Thieves Now Using Laptop Computer to Steal BMWs

William330

Active Member
Messages
944
Likes
7
Location
USA
#1
Leftlane News
May 3

High-tech thieves are becoming increasingly savvy when it comes to stealing automobiles equipped with keyless entry and ignition systems. While many computer-based security systems on automobiles require some type of key — mechanical or otherwise — to start the engine, so-called ‘keyless’ setups require only the presence of a key fob to start the engine.

The expert gang suspected of stealing two of David Beckham’s BMW X5 SUVs in the last six months did so by using software programs on a laptop to wirelessly break into the car’s computer, open the doors, and start the engine.

“It’s difficult to steal cars with complex security, but not impossible. There are weaknesses in any system,” Tim Hart of the Auto Locksmith Association told the U.K.’s Auto Express magazine. “At key steps the car’s software can halt progress for up to 20 minutes as part of its in-built protection,” said Hart.

Because the decryption process can take a while — up to 20 minutes, according to Hart — the thieves usually wait to find the car in a secluded area where it will be left for a long period. That is believed to be what happened to Mr. Beckham — the crooks followed him to the mall where he was to have lunch, and went to work on his X5 after it was parked.

While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands.

According to the Prague Post leaving such information on a laptop is what got Radko Souček caught for stealing several cars. “You could delete all the data from your laptop, but that’s not good for you because the more data you have, the bigger your possibilities,” he says. He says any car that relies on software to provide security can be circumvented by other software. “Every car has its weak spot,” he says. Souček faces up to 12 years in prison.

The Leftlane Perspective: Many modern cars now rely on software entirely for security. Gone are the days where microchips supplemented mechanical locks as an additional security measure. In the case of true ‘keyless’ systems, software is the only thing between a thief and your car. As computers become more powerful, will stealing cars become even easier? Never mind future cars with better security — what about today’s cars a few years down the road? With cars as inexpensive as the Toyota Camry offering entirely keyless systems, these concerns a relevant to all consumers.


http://www.leftlanenews.com/2006/05/03/gone-in-20-minutes-using-laptops-to-steal-cars/
 
Messages
4,917
Likes
18
Location
Reading,PA
#2
I read about the weakness in immobilizers last year in InfoWorld, it was written up pretty widely in computer magazines as an example of RFID weaknesses. Basically, Texas Instruments sells most of the chips (150 million so far) and they used a 40 bit encryption, weak.

It's not widespread yet, but sooner or later you will be able to buy a "blackbox" on the net to do this yourself!!

Abstract. We describe our success in defeating the security of an RFID device known as a Digital Signature Transponder (DST). Manufactured by Texas Instruments, DST (and variant) devices help secure millions of SpeedPassTM payment transponders and automobile ignition keys.
Our analysis of the DST involved three phases:
1. Reverse engineering: Starting from a rough published schematic, we determined the complete
functional details of the cipher underpinning the challenge-response protocol in the DST.
We accomplished this with only “oracle” or “black-box” access to an ordinary DST, that is, by experimental observation of responses output by the device.
2. Key cracking: The key length for the DST is only 40 bits. With an array of of sixteen FPGAs operating in parallel, we can recover a DST key in under an hour using two responses to arbitrary challenges.
3. Simulation: Given the key (and serial number) of a DST, we are able to simulate its RF output so as to spoof a reader. As validation of our results, we purchased gasoline at a service station and started an automobile using simulated DST devices. We accomplished all of these steps using inexpensive off-the-shelf equipment, and with minimal RF expertise. This suggests that an attacker with modest resources can emulate a target DST after brief short-range scanning or long-range eavesdropping across several authentication sessions.
We conclude that the cryptographic protection afforded by the DST device is relatively weak.

For a very detailed and technical explanation:
http://rfidanalysis.org/DSTbreak.pdf
 

William330

Active Member
Messages
944
Likes
7
Location
USA
#3
So these boxes just keeps broadcasting codes until they discover the correct code?

Seems a simple fix is to ignore reception of all codes for 30 minutes for every 3 incorrect codes attempted. Using that approach, it would take that box a few hundred years to unlock the car.

Having the chip in the key still seems the best way to go -- no key, no start.
 
Messages
4,917
Likes
18
Location
Reading,PA
#4
Yes, that's the brute force method.

But they have also successfully worked around that problem. They set up a receiver that monitors for key transmissions to unlock the door, and record that transmission, immediately grabbing the cipher key, then program the computer to rebroadcast the transmission.

In theory, a car thief could park next to you, record your key when you unlock the car, and follow you home, to work, whatever, and steal your car in seconds with no forced entry.
 

William330

Active Member
Messages
944
Likes
7
Location
USA
#5
Kirby said:
But they have also successfully worked around that problem. They
set up a receiver that monitors for key transmissions to unlock the
door, and record that transmission, immediately grabbing the cipher
key, then program the computer to rebroadcast the transmission.

In theory, a car thief could park next to you, record your key when
you unlock the car, and follow you home, to work, whatever, and
steal your car in seconds with no forced entry.

That's quite a GIANT security hole, is there a way for owners of a
'keyless start' to get around this (such as using a regular key), or
are they screwed? I'm surprised BMW and others would put such
an easily-defeatable system into production.
 
Messages
4,917
Likes
18
Location
Reading,PA
#6
I think you're screwed, unless you add a hidden secondary immobilizing device.

Hehe, back in the early '90s when Texas Instruments developed the chipset, it was thought that 40 bit keys were virtually unbreakable/unhackable, LOL.
 


Top