a dupe of some old article gets posted instead. Not that I'm suggesting what I have to say is interesting, exactly, but I'm sure others have had the same thing happen, others who *are* interesting. :)

    5. Re:Bye-Bye Karma by 1u3hr · · Score: 1
      ecause they don't know EVERY article on Slashdot?

      They have computers. Plug "RFID" into Slashdot's search and you find recent articles, including the dupe, at #3. And as for why it's annoying: this is not a hobby site, these guys earn big bucks and sell lots of advertising, and they're paid to be "editors". Being one, I know I would have been fired long ago if I fucked up as often as these guys. But they have no oversight, except us; we can't fire them but can hope to embarrass them a bit in the faint hope they might take their job seriously.

    6. Re:Bye-Bye Karma by S.O.B. · · Score: 1

      I don't read every article but I do scan the summaries and even I could tell this was a dupe. It takes all of about 5-10 minutes a day to scan the summaries. Plenty of time left to eat and sleep.

      --
      Some of what I say is fact, some is conjecture, the rest I'm just blowing out my ass...you guess.
    7. Re:Bye-Bye Karma by theLOUDroom · · Score: 1
      I'm probably going to get modded into oblivion for saying this.... But why don't people just not read dupes?

      That would imply that they read the articles in the first place.

      I mean, it's not really hurting you that it's there...and some of us didn't see the first one, but see the second one. It just doesn't seem worth complaining over.

      What sucks is that it:
      1. Wastes people's time
      2. Hurts slashdot's credibility
      3. Between the constant misspellings and duplicate articles, it hurts slashdot finanacially because some people (like me) are a lot less likely to subscribe. If this was just a small venture being run out of somebody's basement, I certainly wouldn't say anything, but for a publicly-traded company I think it hurts their image.


      Don't get me wrong, I think slashdot, sourcefourge, etc are all great things, but it hurts to see your friend hitting himself repeatedly with a brick. You want him to stop, so you say "Hey! Stop that!"
      It's not that I'm anti-slashdot, I'm just anti-slashdot hitting itself in the face with a brick. It makes you ugly and unattractive to newcomers.
      --
      Life is too short to proofread.
    8. Re:Bye-Bye Karma by limekiller4 · · Score: 1

      rel4x writes:
      "I'm probably going to get modded into oblivion for saying this.... But why don't people just not read dupes? I mean, it's not really hurting you that it's there...and some of us didn't see the first one, but see the second one. It just doesn't seem worth complaining over. "

      I don't subscribe, so this is just a guess, but dupes count against your account. IIRC, you get n number of premium posts for x number of dollars and so dupes are useless posts you get charged for.

      Again, that's just a guess.

      --
      My .02,
      Limekiller
    9. Re:Bye-Bye Karma by stoborrobots · · Score: 1

      Between the constant misspellings and duplicate articles, it hurts slashdot... ...
      --
      Life is too short to proofread.

      Irony (n): Signing off with a sig which is in direct contrast to your main argument...

      --
      "Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco
    10. Re:Bye-Bye Karma by yarbo · · Score: 1

      If you just check the 'Post Anonymously' box, they still know who posted...

  11. Coral cache link to article by user9918277462 · · Score: 1

    Preemptive anti-slashdotting. There's a bunch of large movie files linked to from the article. Use the mirrors or the coral-ed links.

    http://rfidanalysis.org.nyud.net:8090/

  12. First author by sunhou · · Score: 2, Interesting

    Why does the slashdot summary say the work was done by "Avi Rubin et.al." when Rubin was the 5th out of 6 authors on the paper? Why not say Steve Bono et. al., since he was the first author?

    1. Re:First author by 1shooter · · Score: 1

      Because he, Rubin, is the team leader. The author list is in alphabetical order. RTFA

      --
      6F 9E A9 1E 96 9F 74 27 ED B8 81 6D 0C 4E 1E 78
      My other Sig is a 229.
    2. Re:First author by sunhou · · Score: 1

      You don't know much about academic publishing. Academics routinely ignore the author order to refer to the senior person in the lab/institute, or to give a favourite author more credit.

      I've published 6 journal articles and a couple of book chapters, in fields ranging from mathematical biology to physics to philosophy, so I know enough to get by.

      Refer to them in what context? When publishing a paper in a journal, when you reference another paper with 3 or more authors, you cite it as "Foo et al" where Foo is the first author of that paper. You don't get to choose which author you want to list.

      I suppose when talking at a conference, or just posting stuff on a web page, you could refer to other peoples' work however you like. But if you don't list the first author's name first, it makes it hard for other people to find the paper you're referring to. (Although in this case their paper isn't published yet anyway.)

      If Rubin was really the team leader, he should have been first author. Maybe Rubin is head of the lab this project was done in, but presumably he wasn't head of this particular project. After skimming through the web site and paper, I didn't see anything indicating why Rubin's name was the one chosen for the slashdot summary, so I was just curious.

    3. Re:First author by agurkan · · Score: 1
      The list is not in alphabetical order, even if it was, the proper way to refer to an acedemic work is First Author et al. or so-and-so collaboration. Being team leader may not mean much either. He may be writing the grant proposals and the students may be doing the actual work.

      RTFA carefully, eh?

      --
      ato
  13. DON'T NEED A CAR KEY by Pipermalibu · · Score: 2, Interesting

    "The car keys aren't such a big deal, because you'd also need the key itself for the mechanical part of the lock." Not true, one of my cars has a function called "Keyless Go", just have a credit card type device on you and the car unlocks and starts at the press of a button. I am not sure if it using RFID though. No information on that. But it is using a similar technology for sure

    1. Re:DON'T NEED A CAR KEY by MicklePickle · · Score: 1

      I used to have a car that didn't need a car key either. You just walked up to it, opened the door, (locks were busted), turned the ignition, (ignition lock was busted), and away you went. Wonderful!
      It was even pinched one day. The little bugger jimmied open the door, (didn't need to, just open it - duh), and hot-wired it, (didn't need to do that either - duh).
      Found it a couple of suburbs away and drove it back home.

      --
      -- main(s){printf(s="main(s){printf(s=%c%s%c,34,s,34) ;}",34,s,34);} $p='$p=%c%s%
  14. Mercedes electronic keys - a good design by EMIce · · Score: 5, Informative

    The electronic keys from Mercedes are a good example of this done right. The key has an IR transceiver at it's head that exchanges one time codes with the car when the driver begins turning it. The received code is saved for next time and can't be intercepted without getting physically between the head of the key and the transceiver inside the lock. Even then, an intercepted code would have to be used before the victim returned to his car. Who is going to do a complicated install of capture equipment into a fortified lock at location A and then follow the victim to location B to steal the car? It's just far too conspicuous.

    Mercedes overhauled security, rather than tacking on a secure by being obscure layer to the existing crackable standard - TI Immobilizer systems don't require advanced physical access, just proximity to the key at least an hour before the moment of a heist. Even worse, once the key is cracked it won't change either, so criminals can wait to strike and further avoid notice. Just wait till a tiny RFID scanner and a usable cracking program show up in the black market. A laid off engineer has too much potential to make dough with the ideas that have been released. The program could even do distributed processing on a broadcast LAN or via P2P.

    Now someone is probably going to point out that they'll be laughing when the fancy Mercedes key runs out of batteries and leaves its owner stranded, but this isn't the case. The key can receive power from the car despite not having any visible metal contacts - likely because there is a coil embedded in the plastic key that will get power inductively when the key is inserted - without any wires [slashdot.org]. It's news on slashdot, but it's been shipping since 1997, and much longer before that for other applications.

    As if that weren't it, the key doubles as an RF remote for locking/unlocking doors, popping the trunk, and a panic function. But wait there's more - the IR transciever portion of the key, when aimed at the driver door can open, close, or place anywhere in between all the side windows and sunroof at once. Great for getting into the car on a hot day or sealing up all the windows as you leave. Impressive what they they've put usably into a key, albeit oversized.

    Finally, despite using a radically different model, Mercedes cleverly applied the familiar form and usage pattern of the existing standard to bridge it with the new one - a nice touch for user comfort without any compromise to security. Well engineered indeed.

    1. Re:Mercedes electronic keys - a good design by just+someone · · Score: 1
      The electronic keys from Mercedes are a good example of this done right. The key has an IR transceiver at it's head that exchanges one time codes with the car when the driver begins turning it. The received code is saved for next time....
      confused? info is save for next time. What happens when a different key is user.
      aka What happens when person A uses car with key A, then person B uses car with Key B, is person B locked out?
    2. Re:Mercedes electronic keys - a good design by Scoria · · Score: 1

      Impressive what they they've put usably into a key, albeit oversized.

      I completely agree with everything you've written here. Their IR keys are an enormous convenience. If the batteries fail, the door locks can also be manually actuated. There is a traditional blade embedded within the key that probably contributes significantly to the "excessive size."

      --
      Do you like German cars?
    3. Re:Mercedes electronic keys - a good design by EMIce · · Score: 2, Interesting

      The car does support multiple keys, so there must be a lookup table mapping physical keys to one time keys in there somewhere. So the car knows who last used the car last. It could make an interesting plot point in an episode of CSI.

    4. Re:Mercedes electronic keys - a good design by sg3000 · · Score: 1

      > Now someone is probably going to point out that they'll be
      > laughing when the fancy Mercedes key runs out of batteries
      > and leaves its owner stranded, but this isn't the case.

      No, they'll be laughing when the said Mercedes' security system malfunctions and the car doors continuously unlock despite the fact that the owner locked them less than two minutes before. Then the alarm goes off repeatedly. And the Tele Aid system calls the Mercedes call center who then calls the owner to ask if anything's wrong.

      It's hilarious when it happens for hours even after you waste your morning to drop the thing off at the dealer so they can figure out what's wrong. And you get real-time updates on how the repair is progressing, because you're still getting calls from the Mercedes call center because the alarm is still going off.

      This happened to me years ago when I bought my first (and last) Mercedes, a brand new 2001 SLK320 (one of the cheaper models, but still a lot of money). The damn things are so overengineered, but they have the worst quality. So when something goes wrong, it manifests itself in a bizarre fashion and the dealer can't figure out how to fix it.

      --
      Insert simplistic political, ideological, or personal proselytization here.
    5. Re:Mercedes electronic keys - a good design by BiteMyShinyMetalAss · · Score: 1

      But wait there's more - the IR transciever portion of the key, when aimed at the driver door can open, close, or place anywhere in between all the side windows and sunroof at once. Great for getting into the car on a hot day or sealing up all the windows as you leave. Impressive what they they've put usably into a key, albeit oversized.

      Great for those 'learning' remote controllers for TVs, too. As I recall from a past issue of 2600, all that needs to happen for someone to gain access to the interior of the car is to use a learning remote to learn the IR signal. Assign the IR signal to a button (say, volume up) and the car can be unlocked with a $9.95 tool.

      They surely use more than one RF code for the ignition interlock. Here's hoping that they use more than one for the unlocking of doors. :)

    6. Re:Mercedes electronic keys - a good design by drinkypoo · · Score: 1
      Well, from what I hear, your mistake was buying a new Mercedes. I'm about to buy an '81 300SD, a 3 liter 5-cylinder turbo diesel that by many accounts is Mercedes' finest car ever. It has an excellent engine that is reputed to run on basically anything (for example it's known to run on vegetable oil without conversion beyond a heater to keep it flowing and a filter if it's dirty) and it has all the usual appointments, power everything, yada yada. Then, you just have to accept that you're going to spend 700 to 800 dollars on it every couple of years to keep it in tip-top shape :) But, I'm getting the car for $2500 so the initial investment is low and the car is basically ideal. It's the year when Mercedes became "modern" looking, which is to say they dropped fins and went to square headlights. You can get them in essentially perfect condition for $5,000 and KBB thinks that they're worth about $8,000. Insurance should be reasonable, and 25mpg on the freeway is standard.

      A new car is always too expensive. MB sells a name as much as anything else, and thus they are more excessively expensive than other vehicles. However, if you buy the proper models, they have made some really extremely excellent vehicles. They are all pretty old but they are all so well-engineered that the only way you can tell they're old besides styling is that they're actually solid. The cars are also very well boxed, so they are VERY rigid, which is always a huge plus. It keeps the interior from destroying itself and keeps the suspension geometry accurate.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    7. Re:Mercedes electronic keys - a good design by tftp · · Score: 1

      As the GP indicated, learning of the code is of no use because the code changes all the time. As I understand, the shared secrets are in the car and in the key, and they are never transmitted at all.

    8. Re:Mercedes electronic keys - a good design by __aaahtg7394 · · Score: 1
      So when something goes wrong, it manifests itself in a bizarre fashion and the dealer can't figure out how to fix it.

      And they apparently lack the common sense to pull the battery while disabling the stupid thing. Gotta love under-qualified technicians working on your expensive stuff.

  15. The Ultimate by BossMC · · Score: 1

    I think I just found the most advanced, compact, yet inexpensive automotive security system ever. I managed to get a photo, which is here.

    1. Re:The Ultimate by enosys · · Score: 1

      Do you realize that your security system has now been compromised? Someone just has to look at the picture and make a key like that.

    2. Re:The Ultimate by BossMC · · Score: 1

      Haha, no I didn't think of that. However, if you saw the car that it goes to, you would see that it could probably be broken into with a spoon. It's a ragtop, so if you know how to undo a button, you're in. However, once you're in, you'll find that the battery is disconnected, and you can't pop the hood to reconnect it (in decent time) because it's a reverse-opening hood.

  16. The most interesting thing about this work... by cpeikert · · Score: 4, Informative

    ... is that they reverse-engineered the design of the cipher using just black-box access!

    Reverse-engineering can be easy enough when you have some assembly code or a piece of hardware, but these guys figured out the internals just by looking at input/output pairs. (OK, they had a rough description of the design, but it was lacking almost all details and was even inaccurate in places.)

    That's really clever -- and really underscores the idea that "security through obscurity" tends to fail terribly. (TI probably thought that the use of a proprietary cipher provided a lot of security, so they didn't worry so much about key length. Foolish, but common, reasoning.)

    1. Re:The most interesting thing about this work... by acidblood · · Score: 1

      However, it is sad that they didn't publish full details of the cipher. This goes against full disclosure principles.

      I can already hear screams of `what do you want the cipher for? Are you going to steal cars and get free gas?' No. But using this excuse, researchers can prevent me and others from implementing a faster attack, or even finding an attack of smaller complexity -- this is a Feistel cipher, so it shares some structure with DES and thus some similar attacks (linear, differential cryptanalysis) might apply.

      They're basically monopolizing their right to do research on this device. Sure, it's their call, particularly as they put a lot of work into it, but it's not exactly following established principles of academia.

      And for God's sake, don't try to disguise this information-hiding attitude as a theft prevention device -- the amount of published details is just enough for a blackhat with a modest amount of resources to produce another working implementation, but probably no one else is going to bother. Cars will be stolen anyway, but researchers will be unable to do their job.

      --

      Join the NFSNET. Our prime goal is making little numbers out of big ones. http://www.nfsnet.org/

    2. Re:The most interesting thing about this work... by cpeikert · · Score: 1

      But using this excuse, researchers can prevent me and others from implementing a faster attack, or even finding an attack of smaller complexity -- this is a Feistel cipher, so it shares some structure with DES and thus some similar attacks (linear, differential cryptanalysis) might apply.

      And you're right to say so -- in fact, the paper mentions that the cipher may have some structural weaknesses, so it's legitimate to want to know the details.

      My guess is that if you asked the authors for the full spec, you'd get it. I don't know whether that's sufficient to satisfy those "established principles of academia" or not.

  17. Imagine a Beowulf cluster of... by loonicks · · Score: 1

    oh wait, they already did it.

  18. Re:Dude stop this. by bmetz · · Score: 1

    If you think he doesn't read his own site, what makes you think he reads the comics?

    --
    What did you eat today? http://www.atetoday.com/
  19. Tinfoil by Anonymous Coward · · Score: 3, Funny

    The best line of the story: keep your keys wrapped in tinfoil just to be safe. First there were tinfoil hats - now tinfoil wrapped keys! Where will this madness end?

  20. Off-Topic: Redundant by buckhead_buddy · · Score: 1

    I think it's only after someone's witty, well-thought posting get's moderated redundant that people get the bug up their nether region about redundancies of the "editors".

    It also goads future postings into becoming poorly-edited, formulaic, nonsense as long as it can be posted quickly.

    Quod erat demonstrandum ;-)

  21. Mobil by HarveyBirdman · · Score: 3, Informative

    I think Mobil anticipated this. They started requiring you to enter your ZIP code at the pump a few months back.

    --
    --- Ban humanity.
    1. Re:Mobil by anakin876 · · Score: 1

      that may be more credit card related than anything else. When the Credit Card fraud got too high at a local shell they had to disable the credit card readers until they could implement readers that asked for a zip code. I was working there for a few days at the time and there were a LOT of pissed off people "Why do I have to come in anc check ID?!?!?!" If the credit card fraud gets too bad the credit card company will refuse to pay for it anymore and then you are screwed.

    2. Re:Mobil by AsOldAsFortran · · Score: 1

      Some stations require it, some don't - I don' t think Mobil aimed this restriction at cracked RFID cyphers, but rather at stolen speedpasses. Same way some stations in small midwest towns still don't required payment in advance due to a moderately honest local population.

    3. Re:Mobil by ArtStone · · Score: 1

      Don't most gas stations with MobilPass have TV cameras anyhow? One would think it isn't that hard to match up the date/time/Pump# and see the vehicle and person that used the stolen / fake MobilPass.

      There was a time when people claimed "It wasn't me" on ATM cash withdrawals. Once ATMs started taking pictures of the person using the machine, the claims of stolen ATM cards went way down (or people found out their kids/spouse somehow got control (or a copy) of the card).

      --
      Final 2006 "Proof of Global Warming" US Hurricane Count -> 0
  22. 40 bit keys and complexity by cyberfunk2 · · Score: 2, Interesting

    I'm wondering.. when the RFID chips get a signal from the reader (eg: a mobil speedpass challenge/response), the speedpass obviously has to do some computation on the limited RF energy that its been given, and then return the answer.

    I know vaguely how CPUs do these sort of calculations, but how do you HARD wire a system to do that on so little energy ?

    Do the energy requirements go up w/ keysize ? The complexity of the circuits?

    Do these things have some sort of static flash ROM ?

  23. Re:Just a matter of time by enosys · · Score: 1

    In the case of remote starters, being able to start the engine remotely might help a bit but a thief still has to break into a locked car and unlock the steering wheel.

  24. 40 bit Key? by Deathlizard · · Score: 2, Interesting

    Seriously. Why would Mobil build and support an RFID system protected under a 40 bit key? I thought at the very least those speedpass systems had a 64 bit key.

    I know that encryption isn't that important when true physical contact is involved (such as most credit cards, which have no encryption protection but are starting to get some with smartcards) but when it comes down to something that basicially broadcasts a credit card number, you would think that mobil would be a bit more concerned about it.

    If I had a mobil speedpass I would be concerned, since a small device placed on top of a gas pump could easily passive eavesdrop on your speedpass and pass that information to would be criminals.

    The car key, although just as disturbing, isn't as important to have a strong key since it would involve way too much work to basicially steal one car. To do it you would have to somehow read the signal from the key by bumping into the person leaving the car to active scan their rfid signal, (passive eavesdropping would not work well since it only sends the signal at startup when the person's going to be driving away) Decode it, and then use it to start the car once you bypass the physical key. It would be much easier and faster to steal a car without an immobilization system then to bypass it.

    --
    In Soviet Russia, Trojan exploits YOU!
    1. Re:40 bit Key? by swordgeek · · Score: 1

      "Seriously. Why would Mobil build and support an RFID system protected under a 40 bit key? I thought at the very least those speedpass systems had a 64 bit key."

      Because they're cheap, lazy, and blind. Like all companies.

      --

      "People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
    2. Re:40 bit Key? by anon*127.0.0.1 · · Score: 1

      This may be a stupid question, but I'm honestly curious about something. I'm also no security expert.

      Does it matter that the Speedpass isn't totally secure, if it's more secure then the other ways of paying? I mean sure, you can put some sort of reader on top of a pump and intercept Speedpass codes and break the system and steal some gas. But if you want to steal some gas, why not just fill up and drive off? Or pass a hot check? Or make a counterfeit credit card that'll pass through the card reader? Or steal someones identity and use that to get a real Speedpass for your gas charges. The Speedpass may not be totally secure, but isn't it "good enough"?

      --
      I am NOT a man!
      I am a free number!
    3. Re:40 bit Key? by nolife · · Score: 2, Interesting

      I can not comment on the decision to use a 40 bit key but I will still carry and use my SpeedPass. You can only use the device at these gas stations and for the in store purchases. Not high dollar unless you fill a few diesel trucks. A thief has to be physically present in these stores to use the cloned ID. Basically, he/she is not online in Russia somewhere ordering plasma screens. A large shopping spree would consist of the person going from gas station to gas stations buying junk food and gas. Your credit card company and the SpeedPass system will refund any fradulent purchases you did not make and the thief does not have your actual credit card number or any personal information about you that would be useful for anything.
      In conclusion..
      When I compare convienence to security, the SpeedPass still wins. To compare, my standard credit card if taken or even sighted, has the number written right on it with no encryption for anyone to see, including the resturant personell or gas station attendant inside the store who will gladly take the card and swipe it for you. They can do much more with that then my SpeedPass that is tied to that same exact credit card.

      --
      Bad boys rape our young girls but Violet gives willingly.
    4. Re:40 bit Key? by plover · · Score: 1
      It's not a stupid question at all. If you read any of the recent research by Bruce Schneier, you'll find he presents this same concept under the name of "attack trees". Basically he says that if there are a set of known attacks on a system, the bad guys will go for the cheapest one that will give them success (or easiest or fastest, depending on their motives.) SpeedPass forging certainly is harder than any of the other mechanisms out there, so your common criminals are still likely to try the other mechanisms first.

      A real-world application of your suggestion is called the "Bear Theory*" and can be seen at any retailer: the stores don't have to be "100% shoplifter proof", they just have to make shoplifting harder at their store than it is at the store down the street. Get the bad guys to stay away from you, and you're saving the money. (* The Bear Theory states that you don't have to outrun the attacking bear, you just have to outrun the slowest guy you're with.)

      One advantage to attacking through SpeedPass, though, is the possibility that Mobil might not be "watching" SpeedPass transactions as carefully as they do others because they may have an innate faith that SpeedPass cannot be cracked. If your bad-guy goals include "don't get suspected", then SpeedPass hacking would be the way to go.

      --
      John
    5. Re:40 bit Key? by has.mac · · Score: 1

      Why a 40 bit key? Does the US government still restrict the number of bits allowed in public keys? I seem to remember the GSM A5 algorithm was first broken in the US because the ki was restricted to a lower number of bits than in Europe. Something like 56 instead of 64, to allow the government an easier job of cracking it if necessary.

    6. Re:40 bit Key? by Joe123456 · · Score: 1

      Thay can buy lot of skomes

  25. Title. by Kickasso · · Score: 3, Funny
    Various Car RFID Car Keys Cracked

    This a dupe article dupe!

  26. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by springbox · · Score: 5, Insightful

    This story is similar to the car key RFID system being cracked but if you look carefully the content is actually different and provides a more technical perspective to the situation. The other one was fluff compared to this. People here need to stop being so nit-picky because I find that most of these "duplicated" articles are informative and contain interesting content that I would have not seen otherwise.

  27. The encryption method by EdMcMan · · Score: 1

    I am very interested about the techniques they barely mention that made a "black-box" implementation of the encryption! Does anyone have any information on this? I think that is the most amazing part of the article, but they go into no detail.

    1. Re:The encryption method by plover · · Score: 1
      You need to read the referenced research paper for details on the algorithm. That was the most interesting part: rather than violate an end-user agreement and reverse engineer the algorithm from an .EXE, they chose instead to break it by studying the published details of the algorithm (which were not completely correct) and by testing a live device.

      The paper is the detail, the article is just the marketing.

      --
      John
  28. Re:Just a matter of time by bcmm · · Score: 1

    This would probably be more usefull for irrating car owners than for theft.

    BTW, do these really exist?

    --
    # cat /dev/mem | strings | grep -i llama
    Damn, my RAM is full of llamas.
  29. Toll passes? by Anonymous Coward · · Score: 2, Interesting

    Here's my question: Will this apply to toll road "speed passes" too? Does this mean that someone can charge up my account driving around all the tollways broadcasting my id? That could be a huge problem when we don't find that out until the bill arrives... and no verification to enter to make sure it's you (that would defeat the purpose of the speed pass). And a whole lot of time and money to go back and fix that system!


    Chris
    http://www.freeminimacs.com/?r=14620338

  30. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by Anonymous Coward · · Score: 1, Insightful

    Oh shut up. It's the same story. If you had actually read the original, you would've found your way to the same information.

    It's a dupe. CmdrTaco doesn't the his own website and he ignores people that pay for it.

  31. Future of security by SteelFist · · Score: 1

    The way the current trend has been going, for any given security feature, it will be only a matter of time before someone cracks it. Lately the talk has been about biometric security coming out, and now I am wondering how long it will be until those are cracked as well.

    1. Re:Future of security by demon_2k · · Score: 1

      "biometric security"

      With time, even that will me cracked...
      Remember, security is not really to stop anything from happening. It's only to discourage.
      If the time and worn to break in becomes too much, i'll won't be worth the effort.
      But a person with a skill, plan and a goal is likely to bypass any security.

      It's only a matter of time...

    2. Re:Future of security by plover · · Score: 4, Informative
      Biometrics are not security. Biometrics are only about authentication.

      Your biometric information is not secret. The police or your parents might have a copy of your fingerprints, for example. It's theoretically difficult to duplicate biometric data, but certainly not impossible: Cryptome has a copy of the research paper where researchers used $20 worth of common kitchen items to successfully fool every commercial fingerprint reader on the market.

      Assuming forgery is tougher than that, the problem really is in the "interface" -- at some point the information stops being "biometric" and has been converted by circuitry into digital data. Digital data, of course, can be sniffed, copied, and modified. That's the real weak point of the biometric systems. If you can replace real biometric data with spoofed data, the computer systems downstream aren't going to know the difference.

      --
      John
  32. Re:Mercedes electronic...useless by profet · · Score: 1

    Sounds great... But unless they can run away from flatbed trucks... They are totally useless.

    The point is this:
    If somone wants to steal your car. They are going to steal your car.

    It is fairly rare to have a car stolen for "joy riding" now a days... It is much more common for cars to be stolen for parts or to be shipped overseas.

    Either of these scenerios imply that criminals are looking for a specific model, meaning they will know how to bypass any stock security systems. Or they will just throw the $100k car on a flatbed and completly avoid the security system.

  33. nothing new here by mattthateeguy · · Score: 1

    Can anyone say that they are suprised? All wireless technology can be hacked

  34. PSA: Transponder Keys for YOUR Car: $20 on Ebay by jerryasher · · Score: 4, Informative

    I own a 2002 Toyota, which I bought used, and which came with ONE transponder key.

    Toyota wanted $45 for the blank. And $95 to "program the key for the car". My brother has a Mitsubishi, they wanted even more.

    It turns out that if you can obtain a blank, you can usually program your car yourself to accept the key.

    And it turns out that there is a very nice market for these key blanks on ebay. Search for transponder key and your vehicle's make and model. The going rate is about $20.00 and the key blanks usually come with all the instructions you need.

    I bought two blanks for $40, and three days and 20 minutes later I had three working keys for my Toyota saving me over $200 from what the dealer wanted.

    1. Re:PSA: Transponder Keys for YOUR Car: $20 on Ebay by Osty · · Score: 1

      Toyota wanted $45 for the blank. And $95 to "program the key for the car". My brother has a Mitsubishi, they wanted even more.

      You think that's expensive? Bah. Buy a German car that uses laser-cut keys (Porsche, VW, BMW, etc). If I need to replace a key for my car, it'll cost > $200 just to get a new key cut and shipped from Germany (because dealers don't have the equipment or the necessary information to cut the blanks), and that's before the dealer charges labor to associate the new key with the car.

    2. Re:PSA: Transponder Keys for YOUR Car: $20 on Ebay by ForestGrump · · Score: 1

      I agree. And sadly, honda and mazda are switching to the U cut keys, instead of the traditional.

      and the problem with U cut keys is that theyre near impossible to have a cheap "spare" to keep in your wallet just to open the doors when you lock the keys in the car.

      --
      Is it true that more people vote for the winner of American Idol, than vote for the president? -Ali G.
  35. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by elmegil · · Score: 1, Insightful
    The other one was fluff compared to this.

    Maybe if the editors were doing their JOBS that they get PAID FOR, they'd have recognized this fact and only let one story through--the one that would best meet the expectations of their audience.

    Oh wait, we don't have any expectations, because they behave like morons 90% of the time.

    --
    7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
  36. Re:Just a matter of time by enosys · · Score: 1

    Yes, remote starters exist. They're used by people to warm up or air condition their car before they get in it.

  37. Re:Just a matter of time by Skater · · Score: 1

    Remote starters? Yes, they exist. They've been on the market for years, maybe even decades. The new Chevy Malibus have them as a factory-installed option, and I'm sure other new cars have them, too.

  38. Thing is... by Gordonjcp · · Score: 1
    ... most modern cars will have an alarm, deadbolts and a fairly solid steering lock.

    I suspect that even with the immobiliser key fob, you would have a bit of work to do to get the car started. Bear in mind that you have to get into the car without setting the alarm off, which locks out the engine management ECU on most cars. Then, possibly with the alarm going off, you have to get the steering unlocked (tampering with the lock will usually just jam the bolt in place), reset the ECU, get the car started, and drive off.


    Let's just ignore for the moment the way you can disable the immobiliser on most BMWs with a 6" bit of wire...

    1. Re:Thing is... by NeoSkandranon · · Score: 2, Insightful

      Alarms are far less security than you might think. Picture an apartment complex or a college dorm parking lot. Lots of riced up civics and chunky tired jeeps with alarms that go off if you *fart* next to the car.

      After about a month of alarms going off in the dead of night, no one bats an eye at hearing one anymore.

      --
      If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
  39. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by Catbeller · · Score: 1

    How much do you two whiners pay for reading Slashdot? Contribute much?

    Techies can be so bloody whiny about their free content...

  40. Re:Just a matter of time by shotgunefx · · Score: 1

    Well it's not that easy, but there are some benefits of remote start besides not freezing your ass off.

    A couple years back, my sister started the car from her house on a cold day, she gathered her kids and went to go out to the car... which was by then enveloped in flames.

    --

    -William Shatner can be neither created nor destroyed.
  41. Re:Yes, but by AndroidCat · · Score: 1

    Don't dis Avi! He (with multiple authors) wrote a paper on how to automate a Slashdot snail attack (As in Spam King Al Ralsky.)

    --
    One line blog. I hear that they're called Twitters now.
  42. Most Likely A Load Of Shit by Saeed+al-Sahaf · · Score: 1

    What makes you think these products where coded by chimps? Are you telling us that it is possible (for you perhaps?) to make crypo secure RFID products? This is simply an inappropriate use of RFID, and regardless of the quality of the engineers working one these toys, the decision to go with this misuse of technology almost certainly came from the Suits upstairs.

    --
    "Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
    1. Re:Most Likely A Load Of Shit by cpeikert · · Score: 1

      What makes you think these products where coded by chimps?

      Well, the researchers discovered that the proprietary cipher that underlies the system is pretty lousy -- it's not particularly fast, and it may have structural flaws. You don't have to be a "chimp" to construct a bad cipher, but ignoring something like AES or the many other peer-reviewed ciphers is pretty dumb.

  43. DOH by 44BSD · · Score: 1

    Hey all --

    Sorry to have submitted a dupe. I don't read the NYT, and I saw this via a somewhat esoteric web site, and when it wasn't up on today's /. already, I figured it hadn't been submitted. My bad for not reading /. yesterday ;^).

    Anyway, the obvious thing to do is see what domain names Avi and cohorts have registered recently, to see what they will obliterate next.

    If this guy hooks up with Matt "Locksmiths ph33r my 7eet sk1llz" Blaze (linkage) it will be rather amusing.

    On a serious note, why don't these firms just hire Avi, Ross Anderson, or Markus Kuhn up front, and save embarrassment and retooling?

    1. Re:DOH by alex_ware · · Score: 1

      "Texas Instruments provided us with 5 DST tags whose keys we did not know."
      They could have been paid to do that by TI as they definately provided some equipment. Or they could be in universatry.

      --
      If you have nothing useful to say post as AC.
    2. Re:DOH by Legion303 · · Score: 1

      Is it your fault for submitting, or the editors' fault for not catching it?

  44. Dupe-dopey mods... by TFGeditor · · Score: 1

    Who moderated the parent OFFTOPIC? Since the article is a dupe, it eems to me a comment about it being a dupe is about as on-topic as you can get.

    --
    Ignorance is curable, stupid is forever.
  45. Re:Mercedes electronic...useless by foetusinc · · Score: 1

    Except all newer Mercedes have mercury switches that detect tow-away. Won't stop you putting it on the flatbed, but you still have to disable the security system before the car calls home and gives the cops a nice sub-meter fix on your chop-shop.

    My understanding is that the handful of high-dollar Mercedes that get stolen every year are almost always taken by carjackers. With all the security measures, it's much simpler to just box somebody in at an intersection, put a big gun against the glass, and ask politely for the keys.

  46. RFID Cryptanalysis Paper Mirror by jbltgz · · Score: 1

    Just in case this site gets slashdotted, I setup a quick mirror of the research paper: DSTbreak.pdf

  47. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by value_added · · Score: 1

    The best part of subscribing to Slashdot is watching CmdrTaco post multiple duplicates in a row...

    Actually, what's even better is getting a chance to re-read a great article. Sort of like a good book.

    Ok, well, maybe not.

  48. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by sponga · · Score: 1

    so let me get this right we get fluffed up dupes if we subscribe?

  49. Nope... by Nikker · · Score: 1

    This is the ultimate in car protection

    Should be installed in all of Americas cars by 2006.

    --
    A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
  50. The Joy of Work by Marran+Gray · · Score: 1

    I think there's a motivation for abuse that nobody's mentioned yet: mischief. Sure, if I'm a bigshot car theft ringleader boosting expensive autos into semis and shipping them out of the country I don't much care about this little development. But if your cow-orker leaves the key to his shiny new car in a fixed location, even his own pocket... and you just happen to already be an electrical engineer...

    --
    "There are hundreds of game theorists at the gates, sir, and they want to hold an election!"
  51. So? by Saeed+al-Sahaf · · Score: 1

    What do you want, a retinal scan? Short or having some human examine you, your ID, and your other boneifieds to vette you, systems like these will always be crackable. Get over it, life has risks.

    --
    "Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
    1. Re:So? by HarveyBirdman · · Score: 1
      What do you want, a retinal scan? ... Get over it, life has risks.

      Sweet bouncing feathery Jesus, what got up your ass? I just made a fucking observation that Mobil has added a layer of security. I wasn't complaining about anything.

      --
      --- Ban humanity.
    2. Re:So? by Saeed+al-Sahaf · · Score: 1
      Sweet bouncing feathery Jesus

      Dashboard toy / air freshener?

      --
      "Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
    3. Re:So? by Darth_brooks · · Score: 1

      you get that thing i sent ya?
      ~Potomus

      --
      There are some people that if they don't know, you can't tell 'em.
  52. Cool by nurb432 · · Score: 1

    With the price of gas hovering around 2 bucks a gallon here in the midwest, all i can say is 'cool, free gas for all!'

    --
    ---- Booth was a patriot ----
    1. Re:Cool by welshie · · Score: 1

      USD 2 per US Gallon? Let me compare to the real world here: USD 2 is approximately GBP 1.05, or EUR 1.53 1 US Gallon = 3.785 litres. So you're complaining about USD 0.52 per litre, which is GBP 0.22 per litre, or EUR 0.40 per litre. Typical unleaded 95RON pump price, including taxes in the UK, is GBP 0.80 per litre. (USD 1.51, EUR 1.15) Typical unleaded 95RON pump price, including taxes in France is about EUR 1.05 per litre (USD 1.36, GBP 0.69) (currency prices are inter-bank rates as per oanda.com) So, to a European, (and for that matter, pretty much anywhere outside of the USA, and some oil-rich states with stable economies - yes there are some of those), 2 bucks a gallon is almost free anyway.

    2. Re:Cool by nagora · · Score: 1
      With the price of gas hovering around 2 bucks a gallon here in the midwest, all i can say is 'cool, free gas for all!'

      2 bucks per gallon pretty well is for free.

      TWW

      --
      "Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
    3. Re:Cool by /dev/trash · · Score: 1

      Yeah but when I have to drive 30 miles round trip a day to get to work, $2 a gallon is not cheap. What do you commute? 2 miles?

  53. Re:Just a matter of time by King_TJ · · Score: 1

    Actually, I'm not 100% certain, but I think I recall reading that the remote starters in cars generally use some type of rolling authentication code - so it's not especially easy to crack.

    (At least, you're not going to get anywhere by trying to capture the radio transmission off someone's keyfob and duplicating it, or that sort of thing.)

  54. Cost of living by nurb432 · · Score: 1

    You have to factor in cost of living and average income, you cant just compare exchange rates..

    And that varies from state to state, country to country.

    --
    ---- Booth was a patriot ----
  55. funding by mikeee · · Score: 1

    The thing about this I thought was interesting is that the research was sponsored by RSA Corp. Anybody want to bet that wouldn't have happened if TI had licenced a RSA algorythm?

    I suppose it's a good thing that companies are competing in this way, rather than just slathering us all in layers of obfuscation and FUD.

  56. True enough... by Gordonjcp · · Score: 1

    I've actually sawn open the bonnet of a car and cut the battery leads, because the owner would not turn the alarm off. After hearing the damn thing right outside my house from 1am to 5am, tempers were getting frayed right throughout the building...

    1. Re:True enough... by tomhudson · · Score: 1

      -- easier to just break a tail-light and short it out - this kills the alarm as well - the brake light circuit and interior lights are independent of the ignition in most cars, which is why your tail lights stay on if you put your foot on the brake, even if the key isn't in the ignition.

    2. Re:True enough... by |<amikaze · · Score: 2, Insightful


      But... if the brake light isn't on... there won't be any power flowing to it.

    3. Re:True enough... by tomhudson · · Score: 1
      Simple DC circuit. Power to one lead -always live - the other leads to your brake switch. Pushing the pedal closes the switch and completes the circuit.

      This also explains turn-signal or running lights that go "funky" - lights that are always half-on - there's a short to ground somewhere, allowing them to light up even when the turn signal isn't operating.

    4. Re:True enough... by Gordonjcp · · Score: 1

      No, the half-on lights are because the earth to that cluster has become disconnected. Thus power is flowing to earth through (usually) both brake light filaments in series (think about it...)

  57. Re:Not True by tomhudson · · Score: 1
    Do you have the Delco radio that says "anti-theft lock" on it, or something better?

    I've seen this happen to about a half-dozen Cavaliers and Sunfires (1998-2002 IIRC).

  58. I don't think that would work. by Gordonjcp · · Score: 2, Informative

    As the other poster says, the brake light won't be on. Furthermore, if you did short out the brake light, and it *was* on, all you'd do is pop the brake light fuse, which may not affect the alarm.

    1. Re:I don't think that would work. by tomhudson · · Score: 1
      Read my reply to the previous poster. There are lots of circuits that have one side "live" and the other side is only completed by a switch. If you drop it to ground, the circuit is complete, even when the ignition key is off.

      You're not completing the circuit between the brake light switch and battery in cases like this - you've bypassed it (and the fuse that protects it) completely. Ask yor local car thief or cop specializing in auto theft for a demonstration.

    2. Re:I don't think that would work. by Gordonjcp · · Score: 1
      Yes, but the brake lights are not one of them. Simple reason being that the brake, tail and indicator circuits are earthed through the bodywork. In this case you *are* completing a circuit between the bulb and the positive bus. They are pretty much always fused, too.


      In any case, this *still* wouldn't stop the alarm from sounding, because you're trying to short the battery. Now the battery can provide a couple of hundred amps for a couple of minutes. You'd set the electrics on fire before you got the alarm to shut up.


      If you're still not convinced about the brake light wiring, I'll post a couple of links to car electrical diagrams from my broad selection of workshop manuals.

  59. Only 30 miles? by Zed+Too · · Score: 1
    30 miles round trip (i.e. 15 miles each way) would be a fairly short commute, even in the UK.

    2 miles is walking distance, and yes I do walk to work (but that puts me in a tiny minority).

  60. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by dq5+studios · · Score: 1

    Maybe he's like the rest of us and blocks all posts by michael?

  61. Re:CmdrTaco Cracked, Various Slashdot Editors Dupe by Kent+Recal · · Score: 1

    Maybe I get modded flaimbait for this but I feel that's part of the reason why a lot of open source software is so damn good.
    We try hard to do stuff right because we hate it so much when others don't.