Slashdot Mirror

← Back to Stories (view on slashdot.org)

Motorcycle Gang Busted For Hacking and Stealing Over 150 Jeep Wranglers (bleepingcomputer.com)

Posted by BeauHD on from the justice-prevails dept.

An anonymous reader writes: "The FBI has arrested members of a motorcycle gang accused to have hacked and stolen over 150 Jeep Wranglers from Southern California, which they later crossed the border into Mexico to have stripped down for parts," reports Bleeping Computer. What stands apart is how the gang operated. This involved gang members getting the Jeep Wrangler VIN (Vehicle Identification Number), accessing a proprietary Jeep database, and getting two codes needed to create a duplicate replacement key. Gang members used one code to cut the key, while they used the second code while stealing the car, connecting a handheld programming computer to the car, and programming the replacement key's chip, synchronizing it to the car's dashboard. All of this took under 2 minutes and was also possible because Jeep Wranglers allow thieves to pop the hood from the outside of the car and disable the alarm even before using their non-authenticated replacement key. Officials say that all the database queries for the stolen VIN codes came from a Jeep dealer in Cabo San Lucas, Mexico. Court documents don't say if the dealer cooperated or gang members hacked its system. The motorcycle gang's name was Hooligans and the sub-unit that stole the Jeeps was named Dirty 30.

49 of 83 comments (clear)

  1. Hooligans by Anonymous Coward · · Score: 1

    Those British soccer fans are WAY out of control at this point.

    1. Re:Hooligans by Tablizer · · Score: 1

      You'd think smart hackers would have enough brain power to find a better gang name.

      --
      Table-ized A.I.
    2. Re:Hooligans by dunkindave · · Score: 4, Insightful

      I doubt the gang did the hacking. There is probably a person or group who figured out how to do this hack, then sold the info and devices with instructions to the gang who used it. It's a lot like hackers of old versus script kiddies today. A couple decades ago to hack a system normally meant the hacker had the skills and understanding, but today it is often just a person who knows how to run a program that someone else wrote.

    3. Re: Hooligans by Anonymous Coward · · Score: 2, Informative

      The name comes from a notorious Irish family.

    4. Re:Hooligans by michelcolman · · Score: 4, Funny

      Or the gang has one member who sits in a dark apartment room surrounded by computer screens full of green text and who's in constant contact with them over a secret radio frequency.

    5. Re:Hooligans by tlhIngan · · Score: 1

      I doubt the gang did the hacking. There is probably a person or group who figured out how to do this hack, then sold the info and devices with instructions to the gang who used it. It's a lot like hackers of old versus script kiddies today. A couple decades ago to hack a system normally meant the hacker had the skills and understanding, but today it is often just a person who knows how to run a program that someone else wrote.

      Or they simply got an employee to do it for them. Dealers have access to the database for service purposes (in case you need to generate a replacement key). All they need is to get someone "on the inside" to do the lookup for them.

    6. Re:Hooligans by DarthVain · · Score: 1

      That looks vaguely like "hacking" in Fallout...

      Seems like every time the TV news needs a graphic for hacking they use the Fallout one... I find that hilarious and it makes me feel a bit smug all at the same time, win win!

    7. Re:Hooligans by Chemtox · · Score: 1

      A "couple decades ago" hackers chopped wood, or someone else's bugs. When "hacking" got conflated with "cracking" there were plenty of script kiddies already.

      As for illiterate Hooligans manning weapons they don't understand, those have been around since cracking exists, be it of systems, or skulls (cf. Space Odyssey).

    8. Re:Hooligans by Chemtox · · Score: 1

      I bet you're the kind of guy that likes his email server to be called "hermes" or "isimud", instead of, you know, "mail".

  2. It starts with... by k3vlar · · Score: 2

    [...] possible because Jeep Wranglers allow thieves to pop the hood from the outside of the car and disable the alarm even before using their non-authenticated replacement key.

    There's your main problem right there.

    --
    Unlike porn, which yada yada rimshot hey-ooh!
    1. Re:It starts with... by dunkindave · · Score: 3, Insightful

      [...] possible because Jeep Wranglers allow thieves to pop the hood from the outside of the car and disable the alarm even before using their non-authenticated replacement key.

      There's your main problem right there.

      If you look you will find that a lot of car hoods can be opened by inserting the right tool through the grill to access the locking mechanism. It's a lot like how a slim jim can get you in through the door.

    2. Re:It starts with... by k3vlar · · Score: 4, Insightful

      What I mean is opening the hood while the vehicle is locked should trigger the alarm, just as opening the door with a slim jim would. Or the horn/alarm circuitry should be located behind the firewall so it can't be disabled so easily.

      --
      Unlike porn, which yada yada rimshot hey-ooh!
    3. Re:It starts with... by Anonymous Coward · · Score: 1

      Really? That is the main problem? Not the fact that you can generate a replacement key from VIN?

    4. Re:It starts with... by Waffle+Iron · · Score: 1

      That can be done for any car - how do you think dealers make a new key when you misplace your original keys?

      It may make sense to have that capability. But there's no reason for the whole database to be replicated anywhere outside of some secure vault within Jeep's corporate headquarters in Italy. Dealers should send authenticated individual queries to the central system as needed.

    5. Re:It starts with... by LazyBoot · · Score: 5, Insightful

      That can be done for any car - how do you think dealers make a new key when you misplace your original keys?

      It may make sense to have that capability. But there's no reason for the whole database to be replicated anywhere outside of some secure vault within Jeep's corporate headquarters in Italy. Dealers should send authenticated individual queries to the central system as needed.

      Since they could track it down to a specific dealer, it sounds like that is exactly how it works.

    6. Re:It starts with... by locopuyo · · Score: 3, Funny

      Great idea! They could even go a step further and ban breaking into and stealing cars. Then the alarms wouldn't go off.

      --
      The Official Site of 1337 Pwnage
    7. Re:It starts with... by michelcolman · · Score: 1

      So basically, if your alarm goes off, that means all is fine. When it doesn't make any noise, that's when you should be worried.

    8. Re:It starts with... by AmiMoJo · · Score: 1

      Has a car alarm ever helped anyone? Most people seem to ignore them, and when you see criminals on CCTV they appear to just ignore the alarm and carry on looting the vehicle or driving it away.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re:It starts with... by peragrin · · Score: 1

      Do you know how long that would take in a global market place?

      Your key breaks, you get towed to the dealer who then has to submit a request which will be returned in 4-5 days while your car isn't in your possession. To cut and program a key which takes 5 minutes.

      You turned a 10 minute issue into 5 day wait.

      To access the database you need the vin and access to a remote database. It isn't like every dealer has a full copy. They have log in to access it.

      The real issue is that log in probably failed rubber hose crypto. And they didn't have any verification on use. Every dealers inquiries like that should be logged and sorted. If a dealer inquires about more than x vins beyond what they sold then further inspection should happen manually into the inquires. You can go further and tie it into their dealership contract too.

      It wouldn't prevent this from happening but it would notice sooner than -50 cars later especially if you make x to be 6 or 10 a month.

      --
      i thought once I was found, but it was only a dream.
  3. Low-tech solution by TWX · · Score: 3, Interesting

    How about a low-tech solution of blocking the visible-under-the-windshield VIN with a piece of paper? Is that legal? It seems like it would help reduce the problems, or at least make the thieves more inclined to move on to a different vehicle.

    --
    Do not look into laser with remaining eye.
    1. Re:Low-tech solution by dunkindave · · Score: 2

      How about a low-tech solution of blocking the visible-under-the-windshield VIN with a piece of paper? Is that legal? It seems like it would help reduce the problems, or at least make the thieves more inclined to move on to a different vehicle.

      In California it is illegal, but you can use the CA DMV website to look up the VIN if you have the license plate number, so covering the VIN would just add one more step for the crooks.

    2. Re:Low-tech solution by TheGavster · · Score: 3, Informative

      On my car, the VIN is also etched into the corner of each of the glass pieces. Since you also need to regularly supply a VIN for registration, service, and even sometimes to take the car onto a private lot, the best thing would be for Chrysler to require something more private in order to get the codes for the key and the computer :/

      --
      "Because Science" is one step from "Because old book". Try "Because of my experiment testing my falsifiable assertion".
    3. Re: Low-tech solution by TWX · · Score: 1

      Last time I looked into that, it was a gimmick that the dealerships use to try to justify tacking on another thousand dollars to the purchase price, and they, not the manufacturer, etches the glass.

      --
      Do not look into laser with remaining eye.
    4. Re: Low-tech solution by Woldscum · · Score: 1

      It prevents them from being sold as legit replacements by crooked junk yards. You also get an insurance discount.

    5. Re: Low-tech solution by Woldscum · · Score: 1

      No genius. The marked parts need to be destroyed. The crooks will need to destroy ALL of the glass.Have a car shell with a good VIN? Steal the exact same model and color car then swap all the non numbered parts. The glass is a HUGE expense. The engines and most transmissions are also numbered.

    6. Re: Low-tech solution by wed128 · · Score: 1

      True, but there's more glass then just the windshield. All those doors need to be taken apart. The rear glass as well. Silly high windows in the body behind the back doors? those need replaced too.

      So lets say $1000 in glass. 2.5% of the value of the car, now lets get into labor.

    7. Re: Low-tech solution by TWX · · Score: 1

      Have you actually worked with vehicles much? It does not sound like it.

      Prior to the advent of computers controlling all aspects of the car it was just easier to swap the VIN tags over to the stolen car, and to basically rough-up and then fix and paint over stamped-in VIN tags. Alternately, cut-out and re-weld a larger section of firewall and do a good job finishing and grinding so after it's painted it's clean looking.

      It's a hell of a lot of work to swap all of the auto parts over from the stolen car to a "body shell" as you call it. Most car thieves that steal to part-out that extensively do not put cars back together themselves.

      In this day of modern computers it's also harder to re-VIN the car, as the VIN is also readable from the computer. The Jeeps in this article were being parted-out, but it doesn't say what was used versus abandoned. For all we know these were heavily upgraded vehicles with lots of aftermarket stuff, where it would make sense to strip all of the goodies to put on one's otherwise stock Jeep.

      --
      Do not look into laser with remaining eye.
    8. Re: Low-tech solution by Grishnakh · · Score: 1

      Modern windshields on $40k cars are a lot more expensive than that. $40k cars have a bunch of sensors behind the mirror that have to mate up with the pattern on the windshield, and I believe you also have to do a special alignment process using a service tool when you change the windshield.

      Sure, on some 15-year-old no-frills car, replacement windshields are $150.

    9. Re: Low-tech solution by Shotgun · · Score: 1

      The radio in the Jeep is programmed with the VIN. If you find a cheap replacement on Ebay, it won't work in your Jeep unless the seller gives you the VIN of the one it came out of.

      --
      Aah, change is good. -- Rafiki
      Yeah, but it ain't easy. -- Simba
    10. Re:Low-tech solution by slazzy · · Score: 1

      Another good idea would be adding a contact switch to the hood, so the alarm will go off when the hood is opened. Jeep should have done this from new.

      --
      Website Just Down For Me? Find out
    11. Re: Low-tech solution by Woldscum · · Score: 1

      Absolutely have. Worked HS Summers in a body shop. The shop would buy totaled Ford Rangers and Mazda pickups. The parts interchange. Then we would assemble complete vehicles out of the parts for side money. The completed truck would then have a "salvage title". But before that a State Trooper would drop buy and inspect every piece of glass for any numbers. Also the engine, trans, rear end and cab VIN. All of the parts trucks had to have a title and clear VINs. Some times a new replacement VIN will be issued. He would also stick a OBD reader on the truck and check the VIN in the firmware.

      No one is reVINing $40K+ cars and SUVs. The money is in the sub $10K cars and trucks for the ghetto and country. Less than a weeks work they can make $5K easy.

    12. Re: Low-tech solution by Woldscum · · Score: 1

      No one is swapping VINs on $40K new cars. They are swapping stolen parts on 10+ year old Honda's and Toyota's. A crapped out Civic for $7K cash. For 5 days work and 2 guys. They could make $5k to $6k cash and doing 4 to 5 cars a month. That is where all new glass would hurt. These guys are not buying parts. They are stealing them. They steal cars to order not what ever is easiest to take.

    13. Re:Low-tech solution by TheGavster · · Score: 1

      Actually a number of parts on most cars are labelled with the VIN to limit the value of stealing the car and chopping it up for parts (though obviously there's still some money to be made, since that's what this gang was doing). This is where the term "numbers matching" comes from in the classic car community: when all of the serialized parts of the car match the original VIN, the car is "truer" to the original delivery. I simply gave the windows as an example of a part visible without too much suspicious effort.

      --
      "Because Science" is one step from "Because old book". Try "Because of my experiment testing my falsifiable assertion".
    14. Re:Low-tech solution by TWX · · Score: 1

      When collectors talk numbers-matching they're generally referring to the motor and body, and frame if the car has a separate frame, and sometimes the transmission if the car's transmission was labeled as such.

      In most cases that I know, which are Chrysler products, it's predominately motor and body. No one really cares about anything else.

      --
      Do not look into laser with remaining eye.
  4. lets will be facing more time then killing someone by Joe_Dragon · · Score: 1

    lets will be facing more time then killing someone under the poor hacking laws.

    Pro tip just take the deal to get a few a few GTA's on you rap sheet.

  5. Nicknames that stick. by berchca · · Score: 1

    Dirty 30 was a lot cooler before he turned 55...

    1. Re:Nicknames that stick. by Bodhammer · · Score: 1

      May he could just be Dirty Sanchez? Just saying...

      --
      "I say we take off, nuke the site from orbit. It's the only way to be sure."
  6. I think it's time. by Gravis+Zero · · Score: 4, Insightful

    It's time that you should be able to program your car with your own codes because obviously dealerships cannot be trusted to secure them.

    --
    Anons need not reply. Questions end with a question mark.
    1. Re:I think it's time. by Anonymous Coward · · Score: 2, Informative

      It's time that you should be able to program your car with your own codes because obviously dealerships cannot be trusted to secure them.

      Nothing is stopping you from having the locks changed the day you buy it. Changing codes is normally harder, sometimes requiring changing out the computer.

    2. Re:I think it's time. by geekmux · · Score: 2

      It's time that you should be able to program your car with your own codes because obviously dealerships cannot be trusted to secure them.

      Nothing is stopping you from having the locks changed the day you buy it. Changing codes is normally harder, sometimes requiring changing out the computer.

      Uh yeah, nothing is stopping you, except for the fact that "locks" these days are in fact codes, because many cars aren't coming with physical keys anymore. They're configured with wireless keyfobs instead. Not even an ignition key. My cars have been that way for 10 years now.

    3. Re:I think it's time. by Grishnakh · · Score: 1

      Changing the physical key isn't going to keep people from stealing the car if they have the codes. You only use the physical key when the car's lost power (so you can open the door, and thus the hood, if it isn't a stupid Jeep), or more frequently if your keyfob's battery has died.

  7. they were busted for being stupid by WindBourne · · Score: 1

    Stealing jeeps? What idiots. At least steal Teslas.

    --
    I prefer the "u" in honour as it seems to be missing these days.
    1. Re:they were busted for being stupid by gl4ss · · Score: 1

      they had access to the key db of jeep(chrysler?).

      and well, they had to have the range to drive all the way to mexico without phoning home.

      --
      world was created 5 seconds before this post as it is.
    2. Re:they were busted for being stupid by Grishnakh · · Score: 1

      Teslas have almost no market for used parts. Maintenance is always done by Tesla service centers. And Teslas are such a tiny portion of the market that even if this weren't the case, no one would want the parts because of the lack of market penetration; it's the same reason no one steals Rolls-Royces for parts.

      It seems that the "Hooligans" are a lot smarter about basic economics than you are.

      Finally, I applaud this biker gang: they're doing a real public service by removing those shitty Jeep Wranglers from US territory. Hopefully they'll expand their operations to include all Chrysler vehicles.

  8. Re:there is no way to stop people from stealing ca by jabuzz · · Score: 1

    I suspect you will find vehicle thefts are at record lows at the moment. In general stealing cars today is much harder than it was 30 years ago, or even 20 years ago. Here are the graphs for the UK, US and Canada to show it.

    https://www.statista.com/stati...

    https://www.statista.com/stati...

    https://www.statista.com/stati...

    Though there does appear in all three to be a slight uptick in the last few years. Basically car crime is still *A LOT* lower than it was in the past.

  9. With even bigger CGI muscles! by Impy+the+Impiuos+Imp · · Score: 1

    The motorcycle gang's name was Hooligans and the sub-unit that stole the Jeeps was named Dirty 30.

    Sounds like a great movie plot. F9 of the Furious, here we come!

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  10. The secret is... by el_smurfo · · Score: 1

    ...many cars can be stolen this way. I believe that the Wrangler were targeted because they are valuable in Mexico, not because they were particularly hackable. There have been several slightly older model BMWs stolen in my neighborhood using very similar techniques, key cutters and black market OBD software and VIN databases. Just wait until they can just unlock and start a car remotely via the car's wireless data connection...

    1. Re:The secret is... by Grishnakh · · Score: 1

      I believe that the Wrangler were targeted because they are valuable in Mexico, not because they were particularly hackable.

      Whatever the particular reason, I for one applaud the Hooligan biker gang for performing this valuable public service of removing Jeep Wranglers from US territory. I hope they'll improve their hacking skills to include all Chrysler models. It'd also be nice if they'd steal the last few remaining Pontiac Azteks and ship those to Mexico too (or better yet, some cooperative junkyard where they can be crushed).

  11. Re:Illegals by Grishnakh · · Score: 1

    -1 Stupid.

    This is a biker gang. Bikers are almost all white, except for the small number of all-black biker gangs. I've never seen a Hispanic person in a biker gang or on a motorcycle.