Slashdot Log In
Mobil SpeedPass, Various Car RFID Car Keys Cracked
Posted by
CmdrTaco
on Sun Jan 30, 2005 11:36 AM
from the feeling-safe-yet dept.
from the feeling-safe-yet dept.
44BSD writes "Crypto-enabled RFID products, including Mobil SpeedPass and various car keys, have been defeated utterly by Avi Rubin, et. al. Details are at rfidanalysis.org. An academic paper is also available."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
CmdrTaco Cracked, Various Slashdot Editors Duped (Score:4, Informative)
The best part of subscribing to Slashdot is watching CmdrTaco post multiple duplicates in a row, then giving up and posting a dupe anyway. Before this story, a dupe of the Super Bowl
Hey Taco, when's the last time you read your own site? Oh wait, why am I asking, you'll never see this.
Re:CmdrTaco Cracked, Various Slashdot Editors Dupe (Score:5, Insightful)
Parent
Re:CmdrTaco Cracked, Various Slashdot Editors Dupe (Score:2, Insightful)
Maybe if the editors were doing their JOBS that they get PAID FOR, they'd have recognized this fact and only let one story through--the one that would best meet the expectations of their audience.
Oh wait, we don't have any expectations, because they behave like morons 90% of the time.
Dupe... (Score:4, Informative)
Re:Dupe... (Score:3, Interesting)
I'm defeated too (Score:3, Funny)
Damn it. I feel so inferior. My car keys defeat me as soon as I put them down, and suddenly they're not there anymore.
It's a conspiracy I tell you!
Well... (Score:3, Insightful)
Re:Well... (Score:3, Interesting)
Pop the lock cylinder, insert screwdriver, turn, drive away.
Before the first time I had to do it, I could have sworn it was impossible to lose a key in 1" of fresh-fallen snow.
Re:Well... (Score:3, Interesting)
Keys in van, van running, close to quitting time, and getting dark fast.
So, 1 big screw-driver, 2 wooden shims, 1 coat-hanger wire and some cursing later, I can turn the engine off.
The quickest;
Re:Thing is... (Score:3, Insightful)
After about a month of alarms going off in the dead of night, no one bats an eye at hearing one anymore.
Re:True enough... (Score:3, Insightful)
But... if the brake light isn't on... there won't be any power flowing to it.
I don't think that would work. (Score:3, Informative)
Re:Well... (Score:2)
Re:Well... (Score:2)
Oh well, I have almost no concern my Prius will get stolen. Possibly broken-into (though I'm careful to never leave anything visible inside it), but not stolen.
N.
Great use for RFID (Score:3, Funny)
Sad. (Score:3, Insightful)
Re:Sad. (Score:2)
And I am willing to bet that top ppl are surprised.
I'm willing to bet they aren't. The system only has a very limited key length (40 bits) and anyone with half a lick of knowledge knows that a 40 bit key is vulnerable to offline brute force cracking.
My guess is they knew the system could be pretty esily cracked, but combined with the very short range of RFID (I believe the researchers captured the key data on the order of several inches) it wasn't considered a major vulnerability.
Re:Sad. (Score:3, Interesting)
Re:Sad. (Score:4, Insightful)
Speedpasses are not there for the benefit of the consumer, any more than the uscan at the supermarket.
There's a debatable benefit for the key bugs for your car ignition - debatable because anyone can still steal/strip your car, and it gives people a false sense of security, as well as adding another layer to "what can go wrong now"...
Speaking of which - Pontiac anti-theft radios. Leave your headlights on overnight, and you can't get a jump-start, because you have to re-code the radio first. Try that at -30 (and no, it wasn't me).
Parent
Re:Sad. (Score:3, Insightful)
Illegal under DMCA? (Score:3, Interesting)
Bye-Bye Karma (Score:5, Insightful)
Re:Bye-Bye Karma (Score:2)
Part of outrage is that it makes it clear that the editors don't bother to read the very "new accumulator" the work on. I sometimes miss a day or two worth of articles, but it's not my job-- they're paid to be editors. They're the only o
Off-Topic: Redundant (Score:2)
It also goads future postings into becoming poorly-edited, formulaic, nonsense as long as it can be posted quickly.
Quod erat demonstrandum
Re:Bye-Bye Karma (Score:2)
Re:Bye-Bye Karma (Score:2)
They have computers. Plug "RFID" into Slashdot's search [slashdot.org] and you find recent articles, including the dupe, at #3. And as for why it's annoying: this is not a hobby site, these guys earn big bucks and sell lots of advertising, and they're paid to be "editors". Being one, I know I would have been fired long ago if I fucked up as often as these guys. But they have no oversight, except us; we can't fire them but can hope to embarrass them a bit in the faint hop
Re:Bye-Bye Karma (Score:2)
First author (Score:3, Interesting)
DON'T NEED A CAR KEY (Score:2, Interesting)
Mercedes electronic keys - a good design (Score:5, Informative)
Mercedes overhauled security, rather than tacking on a secure by being obscure layer to the existing crackable standard - TI Immobilizer systems don't require advanced physical access, just proximity to the key at least an hour before the moment of a heist. Even worse, once the key is cracked it won't change either, so criminals can wait to strike and further avoid notice. Just wait till a tiny RFID scanner and a usable cracking program show up in the black market. A laid off engineer has too much potential to make dough with the ideas that have been released. The program could even do distributed processing on a broadcast LAN or via P2P.
Now someone is probably going to point out that they'll be laughing when the fancy Mercedes key runs out of batteries and leaves its owner stranded, but this isn't the case. The key can receive power from the car despite not having any visible metal contacts - likely because there is a coil embedded in the plastic key that will get power inductively when the key is inserted - without any wires [slashdot.org]. It's news on slashdot, but it's been shipping since 1997, and much longer before that for other applications.
As if that weren't it, the key doubles as an RF remote for locking/unlocking doors, popping the trunk, and a panic function. But wait there's more - the IR transciever portion of the key, when aimed at the driver door can open, close, or place anywhere in between all the side windows and sunroof at once. Great for getting into the car on a hot day or sealing up all the windows as you leave. Impressive what they they've put usably into a key, albeit oversized.
Finally, despite using a radically different model, Mercedes cleverly applied the familiar form and usage pattern of the existing standard to bridge it with the new one - a nice touch for user comfort without any compromise to security. Well engineered indeed.
Re:Mercedes electronic keys - a good design (Score:2)
aka What happens when person A uses car with key A, then person B uses car with Key B, is person B locked out?
Re:Mercedes electronic keys - a good design (Score:3, Interesting)
Re:Mercedes electronic keys - a good design (Score:2)
I completely agree with everything you've written here. Their IR keys are an enormous convenience. If the batteries fail, the door locks can also be manually actuated. There is a traditional blade embedded within the key that probably contributes significantly to the "excessive size."
Re:Mercedes electronic keys - a good design (Score:2)
> laughing when the fancy Mercedes key runs out of batteries
> and leaves its owner stranded, but this isn't the case.
No, they'll be laughing when the said Mercedes' security system malfunctions and the car doors continuously unlock despite the fact that the owner locked them less than two minutes before. Then the alarm goes off repeatedly. And the Tele Aid [mbusa.com] system calls the Mercedes call center who then calls the owner to ask if anything's
Re:Mercedes electronic...useless (Score:2)
The point is this:
If somone wants to steal your car. They are going to steal your car.
It is fairly rare to have a car stolen for "joy riding" now a days... It is much more common for cars to be stolen for parts or to be shipped overseas.
Either of these scenerios imply that criminals are looking for a specific model, meaning they will know how to bypass any stock security systems. Or they will just throw the $10
PSA: Transponder Keys for YOUR Car: $20 on Ebay (Score:5, Informative)
Toyota wanted $45 for the blank. And $95 to "program the key for the car". My brother has a Mitsubishi, they wanted even more.
It turns out that if you can obtain a blank, you can usually program your car yourself to accept the key.
And it turns out that there is a very nice market for these key blanks on ebay. Search for transponder key and your vehicle's make and model. The going rate is about $20.00 and the key blanks usually come with all the instructions you need.
I bought two blanks for $40, and three days and 20 minutes later I had three working keys for my Toyota saving me over $200 from what the dealer wanted.
Parent
The most interesting thing about this work... (Score:5, Informative)
Reverse-engineering can be easy enough when you have some assembly code or a piece of hardware, but these guys figured out the internals just by looking at input/output pairs. (OK, they had a rough description of the design, but it was lacking almost all details and was even inaccurate in places.)
That's really clever -- and really underscores the idea that "security through obscurity" tends to fail terribly. (TI probably thought that the use of a proprietary cipher provided a lot of security, so they didn't worry so much about key length. Foolish, but common, reasoning.)
Re:The most interesting thing about this work... (Score:2)
I can already hear screams of `what do you want the cipher for? Are you going to steal cars and get free gas?' No. But using this excuse, researchers can prevent me and others from implementing a faster attack, or even finding an attack of smaller complexity -- this is a Feistel cipher, so it shares some structure with DES and thus some similar attacks (linear, differential cryptanalysis) mi
Tinfoil (Score:3, Funny)
Mobil (Score:4, Informative)
40 bit keys and complexity (Score:2, Interesting)
I know vaguely how CPUs do these sort of calculations, but how do you HARD wire a system to do that on so little energy ?
Do the energy requirements go up w/ keysize ? The complexity of the circuits?
Do these things have some sort of static flash ROM ?
40 bit Key? (Score:3, Interesting)
I know that encryption isn't that important when true physical contact is involved (such as most credit cards, which have no encryption protection but are starting to get some with smartcards) but when it comes down to something that basicially broadcasts a credit card number, you would think that mobil would be a bit more concerned about it.
If I had a mobil speedpass I would be concerned, since a small device placed on top of a gas pump could easily passive eavesdrop on your speedpass and pass that information to would be criminals.
The car key, although just as disturbing, isn't as important to have a strong key since it would involve way too much work to basicially steal one car. To do it you would have to somehow read the signal from the key by bumping into the person leaving the car to active scan their rfid signal, (passive eavesdropping would not work well since it only sends the signal at startup when the person's going to be driving away) Decode it, and then use it to start the car once you bypass the physical key. It would be much easier and faster to steal a car without an immobilization system then to bypass it.
Re:40 bit Key? (Score:2)
Because they're cheap, lazy, and blind. Like all companies.
Title. (Score:3, Funny)
This a dupe article dupe!
The encryption method (Score:2)
Toll passes? (Score:2, Interesting)
Chris
http://www.freeminimacs.com/?r=14620338 [freeminimacs.com]
Re:Dude stop this. (Score:2)
Re:The Ultimate (Score:2)
Re:Just a matter of time (Score:2)
BTW, do these really exist?
Re:Future of security (Score:5, Informative)
Your biometric information is not secret. The police or your parents might have a copy of your fingerprints, for example. It's theoretically difficult to duplicate biometric data, but certainly not impossible: Cryptome [cryptome.org] has a copy of the research paper where researchers used $20 worth of common kitchen items to successfully fool every commercial fingerprint reader on the market.
Assuming forgery is tougher than that, the problem really is in the "interface" -- at some point the information stops being "biometric" and has been converted by circuitry into digital data. Digital data, of course, can be sniffed, copied, and modified. That's the real weak point of the biometric systems. If you can replace real biometric data with spoofed data, the computer systems downstream aren't going to know the difference.
Parent