Slashdot Mirror
Car Thieves and Insurers Vote On Keyless Car Security
RockDoctor writes: The BBC reports that Britain's car thieves, rapidly followed by Britain's car insurance companies, have been expressing their opinions on the security of keyless car entry and/or control systems. The thieves are happy to steal them (often using equipment intended for dealer maintenance of the vehicles) and in consequence the insurance companies are refusing to insure such vehicles (or to accept new policies on such vehicles) unless they are parked overnight in underground (or otherwise secured) car parks. I guess I won't be considering buying one of those for another generation. If ever.
What I can't figure out is how incompetent the car industry's software engineers must be. The implication of this is that it's possible to clone a key based only on the signal it gives off. The implication of that is that they're sending out a static password.
I mean, why are these keys not just broadcasting an "I'm here" signal (possibly with a unique id), and then doing some challenge/response authentication ala SRP that can't have the key reverse engineered from the transmissions to actually perform the unlock.
How did the car companies think they could get away with such crappy security?
The problem is lost keys. There has to be a mechanism for an automotive dealer or manufacturer to replace lost keys, and it has to function without the original key. It's the 2010's version of old master keys for tumbler locks.
Even the summary says thieves are using those reprogramming/recovery tools intended for dealers.
Locks keep honest people honest. They barely slow down a professional.
Damn straight.
Another thing people don't take into consideration is that about 40% of vehicle thefts are tow-aways.
That way they can work on the locks and security in the safety of their chop shops.