Slashdot Mirror
Radio Attack Lets Hackers Steal 24 Different Car Models (wired.com)
An anonymous reader writes from a Wired article: A group of German vehicle security researchers has released new findings about the extent of a wireless key hack, and their work ought to convince hundreds of thousands of drivers to keep their car keys next to their Pudding Pops. The Munich-based automobile club ADAC recently made public a study it had performed on dozens of cars to test a radio 'amplification attack' that silently extends the range of unwitting drivers' wireless key fobs to open cars and even start their ignitions (in German). The ADAC researchers say that 24 different vehicles from 19 different manufacturers were all vulnerable, allowing them to not only reliably unlock the target vehicles but also immediately drive them away. "This clear vulnerability in [wireless] keys facilitates the work of thieves immensely," reads the post. "The radio connection between keys and car can easily be extended over several hundred meters, regardless of whether the original key is, for example, at home or in the pocket of the owner." [...] Here's the full list of vulnerable vehicles from their findings, which focused on European models: the Audi A3, A4 and A6, BMW's 730d, Citroen's DS4 CrossBack, Ford's Galaxy and Eco-Sport, Honda's HR-V, Hyundai's Santa Fe CRDi, KIA's Optima, Lexus's RX 450h, Mazda's CX-5, MINI's Clubman, Mitsubishi's Outlander, Nissan's Qashqai and Leaf, Opel's Ampera, Range Rover's Evoque, Renault's Traffic, Ssangyong's Tivoli XDi, Subaru's Levorg, Toyota's RAV4, and Volkswagen's Golf GTD and Touran 5T.
I had this in a rental car recently, and once I figured out there was not place to put the key (never seen it before, never even occurred to me) I did wonder just how secure it was.
So, what, it just continuously broadcasts "you can start now", with no intermediate encryption or anything? There's clearly no user interaction required to start the car (I never did get used to having the "key" in my pocket to start the car), no button to push or anything.
TFA says "every second semester electronic student should be able to build such devices without any further technical instruction." That positively screams of something which was built to be cool, but with no real thought about security.
I wonder if this is something which even changes on each invocation, or if you could simply record and play back the signal ... in which case this is a pretty pathetic system.
And, once again, the security of such things is purely an afterthought when it's pointed out how trivial it is to bypass. And, once again, I say companies need to have legal liability for shit like this.
Lost at C:>. Found at C.
"their work ought to convince hundreds of thousands of drivers to keep their car keys next to their Pudding Pops"
Huh? Pudding pops? What does that even mean? I thought the new Slashdot management was going to get rid of these horrible summaries that don't make any sense. Since the word is capitalized, I assume this means Jell-O Pudding Pops? The frozen snack from the 80s? They stopped making these a long, long time ago. So you should keep your key fob in the freezer? How does that help?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
This is why analog is still better, but I'm sure there will be people on here who will give excuses for why we absolutely, positively, without exception MUST go digital.
Because . . . digital.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Actually, I kind of liked my Mazda key that was designed so that I never had to take it out of my pocket, except: 1) My sister-in-law drove the car, gave it back to me while it was still running, I drove my daughter friend home, turned the car off... then couldn't start it again, because I didn't have the key! and 2) You get so used to pushing the button on the door handle to unlock it that it comes as a shock when you push the button and noting happens, as you slowly realize you never put the key in your pocket that morning.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Our lives aren't significantly enhanced by wireless keys. Are they?
To be honest this wasn't entirely a surprise, wireless I have to admit is very convenient thou and well as they say there's a fine balance between convenience and security. On the other hand a lot of modern cars feature systems such as OnStar which means your vehicle can be tracked or disabled by the manufacturer so they're not exactly the most ideal cars to try to steal.
And no, these keys are encrypted but the problem is they're using a "range-extender" to make make it seem like your key is right next to the car when in reality it is a fair distance away.
Even assuming there were, a device that perfectly re-emitted the signal would be seen as the original source by the car, and there'd be no way of differentiating it. The signal itself can't carry that information, so it can't be encrypted to prevent tampering.
Solution:
(Assuming the key/car are using private/public key pairs)
You'd have to put a reasonably accurate clock in the key, and then have it encrypt and send timestamps to the vehicle using a sequence of rapidly fired request messages followed by response messages.
The car could then decrypt the messages and compare the timestamps from the sequence of messages measuring the distance between the key and the car. The clock in the key would have to have similar accuracy to a laser ranger finder.
The actual protocol would be a bit more complicated in the details, but the basics outlined above are what is needed.
Someone you trust is one of us.
Analog car remotes were subject to much more trivial replay attacks. Of course those at least required you to know when the owner was pressing a button. Once you're in the car, you can steal it if it's an older car without computer-based security.
If you haven't owned a car with keyless drive like this, you can't imagine how convenient it is to just walk up to locked car, open the door and drive away without digging out a ring of keys.
I can go days without ever taking my keys out of my coat pocket.
This is why I stick with wired keys only.
Stick shift. So that eliminates some thieves right there. Manual choke. Most thieves were not alive when one had to know how to start a car with one of these.
And if I want to be really nasty, I'll disable the electric starter and use the crank handle that fits into the crank pulley (yes, my truck has one of these).
Have gnu, will travel.
No, they don't. The keys passively send out signals without user interaction, probably in response to a signal sent out by the car which has a bigger battery than the key. In either case, if you have a keyless car, the car communicates with the key without user interaction.
Someone you trust is one of us.
They could add a secure lock mode, where if you affirmatively press the lock button on the keyfob, the car will require an affirmative unlock press on the keyfob and not unlock based on the "presence" of the keyfob.
I also wonder why they couldn't have some means of shutting off the radio in the keyfob so it didn't produce a signal that could be relayed to the car. Maybe a motion sensor in the keyfob that when it wasn't moved for a period of time would shut off its radio completely until enough movement woke it up.
Years ago you could open your neighbour garage door with a radio transceiver and a tape recorder. Today you can't because all of them use ROLLING CODES.
Does this mean car FOBs don't use rolling codes?!?!
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
The doors never ever had locks (and even if they had, you can fold the tent without tools or access from the inside). It starts with a button on the dashboard.
And then, you need to know how to drive it, be strong enough to actually do that, and a good reason to steal a pile of soviet-era rust. It is a very good city car.
This is the so-called "keyless" entry system where mere presence of the key-device is considered enough to open the doors and start the car.
All they are doing is extending that "probe" range artificially so the key thinks it's near the car and the car thinks the key (and thus the driver) are near too.
It's one of the incredibly STUPID ideas that I actively removed from the list of options on a new vehicle that I was offered recently, for precisely this reason. If you have the traditional "press a button to open doors" keys, then you're still subject to radio interception attacks (dependent on the complexity of the protocol, it's not hard to imagine it can be secure but that it's not as secure as you might think) but not to simple "passive" authorisation at a distance like this.
This makes me seriously wonder how many people keep the key in their car when they park at their house, to prevent just such an occurrence.
Excuse me, I need to go... car shopping.
I browse on +1 so AC's need not respond, I won't see it.
The only reliable way I know of to do a distance check using radio is to time a signal/response loop, but at the distances we're talking about here, processing time in the fob is probably the majority of it and if that's not precisely predictable it doesn't help much.
For example, at 300m the speed-of-light round trip time is about two microseconds, so if the time it takes the fob to accept, process, and respond to the signal has more than 2 microseconds of variation the car can't tell if it's far off or just slow.
Most cars in Europe are stick shift...
Sig?
and if it happens to your rental discover will not cover you. That will be 22K
They may or may not of used a hack to take the car but as a renter you will be on the hook if they fail to update there car software.
http://elliott.org/should-i-ta...
Try educating yourself. Digital is just discrete analog.
All signals are prone to reamplification attacks.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Yes, correct. The simple fix here is to notice the delay in response from the vehicle's hail to the keyfob, and the keyfob's response. The amplification attack introduces a detectable latency in the keyfob's response due to the time required to process and relay the communication.
I am embarrassed for the vehicle manufacturer's that do not introduce a simple time-out for a keyfob response, and perhaps even introduce a check-engine-like vehicle app indicator for the driver to see that such an attack has been detected (plus where and when) and thwarted.
But do not fear. For just $5USD a month, we can install a package on your vehicle that will detect the theft, drive the vehicle to the nearest police station, lock the doors, tune the radio to celinedion.24_7.com, and turn the volume up to 135dB. You can contact us at www.makethebastardspay.com
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Both our Toyota and Subaru has keyless ignition and it constantly yells/beeps at you telling you the key is not in the car. Did you not notice, or did Mazda forget to put such an obvious alert?
Do car makers really have good incentives to fix their security?
Not really, since they can sell a new car paid by the insurance company when someones car gets stolen. The only downside is negative reporting - but that can be fixed by massive ad-campaigns; just look at VAG, they are running ads like crazy in Europe right now, but they have dropped their tag-line "vorsprung durch technik" (lead by technology). I guess they don't want to use the new and improved tag-line "vorsprung durch betrug" (lead by cheating).
The whole wireless key fob thing is a pure convenience thing that when it fails becomes extremely inconvenient because convenience is security's biggest enemy. I can't understand that people would accept that their car have no physical security to speak of since it is quite a huge investment for many people.
The only mitigation I can think of if you still want the convenience of a wholly wireless key fob is that they introduce a check for max latency for the key-challenge response which is like 27 picoseconds(?) for a 4 meter radius not including the electronics internal response time. This means of course that the timing of the key exchange must be wholly deterministic.
--- Reality doesn't care about your opinions, it happens anyway and if you are in the way you'll get squished.
For completeness, you can add an LPG system to the mix. But, boy, still don't leave it unattended here in Bulgaria.
. . . my car starts in German.
My Mazda 6 (2015 model) will not start unless the keyless remote is inside the car. I don't know exactly how this works, but it does work. I have tried setting the key on shelf only a foot from the car. It knows the key is nearby, but instead of starting, it flashes a red key icon.
Further, if the car is running and I get out of the car with the key in my pocket, the car beeps and the doors will not lock. And, if I shut off the car, but leave the key inside the car, the car beeps at me as I walk away. You'd have to be fairly oblivious to these warnings and actively circumvent them to lock yourself in/out of the car.
Do you call the person who uses a slim-jim (not the meat sticks), lock picks or a slide hammer to steal your car a lock smith? No we call them car thieves. Simple, plain ol' un-glamorous car thieves. It IS useful to know the car makers are so stupid as to make car entry systems as simple as this, BUT, this is NOT hacking. It is practice for breaking and entering.
At least so far, no Tesla. This id interesting Considering that in 1.5 years they are expected to make a huge impact.
I prefer the "u" in honour as it seems to be missing these days.
On top of which, when was the last time the batteries in a $2 mechanical key died?
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
This could be solved by two factor authentication. Not only would the key fob transmit a radio signal, but you would also need a metallic dongle with uniquely coded grooves that when inserted into a specialized slot would engage a mechanical door release mechanism.
Many of these manufacturers plan on creating autonomous vehicles as well. Yet they DGAF about security, sometimes on this embarrassing of a level. I'm eager to see how that plays out, except perhaps for the inevitable deaths.
Automatic vehicles exist but not in significant numbers. Companies like Hertz laugh their asses off by hiring them out to US visitors for a small fortune.
That'll teach you to buy a car that doesn't use a plain-old physical key you insert into a lock.
While I'm on the subject, any car that has any sort of wireless systems built into it needs to have a hardwired switch you use to turn OFF the transceivers completely, so the car is isolated and can't be hacked into wirelessly.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Most cars in Europe are stick shift...
I thought Europeans were more interested in fuel economy, since fuel taxes are so high there. Automatics get better fuel economy than manuals in all new cars now.
I have a 2015 Mazda3, and it's the same. It works by having multiple transceivers mounted around the vehicle: one on each front door, one on the hatch door, and one (maybe two) inside the passenger compartment. It can tell where the key is that way.
Only has physical locks. #Baseline.
He didn't notice. I have a Mazda too, and if you leave the engine running as you leave the car (with the key in your pocket), it beeps loudly and annoyingly, just like your Toyota and Subaru (though not "constantly", it beeps for several seconds as you walk away). You'd have to be deaf to miss it.
My Prius has a remote keyless entry and start system. If the battery dies, the fob has a physical/hard metal key that can open the doors. To start the car the car's manual says one can touch the metal Toyota label on the fob to the start button and the car will start. I've tried that and it works. I'm not quite sure how that works but it's possible the fob or the button has an RFID chip for communication or the button provides electricity to the fob. The start button is black with silver painted text but doesn't look conductive, so I I'm not sure the latter suggestion is correct. Anyway, if the fob's battery dies one can gain entry to the car and get it started. Also the display console has a notice when the fob battery is getting weak so there is a warning to replace the battery.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Automatics get better fuel economy than manuals in all new cars now.
Sounds good. The only problem: it's not true. Granted, the efficiency of non-manual transmissions (traditional automatics, CVTs, automated manual transmission , etc.) has improved greatly, and in some cases it's better than manual transmissions, but from what I've seen from shopping for small cars, manual transmissions are still a bit more fuel efficient on average.
I won't post a ton of links, but your statement only requires a single counterexample to disprove, so here's one: the Hyundai Accent.
LOL, hmmm ... I wonder if the rental Jetta I just had opened the doors as well with that thing.
I'll feel like a right fool if I could have just walked up to it and opened the door instead of pulling out the fob to open the doors and then putting it back in my pocket before I got in.
Because that struck me as kind of a waste of time.
I was so baffled when I first couldn't figure out where to put the key to start the car it never even occurred to me it opened the doors as well. I spent over 5 minutes trying to figure out where to put the key (yes, I'm special like that).
Which is the problem with rental cars, by the time you figure out some of the seemingly simple things it's time to return the car. I once had to pull out the manual to figure out how to put in the gas nozzle in some Fiat thingy I'd rented, and even with the manual I found myself thinking "why the hell is this step necessary?"
Lost at C:>. Found at C.
Our lives aren't significantly enhanced by wireless keys. Are they?
Oh yes they are. Have you not heard of the Heisenberg Shopping Principle? The one that states the key to your car is always in the pocket of the hand most heavily loaded with shopping bags?
Actually funny side story I lost my keys once. I was about to go back up to my apartment and check there but then I thought I'll see what happens if I push the start button, and sure enough the keys were under my car seat.
Are you aware of how many European models are no longer available with a manual transmission even as an option?
Wouldn't it be even more convenient if the doors had no locks at all? No need to worry about keys at all. The point of security and keys is to trade convenience for security... more the security, higher the inconvenience.
BTW, if you're at a gas station and outside the car but close enough for the car to detect the key, wouldn't this be enough for a thief to enter the car and drive away?
I don't know how they get the position of the key so accurate, but my 2015 Santa Fe can tell the difference between me standing right next to the driver door with the key in my pocket, or the key sitting in the center console (only 3 feet difference). I once accidentally left the key in the center console, got out of the car, and attempted to lock the car. It would not let me. I was actually getting pretty pissed because I thought the car wasn't working correctly because I thought the key was in my pocket. Nice little feature to keep idiots like me from locking myself out. That came in REALLY handy that day, since I had my sister-in-law's wedding dress in the car... and I was delivering it for her to get ready for her wedding. Hyundai engineers kept me from having to smash the window of my brand new car. Thanks guys!
That is in 1960s/1970s can easily use a slim-jim or a coat hanger (bent with small hook), stick inside door at window line, push down and up until the hook grabs the mechanism and the door lock button pops up. I remember when a friend left keys in car, called a locksmith and arrived on scene, 5 seconds later unlocked the car with a slim-jim. His reaction, "well why in the hell even lock the car in the first place!!!" Then can easily hot wire the car by reaching under and digging up the wires. For column keys, stick a heavy-duty tool and simply force it to start position.
Then later cars not so easy to steal. Protective mechanisms around door locks, column locks with more theft prevention measures, and car alarms. A side problem is increase in car jackings as need to force owner after they started the car. There is also "smash and grab" car burglaries that increased a lot in recent years as they are fast and police no longer respond (not that they can do much after the fact).
Sounds like back to the future where cars are now easily steal-able. Now what was that trick Bif used to make it so he is the only one that can start his car?
mfwright@batnet.com
Analog car remotes were subject to much more trivial replay attacks.
My analog is an actual key in the actual ignition switch.
I have a 2001 Honda Civic Ex and 2002 Honda CR-V Ex and have only ever used the remote entry fobs occasionally and don't usually even carry it -- them -- with me. I like to keep my keys hooked on my belt loop and stuffed into my back pocket and the remote fobs are simply too big - and unnecessary if you have the key.
I don't have key-less start - yet (it's becoming inevitable) . While I can understand the perceived appeal -- especially to the manufacturer as they get to stop supporting keys and yet charge more for the electronics -- I think it's stupid and unnecessary and can't stand it. I can only hope that by the time I have to buy a new car, I can get a regular key even if I have to pay more.
It must have been something you assimilated. . . .
analog signal != physical objects
The same remotes are also used for keyless entry and not just keyless ignition. I do think keyless ignition is a mistake, at least in its current form.
So, to defeat this attack, keep the key in a Faraday cage.
Maybe inside my foil-lined wallet next to my NFC cards, then.
2011 might not have had this feature. It complains if you leave the key in the car or in the trunk (I'm surprised it can tell if it's inside or outside the car); I haven't noticed it beeping if you drive off without the key, but I may have had the stereo blasting.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Automatic vehicles exist but not in significant numbers. Companies like Hertz laugh their asses off by hiring them out to US visitors for a small fortune.
I'm British but live in the US with a US driving license. When I go to Europe and rent from Hertz, they will bump me over to an automatic, assuming I made a mistake when I asked for a manual. So they aren't getting any more money out of me, but they do get to give me horrible cars.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
All security is inconvenient. If it's convenient it's not secure. It's really convenient to leave your front door open so that you can just walk in, it's not very secure.
Security is a trade off, you balance your convenience with your security at whatever point you feel comfortable. Does the convenience of using just a fingerprint to access your phone justify the level of security it offers? If so then use it. If not, don't. You don't get to complain that your convenient security didn't turn out to be very secure.
"Grab them by the pussy" -- President of the United States of America
Wired.com will not permit access unless your web browser will run every script that every malware distributor who buy ads on every one of the ad server companies they use. Oh HELL no! I do not block ads. I do run NoScript, though. I would enable wired.com, but I'm not going to blanket allow all the malware-distributing ad servers.
Lexus of some sort, it was a car, not an RX wagon.
Parked at McDonald's in Miami, a white van pulls up, not a minute later a guy from the van pops the door with his hand and just drives away. Security camera recorded it.
Car was found later, no signs of forced entry.
The "Civilized World" jumped the shark ca. 1973.
You don't even need to get that deep. I used to have a car that was sadly very easy to steal, you could use a screwdriver to start it. So after it got stolen once, when I got it back I got into the habit of pulling the coil wire out and taking it with me for the night when I got home. 2 times I came downstairs to find the ignition in the 'on' position, but the car was not moved. Car thieves aren't generally going to stick around to try and diagnose the car they're trying to steal if it doesn't start in 10 seconds of cranking, so popping a coil wire off in 5 seconds is a quick and easy way to safeguard your car against 99.9999% of the thieves out there.
I'm the same. My keys are kept on a spring coil of wire, commonly referred to as a key ring.
Also, my vehicle is old enough (one of the last of the line, actually) to have just a regular key with nothing electronic about it. A duplicate key costs about $1.75. It's underpowered and plain looking enough ('stripped' is what car fanatics call it) that nobody is likely to steal it.
You don't even need to get that deep. I used to have a car that was sadly very easy to steal, you could use a screwdriver to start it. So after it got stolen once, when I got it back I got into the habit of pulling the coil wire out and taking it with me for the night when I got home. 2 times I came downstairs to find the ignition in the 'on' position, but the car was not moved. Car thieves aren't generally going to stick around to try and diagnose the car they're trying to steal if it doesn't start in 10 seconds of cranking, so popping a coil wire off in 5 seconds is a quick and easy way to safeguard your car against 99.9999% of the thieves out there.
Until recently I'd just pull the distributor rotor off, it's small enough to fit in my pocket with my keys so I can do it when going out as well as overnight at home.
I'm a minority race. Save your vitriol for white people.
Yeah, it may be new. But the beeping on my 2015 Mazda3 is from a beeper under the hood (the same beeper that tells you the car is unlocking or locking). You'll hear it after you close the door, even with the stereo blasting.
I'm sure automatics are more popular in certain niches. Some electric vehicles are entirely automatic so perhaps the future will see manuals disappear. Personally I don't mind driving automatic or manual.
You don't even need to get that deep. .... I got into the habit of pulling the coil wire out ... Car thieves aren't generally going to stick around it doesn't start in 10 seconds of cranking
You don't even need to go that deep (... under the hood; I would not fancy pulling the coil wire off in my best suit.)
I added a key switch inside the car that cuts the power to the starter motor relay. Car thieves are even more discouraged if the car does not even crank.
> WTF, are people incabable of pushing a button on their fob any more?
I would have said the same thing until I tried it. My latest car came with a proximity key. I've come to appreciate it, especially when my hands or full or it's raining.
I need to have my car "key" (fob) on a keychain with two access cards, each credit card sized, so digging the whole thing out of my pocket is a bit of a hassle (the cards turn sideways and hang on the pocket). It's not something I would pay $300-$400 to add aftermarket, but it's a convenience. Avoiding digging out the wad of a keychain and trying to find the right button in the dark also helps when I'm trying to be smooth on date night. :)
This makes me seriously wonder how many people keep the key in their car when they park at their house, to prevent just such an occurrence.
My car won't lock the doors with the fob inside without a person inside. I supposed you could set a heavy weight on one of the seats to fool the sensor, but that seems to be a lot of trouble to go through to avoid having to put your damn keys in your pocket (or purse) in the morning. Especially when most people just put the fob on the same keychain as their house keys.
Yea but how many people lock their car doors when they are parked in their own garage? I certainly don't.
I browse on +1 so AC's need not respond, I won't see it.
I'm referring to people leaving the fob in their car when they park in their garage at night for convenience, not locking yourself out. I don't know about you, but I don't lock my car doors when it's parked inside my own garage. While I do lock the door between my house and garage (and thus would notice if I left my house key, attached to a fob, in the car) many people don't do that either.
Not really and different than leaving their keys in it but still, I know people personally who are doofy enough to do it. I'm sure there are plenty of other out there who would.
I browse on +1 so AC's need not respond, I won't see it.
The reed switch glued to the underside of my cup holder is not computer based and works to prevent operating my car just fine unless you have my magnetic coaster.
They used to religiously turn off the engine even at stop lights. (cue arguments about starter wear n tear) but that's the mantra - now I haven't been across the pond in years but my experience in multiple Euro countries was basically this.
So while automatics might get better mileage it's only if all cars are running the entire time, and manuals lots of time aren't running the same amount of time.
If your gas cost 8-10x US prices, you might too....
People in cars cause accidents....accidents in cars cause people
No, Couldn't tell you exactly how they triangulate it, but the cars with fobs are fairly intelligent about whether or not the key is actually IN the car vs. just outside the car.
Honesty may be the best policy, but by process of elimination, dishonesty is the second best policy.
These days, a lot of new cars have stop-start technology (they automatically shut down at stoplights, and restart when you step on the gas).
I've been an auto tech for six years and have had this happen exactly on a couple occasions - "It must be in here, the car turns on." Saved me looking all over the shop, but didn't keep me from having to pull the center console to get it out of the emergency brake.
Honesty may be the best policy, but by process of elimination, dishonesty is the second best policy.
yep, another reason that autos will start making the fuel economy gap smaller.
People in cars cause accidents....accidents in cars cause people
That's because you aren't looking.
http://www.autoblog.com/2010/0...
http://www.edmunds.com/fuel-ec...
http://www.cartalk.com/blogs/t...
The Club, and other physical devices, have always been and will always be a good belt and suspenders.
I've got no problem with a manual car, but shifting with my left hand gets me all dyslexic. Bad enough I have to drive on the wrong side.
They listed a bunch in there. Two I know of offhand are the Ford Focus and the Mazda3.
No, DSGs do not use more fuel. Citation needed. You're just making things up to fit your bias.
I've got no problem with a manual car, but shifting with my left hand gets me all dyslexic. Bad enough I have to drive on the wrong side.
When I lived in the UK and was travelling to mainland Europe often on business, I got used to flipping back and forth. The most important thing being to pay a little conscious attention at junction so you know the right lane to aim for. If you are on mental autopilot it's easy to go to the wrong side. So you need to make it a conscious thing.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
No, I'm not wrong:
http://www.fueleconomy.gov/feg...
For the 2.0 engine on the Focus, the manual gets 26/36, the AM-S6 auto gets 26/38, and the AM6 auto gets 27/40.
http://www.fueleconomy.gov/feg...
For the Fiesta, the manual gets 28/36, the auto gets 27/37.
http://www.fueleconomy.gov/feg...
For the Mustang, the 2.3L gets 22/31 with manual, 21/32 with auto. With the 3.7L V6, it gets 17/28 manual, 19/28 auto. With the 5.0L V8, it gets 15/25 manual, 16/25 auto.
http://www.fueleconomy.gov/feg...
For the Chevy Cruze, the manual gets 29/41 and the auto 30/42.
http://www.fueleconomy.gov/feg...
For the Camaro, the 2.0L turbo manual gets 21/30 and auto gets 22/31. On the 3.6L V6, the manual gets 18/27 and auto gets 19/28. On the 6.2L V8, the manual gets 16/25, and the auto gets 17/28.
http://www.fueleconomy.gov/feg...
For the Honda Civic 2.0L, the manual gets 26/38, the auto gets 30/41.
http://www.fueleconomy.gov/feg...
Fro the Subaru BRZ, the manual gets 22/30 and the auto gets 25/34.
So yes, you're full of shit, and I've proven YOU wrong with references.
In don't have any idea what the UNECE NEDC is. Those are the official mpg figures for US cars, and they're entirely valid in the USA, using a US testing regime.