Using Laptops to Steal Cars

Ant writes "Thieves are using laptops/notebooks to steal the most expensive luxury cars. Many of these cars have completely keyless ignitions and door locks, meaning it can all be done wirelessly. Thieves often follow a car until it gets left in a quiet area, and they can steal it in about 20 minutes..."

Comments

Far too long.

[grub]

20 minutes to remove the laptop from the bag, smash the window and pound on the steering column with it? They must be using those modern, fancy-pants, lightweight laptops. In the old days we could get a car in under 5 minutes with a Mac Portable.

Re:Far too long.

[ccarson]

I would just use my tow truck...

Re:Far too long.

[drinkypoo]

Even in your average American "luxury" car, multiple attempts to start the car without the appropriate key will disable the ECU. Furthermore, in most systems, if certain items are damaged, the ECU actually has to go back to the manufacturer for reprogramming because it's part of the anti-theft system. See, there's a communications module with an antenna near the ignition switch, and it has a unique ID. You need the factory scan tool to assign a new radio module to the ECU. (I'm forgetting some details, there's more to it than this, but I figure I can look it up in the shop manual if I ever need to work on a car like that. Einstein said to never memorize what you can look up.)

The point is that unless you have the proper equipment to unlock, the car can lock itself to the point where it can not be driven. See, modern cars have variable valve timing, coil-on-plug ignition, and a whole bunch of other stuff that simply will not work without the cooperation of the computer. And, you can't just change the computer, because the radio module is locked to an ECU as well. You'd have to swap both the ECU and the module. The module is buried in where the ignition switch is and replacement requires partial dashboard or column disassembly. The ECU is sometimes under the hood, but that's very rare; typically it's behind the kick panel on the right side.

I'm sure you were going for humor (that was a joke, right? right?) but there are people asking these questions more seriously and you were most highly moderated. :)

Re:Far too long.

[Anonymous Coward]

Fear my Newton.

Re:Far too long.

[CastrTroy]

So you're saying that if you throw enough wrong codes at the car, then it will disable itself? Sounds like you could have a lot of fun disabling people's cars on them. You could probably disable a whole parking garage full of cars with strong enough transmitter and 5 minutes of free time. Even without that, just walk up to a car that isn't yours, and press the button 50 times.

Re:Far too long.

[geoffeg]

And since the Mac Portable used a lead-acid battery you could use it to jump start the car! (ok, probably not)

Re:Far too long.

[dgatwood]

Problem is that this is relatively weak. Most car alarms automatically shut off if the car gets tilted to a certain angle to avoid alarms while being towed. All you have to do to steal a car, then, is to buy a tow truck and tow it to a private garage, wherein you have sufficient privacy and time to replace those modules....

Seriously, if you're talking about the folks who are most likely to steal luxury cars, nothing short of a LoJack-like device makes sense. All you can really hope to do is deter casual thieves.

Re:Far too long.

[Spock the Baptist]

"Fear my Newton."

Fig, apple, or blueberry?

Re:Far too long.

[drinkypoo]

Except that the system I'm talking about is a short-range radio that is only activated when a key is put into the ignition, in order to read the code stored in a RFID tag (or similar - sometimes they actually use electrical contacts even, but that's old tech) on the key. Other systems work differently.

Re:Far too long.

[drinkypoo]

Most car alarms automatically shut off if the car gets tilted to a certain angle to avoid alarms while being towed.

That's very nice, but it has nothing to do with what we're talking about here, which is not alarm systems, but theft prevention devices built into the car's PCM, or Powertrain Control Module (formerly "ECU", or Engine Control Unit, but PCM is the OBD-II terminology and all cars are now OBD-II.)

Car alarms have two purposes: Inform everyone that the car is being tampered with, and stop the car from being driven. These systems have only one purpose: Stop the car from being driven. Either way, it's insignificant to the towing company. The ECU does not disable itself when the vehicle is at an angle. Personally I think that whole thing about car alarms disabling themselves is a myth anyway, because car alarms still work when cars are parked on steep-ass hills in san francisco.

Re:Far too long.

[DaFork]

So... when did you steal your first car? ;)

Re:Far too long.

[Bastard of Subhumani]

I couldn't even lift a tow truck, let alone swing one fast enough to break a window.

Re:Far too long.

[necro2607]

Oh yeah like one of these? http://www.everymac.com/systems/apple/powerbook/st ats/mac_portable.html

For the office-ready desktop alternative why not try the Macintosh XT? http://www.everymac.com/systems/apple/mac_classic/ stats/mac_xl.html

;)

Re:Far too long.

[littlerubberfeet]

I would agree with the last part...Also, there are many cars that need to be put on flatbeds, and thus don't tow tilted. An exotic sportscar with all wheel drive and low ground clearance must be put on a flatbed.

Re:Far too long.

[dgatwood]

I've fixed my car using OBD-II and freediag. I'm quite familiar with the subject, and it DOES have EVERYTHING to do with what we're talking about. It doesn't require specialized scan tools to talk to the PCM/ECU. It requires some very inexpensive hardware, coupled with properly written software.

Powertrain security is a joke from a security perspective. It might stop a casual thief, but its main purpose has always been to encourage the customer to pay the dealer for extra keys so that they can make more money. The fact is that, with the exception of tracking systems, alarm systems are the only viable line of defense.

If you can disable the alarm and tow the vehicle to a private location, the vehicle is as good as yours no matter what the manufacturer did to the PCM. Why? Because the dealer obviously has a way to reset the system and program it for new keys, and there are only two things preventing a thief from doing the same thing: lack of information and the inability to do it surreptitiously. The first one falls into the "security through obscurity" category, and thus is unlikely to stop car thieves at this level of sophistication for very long. The second one can be defeated with a tow truck.

Thus, while I left out a couple of steps in arriving at the conclusion before, my point is valid: powertrain security is a pointless exercise. Even requiring an ignition key is basically a pointless exercise except to prevent children from accidentally starting the car. It prevents naive abuse of the vehicle and nothing more.

Re:Far too long.

[myth24601]

"Personally I think that whole thing about car alarms disabling themselves is a myth anyway"

It's gotta be true because Swartzeneger did it in the movie Twins by lifting up the back of a car.

Of course I didn't question how the character would have known anything about car alarms since he spent his whole life on a tropical island without cars.

Re:Far too long.

[Anonymous Coward]

I'm assuming the incline theory being talked about is that the alarm shuts off if, after having been level and tripped, the car is then tilted up by the tow truck.

Your San Fran analogy doesn't work because the car is already tilted when the alarm is tripped.

Re:Far too long.

[Anonymous Coward]

When he's illegally parked in my parking space, the towing company has my full permission to tow that POS out on its fender...

Re:Far too long.

[Anonymous Coward]

20 minutes is definitely far too long. it takes less than 5 minutes to hook up a car to a tow truck and haul it off. who cares about hacking the ECU. when the car arrives at the chop shop, the ECU and the security transponder will be tossed in the trash. the rest of the car will be stripped and sold for parts. $profit!!

Re:Far too long.

[drinkypoo]

It doesn't require specialized scan tools to talk to the PCM/ECU. It requires some very inexpensive hardware, coupled with properly written software.

Since it cannot be done through ordinary OBD-II codes, and can even require the use of nonstandard pins (since OBD-II doesn't regulate most of the pins on the connector) this is not necessarily true. You don't need anything special to pull and clear codes but you often do need something special to, say, reprogram the PCM.

Why? Because the dealer obviously has a way to reset the system and program it for new keys, and there are only two things preventing a thief from doing the same thing: lack of information and the inability to do it surreptitiously.

At least in the case of the system GM was using in the late nineties, the dealer did NOT have a way to reset the system under many conditions, and the PCM had to be sent back to GM.

Re:Far too long.

[Godji]

Aha! So I can actually perform DoS attacks on vehicles! Cool!!! ;))

I mean, it's not like the car has a firewall to stop me...

Re:Far too long.

[DigiShaman]

But in theory, he could DOS the system with a high-gain transmitter to disable the system. Exactly how, I'm not sure. But one could shutdown and entire highway with enough stalled cars.

Re:Far too long.

[fm6]

But one could shutdown and entire highway with enough stalled cars.

Given the kind of cars we're talking about, that would only work in Beverly Hills!

Re:Far too long.

[dgatwood]

Since it cannot be done through ordinary OBD-II codes, and can even require the use of nonstandard pins (since OBD-II doesn't regulate most of the pins on the connector) this is not necessarily true. You don't need anything special to pull and clear codes but you often do need something special to, say, reprogram the PCM.

Either way, it's still security through obscurity. It a dealer can do it, then all it takes is one person getting their hands on the device, noticing the extra pull-down resistor between pin 13 and ground or whatever, and spreading the word.

At least in the case of the system GM was using in the late nineties, the dealer did NOT have a way to reset the system under many conditions, and the PCM had to be sent back to GM.

That does limit the availability of the technology to crack the system, but it's still security through obscurity. At worst, it probably requires an EPROM programmer or a JTAG debugger plugged into a connector on the PCM's main board. They're not going to design one that burns out hardware or something silly, as that would end up costing them money in the long run.

Re:Far too long.

[drinkypoo]

It won't work on cars that are already started, the module doesn't do anything then. Even on parked cars, he'd have to have both the transmitter (which wouldn't need much power, the key's output power is roughly nil) and a way to insert a blank key in the ignition since that's the only time that the key is actually scanned (maybe just at ignition time.)

Re:Far too long.

[bhtooefr]

Well, other companies can reprogram the ECU.

For example, if RocketChip (a certain ECU reprogramming company that the Volkswagen TDI crowd prefers) were to get a request to disable the immobilizer on an ECU, they'd do it.

So, pop the hood, take out the ECU, send it to a reprogramming company, ask for the immobilizer to be deleted, and voila, you have no immobilizer. Or, if you want to steal a certain model of vehicle, have an ECU ready to go.

Older immobilizer equipped cars are even more of a joke. Unplug the immobilizer control unit, short out the right pins, and drive off.

Not that I suggest stealing cars. I'm just saying that even your high-tech, impossible to defeat immobilizer systems are easily defeated.

Re:Far too long.

[drinkypoo]

Since it cannot be done through ordinary OBD-II codes, and can even require the use of nonstandard pins (since OBD-II doesn't regulate most of the pins on the connector) this is not necessarily true. You don't need anything special to pull and clear codes but you often do need something special to, say, reprogram the PCM.

Either way, it's still security through obscurity. It a dealer can do it, then all it takes is one person getting their hands on the device, noticing the extra pull-down resistor between pin 13 and ground or whatever, and spreading the word.

First of all, the dealer typically can't do it. It usually requires the unit to be sent back to the manufacturer, to avoid just this kind of problem.

Second of all, these vehicles sometimes have two completely separate data interfaces. For instance, they may have the ISO ODB-II interface for pulling powertrain codes and doing all the usual stuff you can do with the scan tool like snapshots and the like, and an entirely separate communications interface on some of the non-specified pins for reprogramming the ECU. I've heard of at least one vehicle handled in this way.

At least in the case of the system GM was using in the late nineties, the dealer did NOT have a way to reset the system under many conditions, and the PCM had to be sent back to GM.

That does limit the availability of the technology to crack the system, but it's still security through obscurity. At worst, it probably requires an EPROM programmer or a JTAG debugger plugged into a connector on the PCM's main board. They're not going to design one that burns out hardware or something silly, as that would end up costing them money in the long run.

Sure, but in any case, even replacing the PCM in the course of auto theft usually involves too much of an investment in time, not to mention that to remove the kick panel, you usually have to open the door, and frequently have to remove the trim piece on the jamb. All that makes you far more noticable.

As has been pointed out, a tow truck bypasses all of this crap, but if you can park someplace a tow truck can't get you, then you're really in pretty good shape. And, I do agree that a lojack is probably more effective than everything nonlethal that you can do put together.

Re:Far too long.

[Anonymous Coward]

But the towing company won't touch the car until they have a flat bed because they don't want to be sued by the owner of the car for negligence; I can assure you, Sir, that the towing company could care less if you or I are inconvienced.

Re:Far too long.

[CFTM]

You forget that the Gubbanator was not only insanely strong but also insanely smart! He must have studied Car Alarm Manuals for shits and giggles while chillin on his island; I know instruction manuals are on my leisure reading list!

Re:Far too long.

[garylian]

All very valid comments. However...

For pure griefing fun, if you can't steal the car, you make it so the owner can't drive it, either. You are doing the same microwaving that ECU.

I had a car that folks tried to steal at least 3 times. The first two failed, and broke something off in the ignition, forcing me to pay for a window and the ignition repair. The third failed, and may have gone and done a little joyriding, but by that time the turbocharger was going on the engine, so the police believe they actually brought it back.

Let's not give some enterprising folks the idea of running around and shorting out the ECUs of cars everywhere.

Besides, I wonder if something like this foils Lo-Jack. If not, no biggie. I mean, if you spend more than $25K on a car/truck, or have a vehicle that is high on the stolen list, and don't have Lo-Jack (at least if it is available) you are asking for it.

It works so well, most car theives steal a car and simply move it a few blocks, park it, and leave it for 24hrs. If nobody picks it up, then they take it to the chop-shop. That 24hrs is to keep from having the chop-shop raided. That's their method of stoping Lo-Jack. Which is why they usually recover the car in decent condition within 15 minutes most of the time.

Re:Far too long.

[Anonymous Coward]

OMG!!!111oneone They have APPLE Newtons? Those probably taste soooo good. (Yes, I've had a nice comfy home under a medium sized rock for the past twenty some years).

Re:Far too long.

[idlake]

Even in your average American "luxury" car, multiple attempts to start the car without the appropriate key will disable the ECU.

Sounds like a recipe for disaster; at least on my cars, the anti-theft devices have often caused trouble.

Re:Far too long.

[Shanep]

20 minutes to remove the laptop from the bag, smash the window and pound on the steering column with it? They must be using those modern, fancy-pants, lightweight laptops. In the old days we could get a car in under 5 minutes with a Mac Portable.

Pfft, amateur. You're using the wrong tool. In my day we could get any car in under 2 minutes with a Dolch luggable. You did have to take care not to accidentally smash the whole steering wheel right off the column though, if you missed.

Of course nowdays, the newer Dolch's are still usable, but less care needs to be taken, as these will merely dent the steering wheel.

Re:Far too long.

[Anonymous Coward]

"the towing company could care less if you or I are inconvienced"

They could?

I was always of the opinion that they couldn't care less.

Re:Far too long.

[darkonc]

You need the factory scan tool to assign a new radio module to the ECU.

So, in other words, all I have to do is dupicate the factory scan tool(s) -- or the minimal parts of them necessary to circumvent the anti-theft module(s), and VOILA -- one cheap car (or one hundred, as the case may be).

If it hasn't happened yet, it'll happen sooner or later.

Re:Far too long.

[Anonymous Coward]

Now if they could just perfect the ability to wirelessly assume control of the a-hole's car that just cut you off in traffic so you force his car to make a right turn off the bridge...

Re:Far too long.

[dknj]

I've heard of at least one vehicle handled in this way.

Hello Audi and Volkswagen. I'm pretty sure BMW, Jaguar, et. al do the same

Re:Far too long.

[Anonymous Coward]

Nothing is impossible if the thief really, really wants it.
I remember our local police department in the 1990's was using an SUV as bait to lure some car thieves in our area and it had an satellite tracking device and other fancy features to prevent it from being stolen. The thieves stole the SUV by lifting the whole thing on casters and rolling the whole thing into an container, like the ones they ship stuff in, and the police couldn't find the tracking signal for an week. The next time the tracking signal appeared it was in Mexican desert with a few pieces of what was left of the SUV they couldn't sell.

Re:Far too long.

[lowrydr310]

Seriously, if you're talking about the folks who are most likely to steal luxury cars, nothing short of a LoJack-like device makes sense.

Even then, wouldn't a Faraday Cage car-hauler defeat that?

If someone wants something bad enough, they'll get it.

Re:Far too long.

[Anonymous Coward]

> but it has nothing to do with what we're talking about here
apperently your not talking about the main story.

Most of your posts have nothing to do with what the article discusses, or even the slashdot summary

eg

Many of these cars have completely keyless ignitions and door locks, meaning it can all be done wirelessly.

and Gone are the days of the mechanical lock.

I know it's not cool to read the article...

Re:Far too long.

[jamesh]

the car can lock itself to the point where it can not be driven

Ah... i see it now... a drive by DoS attack. Roadside assist companies hiring script kiddies to drive around parking lots in pre-computer vehicles with a high power transmitter issuing authentication requests on all known channels.

Re:Far too long.

[dgatwood]

Even then, wouldn't a Faraday Cage car-hauler defeat that?

Depends on how you design it. In a continuously active system, such tampering would result in the police swooping in. With systems like LoJack, though, you're right.

Re:Far too long.

[edunbar93]

And *any* anti-theft system (short of exploding the car or something equally fatal) can be defeated by stealing a tow truck and hauling the difficult-to-steal car away.

I'm actually surprised that the method mentioned in the article doesn't take less time. Personally, I would just point a sensitive antenna at the owner as he turned on the security system and use the code that was broadcast to anyone willing to listen. SSL keys will be in the next implementation, I think.

Re:Far too long.

[Anonymous Coward]

Which is why the proper way to steal a modern luxery car is to wait till the owner returns, and then ask nicely for his
keys at gunpoint.

Re:Far too long.

[N Monkey]

20 minutes to remove the laptop from the bag, smash the window and pound on the steering column with it? They must be using those modern, fancy-pants, lightweight laptops. In the old days we could get a car in under 5 minutes with a Mac Portable.

Seriously though, I heard that with one recent car (possibly a BMW) all the thieves had to do was give it a big enough jolt (something like lifting it up a little and dropping it) and it would think it was in an accident and automatically unlock all the doors! :-(

Re:Far too long.

[everett]

You have much more success genereating a localized EMP to just fry the ECU...

Re:Far too long.

[The_Mr_Flibble]

What a shame.
I thought of a great stress relief for journeys when your stuck behind an idiot driving to slowly.
Hack his car and shut down his engine.

Re:Far too long.

[Pincus]

And as anyone who's been on the 405 near Beverly Hills knows, the freeway might as well already be shut down.

Re:Far too long.

[RESPAWN]

You remind me of a friend who's cousin had his Dodge something-or-other (nothing spectacular and normally not worth stealing) stolen and recovered 3 times. After the third time he wired in a hidden switch that activates a relay controlling the fuel pump. Since then, his car's been broken in to twice but not stolen.

Re:Far too long.

[drinkypoo]

There's an easier way to accomplish this although it can only be used with care in vehicles which aren't like mine; I have a diesel mercedes where everything under the hood is run mechanically. Disconnecting the battery won't stop the car. I've run the vehicle with the battery totally dead (under 8 volts even!) and the only problems are in the area of signals, gauges, and lights.

Anyway, using a microwave magnetron, it is possible to construct a HERF (High Energy Radio Frequency) projector which will confuse the shit out of any non-hardened electronics towards which it is directed. Google it up, it's not hard to come by. Some guy did a demo at DEFCON (IIRC) and shut down computers from like 30 yards or something.

Re:Far too long.

[sshir]

Not that simple.

Actually, you need to evaluate probability that your car would be stolen (where you park it) times value of the car.

Insurance company does it for you - and you're paying.

So the only reason for using Lo-Jack would be if you can deduct all the LJ fee from your insurance premium. Otherwise you paying twice and frankly, there are good reasons behind thinking that it's better not to return expensive car when stolen (e.g. you get more from insurance than from selling it).

So basically Lo-Jack is for very-very-very risk-averse people. But excessive risk-aversion is quite expensive character trait...
Ever wondered why financial markets are "risk neutral"? :-)

Re:Far too long.

[LunaticTippy]

I assumed insurance companies will increase your rate or drop your policy after getting your car stolen. There is also the loss of personal effects and the inconvenience of being stranded and having to get a new car.

My antitheft device? a 1981 diesel nissan.

And thats why...

[Sinryc]

And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.
All they really need to do is start randomizing the locks on cars, and not just use the same pattern...
yea, expensive, but safe.

Re:And thats why...

[$RANDOMLUSER]

Locks are for honest people. If a pro really wants to steal your car, whether the key is physical or software won't matter much.

Re:And thats why...

[stefanlasiewski]

All they really need to do is start randomizing the locks on cars, and not just use the same pattern...

Imagine replacing the existing locking system on the hundred of thousands of cars that use keyless entry. The auto manufacturers will resist.

How many of us predicted this years ago? When I saw my first keyless system, I think the first thought on my head was "They better change the code every time the person enters the car". I'm sure the auto designers were told about this security flaw dozens of times--

Re:And thats why...

[dgatwood]

Regular keys take seconds to defeat. The electronic ignitions take 20 minutes. That's a pretty big improvement in the grand scheme of things.

One thing they're doing these days is to store some state information so that each code is different than the previous one. However, this only goes so far in terms of increasing the complexity of breaking in. There are generally a limited number of possible codes, so you can eventually guess the right one. And since the car will be ignoring bogus codes (to avoid being fooled by other cars' remotes), you can pretty much send it crap until you hit the right value with impunity.

If you really want your car to be secure, what they need to do is make the keyless entry devices carry a public/private key pair. On each key device, put a mini-USB jack on them and have a USB jack on the dashboard hooked up to the car's computer. Use this to copy the public key from each "key". Require that after the first key is loaded, one known key must be within radio range in order to associate a new key.

When you push the unlock button on the key, the device would send an unencrypted "unlock" message. Upon receiving this, the car would reply with a random string of data (say a 2k packet). The key device would receive this, sign the data using its private key, apply a random back-off timer to minimize collisions, then transmit the signed copy of the data, skipping a random time interval between each attempt, and stopping after 5 seconds or when the car transmits a "verified" message.

Of course, the car would stop listening after 5 seconds as well. Since the message to be encrypted changes each time, this would essentially thwart any attempts to fool the car by transmitting random data until it gets it right.

If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.

Re:And thats why...

[myth24601]

Many new cars come with regular keys(not the keyless option) that have an RFID dodad embeded in the key so that the car will not start unless the RFID is there when you try to crank the car. I guess this would stop somone from simply using a lockpick on the car unless they could cercumvent the RFID stuff.

One drawback is that if you want an extra key you have to get it from the dealer or get them to "program" your key if you optain one from a third party.

This has insturctions on how to setup some of the keys that don't require any special equipment. Some require at least one existing programed key while some do not.

PDF warning
http://www.kaba-ilco.com/key_systems/pdf/2006_Auto _Truck_Key_Blank_Reference_%5B2852-E-1105%5D.pdf

Re:And thats why...

[iminplaya]

If you really want your car to be secure...

Just do what I used to do. Pop off the distributor cap, and remove the rotor. Not too many people carry a spare one of those around.

Re:And thats why...

[kfg]

And thats why people will want a regular key.

So the car'll be Gone in Sixty Seconds.

KFG

Re:And thats why...

[greenzrx]

neither of my cars have rotors, or even distributors for that matter, so i'm afraid that won't work for me.

Re:And thats why...

[drsquare]

What makes you think all car thieves are pros?

Re:And thats why...

[Firehed]

...
If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.

If you're THAT paranoid, you just walk.

Re:And thats why...

[Ced_Ex]

That's true. Some retain their amateur status so they can participate in the Olympics.

Re:And thats why...

[EvanED]

And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.

BS. Most keyed locks are no problem to defeat. After practicing lock picking for just a couple days I went out and bought a deadbolt from a hardware store. I had it open in about 10 minutes. One master padlock I have I can pick as fast as I can open with the key. And that is hand-picking the lock; no lockpicking gun. And I'm a newbie lockpick.

Automotive locks are harder to pick (from what I hear, much harder), but don't go deluding yourself that keyed locks are keeping you safe. It's easy enough to learn to pick them, and there are usually so many routes AROUND the lock itself you don't have to.

Re:And thats why...

[citking]

This reminds me of the security company commercial where the guy is feeling around his bald head for a strand of hair to login to his laptop.

To be honest I'd rather just pay a $500 deductible for the damned thing when it gets stolen than have to put up with a 15 minute ritual to open the door and turn the car on. Besides. what's to keep someone from ignoring those kinds of cars and just taking my neighbor's '78 Chevy Malibu Classic?

Besides the obvious, of course...

Re:And thats why...

[NuShrike]

If you're really THAT paranoid, you would stay inside your bunker 2000 feet underground, and hire minions (via a mouth in the wall) to do your shopping.

Re:And thats why...

[dgatwood]

I'm talking about a protocol exchange that takes at most five seconds....

Besides. what's to keep someone from ignoring those kinds of cars and just taking my neighbor's '78 Chevy Malibu Classic?

That's kind of the point. Thieves are more likely to hit the easier targets unless there is a particular reason to go for the harder targets. If they take your neighbor's 78 Malibu, that means they didn't take your Porsche.

Re:And thats why...

[grassy_knoll]

Locks are for honest people. If a pro really wants to steal your car, whether the key is physical or software won't matter much.

Not even a Pro, really. After all, implementation of the GTH(*) protocol has been known to facilitate the transfer of identity tokens to unauthorized third parties.

(*) Gun To Head

Re:And thats why...

[bhtooefr]

Well, my car has a distributor-style diesel injection pump, but seeing as you need a whole lot of tools to reinstall that, I think I'll pass. ;)

However, on a gasser... take the spark plug wires.

Re:And thats why...

[swillden]

When you push the unlock button on the key, the device would send an unencrypted "unlock" message. Upon receiving this, the car would reply with a random string of data (say a 2k packet). The key device would receive this, sign the data using its private key, apply a random back-off timer to minimize collisions, then transmit the signed copy of the data, skipping a random time interval between each attempt, and stopping after 5 seconds or when the car transmits a "verified" message.

I wouldn't bother with public key crypto here. Symmetric is faster, cheaper and at least as secure. The only disadvantage it has is the fact that you need shared keys, but in your design you have to go through a specific key-distribution process for each key device anyway.

Instead, when you insert the key device into the USB slot on the dash, the car's computer should generate a new random key, say 128-bit AES, and provide that to the key device. To authenticate, perform a challenge-response process just like the one you described.

Doing RSA crypto quickly, especially for private key operations, which is what you need here, requires a much more powerful cpu in the key device, or else a hardware large integer math coprocessor to accelerate the computations. You can do 128-bit AES in milliseconds on a dirt-cheap 8-bit micro. You also need far less storage for symmetric keys, both in the key and in the car.

In general, I always look for solutions with symmetric cryptography first, and only if there's some reason it doesn't work, or some reason that public keys are already in place and waiting to be used, do I use PK. Symmetric crypto is simpler, faster, cheaper, easier to manage and much easier to analyze (for security validation).

One weakness to your scheme, in my opinion, is the authorization of a key. It's not enough to just have an already-authorized key in the area. I'd require inserting an authorized key in the USB port, then inserting the new key to be authorized in the same slot within, say, five seconds.

Re:And thats why...

[ByTor-2112]

Actually, the CPU power required to perform the exchange in a reasonable (1 second or less) length of time might take up much more space than available. The power drain could also be considerable. If you were still using a physical key, you could use smaller, less demanding keypairs and simply re-key every time the car key is in the ignition. Otherwise, you need to anticipate keeping the data secure against attacks for a good while.

Re:And thats why...

[Anonymous Coward]

Walk?! With all these hidden snipers gunning for me?

Re:And thats why...

[Lobachevsky]

Asymmetric encryption (public-private pairs e.g. RSA, DH, El Gamal) use symmetric encryption (AES, 3DES, etc) for the session. Asymmetric encryption is SLOW. No sane implementation ever uses asymmetric encryption on more than the hash of an email (signing) or the symmetric session key (key-exchange). This is a SIMPLIFIED example of a public-private "key-exchange" protocol:

Let PE = public encryption function/key, aka Public Key
Let PD = private decryption function/key, aka Private Key
Let S = symmetric encryption/decryption function/key, aka Session Key
STEP 1 ... opening an SSLSocket ...
Server --> PE --> Client
Server S(foo+MAC) --> Client // note: PE, PD never need to be used once the SSLSocket is successfully opened
Server -- S(bar+MAC) -- Client

What does this mean? Two things. First, it means that SSL is as fast as symmetric encryption, because it _is_ symmetric encryption beyond the first part of establishing the connection. Secondly, it means that SSL is no stronger than symmetric encryption because the hacker can _EITHER_ solve PD or S, which can never be harder than solving just for S. The advantage of solving for PD is that the hacker would gain access to ALL sessions with the Server. Solving for S, a "throw-away session key", only gains the hacker access to ONE session. But still, assuming there exists no solution better than brute-force exhaustive search across the space of S, it ~almost~ just as likely you will discover the fixed S as you would a variable S. (For a fixed S you have a 1/S chance of being on your first attempt, a 1/(S-1) chance of being right your second attempt, etc., with a 1/1 (100%) chance of being right on your Sth attempt, but that gives you an average of a 1/(0.5*S) = 2/S chance of being right. For a variable S, you always have a 1/S chance of being right on any attempt. So, it's a 2/S chance (on average) vs 1/S chance (on average). Do you know what that means? They're practically identically difficult problems (both are O(S) complexity). If the fixed S had one extra bit than the variable S, then the amortized chance of being right would be identical. This boils down to the conclusion that communication via fixed symmetric keys are NOT in any way more zero-knowledge hackable (i.e. brute force hackable) than communication via asymmetric keys since the real communication past the handshaking uses a symmetric key.

It would be VERY different to say that fixed symmetric keys are less secure than asymmetric private keys, and I would completely agree with you: there's a logistical problem of passing a fixed symmetric key around to trusted members without a "leak", whereas with asymmetric encryption, I don't worry about leaks or rogue members because I only give out the public key and not the private key. But the primary reason fixed symmetric keys are "less secure" is a logistical problem, and NOT a mathematical problem. Mathematically, symmetric keys are as powerful as needed in a non-quantum-computing environment. That's why top-secret communication using 4096Kbit military-grade RSA (asymmetric) keys in the handshake still use 256bit variable AES (symmetric) keys for the session. Don't confuse the logistical issues of _fixed_ symmetric keys from the technical power of a symmetric key.

Re:And thats why...

[Lobachevsky]

I forgot to use < and > instead of < and > Here's a patch:

This is a SIMPLIFIED example of a public-private "key-exchange" protocol:

Let PE = public encryption function/key, aka Public Key
Let PD = private decryption function/key, aka Private Key
Let S = symmetric encryption/decryption function/key, aka Session Key
STEP 1 ... opening an SSLSocket (handshake, simplified -- no need to go through Cert chains and other nuances in this example!) ...
Server --> PE --> Client
Server <-- PE(S) <-- Client

STEP 2 ... communicating messages, where the message is concatenated with its MAC (message authentication code: sequence + hash), to prevent replay attacks or malicious noise, before being encrypted by the symmetric session key ...
Server --> S(foo+MAC) --> Client // note: PE, PD never need to be used once the SSLSocket is successfully opened
Server <-- S(bar+MAC) <-- Client

Re:And thats why...

[swillden]

Asymmetric encryption (public-private pairs e.g. RSA, DH, El Gamal) use symmetric encryption (AES, 3DES, etc) for the session. Asymmetric encryption is SLOW. No sane implementation ever uses asymmetric encryption on more than the hash of an email (signing) or the symmetric session key (key-exchange).

Obviously.

But when all you're doing is an authentication, like the case at hand, there's no point in setting up a symmetric key -- because you're not going to do anything with it. And you're right that asymmetric encryption is slow, which is why it makes no sense in this application.

This boils down to the conclusion that communication via fixed symmetric keys are NOT in any way more zero-knowledge hackable (i.e. brute force hackable) than communication via asymmetric keys since the real communication past the handshaking uses a symmetric key.

Just to pick at nits, this statement presumes that the attacker doesn't benefit from larger amounts of ciphertext (and, usually, predictable plaintext). If the symmetric cipher had some weaknesses such that the attacker did benefit from more data to work with, then there would be additional security in using session keys.

In practice, (1) there's no known significant benefit to the attacker in having lots of ciphertext to play with given modern ciphers like AES and 3DES and (2) nothing stops you from using session keys with a purely symmetric implementation anyway. In fact, most of the systems I work on do generate a symmetric session key as part of the mutual authentication process, even though the authentication is itself done with a fixed symmetric key.

It would be VERY different to say that fixed symmetric keys are less secure than asymmetric private keys

But what I said was that fixed symmetric keys are at least as secure as asymmetric keys (which are also fixed). This is because there are more known and suspected weaknesses in the asymmetric algorithms, and there's an obvious mathematical breakthrough which would defeat them. In practice, given sufficiently large keys, both AES and RSA are unbreakable as far as we know.

But the primary reason fixed symmetric keys are "less secure" is a logistical problem, and NOT a mathematical problem.

Yes, the only thing assymetric systems buy you for their greater computational cost and complexity is some potential help with the key distribution problem. But that problem doesn't exist in this case, so there's no reason to bother with RSA or similar.

Don't confuse the logistical issues of _fixed_ symmetric keys from the technical power of a symmetric key.

What made you think I do?

Re:And thats why...

[Anonymous Coward]

Just do what I do, pop off the little treadmill and remove the hamster. It's not like someone can just pull a spare one out of their... oh, nevermind.

Re:And thats why...

[iminplaya]

I used an easy solution for that also. I put a splice into the wire leading to the fuel cut-off solenoid. And for double protection, I had a removable steering wheel. If I was really paranoid, I guess I could've bought a "Denver boot". But the best anti-theft device I fuond was to sell the car.

Re:And thats why...

[bhtooefr]

Duh!

I should have thought of that...

Of course, on the steering wheel, a socket driver, a 24mm socket, and a screwdriver are all I need to take it off. In under one minute. Back on is the same amount of time, assuming that I had previously put markings on to align the wheel.

Oh, and my car is a 21 year old car with a fair amount of visible rust, and right now it's not even drivable. So, I'm not thinking anyone's gonna steal it. :)

Re:And thats why...

[Evanisincontrol]

If you're THAT paranoid, you just walk.

What if someone steals your legs? Did you think of that?

Always be prepared, my friend.

Re:And thats why...

[Zeinfeld]

There is no value in a public key scheme here. If either the key or the car is compromised the other is. The protocol only ever involves the same two parties, the car and the key.

There seems to be some confusion as to what is going on here. The attackers are not trying every code in turn, they are doing cryptanalysis of the weak crypto scheme used in the keys which is 40 bits or so.

Re:And thats why...

[modecx]

There's this iButton thing that I was researching for use as a physical access key that I found around 1999. They said it would do SHA authentication by touching a hearing aid battery sized device attached to a key fob, to a receiver plate--in less than a tenth of a second.

I know that SHA is now found to have collision vulnerabilities, and that it can be brute forced with tons (and tons, and tons) of CPU time, but it would probably still be practical, and effective in preventing all but the NSA from breaking into your car.

I doubt that it would be terribly difficult to make a fairly strong public key encrypted radio operated lock that worked just as quickly. The main limiting factor would be the amount of power required to operate whatever dedicated processor was necessary, and how good of an antennae you could fit in the remote.

Re:And thats why...

[me3head]

That's exactly what they do. And the RKE systems use a rolling code, like a garage door.

Re:And thats why...

[dgatwood]

With regards to speeed, way back in 2001, the state of the art was 600kbit/sec. for a stand-alone RSA crypto chip with a 512-bit modulus. At that rate, what I proposed would take 1/20th of a second for the calculation in question. Several seconds? Hardly.

As for battery life, it's not like you push the button constantly. Those devices are typically only active if a button is depressed. You can have a pretty complex device and a long as you are only using it for a few seconds a day, that lithium battery is going to last a long time.

With regards to keeping the data secure, I'm not sure how that is relevant. In the scheme I proposed, the data is generated randomly when the request is made, is used once for authentication, and is never used again. There is no need to keep data secure against attacks, as replay attacks will be useless five seconds after the exchange occurs.

Now, if you meant that you had to keep the keys secret for a long time... in the design I have in mind, the public key can only be obtained through physical access to the device, and the private key pair cannot be obtained without physically cutting into the microcontroller and reading the value from the flash part using an electron microscope....

Re:And thats why...

[dgatwood]

If that were what they did, it would not be crackable in twenty minutes. What I described wouldn't be crackable by a single laptop in twenty YEARS.

Rolling codes only are useful if you can't snoop more than about one or two attempts. Then, they become nearly useless. If you only have a tiny portion of the information public (e.g. using a shared encryption key a la SecurID), it might help, but again, if that's what they were doing, it wouldn't be crackable in twenty minutes.

Re:And thats why...

[Anonymous Coward]

After all that work -assuming the driver has not lost the key, of which there would only ever be ONE (so never, ever lose it!) because duping the key would be too hard/too expensive- the car can still hauled away on a boring old tow truck, stuffed into a container and shipped* off to China.

Fancy security systems, alarms, ECU cutouts, etc are nice but the tow truck defeats all of them.

One thing I do to defeat the thieves is take my ignition relay inside with me. It is not possible to start the car without the relay and it's highly unlikely that an average theif would just happen to have my specific relay in his/her bag of tricks.

But a tow or large forklift could still take the car anyway. But it's an old car. I trust that helps me a little. Nobody would want it. I hope.

*China. Or Mexico or Saudi Arabia or points unknown. In the office park where I work, a new company has setup shop shipping cars to China in common truck container boxes. From the looks of things, they buy wrecked cars at auction, pack them up, and send them to China.

It appears legit from across the parking lot but this is the same sort of operation is used by car theives.

The oddest thing about this place is that they have several big rigs just sitting around idling. Virtually all such trucks have to keep moving to make money, but these guys just sit for days at a time, waiting for a trailer or whatever. There has to be some deeeeeep pockets behind this operation if they can afford to have drivers sit for 2-3 days or longer.

Those hairs on the back of your neck that stand up when something's not right? This place makes those hairs jump out and run. But how much harm can come from shipping out cars?

Re:And thats why...

[gedeco]

Regular keys take seconds to defeat. The electronic ignitions take 20 minutes. That's a pretty big improvement in the grand scheme of things.

But on the contrary, the thief can work unnoticed 20 minutes in another car parked next to it. Actually they could have broken the software long before the theft. After 20 minutes, he makes a phone call and sombody enters the hacked vehicle and drive away.
Nobody will see the difference even when you see it happen.

Regular keys takes seconds to defeat: This applys to regular thieves. When trying to break in they could get caught due to suspicious behaviour.
The laptop hacker just walks to the car and opens it and drives away. Nothing suspicious about that.

Re:And thats why...

[v1]

And since the car will be ignoring bogus codes (to avoid being fooled by other cars' remotes), you can pretty much send it crap until you hit the right value with impunity

That's not quite how it works. The transmitter sends a two part code. It's a bit like a credit card. It sends its unique number, plus what amounts to a PIN. The only car that listens to it is the one who has a matching unique code. Then it compares the pin. Five mismatched pins and it will go on the offense, usually ignoring all code attempts for the next 5 minutes or so. More aggressive systems might disable the system entirely, but that's a bit draconian since any twit could use a rigged remote to go around town killing cars. The PIN is either generated randomly at the factory, or (less securely) by using a formula based on the PIN. (systems that use formulas are much less secure)

More sophisticated systems (bmw'ish) use two way remotes that do challenge-response, so that it's not possible to "sniff" a code at short range and simply play it back tomorrow when they come to work and park in the same stall. The remote sends a "hello", the car replies with a randomly generated challenge. The remote generates a reply based on its private key and transmits it back to the car, which disarms it. (theoretically the remote never transmits the same code twice, and each time you try to disarm the car the car requires a different response) Some ignition key systems work this way also.

So you cannot simply park next to a car and try all the codes in a 20 minute run. Good remotes will have a large number of unique codes (so you have to sniff the code when the owner arms/disarms it) and will have a large number of possible PINs, as well as a reasonable disable time. If the PIN is only 3 digits, and the sleep period is 5 minutes after 5 failures, it will take on average eight hours break the code. You may be nondescript with a laptop in a car, but if you stay parked next to that BMW all day long sitting in your car, THAT will attract attention. (and the owner is likely to return by then anyway)

(ok that was odd, your post changed while I was previewing my reply... owell here it is anyway :P)

Re:And thats why...

[greenzrx]

no plug wires either, i'm afraid. the coils sit ontop of the spark plugs. Cobb's Accessport has a theft deterrent map which either cripples or disables the engine until the map gets switched. it's a PIA to switch the map each time you park though. Also, you'd need to carry around the accessport to swap maps - inconvienient at best. Better off with good theft insurance.

Re:And thats why...

[BLKMGK]

Umm, they ARE randomized! The Euro cars in particular are a real bitch with this kind of thing. Mercedes, BMW, blah blah - tough key systems. Dunno' if Domestic manufacturers are doing this or Japanese but the Germans sure are. Most of the Japanese and Domestic stuff I've seen is still keyed but Caddy, Corvette, and maybe some of the high end Japanese may be moving wireless and I doubt they are using static keys. Heck, some of the Euro stuff uses IRDA...

Re:And thats why...

[ByTor-2112]

I'm still very doubtful that you can fit this type of device in the proper form factor.

Moral:

[Musteval]

Laptops are evil.

Fortunately, friendly Republican senators are even now pushing a bill through Congress to outlaw these devil-machines. Always looking out for our interests, those guys.

Re:Moral:

[ntsucks]

Unfortunately, friendly Democratic senators are sponsoring a plan where the federal government will buy a laptop for thieves that do not have their own. ;-)

Re:Moral:

[Anonymous Coward]

oh so THATS where they are getting those 100 dollar laptops!

Re:Moral:

[Gogo0]

Poke fun at republicans: mod up funny/insightful
Poke fun at democrats: mod down offtopic/flamebait

Yep, this is slashdot.

Re:Moral:

[fm6]

No, what makes this Slashdot is that every mod somebody disagree with is taken as a sign that the whole system is broken. Bogus. At this moment, the comment that teaks the demos has the same score as the one that tweaks the repubs.

A few weeks ago I said something unflattering about GWB, and immediately got downmodded. How does that fit in your theory?

Re:Moral:

[Pieroxy]

Let it be clear for everyone now: Buying a laptop is clearly funding terrorists activities. Such as downloading an MP3 or ripping a CD. I mean come on, ripping a CD !!!! The name says it all!

IF it wasn't meant to be ripping off artists (which is now widely assumed to be equivalent to funding terrorists activities), it would have been called otherwise.

Isn't the digital revolution a lot of fun?

Re:Moral:

[Rude Turnip]

No, no, you're not thinking like a Republican; here's how it would go:

Laptops will stay legal. That way, more cars with wireless security get stolen. Your insurance premiums go up due to increased theft, which pays back the insurance companies for their campaign contributions. Moreover, once you get your settlement check from the insurance company, those funds then go towards the purchase of a new car, which pays back the auto lobby.

Now, couple this logic made with the post made by ntsucks:

"Unfortunately, friendly Democratic senators are sponsoring a plan where the federal government will buy a laptop for thieves that do not have their own. ;-)" ...and you'll see that both major political parties are just two sides of the same coin. The laptop industry wins, the insurance industry wins and the auto industry wins, all at your expense. And of course since most laptops are made in Taiwan, a large portion of the laptop purchase proceeds will prop up the government of Taiwan, who will buy their military gear from American defense companies. It's all so freaking clear, people!!!

Re:Moral:

[RazorBlade99]

Nah.... the democrats will just promise to get the thieves the laptops to acquire votes from that demographic group but never deliver the laptops once they gain office.

Re:Moral:

[Anonymous Coward]

Won't do them much good to try to get votes from the thieves, unless they're only targeting the ones who haven't been convicted yet. :)

Re:Moral:

[lakin]

Here at slashdot, we do not tolerate unflattering talk about the George Washington Bridge!

Re:Moral:

[Anonymous Coward]

Maybe it was lame even by Slashdot standards, if that's even possible.

Re:Moral:

[fm6]

Don't be dense. It should have been obvious from the context what I was talking about.

Re:Moral:

[Gogo0]

A few weeks ago I said something unflattering about GWB, and immediately got downmodded. How does that fit in your theory?

It doesnt, my comment was just a ploy to get the parent modded up so that some of the foaming-at-the-mouth liberal mods could prove how wrong I am.
It works every time.

Re:Moral:

[fm6]

Talk about double binds. Either outcome "proves" your theory.

Re:Moral:

[Gogo0]

Thats what makes it humorous... or rather what was supposed to make it humorous...
Too far down the thread three on a day-old story to be too humorous, in any case.

Re:Moral:

[fm6]

Funny how right-wingers like to say, "I was just making a joke" when they get caught saying something stupid.

Re:Moral:

[Gogo0]

Nice observation.
So I guess that since youre not a republican, you will just admit how stupid that was in stead of trying to spin it into a joke?

Related video

[Crussy]

I saw a video from a conference in Germany that has to do with infared hacking. It's quite interesting if you have the time to watch it.

Re:Related video

[antifoidulus]

Just a heads up to anyone planning to download the video, it is a hefty 330 megs.

Re:Related video

[Rosco P. Coltrane]

Well right, it's slow over IRDA...

Re:Related video

[laron]

This video (and many more) is also available as a torrent:
http://media.ccc.de/filez/congress/2005/lectures/v ideo/mp4/22C3-videos-incomplete-20050423-torrents/

Re:Related video

[Linker3000]

I programmed an old Radio Shack learning remote control with the IR key fob for a the Sales Director's 7-series BMW (about 15 years ago) and really used to piss him off by re-unlocking the car in the car park from my desk as he tried to lock it when he arrived at work.

Re:Related video

[buck_wild]

You had a remote? We had to use pieces of string and paperclips. Yeah, and some bellybutton lint! Man, we blew his doors cleeean off.

About time . . .

[turbopunk]

I knew this was going to happen a LONG time ago.

I'm surprised it took this long.

Re:About time . . .

[kfg]

I'm surprised it took this long.

It didn't. They've been showing it on TV cops and robbers shows for some years already. It aint' exactly news if they did it on The A Team.

KFG

and then what?

[JeanBaptiste]

I've been under the impression that thieves steal cars to strip them for parts, as its impractical to re-sell a stolen car as a whole.

Are parts for luxury cars that specialized? I thought most parts were more or less universal these days. Does a H3 take a special spark plug or something? /20 minutes and a laptop? //more like 2 minutes, a brick and a screwdriver

Re:and then what?

[joshsisk]

The sparkplug may be standard (not that anyone steals a car to sell the sparkplugs) but the engine components, as well as all the body components, transmission, etc, are likely not. A new bumper for my (not luxury car) would cost me at least $500 new, for example.

Re:and then what?

[7macaw]

A spark plug may be more or less generic, but transmission, engine, engine-controlling computer, etc. are more specialized and tend to be expensive just because the owners of an expensive car are supposed to be able to pay some more.

And speaking of hummers, a set of those shiny rotating wheel covers costs around 5 or 10 thousand, I think.

Re:and then what?

[deacon]

These high end luxury cars are exported overseas to markets (North Africa for example) where the origin of the car is easily hidden, and the new owners might not even care.

Crash parts are taken from cars that are very popular, like Toyota Camry, where there is a big demand due to the huge number of cars on the road.

An original Toyota front fender is about $260. Add headlights, front bumper cover, hood, grill, and a stolen Camry is worth almost 2 K in just front end parts.

Re:and then what?

[Anonymous Coward]

Actually luxury cars are usually stolen for export. The most common car thefts are things like Honda Civics that are strippe dand sold for parts. This is not practicle with luxury cars that have serialized parts.

Luxury cars are usually only stolen under limited circumstances. That is someone has a buyer in China, Saudi Arabia or a random warlord and they steal the car in a port city Los Angeles usually drive it into a cargo container and ship it out never to be seen again.

Re:and then what?

[thebdj]

Another thing is that a lot of times parts from luxury cars are interchangeable with those of lower models. I remember hearing somewhere that thefts of Acuras was up because people would buy the parts for Honda automobiles. Sometimes this is buying a bigger engine or luxury parts that they do not sell in the lower end cars. I would imagine this sort of interchange can also be done with Toyota and Lexus and pretty much any other car line and its luxury counterpart.

Some cars do make it overseas, but unless you live in or near a port city, odds are your cars are being stolen for parts. I mean why would you ship cars from middle America to a port town when you can just distribute the various parts well enough locally. Besides, most port cities have their own abundance of cars for the taking, especially when you consider the majority of the US population is still situated out towards the coasts.

Re:and then what?

[sunwukong]

Also keep in mind that the parts market is where dealers and shops make a lot of money -- the margins are huge.

A consumer group once calculated that rebuilding a $30K Honda from "genuine" parts would have a material cost of over $90K!

Re:and then what?

[einhverfr]

We have an older used Audi (combo electronic/physical lock, iirc both are required to drive the car but either one can open the door).

We had to get a fuel injector replaced. Unfortunately, Audi had changed the specs so it meant that we had to replace all six of them at $100/fuel injector.

So the answer is "yes."

Re:and then what?

[necro2607]

They spinners, foo'!

Re:and then what?

[kfg]

Are parts for luxury cars that specialized?

On my Maserati even the paint was specialized.

KFG

Re:and then what?

[Anonymous Coward]

It happens the other way too... Many driveline and suspension components from the Nissan 350zx (and the big-ticket: 350zxTT) fit the Infiniti G35. Giving you Luxury car Luxury with Sports-car performance and handling (almost... the G35 still weighs a lot more).

Re:and then what?

[ScottCooperDotNet]

Get the car over the border and it likely won't be traced.

Re:and then what?

[eMartin]

The article talks about luxury cars, but these keyless systems are far more common than they make them out to be. At least in Europe.

I spent ten days in England recently, and with the exception of my grandmother's 20 year old Peugeot, every car I rode in had a keyless system. None of them were luxury cars. Some, far from it.

Re:and then what?

[Mister Whirly]

And those rims don't require a laptop to steal....

Re:and then what?

[Mia'cova]

Not if you know where to buy them! ;)

Re:and then what?

[ben0207]

I live here (England), and have done since birth, and I assure you, you are either talking shit, or never ventured out of Central London.

Re:and then what?

[Mister Whirly]

but it did go 185...

Re:and then what?

[kfg]

but it did go 185...

Dunno, I decided not to lose my license finding out. I like to drive.

But, ummmmmmmmmm, It was really sweet at a buck and quarter. Don't tell anyone 'bout that, 'K? Life's been good to me so far.

KFG

Re:and then what?

[Mister Whirly]

heh, yeah my Camaro speedometer stops at 130, so I don't really exactly know how fast it goes. I do know it had about 1/4 gas pedal left after it hit 130 though...

Um, hypothetically of course... :)

Re:and then what?

[hibiki_r]

Of course they do:

http://www.autobytel.com/content/buy/lm/new/index. cfm/make_vch/Honda/model_vch/S2000

Re:and then what?

[Ogive17]

Are you thinking of "keyless entry"? Yeah, most cars have that as a standard option now.

Now for the keyless entry that this article talks about, it is NOT that common. I work for Honda and even though 99.9% of what I do involves N. America or Japan, I'm fairly certain we do not have many models ANYWHERE with said system. The only one we sell in the US is the Acura RL.

Re:and then what?

[vertinox]

I've been under the impression that thieves steal cars to strip them for parts, as its impractical to re-sell a stolen car as a whole.

Yeah... In most states it is virtually impossible to even buy a car from another state and bring it across the border and avoid sales tax. Much less get a full fledged stolen car.

Although, it appears that pepole don't steal as many cars as they did 10 years ago. Mostly because the parts are becoming too complex to tear out and use in similar cars. I was lucky to find a new computer for my old 91 Mitsubushi in a Junk yard from wrecked one and this was a few years back.

Anything made past 2000 is just unreasable to expect returns off scraped items unless you have the computer equipment in your garage to get it working correctly and I don't think most chop shops would put that much effort in it.

That and in most states it is impossible to pass inspection with scrap work cars.

I could be very wrong though... Perhaps organized crime has such shops.

Re:and then what?

[Magical Pingu]

Keyless entry is very common - i.e unlocking the door with a remote key. But keyless/handsfree startup isn't that popular. It's mostly Renault cars that use it. They all start up by inserting a card into the dashboard and pressing a button. Their upper range cars have handsfree entry, which is all proximity based - you don't need to take the key out of your pocket to open the door and drive it.

Re:and then what?

[Anonymous Coward]

Lots of cars simply get loaded onto ferries and 'exported' to other countries where they get sold on the second hand market.

Re:and then what?

[Anonymous Coward]

The window glass is probably the most valuable part, considering all the assholes who would happily break it to get the rest of the crap.

Re:and then what?

[eMartin]

As I understand it, there was a switch to start the car, but it only worked when the "key" was nearby, although that stayed in the driver's pocket or bag.

Re:and then what?

[eMartin]

Well yes, the cars were all from London. One of them was a rental.

But no, I'm not making it up. I think I was probably in six different cars on the trip, and five of them were keyless.

They were all recent models except my grandmother's, but they were not luxury.

Re:and then what?

[WoodieR]

that's mark-up for ya ... and just think ... those parts really only cost Honda $1500 to design and test and manufacture ... then they sell you the car for $30,000, then they sell you the parts for $90,000 ... and just think if you finance this thing ??? $30,000 * 3.9% amortized over 6 years = $outrageous$ repaid

And so it follows...

[MudButt]

This is exactly why my daughter will not have a keyless chastity belt...

Re:And so it follows...

[peragrin]

Wait!! Your on Slashdot, your not supposed to have childern!!!

Sorry I couldn't help myself.

Re:And so it follows...

[Anonymous Coward]

Learn to help yourself, fucktard.

Re:And so it follows...

[cez]

Surprising that Northstar or whatever luxury gps / alarm service that these newer vehicles have can't detect a brute-force attack. I can't imagine its as easy as finding the right frequency, there has to be some sort of security thats being actively bypassed, one that should send up a red flag. "Too many ignition start attempts...you are being locked out of your vehicle for the next 60 seconds..."

Re:And so it follows...

[CCFreak2K]

If I had a daughter, I'd want the SMART ones to procreate with her.

I'm 18 though, so it's a moot point right now, heh.

Re:And so it follows...

[6079 - Winston S]

Wait.. You want to protect your daughter's chasity against geeks?

Talk about missing the target demographic.

Re:And so it follows...

[Anonymous Coward]

so only you can have sex with her?

Re:And so it follows...

[caluml]

What you need is a trusted 3rd party to hold onto it for you. I, am just such a person - my "Excellent" Slashdot karma confirms this. I will only require one payment for this service, deliverable on your daughters 18th birthday.

Re:And so it follows...

[Leomania]

If I had a daughter, I'd want the SMART ones to procreate with her.

And what if she ended up with a script kiddie instead?

Re:And so it follows...

[HTH NE1]

This is exactly why my daughter will not have a keyless chastity belt...

Like there aren't portals around back and on the balcony.

Re:And so it follows...

[Anonymous Coward]

LOCKSMITH!!!

Re:And so it follows...

[Anonymous Coward]

You just came up with the best hacking competition ever.

Re:And so it follows...

[Kuvter]

You have a daughter!? Your screen name is MudButt. What woman would sleep with a MudButt?

With that said, same for when I have a daughter.

Re:And so it follows...

[Anonymous Coward]

Which is why you put a nappy (diaper) on under the belt (the belt prevents removal) and make her brush her teeth before you kiss her goodnight.

Re:And so it follows...

[Any Web Loco]

Is that a euphemism?

Resale Value

[gyrogeerloose]

Cool! The resale value of my 10-year-old car just went up!

Occam's Razor strikes again...

Re:Resale Value

[kfg]

Cool! The resale value of my 10-year-old car just went up!

Chief auto theft deterant device: Driving a ten year old, Monkey Shit Brown Oldsmobile Delta 88 with flower vases in the rear window and a "Support the Troops" ribbon on the trunk lid.

KFG

Re:Resale Value

[owlstead]

Those kind of cars are pretty much used by joy-drivers and sometimes by homeless people to sleep in (and sometimes to do more than just sleep). I've got two friends whose old cars were stolen and used by joy-riders (without the use of keys). And one whose expensive merc was stolen by a joy rider using the keys stolen from his house (actually, he was featured on slashdot). The merc was pretty damaged, the two other cars were total-loss (though you could buy ~ 10 old cars to fix the merc).

So just having an old car does not keep you from harm.

Re:Resale Value

[kfg]

Those kind of cars are pretty much used by joy-drivers and sometimes by homeless people to sleep in. . .

Worse than that. He's a drummer.

KFG

Re:Resale Value

[HansieC]

I'd say if you had a 10 year old '88 model car in 2006 selling it would be the least of your problems (or financial boosts).

Re:Resale Value

[jimicus]

This friend of yours didn't happen to make the news because he chased after his stolen merc naked?

Re:Resale Value

[owlstead]

Well, no, obviously he wasn't at home when they stole the keys. Although I could think of people forgetting to lock their house when they are taking a shower.

text of article

[Anonymous Coward]

Text of article:

High-tech thieves are becoming increasingly savvy when it comes to stealing automobiles equipped with keyless entry and ignition systems. While many computer-based security systems on automobiles require some type of key -- mechanical or otherwise -- to start the engine, so-called 'keyless' setups require only the presence of a key fob to start the engine.

The expert gang suspected of stealing two of David Beckham's BMW X5 SUVs in the last six months did so by using software programs on a laptop to wirelessly break into the car's computer, open the doors, and start the engine.

"It's difficult to steal cars with complex security, but not impossible. There are weaknesses in any system," Tim Hart of the Auto Locksmith Association told the U.K.'s Auto Express magazine. "At key steps the car's software can halt progress for up to 20 minutes as part of its in-built protection," said Hart.

Because the decryption process can take a while -- up to 20 minutes, according to Hart -- the thieves usually wait to find the car in a secluded area where it will be left for a long period. That is believed to be what happened to Mr. Beckham -- the crooks followed him to the mall where he was to have lunch, and went to work on his X5 after it was parked.

While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands.

According to the Prague Post leaving such information on a laptop is what got Radko Souek caught for stealing several cars. "You could delete all the data from your laptop, but that's not good for you because the more data you have, the bigger your possibilities," he says. He says any car that relies on software to provide security can be circumvented by other software. "Every car has its weak spot," he says. Souek faces up to 12 years in prison.

The Leftlane Perspective: Many modern cars now rely on software entirely for security. Gone are the days where microchips supplemented mechanical locks as an additional security measure. In the case of true 'keyless' systems, software is the only thing between a thief and your car. As computers become more powerful, will stealing cars become even easier? Never mind future cars with better security -- what about today's cars a few years down the road? With cars as inexpensive as the Toyota Camry offering entirely keyless systems, these concerns a relevant to all consumers.

Posted anonymously to avoid karma whoring.

Re:text of article

[Anonymous Coward]

The worst thing about a Toyota Camry is an engineering flaw IMHO. When the Camry is stopped and shifted into park every damned door unlocks automatically. It's a car jackers dream.

Re:text of article

[Goblez]

"As computers become more powerful, will stealing cars become even easier?" Or perhaps the question should be, if the people that are stealing the cars are better educated (hacking the security system), will it be harder to stop them from finding a way to steal it? -- Goblez P.S. The answer is Yes.

Re:text of article

[Bob3141592]

It's difficult to steal cars with complex security, but not impossible. There are weaknesses in any system," Tim Hart of the Auto Locksmith Association told the U.K.'s Auto Express magazine. "At key steps the car's software can halt progress for up to 20 minutes as part of its in-built protection," said Hart.

There's an Auto Locksmith Association? As opposed to a House Locksmith Association or a Train Locksmith Association? Are we getting a little bit too highly specialized these days?

Re:text of article

[fm6]

Different level of security. A front door look just has to be hard to pick. It doesn't have to try to prevent the burgler from starting up the house and driving it away.

Re:text of article

[Anonymous Coward]

What a varied world we live in. One guy is surprised that his car got broken into for a stack of expensive gadgets and another worries about carjackers.

Gone in 20 Minutes...

[im_mac]

Are they referring to their server? 5 minutes after the link arrived on /. and I already get a timeout error.

I think I speak for everyone when I say...

[drinkypoo]

".torrent?"

VERSE VICEA

[Philip K Dickhead]

I want use Cars to steal LAPTOPS!

Re:VERSE VICEA

[jspoon]

I want use Cars to steal LAPTOPS!

That's only allowed in Soviet Russia.

Re:VERSE VICEA

[ichigo 2.0]

Try camping outside of a university with your car. When you see a group of people with laptops use your GTA-honed driving skills to "acquire" their property. Remember not to drive over too many people, or else you won't be able to shake the cops without a new paint job on your car.

Re:VERSE VICEA

[Anonymous Coward]

Actually, in Soviet Russia, cars (with dark tinted windows) steal YOU.

Re:VERSE VICEA

[Firehed]

Unless you have a red car, surely the "paint" job is included.

Re:VERSE VICEA

[Kenshin]

Nothing's stopping you from driving through the front window of Best Buy.

Aside from the reenforced concrete poles, of course.

Glad I didn't get a Prius

[mikeisme77]

The keyless feature of the Prius was one of the main reasons I was considering it over the hybrid Honda models, but after considering the higher price of the Prius and reading about the insecurity of RFID I decided against it. Now I'm even more sure I made the right decision.

Re:Glad I didn't get a Prius

[ConsumerOfMany]

Im pretty sure the fact that it is a Prius is the best deterrent against theft you can have.....

Re:Glad I didn't get a Prius

[NuShrike]

What's wrong with the price of the Prius? Have you compared the cost vs included creature comforts item by item, inch by inch, to see how the price is justified versus whatever you were buying? Still cheaper than the other hybrid models.

You don't see people complaining you're never make your money back buying that navigation/V6+/European/SUV/luxury type vehicle.

You can turn off the RFID keyless entry. The only thing the RFID could then be used is engine ignition.

Sounds like a weak straw-man argument you have.

Re:Glad I didn't get a Prius

[mikeisme77]

The Prius with similar safety features to the hybrid Honda Civic I bought was $3,000-4,000 more in the Chicago area because they chose not to sell package 4 in this area--and anything less than that and I wasn't getting the safety features I wanted/needed. Estimated EPA of the Prius is higher, but not by that much more, and I'm getting higher than the EPA of the Civic hybrid. I actually thought the Civic was more comfortable to drive as it allows greater adjustment of the seat and steering wheel. The main things the Prius had over the Civic (besides slightly higher EPA rating) were storage space and cool tech items (that I didn't need, and some I didn't even want). The keyless entry was a feature I DID want and might've been enough to tip me over toward the Prius had it not been for the security issue.

Re:Glad I didn't get a Prius

[CheshireCatCO]

Getting into a car isn't that hard. Getting it to move is tougher. So it's precisely the ignition that I'd be worried about, not the keyless entry.

As far as the GP's logic goes, I understood it perfectly: not everyone wants/needs all of the add-ons. If you're looking at a Civic, you're probably worried about the bottom line you're paying right now, not in five years. I know I was when I got my hybrid. Which is part of why I didn't get a Prius myself.

I don't think anyone is saying that the Prius is over-priced. But it is undeniably more expensive. For many of us, that's a factor.

Re:Glad I didn't get a Prius

[HTH NE1]

What's wrong with the price of the Prius?

They regularly sell for $3000 or more over MSRP, even when they are two years old with over 30,000 miles on them, you don't save much on gas unless you're in an overpopulated city with lots of stop-and-go traffic, and licensing is more expensive since the government feels they don't earn them back enough in gasoline taxes.

It doesn't have much for rear view mirror visibility.

I wanted one, but walked out when the dealer quoted one price, talked to his manager, and then quoted another that was $1900 higher. I got the 2007 Honda Fit instead.

Re:Glad I didn't get a Prius

[Mister Whirly]

Plus after you own a hybrid, you will grow to love the smell of your own farts...

Re:Glad I didn't get a Prius

[RzUpAnmsCwrds]

and reading about the insecurity of RFID I decided against it

My god, I am so tired of people labeling every RF-based system "RFID". The Prius uses an active (there is a battery in the transmitter), code-hopping system, just like many newer garage door openers.

Theives aren't going to hang around for 20+ minutes to steal your car. There are plenty of other vehicles that are both more valuable and considerably easier to steal.

Re:Glad I didn't get a Prius

[Mister Whirly]

Doesn't anyone watch South Park on /. ???

Security by Obscurity is no security at all.

[anubi]

From the article...

"While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands."

Re:Security by Obscurity is no security at all.

[Threni]

Same reason you can't trust the police/government with key escrow etc - the idea that those people never trust to "bad" (discuss!) people is laughable.

Anyway, 20 minutes to steal a car is well slow. You'd get caught, unless the police were really into doughnuts in your area. If you can't steal a car in under a couple of minutes you might as well give up.

Re:Security by Obscurity is no security at all.

[Anonymous Coward]

Ric Romero was ghost writing that day ...

Oh wait, sorry, wrong site.

Re:Security by Obscurity is no security at all.

[Chandon Seldon]

20 minutes to steal a car is more than fast enough if there's no visible sign of you doing it. Here's the scenario:
- You spot a target car parked somewhere.
- You park next to it, and press "enter" on your laptop.
- After closing the screen on your laptop and throwing it under the seat, you wait.
- When the lights on the target car flash because your laptop has found the unlock & start code, your buddy goes and drives it to the chop shop.
- You pick up your buddy at the chop shop ready to steal the next car.

Note that at no point does it visibly look like your breaking into a car or anything. Anyone who sees your buddy get in to the target car and drive off will assume it's his car. The only risk is that someone who knows the target car isn't yours sees your buddy drive off with it, in which case you probably don't want to have valid plates on your working car.

Re:Security by Obscurity is no security at all.

[edunbar93]

While automakers and locksmiths are supposed to be the only groups that know

Because, you know, there will *never* be any evil locksmiths or auto maker employees. Oh no.

shens

[slashdotnickname]

I call shens on this article.

Though what the author describes is technically possible, outside of test environments luxury cars are almost never stolen by strangers... friends or family members with grudges maybe, but professional car thieves avoid these cars because of their almost zero resell/chop-up value.

Re:shens

[TubeSteak]

but professional car thieves avoid these cars because of their almost zero resell/chop-up value.

Car thieves go after high end cars all the time.

If for no other reason than to steal the headlights & rims.

A friend of mine knew some people that would go out in a 4 man team to steal rims. They had an expensive hydralic jack and some power tools. He said they were shady guys, but would do a NASCAR Pit Crew proud.

And that's not even the pro's.

Re:shens

[Anonymous Coward]

Nonsense - they put the car in a container and ship it overseas. There are a lot of places where people care more about the status/price of a car than whether it has been stolen.

Re:shens

[ergo98]

outside of test environments luxury cars are almost never stolen by strangers... friends or family members with grudges maybe, but professional car thieves avoid these cars because of their almost zero resell/chop-up value.

Luxury cars are stolen all of the time, primarily to put on a container ship and send overseas (depending on where you are, overseas varies. A stolen car from Germany ends up in Canada, and vice versa, both without local paper trails documenting the theft).

Nonetheless this story..smells..bogus, or at best completely anecdotal. One short article on some random website is hardly convincing. It looks like a car-centered blog.

I'll wait until it has credible backers before I worry about thieves wirelessly stealing my car.

Re:shens

[PenGun]

The scam when I was young was to take a crane truck, grab a nice new vette and take it out to the toolies flip it upside down in a ditch and gut it. Took about 20 min to remove the running gear.

  It was kinda cool to come across a vette upside down looking like an old crab shell with all the guts missing.

    PenGun
  Do What Now ??? ... Standards and Practices !

Re:shens

[Breakfast Pants]

"And that's not even the pro's." And that's not even car theives. They are just taking the rims off of the thing on the street.

does this mean

[supe]

My updated keyless 1968 Rambler 550 classic is going to be stolen soon?
Guess I'll havee to down grade.

Re:does this mean

[Thunderstruck]

No, but they may come after my old Caddy'. Unlike a Rambler, a Cadillac is not a car to scorn.

Re:does this mean

[PenGun]

Nash Rambler

  How do I get this thing out of second gear ? ... toot toot

      PenGun
    Do What Now ??? ... Standards and Practices !

Re:does this mean

[RESPAWN]

You laugh, but I had a friend with a late 70's Ford pickup that he attempted to do work on himself one day. Anyway, he got a little too curious one day and took the lock cylinder out... and lost all of the pins. No, he no longer needed any key to start his truck. This was made even more fun by the fact that myself and some of our mutual friends would conveniently forget to lock the passenger door and he never remembered to check it. Eventually, when we'd get bored, we'd drive out to his work, get in to his truck through the unlocked passenger door, and move his truck to the other end of the parking lot.

He finally figured out what was going on when he saw us hanging out in the parking lot one day. :)

Re:does this mean

[FurryFeet]

I think I speak for everyone when I say your car has the absolute best thief deterrent. Ever.

Kudos to you, sir. Bravo.

Yea, right

[TubeSteak]

The Leftlane Perspective: Many modern cars now rely on software entirely for security. Gone are the days where microchips supplemented mechanical locks as an additional security measure. In the case of true 'keyless' systems, software is the only thing between a thief and your car.

So what?

It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.

I remember seeing on TV a news thing they did with a former car thief. He said that a car with a club, a brake pedal lock and an alarm system were the most secure. Not because they were un-stealeable, but because it wasn't worth the time or effort.

Maybe Car MFGs will get serious about security in the future, but I doubt it. The only business they lose is from people who see the top ten most stolen cars and think "I don't want one of those". Otherwise, stolen cars = money for them, mechanics and part manufacturers.

Re:Yea, right

[Breakfast Pants]

Yep, right now keyless entry can be duped by a straight replay attack. They need to implement query/response and prevent replays with cryptographic salts.

Re:Yea, right

[trentblase]

Yes, thieves will always target weakest link. I saw a think on TV where they hung out in a parking lot writing down VINs and asking people their names "for a survey". Then they would go to the dealer and social-engineer a newly cut key out of them. By the time the owners got back from the mall, the camera crew was able to demonstrate how easily they could have stolen the car.

Re:Yea, right

[Ryan Amos]

They lose a lot of money in the replacement parts market.

In the case of 4 or 5 year old import cars, they are stolen specifically for their parts. If you know how to move the merchandise you can chop up a 98 Civic and sell them for twice what the car is worth. Car companies lose money off replacement parts because many times unscrupulous mechanics will sell stolen parts as new.

Most of the cars on the "top ten most stolen" list are stolen for this exact purpose. So it has more impact on their bottom line than you might think.

Re:Yea, right

[P3NIS_CLEAVER]

The club is the stupidest thing in the world. One simply zips through the steering wheel with a hacksaw to remove it.

Re:Yea, right

[geobeck]

It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.

I don't think the type of key has much of an effect. Because car doors are designed not to trap the occupants in an accident, damaging the lock will make it fail open. My car was stolen about three years ago, when all it had on it was the Club, installed the old way, nice and tight in a horizontal position. After it was recovered, the insurance esimator told me exactly how he figured it was stolen:

1. Thief uses a screwdriver to open the door (5 sec).
2. Thief yanks on the Club to break the steering lock (5 sec).
3. Thief hacksaws the steering wheel and removes the Club (30 sec).
4. Thief uses the Club as... well, a club to bash off the ignition (10 sec).
5. Thief hot-wires the car and drives away (30 sec).

So in a couple of minutes, my car disappears.

I remember seeing on TV a news thing they did with a former car thief. He said that a car with a club, a brake pedal lock and an alarm system were the most secure. Not because they were un-stealeable, but because it wasn't worth the time or effort.

Interestingly enough, that's the exact setup I put on my car after getting it back from the shop... without the label from the alarm manufacturer that tells a savvy thief exactly what kind of alarm he's dealing with. And with the Club installed the new way, loose and diagonally, so at least it can't be used as a lever to break the steering lock.

Nowadays, I like to park my car right beside a nice, shiny mini-van with no visible security systems. (Dodge mini-vans are the most frequently stolen vehicle around here.) Anticipating the long time required to get though my hardware and unknown alarm system, a thief will always move to the next car.

Re:Yea, right

[poot_rootbeer]

It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.

A rock through the window defeats even the newer laser/dimple key systems.

The benefit of using a laptop, though, is that the thief doesn't have to engage in suspicious-looking activities like reaching through shattered safety glass on a car with a shrieking alarm, or fidgeting over the door lock with a bobby pin. Now they can just park a cargo van next to the target car, and sit in the back packet-sniffing to their heart's content without a passerby raising an eyebrow.

Re:Yea, right

[ergo98]

The club is the stupidest thing in the world. One simply zips through the steering wheel with a hacksaw to remove it.

Oh, so you saw that episode of Dateline or 20/20 too, eh?

I had an old, 300,000km '98 Dodge Neon -- one of the most stolen cars in my area.

Given that I didn't want the hassle of it being stolen, not to mention that I don't like equipping joyriders and criminals, I always used "The Club".

Several times cars in the vincinity, including cars on either side once, were broken into and attempted to be stolen (once the van beside me was stolen. I lived in an apartment complex in London, Ontario at the time, an area with terribly high property crime). The Neon wasn't touched.

Most criminals don't carry around hacksaws, and it's a much lower bar to stopping or at least disuading petty criminals than it is to stop a professional car thief.

Insert...

[Billosaur]

...favorite Knight Rider joke here: "Michael, someone's trying to connect to me via Wi-Fi and and override my locking mechanism!"

Re:Insert...

[TubeSteak]

"The connection via WiFi... I like it.
Hold me Michael, I'm scared."

Re:Insert...

[geekoid]

"Kit, wreck their credit, have their cars towed, and kill their dog. When your done, take me to the beach, it's my almost time for my lifegaurd shift."

couple of points

[mapkinase]

1. What kind of embedded os they are running? I am at total loss with modern cars.

2. It seems that this problem is more solvable than attacks on computers from the Internet, because the car hackers have the following disadvantages

*) less time to hack
*) less time to use the car after hacking
*) more visibility and danger of immediate apprehension
*) even the most luxurious cars are of a less source of income (after stealing) compared to what modern hackers can earn

Re:couple of points

[From A Far Away Land]

"1. What kind of embedded os they are running? I am at total loss with modern cars."
I can't say for sure but I'd guess Windows 95. It's the only OS that asks "Where do you want to go today?" and nothing else would make sense for a car.
"Humanity to others" just doesn't seem likely, especially in an SUV.

Re:couple of points

[TubeSteak]

1. Usually custom everything, if for no other reason than to try and frustrate the aftermarket mod chip guys.

2.

- If they know the owner isn't coming back soon, they have all the time in the world

- I'm not sure how you come to that conclusion.

- Again, I'm not sure how you come to that conclusion. If anything, a laptop is less conspicuous than the normal regimen of car-stealing tools.

- This is possible, but these aren't 'hackers', they're car thieves. I imagine your every day hacker wouldn't have a clue how to fence a stolen car.

Re:couple of points

[mapkinase]

*) Beckham (the schmack from the article) left his car in the mall. So the time is one day max. Hacker has time limited by the next security patch IF it is ever applied by the computer or the user.
*) This stems from the point 1. You need to dispose your car or store it (additional disadvantage) somewhere - this is pain in the neck, before the police is alerted. I expressed this "hot coal in the hands" situation by the formula "less time".
*) Compared to car-stealing tools - yes, compared to "normal" hacker tools - no.
*) Well, for the lack of a better term...

I think I did not make clear enought my point of comparison a computer software hacker and a car software "hacker"/thief, not comparison between a crowbar car thief and a laptop-empowered car thief.

Re:couple of points

[Anonymous Coward]

1. What kind of embedded os they are running? I am at total loss with modern cars.

As far as I can tell from my studies, none. You don't need a full blown OS to go through one loop and do lookups on a few dozen hashtables of fuel and spark maps. Most likely just a simple BIOS will do.

Seriously, you can program a BASIC stamp to run a car. It's not that complicated.

(from a code perspective)

Re:couple of points

[Anonymous Coward]

What kind of embedded os they are running?

Harmon-Becker (OEM for Mercedes-Benz, BMW, some Volkswagen, some Porsches, Ferrari(?), and a few other European manufacturers) has QNX, Siemens-VDO (Volkswagen, some BMWs) uses VxWorks. I know of one (small) OEM that uses Greenhills Integrity. Embedded Linux has a looong way to go in this industry. Processors are mostly Hitachi/Renesas SH4 with Becker and PowerPC at Siemens. This is only then main unit though, the thing that sits in your dashboard. There's a buttload of other controllers (whole range of 8- to 32-bit controllers from various vendors, ATMEL, Freescale, Infineon and others) in a modern car (motor management, anti-lock brake system, etc.). Some of this stuff might not even use an OS.

I saw a documentary on German TV the other day. There's a market for break-out boxes (or should that be break-in?) in Poland. Around 1000 a piece, IIRC. After breaking in the car and opening the dashboard the thief connects the box to the system bus (CAN) and it then starts even the newest (half a year old) Volkswagen models. I dont know of any car where data on the system bus is encrypted (yet) but starting the motor is complicated anyway. These boxes obviosusly have been done with a lot of insider knowledge.

Re:couple of points

[electr01nik]

1. What kind of embedded os they are running? I am at total loss with modern cars.

Most likely Windows Automotive 5.0, but could be very likely that what controls the engine/powertrain and what tells the doors to unlock is completely different software, just as it is very likely that the door locks tell the Microsoft PCU software to disable when the car is at a certain angle, as someone mentioned before.

~o1

What does she do?

[demonic-halo]

Hmm..

For someone to follow her around with a laptop for 20 min... And to need a chasity belt...

She's probably doing something she shouldn't be doing.

Re:What does she do?

[enrgeeman]

or someone.

How could it be that badly designed?

[AnyoneEB]

20 minutes? What, is it just sending some pre-generated random number? Are they really too lazy to use a simple challenge-response scheme like normal password authenication? Or would that take up too much battery power on the errr... key?

Of course, as another poster mentioned, it does not really matter what you can do fancily and wirelessly because you can just smash the window.

Re:How could it be that badly designed?

[David Horn]

No, the delays are part of (ironically) extra security on the part of the car's computer. Making the thief wait for 20 minutes gives the owner a chance to return to the car and discourages the thief from working on things in public. Mind you, chances are they simply park up near to the car they want to break into and play with their laptops.

Re:How could it be that badly designed?

[Zakabog]

But smashing the window will make a lot of noise, set off any car alarms, and you won't be able to start the car. Plus it's obvious it's not your car if you're smashing the window. Someone just sitting against their car using a laptop isn't that suspicious at all, if anyone asks you're just waiting for your friend.

Re:How could it be that badly designed?

[zakezuke]

But smashing the window will make a lot of noise, set off any car alarms, and you won't be able to start the car. Plus it's obvious it's not your car if you're smashing the window. Someone just sitting against their car using a laptop isn't that suspicious at all, if anyone asks you're just waiting for your friend.

While yes, smashing a window would make much noise... and looks rather suspicious... what are bystanders going to do about it? You would "think" they would phone the police but if you actually observe parkinglots where this tends to happen most people don't do jack. And heck even calling 911 the responce time can be anywhere from 5min to an hour by that time said theif could run away on foot or run away with the car.

Alarms are even more of a joke... they are so common place people tend not to even look anymore. It's better than nothing, but might scare away your average petty thief, but at this point people don't care unless it goes off all the time... like that jackass down the street who has a viper 3000... you know the one.

Re:How could it be that badly designed?

[Zakabog]

Even if you get into the car and no one cares that the alarms going off, and no one cares that you just smashed in a car window (how many times have you observed someone smashing in a car window while spectators did nothing and just watched? No one's going to smash in a window with you looking) you still have to start the car which is going to be impossible without using the laptop (although I think in a luxury car smashing in the window will set off some kind of alarm that'll stop you from turning the car on anyway.) You can't just hot wire a luxury car, they have all kinds of lock outs for all the systems if the key isn't present. The laptop acts as a key if you use it properly (as in don't smash the window with it.)

Re:How could it be that badly designed?

[zakezuke]

(how many times have you observed someone smashing in a car window while spectators did nothing and just watched? No one's going to smash in a window with you looking)

10 or 12... and I wouldn't say did nothing.... I at least looked for a phone, but none to be found. It unfortunatly is rather common. A good rule of thumb... if you part in the inner city... park where the drug dealers peddle their wares. They are the last people who want the police around and tend to do a better job than neighborhood watch.

Even if you get into the car and no one cares that the alarms going off, and no one cares that you just smashed in a car window you still have to start the car which is going to be impossible without using the laptop (although I think in a luxury car smashing in the window will set off some kind of alarm that'll stop you from turning the car on anyway.) You can't just hot wire a luxury car, they have all kinds of lock outs for all the systems if the key isn't present. The laptop acts as a key if you use it properly (as in don't smash the window with it.)

I don't honestly know about modern cards, as in cars made past like 2000, I was more commenting on the window smashing thing. Happens often enough and even if there are witnesses, it tends not to matter. I can however speak about experences with pre-2000 toyotas... where the cars do have a default mechanical mode even if the car's computer is kapaut. It'll run poorly, and often limited to 25 or 35mph, but the car will run.

I'm not up on modern fuel injection systems, so I can't say whether the vacuum is enough to permit fuel delivery without external assistance.

Assuming that is the case... there are three things you need to get an engine running...

1. Crank (Starter or a push)
2. Fuel (Fuel injection)
3. Spark (Timming and spark)

The starter motor is rather accidemic, it's just a dc motor. Fuel typicaly not an issue, but as I have no experence with trully new cars it might be. Spark would only be an issue if they decided to go with a trully distributorless system and lumped off the cam lobe. If the cam lobe still exists all you need do is connect it to a coil and your engery supply and poof, a running engine. Even without any sort of electronic advance it'll work well enough to move the car. If talking DIS, I know less about those, but the cue is probally done though magnetic induction, which would require some form of relay... something that is actually academic and might actually be easier as, near as i'm aware, there is a coil for every two cylinders in this event. Actually... come to think about it, a DIS would likely be easier.

Fuel injection i'm fuzzy on... but needless to say I find it hard to believe that it's impossible to steal a largly electronic car without a laptop. The technology to make an engine run is really very basic. Making it run "well" is more advanced.

That's not all

[From A Far Away Land]

There are reports out of Nebraska today that people with laptops have been seen plugging them into airport electrical outlets, and stealing electrons in an unguarded airport. The Department of Homeland Insecurity has declined to comment on the matter.
Details at 6:00

Re:That's not all

[Anonymous Coward]

Just look for the people with their beard hair standing on end.

Re:That's not all

[Breakfast Pants]

I believe you mean stealing electron momentum; turn in your geek card.

Re:That's not all

[From A Far Away Land]

I may have to yield to your geek cred, but explain how a battery contains "electron momentum"? My understanding is that electrons build up in the battery, so that there is a difference in charge, that once a circuit is available, the electrons flow to the positively charged end of the ciruit, providing power to the device.

Re:That's not all

[temojen]

Is it really stealing if they put the electrons back when they're done with them?

Re:That's not all

[littlerubberfeet]

Ahhh, pants is correct. That AC outlet serves up nice little chunks of energy...no actual electrons move, they just vibrate eachother on down the line at 60 Hz. If the airport supplied DC power, then one could steal electrons...

Or, actually, we are the ones giving electrons (e-) to the airport, so we should sue them ;-)

Re:That's not all

[SydShamino]

>> Is it really stealing if they put the electrons back when they're done with them?

Yeah but they just aren't the same after that. All their potential is gone...

Re:That's not all

[lazarusdishwasher]

Is it stealing if the electrons are free?

Re:That's not all

[From A Far Away Land]

"All their potential is gone.."
I guess a positive attitude won't accomplish everything.

Re:That's not all

[aridor]

Is it stealing if you are actually giving them electrons while using the power?

20 *Minutes* is actually quite long...

[rblum]

And that's insecure? Your run-of-the-mill car can be broken into in about 20 seconds. How'd I know? I managed to leave my keys in my car and called AAA. The guy showed up and had it open in under 20 seconds, just using a coathanger.

From that POV, give me the fancy-pants stuff any time.

Not so hard apparently

[Visaris]

There is a student on campus that was bragging that he could do just as the article describes. A professor put down $100 and bet the student that he couldn't get into his car in 15 min without breaking anything. The student took the bet. Needless to say, the whole class was out in the parking lot 5 min later to watch. It took the student about 5 minutes. The car chirped and the lights flagshed. I assume this meant the doors had been unlocked. Next, the car started, the student opened the door and got it.

This was really cool to see live. There is a something about seeing it done live that is very impressive.

Re:Not so hard apparently

[Anonymous Coward]

That is quite scarry, it looks like RFID is failing as an authentication mechanism..... which university did this happen at?

Re:Not so hard apparently

[Anonymous Coward]

I am intrigued by your ideas and would like to subscribe to your newsletter.

No, seriously. Thats cool.

And seriously, I would like to know how the hell it works. From an academic perspective.

(interestingly, my captcha for this post is 'misuse.' How's that for irony?)

Re:Not so hard apparently

[Paralizer]

This is quite a predicament for the student; take the money he won from the professor, or risk failing the class?

What kind of car was it?

Re:Not so hard apparently

[Anonymous Coward]

It was actually a middle school. Kids and computers these days...

Re:Not so hard apparently

[Loligo]

Professors teaching at middle schools?

Who says academic standards are declining?

Re:Not so hard apparently

[JohnnyGTO]

No wonder the cost of schooling is on the rise, takes a big salary to keep those professors in luxury cars :-)

Re:Not so hard apparently

[Rich0]

No surprise there - it probably didn't use challenge-response, but rather a simple transmission of a static code. The former can be made impossible to crack (well, not in the lifetime of this universe anyway), but the latter is trivial.

If they were smart they'd put an SSL cert on the keyfob and have it hash/sign the date/time and transmit that. A replay attack would not work.

Re:Not so hard apparently

[nblender]

The student missed his chance. He should have used the first 4 minutes to wander off somewhere, returning with a cold beer and a lawn chair. Then spent the next 6 minutes sitting in the lawn chair sipping the beer while everyone stands, mouths agape... At 10 minutes, he springs into action.

Re:Not so hard apparently

[wile_e_wonka]

A middle school teacher with a car that starts at the push of a button? Must be Council Rock School District. Well, perhaps it was a car with Northstar.

Re:Not so hard apparently

[geekoid]

Yes, fail the student that can easily get into your car.
hmm

Re:Not so hard apparently

[zanglang]

Umm, actually no. Don't fail the student that can easily get into your car... :P

Geez

[alx5000]

Oh! Perfect! And now I need a nerd for my getaway laptop...

Sigh

[Anonymous Coward]

Am I the only one that found Radko Souek's situation ironic? Instead of doing a better job of protecting his data (encryption) he just left it out there and his information eventually fell into the wrong hands...

leftlane in the hard shoulder

[Anonymous Coward]

looks like Slashdot put leftlane's server smoking into the hard shoulder awaiting recovery

Tow truck?

[Anonymous Coward]

Why go through the hassle? It's WAY easier to back up to a car with a flatbed or wheel lifts to steal a car. You can lift the drive wheels and be gone in 30 seconds or less. You can then override the rest of the system at your leisure.

I just want my car to phone home.

[jcr]

All I need it to do is advise me of its location, and if it's not where I think it should be, I want to snap a picture of whoever's in the driver's seat. Then, I'll either fax that picture and the car's location to the cops, or just wait for the perp to leave the car and go take it back myself.

Of course, wiring a 2 or three farad capacitor into the steering column so that I could zap him unconscious would be fun, too.

-jcr

Re:I just want my car to phone home.

[P3NIS_CLEAVER]

Of course, wiring a 2 or three farad capacitor into the steering column so that I could zap him unconscious would be fun, too.

The capacitor would be as big as your car.

Re:I just want my car to phone home.

[Grey_14]

As well, Imagine getting in an accident, You'd get electrocuted, then a picture of your mangled electrocuted self would get e-mailed out onto the net. Not the most dignified way to go, (Or possibly worse, survive!)

Re:I just want my car to phone home.

[Rob Simpson]

Um, no. Capacitor technology has improved in the last few decades. A 3 farad capacitor is 10" x 6.5" x 3.25", according to this site for people who care way too much about their car audio.

Re:I just want my car to phone home.

[P3NIS_CLEAVER]

With 20 volts? Also car audio is notorius for bogus numbers, they are allowed to quote peak watts vs. RMS watts for instance.

I will be impressed when you can find me something that does 200+ volts at 2 or 3 farads.

Re:I just want my car to phone home.

[Anonymous Coward]

Holy shit, you just made me double over with laughter.

Re:I just want my car to phone home.

[fossa]

But D.A.R.Y.L. will just put his gum over the lens!

Re:I just want my car to phone home.

[jcr]

As well, Imagine getting in an accident, You'd get electrocuted,

It's more likely that if he capacitor was breached, it would arc internally and discharge through the more direct path.

-jcr

Re:I just want my car to phone home.

[Geminii]

You REALLY wouldn't want someone to hack into that from the next car across. "Hey, someone's remotely accessing my capacit-" *BZZZZAP!*

Re:I just want my car to phone home.

[Anonymous Coward]

A three farad cap would blow your freak'n hands off.... and I don't mean 'off the wheel'. I mean 'NO HANDS!'

Yeah, I want that too. Hook it up to the standard BMW alarm/ignition disable system; don't open the door with a key, get your hands blowed off if you grab the wheel. Awesomeness.

Until you kill your mechanic anyway. Bah. Details.

Re:I just want my car to phone home.

[sp3d2orbit]

You make the assumption that sending the perp's picture to the police means something. My truck was stolen a few months back. The only help I got from the police was a letter asking if I had found my car yet.

"Can't you people take the law into your own hands? I mean, we can't be policing the entire city!" - Police Chief Wiggum

Re:I just want my car to phone home.

[jcr]

You make the assumption that sending the perp's picture to the police means something.

This varies greatly by jursidiction. The SFPD found my van about a week after it was stolen. I'm sure that if you were able to tell the cops the location of your truck, it would be quite a different story.

-jcr

Smart Key - It's an option...

[Animaether]

It's an option... You don't -have- to get the Smart Key. You have to pay extra to get it. There's tons of reasons not to get a Prius, but this isn't particularly one of them.

Re:Smart Key - It's an option...

[mikeisme77]

But if you want side air bags and all those other nice safety features, you have to get the smart key. You also have to get the Bluetooth calling thing and the upgraded stereo system in the Chicago area (they don't have package 4, and below package 4 you don't get all the safety features...)

Re:Smart Key - It's an option...

[trentblase]

Although you can probably disable any of these "features" pretty easily if you are on slashdot.

Re:Smart Key - It's an option...

[adric]

Although you can probably disable any of these "features" pretty easily if you are on slashdot.

In the case of the smartkey, there's a small switch directly underneath the steering wheel... all you have to do is press it.

Re:Smart Key - It's an option...

[trentblase]

Man, I thought you were trolling for a second before I actually looked up the details!

Where can I get my hands on this software?

[farker haiku]

Frankly, I'd like to see how vulnerable my car is. If I can hack it in 20 minutes, well, ok so that'd be cool and stuff, but I can modify my car's computer through a tool made available from volkswagon. I'd like to expirement with my car. I dunno. Try to lock it down a bit if you'll pardon the pun.

Re:And thats why... keys are no better

[stmfreak]

And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.

No, they're not safe. The key merely turns a lock that closes a contact telling the computer it's okay to proceed. After my 2001 Sukuki GSXR was stolen and recovered, I had to learn a thing about hot-wiring ignitions because the thieves had changed the locks. Within the ignition tumbler was a small PCB that connected circuits to ground for parking lights, accessories and the ignition. The added "security" was that a resistor was used in the circuit for the ignition.

Turns out, the wiring harness for the ignition has a molex connector underneath the right side fairing, right about where my fairing had been shattered by blunt-force-trauma. With nothing more than some knowledge, a spare connector, some wires, a switch and a specifically rated resistor, you could build a plug that would "start" any modern GSXR in about 20 seconds.

Keys are no safer. As far as the computers are concerned, they're either on or off. RFID, challenge/response, better encryption, failed-attempt lockouts, these things are going to become more common because they do a better job slowing the thieves down.

Unformative FA

[hackstraw]

Wow, who wrote this stuff?

Unless I'm way off base here, this sentence:

"You could delete all the data from your laptop, but that's not good for you because the more data you have, the bigger your possibilities," he said.

Makes no sense or apparent relevance. Maybe an illusion to using security by obscurity? Dunno.

Does anybody know more about the article than what it says?

What kind of technology does the security software use? I'm assuming its wireless, RFID, bluetooth, retinal scan, or something. I don't know.

Also, I'm curious what country this is based? The 12 years in prison for stealing a car seems a bit excessive, even for US standards. I mean, stealing a car is only an inconvenience. Most people with such a car can't afford it so they finance it which requires full coverage, and so you get a new car.

Also, its so easy to steal a car, so what is new? People used to be able to use standard radio scanners to open garage doors and keyless entry things. Snatching a purse with keys is probably the easiest way to score an SUV today. The problem is really what do you do with the car? That is much more difficult than stealing it in the first place.

Re:Unformative FA

[necro2607]

What he means is:

"You could delete all the data from your laptop [to avoid being caught by police/authorities with this stuff on your system], but that's not good for you because the more data you have, the bigger your possibilities [are for breaking into various vehicles]"

Re:Unformative FA

[Anonymous Coward]

Maybe an illusion to using security by obscurity?

That's "allusion", fucktard.

Re:Unformative FA

[Panaflex]

Which probably means that they're simply replaying signals they've captured over the wire. While it is really difficult to generate the seemingly "random sequences" it is damn easy to record them and play them back. playback, essentially.

Just need the antenna, right h/w and software. Start blowing through codes until the car reacts.

Re:Unformative FA

[Anonymous Coward]

Oh....I see. Just let the insurance company take the fall. Damn Democrats...who the hell do you think ACTUALLY gets to foot the bill? Dimwits such as yourself are why insurance is becoming quite unaffordable by many.

House needs painted? Screw it...burn it down! Insurance will cover it!

Car is dying (cause you haven't changed the oil in 51,334 miles...crash it into a brick wall...AND enjoy the paid time off from work AND get a new car. INSURANCE will pay for it!

Drank too much and blew the liver out? No problem! Have friends remove liver and dump you on pavement of nearest hospital. INSURANCE will cover it!

Thank God my state just gained sanity and made it legal for me to shoot dead some punk that tries to steal my car...let alone sentence the dimwit to 12 years.

That's the way the repo man does it.

[NotQuiteReal]

The repo man uses the tow-away method too. Even though they have a legal right to snatch a car in default they don't like to stick around for a confrontation anymore than a thief does. 20 minutes is a long time.

Re:That's the way the repo man does it.

[innocent_white_lamb]

About 20 years ago, I was a part-time repo man for one of the in-house auto credit outfits. They generally sent me a copy of the keys along with the paperwork when they wanted me to pick something up.

Re:That's the way the repo man does it.

[rbochan]

A lot o' people don't realize what's really going on. They view life as a bunch o' unconnected incidents 'n things. They don't realize that there's this, like, lattice o' coincidence that lays on top o' everything. Give you an example; show you what I mean: suppose you're thinkin' about a plate o' shrimp. Suddenly someone'll say, like, plate, or shrimp, or plate o' shrimp out of the blue, no explanation. No point in lookin' for one, either. It's all part of a cosmic unconciousness.

Re:That's the way the repo man does it.

[Anonymous Coward]

I think your method sounds "right" - but I do remember seeing something about the "tow away method" on some reality tv show or some such. Maybe the poster watches too much TV.

Maybe small-time used car dealers don't go thru the bother of making extra keys.

inexpensive? quite opposite logic applies

[mapkinase]

With cars as inexpensive as the Toyota Camry offering entirely keyless systems, these concerns a relevant to all consumers.

"as inexpensive" - this is exactly why it is NOT relevant to "all" consumers. Who would spend time on training hacking and $500 on a laptop to steal "inexpensive" Camry? The goal does not justifies the means.

Re:inexpensive? quite opposite logic applies

[Loligo]

>Who would spend time on training hacking and $500
>on a laptop to steal "inexpensive" Camry?

The Toyota Camry is one of the best selling cars in America for several years running.

This means a lot of demand for parts. Body parts for accident repair, engine parts, even wheels and tires.

All this translates into the Toyota Camry also being one of the most STOLEN cars in America for the last several years running.

Just because it's a $20,000 car doesn't mean it's not worth stealing. And if you can steal it easily and without damaging anything, so much the better.

  -l

Re:inexpensive? quite opposite logic applies

[mapkinase]

I agree 100% with you that for the thieves armed with unsophisticated tools, yes, it is very attractive target, adding: illegally acquired car is always significantly cheaper than equivalent legal item. Why would a buyer buy a stolen car with all the dangers while he can get legally the car for the same price? I would imagine the difference could be double or triple.

As for the laptop-empowered hacker: psychological profile of such a thief in my head tells me that he needs something juicier (unless the hacker tools he is using become as easily available on the car-theft market as the conventional car-jacking tools).

Laptop-empowered thief is an elite car thief. First, there are very few of them (which is another point - if your Camry is stolen, what are the chances it will be stolen using computer hacking or conventional break in?) Second, he has to be much more educated than an ordinary thief.

Re:inexpensive? quite opposite logic applies

[Loligo]

A buyer DOESN'T "buy a stolen car". The stolen cars are parted out, and legitimate sources (ie: body shops) buy the body panels at a cheaper rate. If they're already painted to the factory colors, so much the better.

The hacker tools he's using are already easily available on the market. Best Buy and CompUSA are just full of small laptops with wireless capability. Not to mention they can also get one the same way they're getting the cars: steal one.

The laptop will soon become just another tool in the arsenal of the professional car thief. To these guys it's not a thrill, they're not doing it on a dare, it's their job. They're not stealing these cars to go joyriding in, they steal one to take to a chop shop for a few hundred bucks.

(Terminology nit-pick: these guys aren't "carjackers", they're car thieves. Carjackers are the ones that stick a gun in your face and shove you out of the car.)

  -l

Re:inexpensive? quite opposite logic applies

[HungWeiLo]

From my anonymous "sources", you can strip a car like a Camry or Accord (MSRP $17k-$30k), sell it piece by piece on Ebay and get about $90k in return.

Re:inexpensive? quite opposite logic applies

[Chandon Seldon]

If that were actually the case, it would stabilize out right quick as people legitimately purchased camrys to strip.

Re:inexpensive? quite opposite logic applies

[mapkinase]

The thief usually does not disassemble the car, he sells it to a shady mechanic.

AS for hacker tools you are forgetting about software. That is the tool I am talking about.

Re:inexpensive? quite opposite logic applies

[ars]

Not exactly - you are forgetting the work/time involved in stripping out the pieces, cleaning them, and selling them.

Re:inexpensive? quite opposite logic applies

[Anonymous Coward]

The hacker tools he's using are already easily available on the market. Best Buy and CompUSA are just full of small laptops with wireless capability.

I can't imagine how a 2.4 GHz wireless radio can be used to hack a 980 MHz remote.

Re:inexpensive? quite opposite logic applies

[Chandon Seldon]

I don't see any reason why labor would be significant with a profit margin like that - for that much money you could train illegal immigrants to do it for $3/hour. Hell, if you buy used cars instead of new cars, the margin becomes even more massive.

My conclusion is that someone's making up numbers or this was true for about 8 minutes before the market corrected.

Re:inexpensive? quite opposite logic applies

[Loligo]

>I can't imagine how a 2.4 GHz wireless radio can
>be used to hack a 980 MHz remote

You've just addressed this entire conversation.

Thank you, Anonymous Coward! You have single-handedly, by this post, demonstrated that this entire thread is without merit, and should no longer be discussed.

Where were you two days ago?

You could have saved every single participant in this conversation a whole lot of trouble.

You irresponsible bastard.

  -l

This must be stopped!

[i_am_the_r00t]

Homeland Security needs to outlaw laptops!

There is an easy inexpensive way to do this.

[Anonymous Coward]

This is detailed in the latest Popular Science. Just get one of those prepaid GPS cellphones. You can track the phone online, at about $9 a month. If I find the article I'll link to it, but check the May 2006 issue of PopSci.

Nice cars are for suckers

[Anonymous Coward]

The first thing I do when I get a new car is I back it into a fire plug, then run it along side of a brick wall. Then I "key" it a bit and ding it up here and there with a 9 iron.

Finally, I pour some cod liver oil on the upholstery and lock a couple of cats in it for a few days (with the windows cracked and plenty of food and water - I'm not mean.)

That just about puts an end to anyone's desire to steal my cars.

posted anonymously so THEY won't find me.

Re:Nice cars are for suckers

[Tongo]

Sorry, but I don't think it would be to hard to figure out who you were based on the description of your car. Anyone with a nose should be able to find you.

Re:Nice cars are for suckers

[iogan]

"The first thing I do when I get a new car"

Dude, you really need to get up to scratch on this whole "used car"-thing. Could save you a lot of money.

What?

[artifex2004]

The worst thing about a Toyota Camry is an engineering flaw IMHO. When the Camry is stopped and shifted into park every damned door unlocks automatically. It's a car jackers dream.

Mine doesn't. If it did it by default, then I'm sure I disabled it the first day, when I read my manual.

Even regular keys aren't regular...

[RareButSeriousSideEf]

When the dealership quoted me upwards of 90 bucks to make a 2nd key for my car, I declined & headed to my local Ace Hardware, who did it for about 84.50 less (hey, it took their most expensive automotive blank). The dupe is cut right, the original has no *visible* embedded chip, and the dupe even unlocks & starts the car -- for about 3 engine cycles. Then it kills the engine & all electric devices. Being a glutton for punishment, I of course repeated the experiment a couple times (easier than RingTFM, no?).

This approaches DRM's insidiousness in vendor lock-in through needless proprietary interfaces. Well, needless from a consumer standpoint, anyway. But hey, I do get deterrence from theives who think my car's worth $6.00 but not $90.00.

I haven't tried starting the car with my laptop yet...

Re:Even regular keys aren't regular...

[ByTor-2112]

I'm not sure about your car, but the owners manual for my car provides instructions for programming additional keys if you have the two original keys. Up to a certain limit, then you have to get the dealer to do it.

"Space Fall"

[HTH NE1]

"If you had access to the computer, could you open the doors?"
"Of course. Why?"
"Just wondered how good you really were."
"Don't try and manipulate me, Blake."
"Now why should I try and do that?"
"You need my help."
"Only if you can open the doors."

"I could open every door, blind all the scanners, knock out the security overrides, and control the computer. Control the computer and you control the ship."

Re:20 *Minutes* is actually quite long...

[Anonymous Coward]

I managed to leave my keys in my car and called AAA. The guy showed up and had it open in under 20 seconds, just using a coathanger.

Convertables don't count!

Re:20 *Minutes* is actually quite long...

[KefabiMe]

And that's insecure? Your run-of-the-mill car can be broken into in about 20 seconds. How'd I know? I managed to leave my keys in my car and called AAA. The guy showed up and had it open in under 20 seconds, just using a coathanger.

From that POV, give me the fancy-pants stuff any time.

The triple A guy would not have been able to do that with these expensive luxury cars. And the 20 minutes the car jackers spend trying to wirelessly crack the car's computer are not spent right next to the car. The thiefs can do it from the safety of their own car while listening to the radio. Once their laptop has cracked the target car's code, they can just walk up, unlock the target car, and drive away.

From that POV, the theif can get a much more expensive car for a lot less risk.

Shortsighted

[LINM]

There are some simple ways to prevent this from happening that would have limited impact on the coolness factor of keyless:

-Install a $400 fingerprint scanner (for this and others non-secure people need a physical key)
-Voice recognition of a code through a microphone
-Require a 4 digit code input through the radio (or other)
-Body weight of person in seat must be +/- 10 pounds last use
-Require a different engine start code/security sequence than the door requires and only allow keyless engine start sequences within 30 seconds of the door opening (and the door must be opened and shut to reset + a 2 minute wait). If the second portion requires an expected 10 minutes to break the code of active attempts (assuming randomized attempts), it will require 40 minutes in stead and require them to get in and out of the car 20 times.

There are probably a few more options and things to add on here, but I would have to start invoicing Slashdot. In short though, I think the security approach (pure tech encryption) is shortsighted (albeit not knowing too much about it).

Re:Shortsighted

[nagora]

Install a $400 fingerprint scanner

I went right off this idea ffter the first few people got their fingers cut off so that their expensive cars could be stolen (the fingerprint system has been available as an option for years in some cars). I'd rather they had to spend 20 minutes hoping I won't come back than ten seconds chopping off my thumb.

Body weight of person in seat must be +/- 10 pounds last use

No use for me; I weigh more than 10 pounds more than my girlfriend and I know plenty of people who also have children driving their cars.

The other two ideas might work.

TWW

Re:Shortsighted

[LINM]

Well I almost suggested a (difficult to implement) retinal scanner. I'd rather lose a finger.

What else is there for the biometric approach?
  -Hand scanner (worse than a finger)
  -Foot scanner (no way)
  -Scent (2020)
  -Facial recognition

I think the coolest solution is the voice recognition when a computer welcomes you to the car and asks you by name (based on your unique key) for your code. To simplify voice recognition, it could transmit (GPS or CDMA) the encrypted (uh oh) code to a centralized unlocking area.

Re:Shortsighted

[kalpol]

-Require a 4 digit code input through the radio (or other)

My 1998 BMW has this feature - you can program a 4-digit code through the info computer. Works great! And you can disable it if you just want to turn the old-fashioned key and drive off.

Re:Shortsighted

[Zoxed]

> Body weight of person in seat must be +/- 10 pounds last use

Do you live in the UK ? Every 1st April BMW run a spoof advert in the UK newspapers: I always rememember one, maybe 15 years ago, that advertised their new security system that did just that. But it also allowed for weight variations due to meal times, seasonal adjustment (heavy clothing etc)...

well..

[DeathByDuke]

at least they upgraded from the old method, standing there with your PSX pad pressing 'X'

Why not just use a tow truck?

[ihistand]

I never understood, why bother trying to start the cars at all when you're stealing them for parts? Isn't it a lot easier and quicker to just hook up a tow truck and off you go, 20 mins later it's a pile of parts anyway. Seems like a waste of time and effort to start it.

I can see if you're a teen going for a joyride. but not a "pro"

Re:Why not just use a tow truck?

[robertjw]

Isn't it a lot easier and quicker to just hook up a tow truck and off you go

My only guess is the guys that actually steal the cars can't afford a truck, but your idea is good. It would be even better to get a repo truck or a setup like this. The repo guys are setup so they can just hook on to a car and drag it away quick. Seems like the same thing would be good for all out theft.

Re:Why not just use a tow truck?

[toddestan]

My only guess is the guys that actually steal the cars can't afford a truck, but your idea is good.

In which case, they would only have to mess with getting a vehicle started once. Then they would have a tow truck :)

...and then what?

[C10H14N2]

I thought the point was to *steal* the car, not just bust it up to the blares of the alarm.

Re:...and then what?

[AnyoneEB]

Actually, the thief is probably just interested in the radio/other removeable components anyway. Also, it is probably quicker to physically hot wire the car than to hack it wirelessly. On alarms: see zakezuke's comment.

Re:...and then what?

[C10H14N2]

In the case of this article, no, the thief was interested in the vehicles, not the contents.

I think the whole point of the article and my sarcasm was that hacking the car is far more dangerous because the "break-in" can be done out of sight and the actual theft is so nonchalant that no casual observer would think they were witnessing anything but the rightful owner driving off. Smashing up the car to get in carries a much higher chance of alerting people that a crime is in progress than just walking up whistling a tune and driving off in a totally disarmed, unlocked, running, fully functional (i.e. no steering lock) vehicle.

Won't get fooled again?

[Keith Russell]

How's this for lucky timing? Audi, through their sponsorship deal with Real Madrid, has gifted the entire Real roster, including Beckham, with brand new, fully loaded Audi Q7 SUVs.

Of course, all the thieves have to do is twiddle two dropdown lists...

One system alone isn't enough

[PeeAitchPee]

A physical security system such as The Club is the way to go, both standalone and as a complement to an electronic system. I've used it for years on both inexpensive and expensive vehicles. It's inexpensive and IT WORKS.

Re:One system alone isn't enough

[P3NIS_CLEAVER]

No it isn't. It takes 20 seconds to cut through the steering wheel to remove it.

You've just been lucky.

Re:One system alone isn't enough

[geekoid]

" It's inexpensive and IT WORKS."

how do you know? Did some crook walk up to you and say "I was going to steal your car, but you have the club, good job."?

Re:One system alone isn't enough

[lgw]

No it isn't. It takes 20 seconds to cut through the steering wheel to remove it.

This is very true - happened to me. You would not believe how expensive a factory steering wheel is! $1000+ Only insure companies ever buy them.

Re:One system alone isn't enough

[TOWCH]

So "The Club" is all about damaging the resale value of one of the most expensive parts of the car!

Re:One system alone isn't enough

[Anonymous Coward]

or maybe 4 seconds to pull the barrel of the lock ;) . and it gives you a nice handy way to break the steering column lock as well, extra leverage.

Re:One system alone isn't enough

[P3NIS_CLEAVER]

That's why they say to never lock a convertible. Ruin a 1,000 top to steal some change and a couple of cds.

Re:20 *Minutes* is actually quite long...

[Anti_Climax]

I locked my keys in my truck at a gas station. The attendant, a former tow truck driver, had my door open with a slim jim (the metal tool not the questionable meat snack) faster than I could have unlocked it with my key in hand.

Gone in 60 Seconds indeed

Re:20 *Minutes* is actually quite long...

[CCFreak2K]

When I locked my keys in my car, the guy took 30 seconds and almost fucked up the lock (I had to lock/unlock it a few times to make it work correctly).

However, I have the benefit of having a car that theives don't want to steal: a 1979 Ford Fairmont. The three most valuable things in there are a power inverter, a discman and some speakers (the stock speakers have gone bad and it only has a radio, not even an 8-track). Not only that, but the car doesn't run too well, either. A theif would be spending his time better stealing any other car on the lot.

Re:And thats why... keys are no better

[Anonymous Coward]

Didn't you have one of those fork locks?
Sure, they can start the motor, but let them try to actually drive it anywhere.

Re:20 *Minutes* is actually quite long...

[Anonymous Coward]

I had a car where I could just reach inside the door through the rust holes and unluck the door. That's a good reason not to leave your keys in the car. Anyway, the point is to slow a thief down. They can always pick up the car or strip it on the spot, but these things get noticed. You can pop the doors on my current car with a slim jim in seconds. It will set off the alarm. You also will need to bypass both a physical lock (steering) and an electronic lock (computer) before you can drive away. I prefer this, even if it means I have turn a key in a lock (such effort).

Halfway to my new Porsche...

[BaronHethorSamedi]

Now all I need is an article explaining how to swipe a laptop.

Re:Halfway to my new Porsche...

[noslayer33]

Here you go: http://www.sfgate.com/cgi-bin/article.cgi?file=/ch ronicle/archive/2006/04/08/MNGE9I686K1.DTL

Re:Halfway to my new Porsche...

[Anonymous Coward]

Now all I need is an article explaining how to swipe a laptop.

First, you'll need to swipe a car [...]

Re:Halfway to my new Porsche...

[dodobh]

Here you go. You only need to steal a car first though.

conspicuous

[TamMan2000]

A good idea, but... A tow truck might attract attention, while sitting an a car parked next to the target car tapping away at your laptop doesn't (yet) attract much attention...

Re:20 *Minutes* is actually quite long...

[Anonymous Coward]

The girls must be falling all over you...

The demons of stupidity are loose

[Beryllium Sphere(tm)]

>While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands.

If you replicate a "secret" a few million times, put it in places outside your control, and if you have no way of changing it in the field then you do not have a secret!

>"...There are weaknesses in any system," Tim Hart of the Auto Locksmith Association told the U.K.'s Auto Express magazine.

What, Mr. Hart, are the weaknesses in OpenSSH public key authentication? It sounds like the automakers are trying to roll their own crypto, with the usual results. Designing a crypto system is like playing chess with a grandmaster. You'll make a mistake somewhere, and your opponent will find that mistake and use it to break you.

As long as people make blunders like this we'll have fiascos like the TI chips with 40-bit encryption.

Re:The demons of stupidity are loose

[MasterC]

What, Mr. Hart, are the weaknesses in OpenSSH public key authentication?

All encryption (that I know of) use mathematical problems that just take a long time to solve. If you can solve the problems faster then the algorithm is worthless and this is how crypto algorithms are broken.

In essence, all crypto algorithms are security through obscurity.

To foul up public/private key crypto you have to deal with large number factorization (or elipitcal curves or ...). That's it. Do it fast enough and it's defeated. The obscurity is the hedging of bets on large number factorization won't happen for a long time, if ever.

The long promised quantum computing can supposedly squash all known crypto algorithms due to its speed and ability to solve these problems. Thus, problems will have to be created that take quantum computers a long time to solve.

The only "advances" in crypto is finding harder and harder problems to solve. That's it. That's cryptography.

The *only* algo that I know of that doesn't rely on mathematical properties like factorization is the one-time pad.

So it's not a weakness in public/private key, per se, but in crypto in general.

(IANA cryptographer, but that's my understanding of it all and I more than welcome any corrections.)

Re:The demons of stupidity are loose

[owlstead]

"All encryption (that I know of) use mathematical problems that just take a long time to solve."

One time pad. Unbreakable. Useless because of the danger of repeats? Just encrypt a challenge with a random number stored in your car and on a cheap 128 MB memory stick, in order. Only other thing is something to keep track and something to XOR. Of course, there should be a way for the dealer to break in as well.

"In essence, all crypto algorithms are security through obscurity."

Nope. The term security through obscurity is about hiding the scheme, not so much as the keys. It can help a bit, but for professional thieves, it only takes one person to bribe. The keys should be the only things you should have to guess.

"The long promised quantum computing can supposedly squash all known crypto algorithms due to its speed and ability to solve these problems. Thus, problems will have to be created that take quantum computers a long time to solve."

AES-256, and some other AES contestants with the same key sizes, are probably resistant against an attack by quantum computers. Random pads are resistant by their very nature (as you noted). There is just no way of checking that a message you find is indeed the one you are looking for.

"The only "advances" in crypto is finding harder and harder problems to solve. That's it. That's cryptography."

Well, the problems should be usable in the right context, provable secure (if possible), use maintainable key sizes and then there are things as key generation, random number generation, time keeping, distribution, using correct protocols (paddings, session counters etc)... But yes, essentially hard problems are the *base* of cryptography :)

"The *only* algo that I know of that doesn't rely on mathematical properties like factorization is the one-time pad."

Well, only if you take factorization in a *very* broad context. Symetric ciphers are pretty different from asymetric ones. You may as well include the XOR function used for one time pads as well.

"So it's not a weakness in public/private key, per se, but in crypto in general."

No. There are scheme's possible with *much* better protection. Most of these scheme's are so bad (or, to be more precise, *cheap*) that cryptoanalysis and breaking the algorithm can be done by anyone that can be bothered to look hard enough.

"(IANA cryptographer, but that's my understanding of it all and I more than welcome any corrections.)"

I am a practicing cryptographer. I've analized protocols and even created - or better, changed - some for special uses. So I understand the basic premisses and uses of cryptography. I hope you can do something with my "corrections". Try wikipedia or practical cryptography from Bruce Schneier for more information (his monthly newsletter is also an eye opener).

Re:The demons of stupidity are loose

[Anonymous Coward]

> I am a practicing cryptographer. I've analized protocols and even created - or better, changed - some for special uses.

Certainly sounds like most cryptographers I know.

Re:The demons of stupidity are loose

[cananian]

The weakness in OpenSSH public key authentication is man-in-the-middle attacks. Just while we're talking about it.

Re:The demons of stupidity are loose

[Chandon Seldon]

So... what mathematical property does the Twofish algorithm rely on?

Re:The demons of stupidity are loose

[zCyl]

Just encrypt a challenge with a random number stored in your car and on a cheap 128 MB memory stick, in order. Only other thing is something to keep track and something to XOR. Of course, there should be a way for the dealer to break in as well.

Why even xor? Why not just have 128 MB of data in the car, and the same 128 MB of data in each wireless key for that car. Then the car just says "Send me the 375th 64-bit number to unlock the doors". If the wireless key transmits the right number, it gets in. If not, the car doubles the delay between accepting another response. Then when the car is opened correctly, the car just increments the key it asks for, and the next time it asks for the 376th 64-bit number. The net cost of the memory cards would be almost zero, no amount of cryptographic trickery would ever break the system, the odds of getting in are less than one in a thousand trillion, and the system would be valid for opening the door 16 million times before repeating or needing refreshed (and I do expect the car would biodegrade before this happened, as this is the equivalent of opening the car doors 100 times a day for 460 years).

Given the cost of flash memory, a simple OTP list of keys is superior to a cryptographic solution for this purpose, as the OTP is both cheap and unbreakable.

Re:The demons of stupidity are loose

[Anonymous Coward]

Hmmm.. Quantum computing may be super-fast and blow current encryption schemes away (in theory) but one must not forget about the development of Quantum Cryptography, which claims to be unbreakable (in theory).. http://it.slashdot.org/article.pl?sid=06/04/19/173 5206

Re:The demons of stupidity are loose

[hankwang]

If not, the car doubles the delay between accepting another response.

Huh, this calls for pranks to lock hundreds of legitimate car owners out of their cars on a parking lot. :-)

Re:The demons of stupidity are loose

[zCyl]

If not, the car doubles the delay between accepting another response.

Huh, this calls for pranks to lock hundreds of legitimate car owners out of their cars on a parking lot. :-)


Think about it. Because the delay doubles, you can't lock someone's remote access to their car for any longer than an equal time period to how long you're willing to stand there and keep broadcasting yourself. This puts some serious constraints on ability to deny service. And if you setup an automatic unmanned denial of service device, then this is no different from planting a permanent jamming device, which is not going to be prevented by an algorithm choice.

And it's much better to have to return to your car and use the physical key, then to return and not find your car...

It isn't really that "Hard" to build security.

[bill_kress]

He says any car that relies on software to provide security can be circumvented by other software. "Every car has its weak spot," he says.

Sounds like a movie ploy. Software doesn't have to be a weakness, it can be another vulnerability, but doesn't have to be.

If someone were to create two-way encrypted public-key communication between the key and the car, where the car sends a random string, the key encrypts it and sends it back encrypted, then the car decrypts the string, that would be a good chunk of it.

Then you add a few factors like ensuring that each attempt must be at least 1/2 second from the last and after some number it reverts to requiring a manual override on the door panel buttons.

After that, software is pretty secure, but what about hardware? Can you R&R the computer? Is the authentication module physically separate from the computer so that a simple wire-cut is all it would take? Can someone override the computer completely by using traditional keys?

It's a damn hard problem to make a secure car, but it shouldn't be one we have to keep revisiting. The car companies should just buy a handful of hackers to help them design the next system.

The designers create a system, give it to the hackers (with full blueprints and software source-code except for the public/private key pairs) and then let them have at it.

Only by continually thwarting fully-informed attacks will they finally be able to design a truly safe system.

Oh, and don't forget to check for DOS attacks such as invoking a lock-down sequence that makes it so the driver can't get in or start his car.

20 min!

[Anonymous Coward]

You slow sorry dog shits!

getting noticed...

[TamMan2000]

I would just use my tow truck...

A car getting towed often gets noticed, but a guy with a laptop parked in the next space doesn't...

Re:getting noticed...

[PitaBred]

Totally OT, and regarding your sig: A Coors Light and Guinness both have the same number of calories (in case you didn't know). You should slap that grad student.

Re:getting noticed...

[ak3ldama]

i also noticed the sig. how lame to want/take coors light over guinness.

Re:getting noticed...

[Anonymous Coward]

Not according to this.

Coors Lite- 30 Calories per 100ml (4.36% alcohol)
Guiness Extra Stout- 43 Calories per 100ml (4.27% alcohol)

Re:getting noticed...

[Loligo]

Guinness Extra Stout (bottles without the widget) and Guinness (cans or bottles with the widget or draught) are entirely different beers with entirely different tastes, textures, and caloric/ABV values.

  -l

Re:getting noticed...

[Anonymous Coward]

"I'll have a Guinness, no wait, make that a Coors Light" -Grad student I work with, who shall remain anonymous...

Totally OT, and regarding your sig: A Coors Light and Guinness both have the same number of calories (in case you didn't know). You should slap that grad student.

I think the point is the difference of the type of man who drinks each. One might be called a "hard c**t" and the other a "soft c**k".

Guinness is like a red hot poker in the eye, while Coors Light is more your pack of butter menthol cough drops. Ordering a Guinness and then retreating to any pale light beer, is like saying, "yeah I'd go sky diving! F**k yeah!" and then once you're up there, not being able to even approach the open door, much less jump.

I have never been able to finish a pint of Guinness. I have Irish mates and we go out and I try to drink it, but damn it tastes super bitter. I may as well be chewing on old car tire inner tubes or something, because it makes me want to vomit my lungs out by the time I get to the dregs. Rrrrrrrwwwwoooooaaahhhhh!!!!!!......

Hey I wonder if the bubbles are going down in your belly, like they do in a freshly poured glass of Guinness?

Re:getting noticed...

[PitaBred]

12oz of Guinness Draught has 125 Calories. A 12oz can of Coors Light has 120 Calories. Almost identical.
Reference

Re:getting noticed...

[lowrydr310]

You can set your slashdot options so you don't have to see anyone's signature. It's a very nice feature!

How can you call something 'beer' that's made with corn and/or rice?

Re:getting noticed...

[inKubus]

A car getting towed often gets noticed, but a guy with a laptop parked in the next space doesn't...

Wait a second: There's a laptop you can DRIVE? Must be the new iBook or something.

Re:getting noticed...

[Guido von Guido]

Because it's still beer. Boring and flavorless, yes, but the majority of the grist is still malted grain. Even Guinness uses some unmalted grains (unmalted barley, both roasted and unroasted).

If you turn your nose up at beer made with corn or rice, you'll also turn your nose at many an excellent American craft beers. Why do they use corn or rice? In many cases, the brewer is trying to prevent the beer from becoming too dark or too heavy. Corn also adds its own flavor, which can be desirable.

Re:getting noticed...

[poopdeville]

Guiness is just a stout. It's not a particularly good stout, at that. Nor is it very bitter. Try Arrogant Bastard if you want something bitter (and with almost twice the alcohol by volume as Guiness).

old news...

[Anonymous Coward]

This has been possible for years. Here is a salon article from 1998 about doing the same thing with a Palm.

http://archive.salon.com/21st/log/1998/12/07log.ht ml

-W

That's funny...

[theheff]

because usually I'm doing the reverse... using cars to steal laptops. *peels out*

If so, it won't last long...

[YesIAmAScript]

Cars use similar systems to garage door openers. They are immune to pure replay attacks. And they have a 48-bit keyspace, only about 6 bits worth of which is active at a time (about 30 or so codes out of the keyspace will work at a time).

So you are looking at hitting a 1 in 2^42, or 1 in 4 trillion needle in a haystack.

Even if you rifle through codes, you're not going to hit one soon.

And if the system is designed to lock out after 3 failures, and make you wait 5 seconds to try another key, that means you won't stand much of a chance of rifling through the codes in your lifetime.

So, if these systems have flaws right now, it's in implementation, not design, and it'll be rapidly fixed.

BTW, for about 15 years there were only about 40 different door keys on all GM cars. We happened to have two at once that had the same door key (although they didn't use the same ignition key, GM used a two key system at the time). So this electronic system is still pretty much better, the only downside, is there is no deterrent to sitting a few feet from a car and trying to open it electronically versus putting a key in the door of the car and trying to turn it.

Re:If so, it won't last long...

[lars_stefan_axelsson]

BTW, for about 15 years there were only about 40 different door keys on all GM cars. We happened to have two at once that had the same door key (although they didn't use the same ignition key, GM used a two key system at the time).

SAAB was even worse, the 900 series is legendary in that respect. And to add insult to injury as keys and locks wore, they would become even more accepting of the wrong key so that you could basically use any key (though you'd stand a better chance with another SAAB key) to open and start any 900. I've done it on numerous occasions, and it even happened accidentally. A friend of mine got into his car on the factory parking lot, tired after the late shift, and it wasn't until he had backed out his car that he noticed the fuzzy dice hanging from the rear view mirror. "What fuzzy dice?" he tought, "I don't have any fuzzy dice...", then it dawned on him that he was actually driving someone else's car.

Re:If so, it won't last long...

[RESPAWN]

Old Toyotas (80's era) are known for having similar issues. I had one key for my old '86 Corolla which I mistakenly thought wasn't cut at all when I bought the car as it didn't have any sharp peaks or valleys. Imagine my surprise one day when I compare it to my cut keys and realize that it was more or less analgous to a lower resolution version of the "real" keys. I was even more surprised when I found that I could unlock and start the car with the key.

Re:And thats why... keys are no better

[lgw]

I had one of those once. The damage the thieves did cutting the steering wheel to pull the bar free cost more than all of the rest of the damage they did. Nasty. I'm sure it slowed them down by a minute or two, however.

Bring Your Daughter to Slashdot Day

[Hoi Polloi]

I hate to break it to you but I found her "Hide-A-Key". You chose an obvious place to try to hide it.

Re:20 *Minutes* is actually quite long...

[cdrudge]

I think his point is it's not that much different with a luxury car then it is with a more traditional car. If you know what you are doing, it only takes a minute or two to steal a car. Here's a video of some amaturish appearing kids stealing a car in about 2 minutes. A minute of that was working the lock and about 40 seconds was working the ignition wires. If it's a quite area, just breaking the window takes a second or two.

In reality the only differences between the two types of theft is the amount of money spent on the vehicle, and the amount of time no one notices (or cares about) someone working on it. 20 minutes or 2 minutes, either way your car is gone.

They use a tow truck to steal hi-tech luxury cars

[vinn01]

In 20 minutes, the car could be at a garage far away and nearly stripped.

My brother's car was stolen with a tow truck. It probably took 20 second (I'd bet that the theives didn't bother with the safety chains). The cops told him that the car would be stripped before they finished taking the report.

OS

[DeadCatX2]

What OS do they use for cars?

Probably whatever real-time OS they have available for the MCU which gets chosen.

I'd laugh if they used PICs.

did you read the article?

[SuperBanana]

The point is that unless you have the proper equipment to unlock, the car can lock itself to the point where it can not be driven.

And I can implement a system that locks out ssh from any IP address that tries more than 3 wrong passwords. That won't stop someone from exploiting a vulnerability in Apache or PHP, and rooting the box. It also won't stop someone from trying passwords from the console, if I didn't set that up as well...

If you had bothered to read the article- the whole point is that theives are exploiting weaknesses in the systems and doing so successfully. Some early systems were hilariously bad; GM's first attempt involved a resistor at the base of the key, and the ECU would simply check if the resistance was correct.

You remind me of the Iraqi Ambassador, with buildings getting shelled behind him, declaring that the Americans are being repelled and have not entered Baghdad. Cars are being stolen right now, despite all the lockouts and "rules" car manufacturers have imposed.

See, modern cars have variable valve timing, coil-on-plug ignition, and a whole bunch of other stuff that simply will not work without the cooperation of the computer.

Variable Valve timing and coil-on-plug ignition do not make a car harder to steal; you still need fuel and a spark, and if the ECU won't allow the car to start, it won't allow the car to start; a 2007 A6 with direct-injection, Variable Valve Timing, Variable Intake Geometry, Coil-on-Plug ignition, etc is no harder to "force" to start than my '91 Audi with none of the above; both ECUs will simply not allow fuel or spark. Plus all of these components are 'stupid'; they're just valves and whatnot. It is not cost-effective to make each coil-pack module demand authentication from the ECU. The manufacturer's job is to make it difficult to steal a car; the rest is society's job (ie low motivation to steal, public awareness ie people notice someone doing something they shouldn't, and last but not least, government- ie police, courts, jail, legislation.)

Futhermore, dealerships use computerized scan tools to communicate with the various modules in the cars. When the owner uses the wrong key 6 times in a row to try and unlock his shiny new Mercedes- they don't package the car up, slap a UPS label on it, and send it back to Germany...nor do they do that with any of the computer modules like you implied; it honestly sounds like you had no idea what you were talking about and confusing RADIO lockouts (where MANY radios WOULD permanently lock themselves if too many incorrect keycodes were entered, and had to be sent to "repair" centers.) The dealer tech plugs in a computer, possibly calls a hotline and validates himself to get a code based off the vehicle VIN number or a code the ECU spits out, aka challenge/response - and then unlocks the security system. VW uses a particular system that is almost completely emulated by software packages like VAG-COM and ProDiag, and both can be used to re-associate a dashboard and ECU without any dealer involvement.

Anti-theft is about theft deterrent; as we network people say, "you can't stop a big enough hammer." There are now towing/recovery companies using tow-trucks that have crane, reach over the car, the tow truck operator slips arms under each wheel, and then the crane picks the car directly up and plops it on the back of the tow truck. You can do almost the same thing with a regular flatbed tow truck and a set of wheel dollies (designed for moving cars that can't be started, have been crashed, etc.)

Re:did you read the article?

[dknj]

VW uses a particular system that is almost completely emulated by software packages like VAG-COM and ProDiag, and both can be used to re-associate a dashboard and ECU without any dealer involvement.

Define re-associate.

Re:did you read the article?

[SuperBanana]

Define re-associate.

The ECU won't allow the engine to start unless the dash is "coded" to it or vise-versa, I forget which. One of the advantages of owning a 16 year old car is that you don't need to worry about this kind of bull :-)

Actually, I should clarify- the system is on a lot of Audis made in the last 5-6+ years; no idea about the VW side, but I assume a similar system is in use, possibly implemented after Audi used it.

Re:did you read the article?

[bmajik]

As I understand it, recoding Immo2 and Immo3 systems with VAG COM requires an SKC, which only a dealership with a terminal to the VAG mothership in germany, can give you. The latest generation SKC is also datestamp dependant, so it's only valid on the day it was requested.

The dealer is under no obligation to give you the SKC, but, assuming they do, THEN you can recode to your hearts conteng using VAS-1551, VAG-COM, or whatever.

I think the insinuation of the OP was that engine complexity has risen sufficiently that you will not get the car started without ECU cooperation. I tend to agree.

The line to draw here might be in the mid-late 80s, when prior to that, some cars had mechanical primary operation with electronic "tuning", but a non-ECU limp-home mode. Bosch KE-Jetronic (CIS-E) comes to mind. Even newer ignition modules have a limp-mode where timing is a static 10BTDC.. ala Ford EDIS.. it will still send a spark signal even in the absense of the advance setting from the ECU.

But even as far back as Motronic 1.0 (mid 80s), if the ECU didn't feel like sending a spark signal, there wasn't going to be one. THere was no anti-theft in M1.0, but the point remains - the ECU has final say in the startability of any sufficiently modern car. (note its worth making the distinction between an ECU that withholds a start signal and one that also withholds ignition/fuel signals on a cranking engine.. an effectivee attack on some cars is to manually engage the starter.. the ECU sees the engine "cranking" and supplies the necessariy signals to the injectors and ignitor(s))

To work around an uncooperative ECU you need to come up with your own fuel control at a minimum (maybe you could fake this by jumpering the fuel pump relay, and then having a potentiometer driving an oscillator on the injectors, assuming batch injection) and spark, assuming the built in ignition doesn't have a fall-back mode.

I think we agree that the ECU being uncooperative makes life worse on old and new cars alike, but i think that there is a sufficiently old/dumb system out there that the ECU can be worked around, where as a sufficiently modern system, the ECU must be convinced to cooperate, as a practical matter.

Re:did you read the article?

[xixax]

See, modern cars have variable valve timing, coil-on-plug ignition, and a whole bunch of other stuff that simply will not work without the cooperation of the computer.

A friend of mine makes aftermarket ECUs and he tells me that thieves *do* pull the native ECU entirely and bring their own. Stealing tech cars should be in the realms of script kiddies (except they don't just spray paint "ow3nz0r!" on the windscreen).

In nay case, a "three strikes" policy would also make it easy to DoS someone's car, a security feature in one dimension, can diminish in another.

Xix.

Re:did you read the article?

[dknj]

you use the vagcom to reprogram the odometer, if its less than 200 miles. if its over 200 miles, you're SOL. no such thing as "reprogramming the dash to accept the ecu".

Best Anti-Theft System I Ever Had

[Hoi Polloi]

My first car was a Ford Pinto with an unbreakable anti-theft system. Every so often, at seemingly random times, it would stall and couldn't be started for approx 24 hrs. It usually did this in the worst possible places (left lane of highway, busy intersection, etc). Any thief who could bypass this system could have had the car if he only told me how he did it because no mechanic was ever able to figure it out.

On a good note I did get to use 100% of my free AAA tows for that year.

My wife's Honda Civic has a similar feature that prevents it from being started if you leave the cruise control on. The cruise control button "on" light is dim and well hidden behind the steering wheel for extra security.

repo software

[wile_e_wonka]

This really brings up an interesting point. Repo guys really might start using this technology. Those big deisel tow-trucks are quicker than breaking into the car, but they are really noisy, which wakes the owner and the tow truck takes long enough that the owner has time to run outside and object (in most states, a verbal objection to repossession is enough to make finishing the repossession job illegal). Imagine if the repo guy just parked accross the street, pulled out his laptop, and went to work. 20 minutes later, he opens the door, hops in, and drives away--no one has time to figure out anything has happened before the car is gone.

However, if repo guys started doing that, then real software for it would come out. Nice, easy to use software with a pretty GUI that even a repo guy can use (I'm not saying they're dumb, but I don't think they're generally too computer savvy. Sorry to all the repo guys read /.). If that happens, then we'll soon have nice easy to use software that just about anyone could use to drive away in a car that isn't theirs.

Re:repo software

[Mister Whirly]

Do you think your average repo man could even operate a laptop let alone utilize the technology to break into and start a car??

Re:repo software

[colinrichardday]

But what if the repoer works for the dealer? Would that make it simpler?

Re:repo software

[wile_e_wonka]

I decided to wait a little while to reply to this. I guess we still don't know the answer to this question for sure, but I thought your post would be a good way to find out if you pissed off any repo guys that read slashdot. But either there were none that found your post, or they're silently seeking a certain "Mister Whirly." So I'll have to tentatively agree with you until further developments.

Re:repo software

[wile_e_wonka]

I learned recently in my Secured Transactions class that there is a basketball player who owns a car dealership that specializes in customers with really crappy credit. His dealership includes in the security agreement a right to make the car unusable upon default. That right is pretty normal, but--this dealership installs a device in every car it sells that the dealer can operate to render the car useless to the owner until they correct the default. The legality of this hasn't been litigated, but seems to be on the line (according to my professor anyway).

Why don't dealerships ever put in the security agreement that they will make and hold on to a copy of the key? Or, in this case, the dealer could order an extra "clicker" with every car, and hold on to that.

Re:repo software

[Mister Whirly]

Hey, where the hell did my cars go last night???

I told you, but you laughed at me.

[geekoid]

About 5 years ago, there was an article about keyless systems and I said they would be easy to crack or get around.
I got many responces me call ing an idiot and explain that there would be so many possiblities it would take years to find the right one.

Re:I told you, but you laughed at me.

[Anonymous Coward]

who's stupider...the idiots that tried to tell you you were wrong...or you for taking them seriously enough to post an 'i told you so' message...or me for bothering to ask the question?

I don't buy it...

[YesIAmAScript]

How did the situation arise, the professor bringing this up?

And a student who could do it was in the class? And the student happened to have his programmable 390MHz transmitter with him?

And then, he managed to pop it open and start the engine, something you can't do from the remote on any car except a few Chevys? All in a few minutes, despite the enormous keyspaces car security systems use?

I'm sorry, I'm calling BS on this story at first glance. Do you happen to have more details?

Re:I don't buy it...

[geekoid]

"something you can't do from the remote on any car except a few Chevys? "

Many cars have remote starting.

Also, it could have been an electronics class.

Re:I don't buy it...

[crabpeople]

And the student happened to have his programmable 390MHz transmitter with him?

what you dont?

Re:I don't buy it...

[Milican]

Well with any large keyspace there is a chance that you could get the right key even the first time, or in the first portion of a brute force attack. Considering there is no proof one can be skeptical or let the imagination run. I'll take the latter.

JOhn

that really sprung out from the article

[bobamu]

it seems that this is never learned.

But hiding the technicalities and making it illegal to discover their weakpoints is the way manufacturers/**aa or whatever think they protect themselves.

Which is great but the whole thing about criminals is that they generally are more concerned with successfully committing crimes than legal issues surrounding their failure to successfully steal cars or even worse, download an mp3.

Yeah..but how fast...

[Anonymous Coward]

Can a Gibson do it? I mean, with 4 hackers they can do it in 5 minutes but wow, the power of the Gibson? 2 minutes flat.

Example of key issues

[Shivetya]

My aunt drove to the mall, locked the car, and then found out she could not get back into the car. Turns out that she had started her car using her husbands keys, both owned the same brand of car but not the same model. Now his key would actually not start her car which I guess might be attributed to wear on one mechanism or another... but I don't know for sure.

Back in the 80s my Ford key would also unlock a few other Fords that friends had in the dorm. I could not start any but it was interesting to find out how many of us could unlock other cars.

Now I have never seen a keyless entry fob work on more than the car it was assigned to.

Re:Example of key issues

[bockafer]

Ford keys use(d) the first 4 or 5 notches for the door and the last 4 or 5 for the ignition (or vice versa). The locks also only use one side of the double sided key. We had a few Fords and would cut one side of the key for one truck and the other side for another.

The reason why the USA is dying on all fronts

[Anonymous Coward]

... is that instead of dealing with issues, all you guys ever do is throw buns at the "other" party. You're both identical, FFS.

Yes, I know your reply was in jest. It still applies though.

And that's exactly how the politicians like it. Play their political games, instead of taking them to task for destroying what was once a great country.

Re:The reason why the USA is dying on all fronts

[LiMikeTnux]

nazis!!!

(i win, hehehehe)

If you really want your car to be secure

[spun]

You need to build up it's self esteem. Talk nicely to it, tell it what a good car it is. Buy it some premium when it's being good.

Don't belittle or yell at your car when it's naughty, a firm "No!" perhaps followed up by thwacking it in the grill with a rolled up newspaper should suffice to let the poor auto know it has been bad without destroying it's self esteem.

When the time comes and your car starts to notice cars of the opposite sex, do not make this a big deal, that can cause deep seated insecurities in any automobile. Let it know that the feelings it is having are natural and no big deal.

It will also help if the car does not have to worry about it's old age and retirement. Let your car know you have invested some money for it to live off of when it leaves the workforce.

Re:If you really want your car to be secure

[buck_wild]

But what to do about problem 'leakage?' I'm still trying to get some of the stains out!

Start stealing cars, pal.

[Khyber]

For any system put in place for security, there's always a way around it. In this case, after taking your laptop and a special adapter from serial/USB to plug into the car's computer, you can reprogram it any way you choose (Guess you never watched Fast and Furious, eh? Remember the guy who had his engine's timing and nitro/fuel ratio all done on computer?) We've been doing shit like this for years and years, down to re-wiring shit under the hood to bypass useless crap like that. Please. There are engineers and smart people out there that coudl take something requiring a laser-cut key with RFID embedded into the key and make it run and drive with a few simple modifications and wire re-routes, and it doesn't take that long. It's not that hard, and if you don't believe me - come with me next time I decide to screw around in a junkyard - I'll show you just how to bypass the computer in a car so you get pure fuel pump and spark without any computer-controlled crap in the way. It's honestly not that hard at all.

Re:Start stealing cars, pal.

[drinkypoo]

I'm skeptical that you can get a car with sequential fuel injectors to run anything close to properly without the ECU. You can't just inject the fuel when the spark takes place. My Nissan (like most of 'em) has a CAS with a #1 TDC signal, three more 90 degree signals (it's a four banger) and 360 1 degree signals. There's no other mechanism for advancing timing, so the best you could do would be to get it to idle, and frankly, I doubt even that. I'd love to be proven wrong but unless you live in nocal I don't think a field trip is in the cards.

Re:Start stealing cars, pal.

[Khyber]

Nope, no field trip in the cards - but you're in luck - Memphis is running a news report right now on ABC (will probably show up on their websites after the actual broadcast) detailing how people are bypassing security mechanisms in cars and stealing them. (And our mayor, of all people, is being blamed for this when he has no responsibility to this, it's not like he gave detailed instructions on how to steal a car) Even just getting a vehicle to idle can give enough power to move the vehicle (try it with an automatic transmission car - keep your foot only on the brake, in first gear idle. let off the brake - boom, you're moving without using the gas pedal.) All that's left to do it unlock the steering wheel, and you're running around with a car, albeit at a slow speed - probably only a good enough speed to idle the vehicle into a waiting tow vehicle or trailer. You are right about timing signals - but thats easily overcome by knowing some mechanical logic (remember, we didn't have computers in cars back when Ford created them) and fuel injectors don't necessarily need all this electronic stuff. Ever seen the slight EM field that's produced by an engine when it's running? (alternator is the source) One of these days we're going to make everything dependent upon electronics, and it'll only take a faulty alternator to fry every electronic device in the car - rendering it useless, possibly on the very first startup of the vehicle. While I'm all for regulating emissions and such from cars - doing it electronically is not the way to go, IMHO.

Re:Start stealing cars, pal.

[drinkypoo]

While I'm all for regulating emissions and such from cars - doing it electronically is not the way to go, IMHO.

It's not just the best way to do it, it's the only way to do it. The perfect example of this is points, the first place transistors really got involved in critical automotive systems. They require constant adjustment for ideal operation as they wear out over time. Then you've got the vacuum advance; they're never quite right either.

The best argument for using computers though is probably that there's no reasonable way for mechanical systems to "learn" over time. The complexity of a computer-based system is probably less than would be necessary to do it mechanically.

Of course, there's also the entirely valid argument that computers are making cars more reliable. Coil-on-plug comes to mind first. However, as should be obvious, they've also made cars much more expensive.

Re:Start stealing cars, pal.

[BLKMGK]

While I cannot say I agree with your comments 100% you are for the most part correct. I've done ECU programming of standalone ECUs and it can be a real bear to get a car running right! There are replacement ECUs out there though that can be swapped in - AEM makes a whole line of them. These can replace anti-theft hardware in some cases but in others you have to wire around some hardware - not something you're going to be doing someplace where you can be spotted. Just swapping in an ECU can be a bitch in some cars! Getting into the ECU with a laptop has gotten pretty easy on SOME cars - they can be programmed almost as easily as a standalone and that includes bypassing theft in SOME cars. The high end stuff isn't going to be that easy and the manufacturers are trying hard to keep people out of the ECUs for lots of reasons too.

I agree that electronics are the best and really only way to do emissions. Heck, we have BETTER running cars as a result too. Wideband O2s, coil on plug, vairable valve timing, and all sorts of engine controls have been a direct result of the desire to get better economy, power, and emissions from cars. Trying to do this mechanically is a joke - electronics HAVE to be in the mix to do it halfway right. Carbs are a JOKE and seldom if ever calibrated right and if they manage to hit stoich a weather change or altitude change will quickly modify the behaviour....

Best way to steal a car...

[Antony T Curtis]

Don't bother with all the high-tech stuff.

Paint up a flatbed truck which has a mini-crane for lifting vehicles to look "official". And get some kind of uniform.

Cruise around areas which have parking meters and if you see a nice car, park next to it and pick it up and drive off. 30 seconds maybe.

Chances are, no one will bat an eyelid or ask a question. And because people are good at completely ignoring the mundane (Someone Elses Problem), no witnesses when you do it in daylight hours.

I won't be surprised if people are already doing this.

Attention Mr. Beckham

[Nom du Keyboard]

The expert gang suspected of stealing two of David Beckham's BMW X5 SUVs in the last six months did so by using software programs on a laptop to wirelessly break into the car's computer, open the doors, and start the engine.

I hope Mr. Beckham doesn't protect his wife Victoria (Posh Spice) Beckam from being stolen and having her engine started the same way.

On second thought I have a laptop, so maybe I hope he does protect...

Poles

[BcNexus]

I am so excited someone else besides me noticed why those were there!

The fact that is the only reason the poles are there is hilarious to me because it takes a clever person to proactively think of having the poles. Of course, it's not so clever if they're a reactive measure!

Low on content?

[hairykrishna]

Anyone have a better link? Are they just scrolling through all the possible keys or what?

Look at the battery life

[kurt555gs]

Looking at the specs, I see 6 to 12 hours battery life in that portable.

Wow, look how far we have come from there.

Doesn't Bother Me....

[darkonc]

I don't own a car....
But I do have a laptop..... (( bwahahahahaah! ))

Why do people.

[TooncesTheCat]

Why do people always think that stolen cars are always stolen for parts or shipped overseas.

It is'nt really hard to steal a car and drive it yourself with perfectly legal VINs and S/N's without ever getting caught. People seem to think stealing a car means that you will never able to drive it. It is actually pretty easy to convert a stolen car into a perfectly legal car so that the police will not be any wiser.

Probably a repo truck...

[cr0sh]

Repo trucks are very similar to tow trucks, but they are designed to do one thing - grab a car and get it away FAST. The main difference is in the lifting system. Most repo trucks use a system where they can lower the grabber forks, shove them under the front or rear tires (they automatically "flip" into place around the tires), lift the car up, and drive away - usually to a "safe" spot where they can easily put on the safety chains and such equipment for the trip back to the yard. Many times, a skilled driver can grab a car and leave without even leaving the cab for the initial take (as long as there is sufficient access to the front or rear of the car).

Take a look around as you drive - see if you can spot the "repo trucks" in your area. Once you know what to look for (most of the time it will be a relatively unmarked truck with the special grabber, white or black, usually - if there is any signage on the truck, look for the words "asset recovery" and the like). Interestingly, also, some repo men do side jobs as tow trucks - for short, in-town runs such trucks work great.

It wouldn't surprise me a bit if there were car thefts being performed with repo trucks - maybe an errant driver who lost his repo job for drug use, drunk driving, or other - or maybe a used repo truck - now being used to steal cars...

Re:20 *Minutes* is actually quite long...

[BcNexus]

Either that viedo is less than 15 fps, or it is sped up, because the people's movements are quite jerky.

Where can I get one

[Kuvter]

of those laptops!?

Oops probably should have posted this as Anonymous Coward.

Assasination?

[Anonymous Coward]

If you gain complete control of the onboard computer, could you, say, corrupt the ABS drivers (pardon the pun)?
Or the brakes completely. Or throw in a new program, that's set to disable brakes at a certain speed.

Would this be possible?

0-day release, but a few years late

[Anonymous Coward]

Where's the release on this? This is why it's important for security vulnerabilities to be released to the public immediately. The public needs to know that it is possible, however unlikely, that some random stranger could get into their car. I don't care about the car; I care about the laptop in the trunk.

I once used the same replay exploit with the original Handspring Visor and a Mercedes e320 that used infrared door locks.

Used to work in a shop

[Skadet]

Late to the punch, I realize, but I used to do odd (electronics) jobs for a car stereo/alarm dealer, where I learned a great deal about car alarms.

No, car alarms don't disble themselves on an angle. In fact, a common accessory is an angle *detector* to make the alarm go off in case someone (legit or not) attempts to tow. Often this is just a ball bearing in an assembly that completes a circuit when tilted, although I've seen ones made out of mercury that work essentially the same way as the older-school a/c & heating thermostats.

When an alarm WILL disable itself is when you enable the courtesy feature. Say you have your sensitivity set high, and the night is unusually windy. Instead of going off all night, your car alarm will disble the inputs for that ZONE for an hour (or 2, whatever... programmable).

Note that door switches, window break sensors, motion detectors are all still active, since each of these is on its own zone.

Missing the point

[Skadet]

I think you're missing the point that locking a car down via software (which is what you're advocating above) isn't secure.

no, they don't...

[YesIAmAScript]

Many cars do not have remote starting. It is available on some 3rd party alarms though.

GM was the first to introduce it. Why, I dunno, since it had been available from 3rd parties for some time.

As to the 2nd part, I blew it, I see how the situation happened, how the prof would make that statement (he was prompted). But having a 390MHz transmitter on hand. Unlikely.

And as I said, the systems are very secure, at least in design.

Re:no, they don't...

[Anonymous Coward]

But having a 390MHz transmitter on hand. Unlikely.

An implicit "try tomorrow, at the start of class" would make the story believable.

Anti Theft ... radio....

[jftitan]

I know this comment will be offtopic! ITS OFFTOPIC!

    My car been broken into for the 5th time for the past 5 years. And it seems to me it happens in April every year. I want a anti-theft system that will stop those trying to steal my car stereo, incl anything else they want to steal.

  This time around, they took my $650 stereo, DC-AC power inverter, power adaptor for my laptop, and adaptor for my cell phones (while leaving behind the plugs). Emptied my glove box for the radar detector, and $100 cash hidden underneith in a black cash fold, while causing $500+ in damage to the center console they tore up trying to take the well mounted stereo and they took my insurance papers for my car. (didn't notice the missing insurance papers until after I got pulled over a week later... the police officer was kind enough to let me go because my car was hit prior)

    I've devised a nice anti-theft system for car stereos, so please bear with me on this.

  I intend on placing a live grenade behind the stereo head unit. Now I know heat might set the thing off... but I'm willing to take that risk on the test bed. alot of trial and error will happen while I test this system with many cars, in very bad neighborhoods.

  I plan on mounting a grenade behind car stereos, fashioned together by a trigger release wire, that is attached to the rear of the stereo and the mounting harnest.
  (I've tried the 12guage wire, to help prevent the theft of my last stereo, and learned with enough force, the weak point in yanking out my stereo was the screw holding the wire to the frame of the car.)

  Now this time the wire will hold the pin and tab of the grenade until the stereo is yanked out of the mount, the wire seperates from the head unit. I say, time/set the grenade for 5 seconds.

  You know what happens at this point. We loose a theif, and a car + stereo + other vehicles nearby, and some casualties of war. But in the grand scheme of it all. I feel better because the bastard didn't get my stereo.

Re:Anti Theft ... radio....

[jftitan]

Correction... Car Alarm systems seem useless in a situation like this...

What if the car battery goes dead. useless alarm.
You overcome the problem of people accidently bumping into your car, setting off your car alarm... who needs that... its annoying.... The Grenade Anti-Stereo Theft system is perfect. It makes no sounds, (until someone steals your stereo)

(Yes I had a Car Alarm installed in my car after the third year of the stereo theives hit, the last two times, the alarm system failed to go off.) Remember the movie of 'the super' superattendant (I know I messed that one up). Car was on blocks after everything was stolen, but as soon as the dude throws a rock at the car, the alarm goes off.... yeah I have one of those systems.

I'm working on a maybe IPing this thing.

Re:Anti Theft ... radio....

[buck_wild]

First off, you rock.

Having had a couple of classic cars stollen, I toyed with several anti-theft ideas myself. The first was a set of needles underneath the driver's seat that would contain (at least) a major sedative. If the car were put in motion without a secondary security system having been satisfied...sproing! And you've got all the evidence needed to hand the guy over to the cops. An alternative is to electrify all metal in the car, or possibly spray out a noxious/toxic substance.

We both know these ideas are (mostly) in jest, as there are some risks. A friend of mine installed razorblades behind his head unit in the dash. When the would-be theif tried to yank it out, he lost 2.5 fingers. As a result, my buddy's insurance company got sued for a large sum, and settled.

These days, I use the security-by-obscurity method; I simply hide anything of value, or at least take it with me. For example, I have an old Ipaq with a wireless card that I use as a head unit in one of my cars. Yeah, I have to plug it in every time, and I only get to listen to a gigabyte worth of stuff, but it's small and won't be a big loss even if I lose it. :)

Re:Anti Theft ... radio....

[jftitan]

Actually I did hide all my stuff..

What really pissed me off was the fact that my stereo was the Sony CDX-M630 series. meaning the hideaway faceplate. When the car is turned off the face flips backwards, only showing a blank insert. I paid good money for the thing (ok, I bought it from a crackhead... but he was an expensive crack head with 1 year warrantees "ba da ding!")

As for the charger, radar detector, power inverter, and so forth, all those items were in the glove box. (which I think I should have mentioned more clearly in the last post.)

All in all, what really pyst me off was the fact that they poped the trunk, and took my craftsman toolbox. it was a birthday gift from a beloved and it really ment something to me (yeah Man with his tools)

Well here is an update. I finally got my Araikon SIM-4 R.I.S. Elite paintball marker with the HP remote + tank, and I froze a few paintballs.

I parked my car in the bad neighborhood where the theft happened, and I pretty much camped out for the late friday night @ 3am. Low and behold, someone was walking down the street checking door handles. (mind you I see all of this through the attached generic 'craptastic' 10x scope, far behind in a bush, (yes I do have way too much time on my hands)), the guy comes to my car, peers in, only to keep walking.

I swear I should have shot the dude just for looking, but I know I couldn't prove a thing if I had called the police. I'm pretty sure he looked into my car, realizing it was a car he hit prior, and it most likely had nothing left to take. I should have left my laptop, or my ipod, or something worthwhile. (no, not the SIM-4... if I left that, then what would I shoot the guy with... my 9mm?... Thats way too redneckish... I want the guy to suffer, and live through it.)

I did follow the guy for awhile, and it seemed to me that he wasn't really interested in stealing things 'seriously', more like a casual thief 'when the opportunity presents itself, go for it' kind of thief. When we reached the end of the block, the guy just kept walking as if he was just... well you know... walking. "It ruined my night." -Joe

Re:Anti Theft ... radio....

[buck_wild]

Niiiice. I didn't mean to infer that you didn't hide/mask your stuff. When it comes to personal security, I'm a fan of 'security through obscurity'.

Why frozen paintballs? Wouldn't that be like a high-powered BB gun? What would be interesting is obtaining a mold for paintballs, and making them from ice. Well, assuming that the gun itself could handle them without smashing them.

Heard at the autopsy: "Interesting. There's an entrance hole but no exit hole, with no particles. I can't specify what weapon was used."

Re:Anti Theft ... radio....

[jftitan]

interesting... keep talking... LoL

    I might make a mold for a .60 cal ice bullet. oh wait... myth busters busted that one. BUT WAIT. they busted that based on a rifle. what if it was a high powered paintball marker like my Araikon SIM-4. (it a weight to design resemblance to the military's M4 rifle.)

Was I talking aloud? doh!

Re:And thats why... keys are no better

[kilodelta]

My 1981 Ford Escort had problems with the ignition key cylinder. I found out that you could pop it out and just start the car with a screwdriver.

I used to leave it unlocked with the screwdrive in the glove compartment. Nobody ever touched it. It wasn't exactly a car that was high on the theft list.

Oh, crap.

[RealGrouchy]

How will this affect the keyless entry to my bicycle? Will people be able to use their laptops to activate its drivetrain?

- RG>

a one-time-pad is workable

[r00t]

2 MB flash on the key, 128-bit codes, 128 k codes total

The car never accepts an old code.

The only exploit other than stealing the key: borrow the key, clone it, and get to the car before the owner uses the key. (the owner's use of the key would make your clone obsolete)

This is probably the best system that doesn't involve the key becoming a receiver. If the key does receive, then you might want to AES encrypt the time of day as received from GPS.

Re:a one-time-pad is workable

[John Harrison]

How about a $2 smart card chip with less than 2k of memory that can securely store a single 3DES (or AES) key and can initiate a secure session with the car, which also has the key? There are several well established methods of doing this and there is basically now weakness. They have to either attack the hardward to extract the keys or crack 3DES or AES, which hasn't been done.

These systems don't need to have 2 MB of memory. That is the wrong solution. They just need to be properly thought out to begin with.

Re:a one-time-pad is workable

[r00t]

To "initiate a secure session with the car", you need to establish a 2-way communication. That reduces reliability and increases cost.

Re:a one-time-pad is workable

[John Harrison]

So do you want to do it correctly or not? It isn't like this isn't a solved problem. Two way communication is cheap compared to both having your card stolen and putting MB of storage in the key fob.

More obscure reference...

[waynemcdougall]

"All circuits are....alll circuits are...all circuits arrrr...."

[20 minutes later]

"Allllll circuits are now free of outside influence."

slow link more secure

[Anonymous Coward]

Wonder if the wireless protocol is too fast -- seems like a 300 to 1200 bps protocol would pretty well eliminate any brute-force attacks while still working fine when the right chip comes close to the car.

Wardriving

[ozTravman]

Now this is real wardriving!

Re:20 *Minutes* is actually quite long...

[cdrudge]

The clock in the lower left starts at 48:17 and the car drives away around 50:54. The total length of the video is 53 seconds. However, if nothing is changing on the screen, the time jumps considerably. That, along with the chopyness, makes me beleive it's some type of a security camera that takes a reduced framerate to allow longer record times. So I think you are right that the framerate is low as well as it is sped up.

google... in 30 seconds

[slew]

.. in 30 seconds (if I actually typed that slow), I could find this website on google...

A DST contains a secret, 40-bit cryptographic key which is field-programmable via RF command. In its interaction with a reader, a DST emits a factory-set (24-bit) identifier, and then authenticates itself by engaging in a challenge-response protocol. The reader initiates the protocol by transmitting a 40-bit challenge. The DST encrypts this challenge under its key and returns a 24-bit response. It is thus the secrecy of the key that ultimately protects the DST against cloning and simulation.

I'm pretty sure, as this article indicates, they probably use better stuff on modern cars these days...

TI has indicated to the authors that they have more secure RFID products available at present; in lieu of specifying these products, they refer to the site www.ti-rfid.com for information.

In fact, RFID chips with somewhat longer key-lengths are already available in the marketplace and used in a range of automobile immobilizers. Philips offers two cryptographically enabled RFID chips for immobilizers. The Philips HITAG 2, however, has a 48-bit secret key, and thus offers only marginally better resistance to a brute-force attack-- certainly not a comfortable level for long-term security. The Philips SECT, in contrast, has a 128-bit key. The HITAG 2 algorithm is proprietary, while Philips data sheets do not appear to offer information about the cryptographic algorithm underpinning their SECT device. It is difficult to say, therefore, whether these algorithms are well designed.

I thought people might just be interested...

Arent we barking up the wrong tree

[tanveer1979]

Why not use something like a "gear lock". Its a physical thing, with thick steel frame. Case in point, a friend of mine uses it in his open jeep. some guy as a prank pushed in a chewing gum into the slot. The guy had to get a "welding machine" to cut open the gear lock after a steel file(industrial grade) failed to cut through. It took two hours. And yes a welding torch will attract lot of attention. Thats why though there exists electronic locks etc,, such physical devices like Steering wheel locks and gear locks are deterrent enough. Since they are very visible most thieves think "Why try my luck here, lemme choose an easier target" So no matter what gimmikery is installed in your car, always go for reliable physical protection. Newer models come with oddly shaped keys which are difficult to replicate and hence the "master key bunch" usually fails.

Ghost Dog!

[squoyster]

Who needs a laptop? All you need is the key pad thingy, a Wu-Tang Clan disk and a Samurai sword.

Using Cars to Steal Laptops?

[2e]

From a related article: "Thieves are using cars/trucks to steal the most expensive luxury laptops/notebooks. Many of these laptops/notebooks have completely keyless ignitions and door locks, meaning it can all be done wirelessly. Thieves often follow a laptop/notebook until it gets left in a quiet area, and they can steal it in about 20 minutes..."

Thieves don't pick locks...

[Joce640k]

Thieves dont' pick locks, they just stick a big wrench in the keyhole and go "kerrrr-ank!"

ASking a thief to take time to learn how to pick locks is like asking him to learn Spanish so he can steal from Mexicans.

Microsoft OS (was Re:couple of points)

[quarkscat]

The original article refers to the BMW X5, certainly a luxury SUV pricewise. I would not be
surprised if the X5 used the same OS as the BMW 7xx series, which is MS Windows CE. A
graphical UI screen on the 7xx is used to access radio/stereo functions, bluetooth config,
environmental controls, GPS navigation, car servicing info, etc. Why MS Windows CE? Both
vehicles were designed and built in the USA, so I presume that there was an inherent pre-
disposition toward this OS.

Another /. poster related a $30K Honda, parted out, as worth more than $90K. No doubt,
a $60 - 70K luxury BMW might break down to more than $200K, parted out. Certainly
not chump-change. This represents a relatively high return for 20 minutes worth of effort,
as opposed to hacking a server somewhere, especially when you consider the downside.
Hacking a server in the USA draws a lot of attention, and violates enough Federal laws to
rack up 20 to 30 years in prison (FBI, DHS, DMCA, Computer Security Act, Patriot Act, etc.).
An auto theft, OTOH, would rack up only 2 - 5 years, even if an interstate crime (Feds).

Methinks some physical anti-theft device, like a brake pedal lock, might be in order for
even a luxury car like the BMW X5 or 7xx. Nothing would prevent a rogue tow-truck
operator from getting your vehicle, though.

DoS

[Craig Ringer]

Fantastic, so now a crook can DoS my car by trying to authenticate too many times, and I have to send a part back to the factory for reprogramming if they do?

Give me my keys back.

Re:DoS

[Craig Ringer]

In fairness, a crook can also DoS my car by taking a hammer to the engine, sticking putty in the locks, etc... so I guess I'm no worse off. You know what they say about physical access.

At least the keyless systems do seem to slow them down a little more.

The best security is:

[Jeremy Singer]

Lock the car in the garage, and hire enough armed guards to provide 24/7 protection. Do an in depth background check on the guards, make friends with them and pay them well. Become somebody known and feared by likely thieves. Remove some key portion of the ignition system and take it with you.

Or you could just get your car insured, take reasonable precautions, and just put this whole thing in perspective. Life has its risks, and they can't all be evaded all of the time. Keep in mind that you will die some day and lose everything no matter what you do.

I want my car to be easy to steal!

[Builder]

Hard-to-steal cars get people killed. Look at any country where carjacking (hi-jacking) has become popular. You'll normally see the same escalation process:

1. Cars have no security, then get stolen
2. People get an alarm - thieves learn how to disable these
3. People get an imobiliser - thieves go work at the installers to learn how to disable these
4. People get a gearlock - the hijacking starts

At point 4, it's easier to take a car while it's rolling than it is when it's parked. So they do. But the escalation continues

5. People get satellite tracking so that hijacked vehicles can be recovered. Thieves turn to killers and murder the hijack victims to buy themselves enough time to get the car parked out of tracking reach while they chop it.

So give me an easy to steal car any day of the week. I want my car stolen from the shopping lot or my driveway. I don't want a gun in my back at a traffic light or a freeway onramp.

Re:I want my car to be easy to steal!

[Anonymous Coward]

No sense of the reality of this, but I recall an article a few years back on carjacking getting bad enough in South Africa that rich luxury car drivers were installing carjacking deterent systems along the lines of flame thrower aimed at the space next to the driver side door. Talk about escalation.

-SK

Re:And thats why... keys are no better

[glesga_kiss]

With nothing more than some knowledge, a spare connector, some wires, a switch and a specifically rated resistor, you could build a plug that would "start" any modern GSXR in about 20 seconds.

The thing is, I did the exact same with an electronic ignition system, must have been around 92/93. My fathers car had a broken keyfob and curious me wanted to know how it worked. Boy was I shocked. It was simply a case of a generic chip, where a "key" was set by cutting traces on the board. There were no more than 12 of these traces to select.

Using a little binary counter, I was able to make an interface to it that cycled through all of the combinations in around five minutes. Piece of piss, needed nothing more than high-school electronics.

Ghost Dog pwns ur whip....

[otis wildflower]

OHS NAP

Useless article...

[taff^2]

I was hoping it was a HOWTO

(semi)Automated attack

[just fiddling around]

The thief does not have to remain in the car next to the target; only the attacker laptop has. So you have an empty car that unconspicuously remains parked beside yours for the whole shift, not a shady character looking over his shoulder.

Even if some user monitoring is necessary on the attacker laptop, it could be done with a cellular remote link and VNC!

Man, did I play too much Shadowrun...

Re:20 *Minutes* is actually quite long...

[Sax Maniac]

But he didn't TAKE your car. Getting in is one thing, overriding all the engine-kill stuff and driving it away is another.

The reason (he claims...)

[TamMan2000]

He realized mid-order that the Guinness was not on tap, and the Coors Light was...

miss you on Slate..

[pure_life]

Dear ein', It has been a while since you've been to slate.. you've also had your posts erased. I was saddened when I saw the empty page, where your MBTU would be. Being that I'm kinda of interested in the phychology of people, and I tend to be oservant.. It seemed only OBVIOUS to me, that your name was specifically unique to you..and that you must also use it for other things. Also, I put that guess together with the fact that you are into technology.. therefor, making it only clear, that you'd most likely have accounts elsewhere.. under the same alias. So, I had found you on a few message boards you went to, since you were first on Slate. I'm not weird (well, maybe a little,) but I mean I'm not a ceep. LOL.. I just have a love for research; & that's all I did was research. & found you on google. Anyone could have done it. :-) Anywho.. just sending a note saying "HI", and that you are missed on Slate. Hope you might pass by every now and then, to post a comment. bringing your informative and enjoyable posts. I find it aweseome, your vast horizon of knowledge. and miss it greatly. Hope all is well with you and your career. - Love, Pure'

Republicans are not conservative.

[Anonymous Coward]

Unfriendly corrupt Republicans steal all they can from government.

Security makes your car less desirable to a thief

[Kodack]

Anybody who wants your car will find a way to take it. Whether it's lock and key, or encrypted tokens. The keys just keep honest people honest.

Even if you locked the doors with a physical key, had a car alarm with tilt sensor, used the club, and had software protection, someone could still bypass all of that and steal your car. But it may not be worth the risk or the effort.

The trick is not to be the weakest link. Yeah someone can get around a car alarm, or cut the club off your steering column. But if you have taken reasonable steps to secure your car, and it's going to be a lot of trouble to get into, a thief is more likely to take a crack at the next car.

If I really wanted to take someones car easy, I wouldn't bother decrypting and breaking in. I'd

A. Wait for them to get into the car and then jack them at gunpoint in which case I get the car and the keys but then they can call the police right away, unless I kidnapp them or kill them, either way it complicates things.

B. Follow them home and break into their garage when they are asleep. You would not believe how many people leave their keys in the car in their garage or how many people leave their cars parked in the driveway, unlocked, with open access to the garage door opener. The weakest link will almost always be the person.

If you don't want to loose your car then be smart. Don't leave your car unlocked. Don't leave the keys in the car. If your car has security, use it and make you a less attractive mark than your neighbor.