Slashdot Mirror
Using Laptops to Steal Cars
Ant writes "Thieves are using laptops/notebooks to steal the most expensive luxury cars. Many of these cars have completely keyless ignitions and door locks, meaning it can all be done wirelessly. Thieves often follow a car until it gets left in a quiet area, and they can steal it in about 20 minutes..."
It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.
I remember seeing on TV a news thing they did with a former car thief. He said that a car with a club, a brake pedal lock and an alarm system were the most secure. Not because they were un-stealeable, but because it wasn't worth the time or effort.
Maybe Car MFGs will get serious about security in the future, but I doubt it. The only business they lose is from people who see the top ten most stolen cars and think "I don't want one of those". Otherwise, stolen cars = money for them, mechanics and part manufacturers.
[Fuck Beta]
o0t!
And that's insecure? Your run-of-the-mill car can be broken into in about 20 seconds. How'd I know? I managed to leave my keys in my car and called AAA. The guy showed up and had it open in under 20 seconds, just using a coathanger.
From that POV, give me the fancy-pants stuff any time.
There is a student on campus that was bragging that he could do just as the article describes. A professor put down $100 and bet the student that he couldn't get into his car in 15 min without breaking anything. The student took the bet. Needless to say, the whole class was out in the parking lot 5 min later to watch. It took the student about 5 minutes. The car chirped and the lights flagshed. I assume this meant the doors had been unlocked. Next, the car started, the student opened the door and got it.
This was really cool to see live. There is a something about seeing it done live that is very impressive.
I am a viral sig. Please help me spread.
One thing they're doing these days is to store some state information so that each code is different than the previous one. However, this only goes so far in terms of increasing the complexity of breaking in. There are generally a limited number of possible codes, so you can eventually guess the right one. And since the car will be ignoring bogus codes (to avoid being fooled by other cars' remotes), you can pretty much send it crap until you hit the right value with impunity.
If you really want your car to be secure, what they need to do is make the keyless entry devices carry a public/private key pair. On each key device, put a mini-USB jack on them and have a USB jack on the dashboard hooked up to the car's computer. Use this to copy the public key from each "key". Require that after the first key is loaded, one known key must be within radio range in order to associate a new key.
When you push the unlock button on the key, the device would send an unencrypted "unlock" message. Upon receiving this, the car would reply with a random string of data (say a 2k packet). The key device would receive this, sign the data using its private key, apply a random back-off timer to minimize collisions, then transmit the signed copy of the data, skipping a random time interval between each attempt, and stopping after 5 seconds or when the car transmits a "verified" message.
Of course, the car would stop listening after 5 seconds as well. Since the message to be encrypted changes each time, this would essentially thwart any attempts to fool the car by transmitting random data until it gets it right.
If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.
Check out my sci-fi/humor trilogy at PatriotsBooks.
And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.
No, they're not safe. The key merely turns a lock that closes a contact telling the computer it's okay to proceed. After my 2001 Sukuki GSXR was stolen and recovered, I had to learn a thing about hot-wiring ignitions because the thieves had changed the locks. Within the ignition tumbler was a small PCB that connected circuits to ground for parking lights, accessories and the ignition. The added "security" was that a resistor was used in the circuit for the ignition.
Turns out, the wiring harness for the ignition has a molex connector underneath the right side fairing, right about where my fairing had been shattered by blunt-force-trauma. With nothing more than some knowledge, a spare connector, some wires, a switch and a specifically rated resistor, you could build a plug that would "start" any modern GSXR in about 20 seconds.
Keys are no safer. As far as the computers are concerned, they're either on or off. RFID, challenge/response, better encryption, failed-attempt lockouts, these things are going to become more common because they do a better job slowing the thieves down.
These opinions guaranteed or your money back.
That's very nice, but it has nothing to do with what we're talking about here, which is not alarm systems, but theft prevention devices built into the car's PCM, or Powertrain Control Module (formerly "ECU", or Engine Control Unit, but PCM is the OBD-II terminology and all cars are now OBD-II.)
Car alarms have two purposes: Inform everyone that the car is being tampered with, and stop the car from being driven. These systems have only one purpose: Stop the car from being driven. Either way, it's insignificant to the towing company. The ECU does not disable itself when the vehicle is at an angle. Personally I think that whole thing about car alarms disabling themselves is a myth anyway, because car alarms still work when cars are parked on steep-ass hills in san francisco.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I would just use my tow truck...
A car getting towed often gets noticed, but a guy with a laptop parked in the next space doesn't...
"I'll have a Guinness, no wait, make that a Coors Light" -Grad student I work with, who shall remain anonymous...
Cars use similar systems to garage door openers. They are immune to pure replay attacks. And they have a 48-bit keyspace, only about 6 bits worth of which is active at a time (about 30 or so codes out of the keyspace will work at a time).
So you are looking at hitting a 1 in 2^42, or 1 in 4 trillion needle in a haystack.
Even if you rifle through codes, you're not going to hit one soon.
And if the system is designed to lock out after 3 failures, and make you wait 5 seconds to try another key, that means you won't stand much of a chance of rifling through the codes in your lifetime.
So, if these systems have flaws right now, it's in implementation, not design, and it'll be rapidly fixed.
BTW, for about 15 years there were only about 40 different door keys on all GM cars. We happened to have two at once that had the same door key (although they didn't use the same ignition key, GM used a two key system at the time). So this electronic system is still pretty much better, the only downside, is there is no deterrent to sitting a few feet from a car and trying to open it electronically versus putting a key in the door of the car and trying to turn it.
http://lkml.org/lkml/2005/8/20/95
I think his point is it's not that much different with a luxury car then it is with a more traditional car. If you know what you are doing, it only takes a minute or two to steal a car. Here's a video of some amaturish appearing kids stealing a car in about 2 minutes. A minute of that was working the lock and about 40 seconds was working the ignition wires. If it's a quite area, just breaking the window takes a second or two.
In reality the only differences between the two types of theft is the amount of money spent on the vehicle, and the amount of time no one notices (or cares about) someone working on it. 20 minutes or 2 minutes, either way your car is gone.
It won't work on cars that are already started, the module doesn't do anything then. Even on parked cars, he'd have to have both the transmitter (which wouldn't need much power, the key's output power is roughly nil) and a way to insert a blank key in the ignition since that's the only time that the key is actually scanned (maybe just at ignition time.)
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Late to the punch, I realize, but I used to do odd (electronics) jobs for a car stereo/alarm dealer, where I learned a great deal about car alarms.
No, car alarms don't disble themselves on an angle. In fact, a common accessory is an angle *detector* to make the alarm go off in case someone (legit or not) attempts to tow. Often this is just a ball bearing in an assembly that completes a circuit when tilted, although I've seen ones made out of mercury that work essentially the same way as the older-school a/c & heating thermostats.
When an alarm WILL disable itself is when you enable the courtesy feature. Say you have your sensitivity set high, and the night is unusually windy. Instead of going off all night, your car alarm will disble the inputs for that ZONE for an hour (or 2, whatever... programmable).
Note that door switches, window break sensors, motion detectors are all still active, since each of these is on its own zone.
Sony ha