Slashdot Mirror
BMW Cars Vulnerable To Blank Key Attack
Techmeology writes "Thieves have discovered how to steal BMW cars produced since 2006 by using the onboard computer that is able to program blank keys. The device used — originally intended for use by garages — is able to reprogram the key to start the engine in around three minutes. The blank keys, and reprogramming devices, have made their way onto the black market and are available for purchase over the Internet."
Not only would Google's self-driving car be vulnerable to this attack, it would start driving around itself! And you would be responsible for everything the hacked vehicle did.
I agree with the previous note. It raises some very interesting points and why Google's self-driving cars would be bad. Just imagine if someone hacked your car and it ran over someone.
There is that, or use security by obscurity. For example, on Ford PATS systems, one can put a switch in on the circuit of the ignition antenna which reads the key's RFID chip.
Flip the switch, and even if a thief was able to clone a 40 (S) or 80 bit (SA) PATS key, they will still be stuck scratching their head as the ignition still wouldn't start.
Of course, this doesn't mean that the thief will not resort to vandalism, but it will mean the vehicle most likely will remain in the same spot unless towed.
Why I rarely bother to lock my car. Granted its an older model. Truth is, ya, a determined theif will steal the car about as quickly as I can unlock the door and start it normally with the key. Most people aren't so motivated, and governed by basic morals. As long as the key isnt in the car, and there's nothing worth stealing in the car, and I'm in a reasonably low crime area, the car is gonna be fine in all likelihood. Just as well since hte lock has started acting finicky about 6 months ago. I really need to take it apart and degrime it with some WD or something.
The guy who said the election was rigged won the presidency with the second-most votes.
Highly advanced cyber-thieves discover method to steal cars with a coat hanger and a screw driver! Everyone cower in terror!
Not that this isn't dumb security on BMW's part, but the thing keeping people from stealing your car is their conscience and the police, not your hyper-powerful super-locks. They might keep some dumb teenagers out of your car, but not car thieves who buy blank keys on the black market and learn to reprogram them.
The seemingly odd thing is that there are other implementations that work the same way (I have seen this done to Honda cars many many times) but don't suffer from this kind of attack, since the car computer purposefully responds very very slowly to the reprogram command. Leave it to those hyper-efficient Germans to think that reducing the time required was a good thing.
I stopped locking my car for a similar reason. Nothing in my car is worth more than the cost of a broken window. I will say that I've lost a few jackets I've left in there during the winter, but, as I said, they were a lot cheaper than a new window.
Joy! Beautiful spark of the gods!
Why so complicated? a simple $3.29 switch that interrupts the power to the fuel pump. Works on 99.98765% of all cars and will foil any thief.
Flip switch under seat, and leave the car. Thief tries to start car and it acts like it is out of gas. No thief will look under the seat for a switch they have less than 30 seconds to get in and get the car moving or they risk getting caught, so if they cant do a fast smash and grab they move on.
Do not look at laser with remaining good eye.
So put the switch different places in different installs. Under the seat, in the glovebox, and under the dash (above the accelerator) all come to mind. Better yet, repurpose an unused factory switch, or find a factory switch you don't really use, put that elsewhere, and hook the old switch up to the fuel pump. Maybe you have to push the tire pressure monitoring system reset button before the car will start...
This is security by obscurity, but when it's different and non-obvious on each car, it's good stuff.
No, that's not "security through obscurity," it's "security through ridiculously circuitous nonsense."
Most modern cars, i.e. the type to have a tyre pressure monitoring reset button, don't like it when people start hacking up their wiring harnesses. And by "don't like it," I of course mean "will refuse to start until a professional technician fixes all the wiring you fucked up."
Not that a fuel pump cut-off switch is a bad idea, but your suggestions on placement and operation indicate a fundamental lack of knowledge concerning modern automotive systems.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
True story. Some years back in N.Y.C. thieves stole a restored vintage car, not knowing the owner had installed his own homemade anti-theft deterrent system. As they're tooling around in Manhattan, the thief who's driving sees a large unlabled red button mounted all by itself in the dash. The guy says to his buddy, "Hey,I wonder what this does...", and presses it. In the middle of a block the engine shuts down, the horn blares, and the car's lights keep flashing on and off. Unable to restart it, the thieves abandon the car, and that owner was laughing when he got it back, unscathed, the same day. So this story shows how you don't always need an expensive complicated alarm system to get the job done.
I had a friend who's car had to have the headlights turned on or else it would honk if you tried to turn the ignition. That was a wacky way to keep people from stealing your car.
"All tyranny needs to gain a foothold is for people of good conscience to remain silent." [Thomas Jefferson]