Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Using Laptops to Steal Cars 455

Posted by CmdrTaco from the because-you-shouldn't dept.
Ant writes "Thieves are using laptops/notebooks to steal the most expensive luxury cars. Many of these cars have completely keyless ignitions and door locks, meaning it can all be done wirelessly. Thieves often follow a car until it gets left in a quiet area, and they can steal it in about 20 minutes..."
This discussion has been archived. No new comments can be posted.

Using Laptops to Steal Cars More

Using Laptops to Steal Cars

Comments Filter:

  • Far too long. (Score:5, Funny)

    by grub ( 11606 ) <slashdot@grub.net> on Wednesday May 03, 2006 @04:28PM (#15256893) Homepage Journal

    20 minutes to remove the laptop from the bag, smash the window and pound on the steering column with it? They must be using those modern, fancy-pants, lightweight laptops. In the old days we could get a car in under 5 minutes with a Mac Portable.

    • Re:Far too long. (Score:5, Informative)

      by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Wednesday May 03, 2006 @04:41PM (#15257016) Homepage Journal

      Even in your average American "luxury" car, multiple attempts to start the car without the appropriate key will disable the ECU. Furthermore, in most systems, if certain items are damaged, the ECU actually has to go back to the manufacturer for reprogramming because it's part of the anti-theft system. See, there's a communications module with an antenna near the ignition switch, and it has a unique ID. You need the factory scan tool to assign a new radio module to the ECU. (I'm forgetting some details, there's more to it than this, but I figure I can look it up in the shop manual if I ever need to work on a car like that. Einstein said to never memorize what you can look up.)

      The point is that unless you have the proper equipment to unlock, the car can lock itself to the point where it can not be driven. See, modern cars have variable valve timing, coil-on-plug ignition, and a whole bunch of other stuff that simply will not work without the cooperation of the computer. And, you can't just change the computer, because the radio module is locked to an ECU as well. You'd have to swap both the ECU and the module. The module is buried in where the ignition switch is and replacement requires partial dashboard or column disassembly. The ECU is sometimes under the hood, but that's very rare; typically it's behind the kick panel on the right side.

      I'm sure you were going for humor (that was a joke, right? right?) but there are people asking these questions more seriously and you were most highly moderated. :)

      • So you're saying that if you throw enough wrong codes at the car, then it will disable itself? Sounds like you could have a lot of fun disabling people's cars on them. You could probably disable a whole parking garage full of cars with strong enough transmitter and 5 minutes of free time. Even without that, just walk up to a car that isn't yours, and press the button 50 times.

        • Re:Far too long. (Score:3, Interesting)

          by drinkypoo ( 153816 )
          Except that the system I'm talking about is a short-range radio that is only activated when a key is put into the ignition, in order to read the code stored in a RFID tag (or similar - sometimes they actually use electrical contacts even, but that's old tech) on the key. Other systems work differently.

      • Re:Far too long. (Score:3, Informative)

        by dgatwood ( 11270 )
        Problem is that this is relatively weak. Most car alarms automatically shut off if the car gets tilted to a certain angle to avoid alarms while being towed. All you have to do to steal a car, then, is to buy a tow truck and tow it to a private garage, wherein you have sufficient privacy and time to replace those modules....

        Seriously, if you're talking about the folks who are most likely to steal luxury cars, nothing short of a LoJack-like device makes sense. All you can really hope to do is deter casua

        • Re:Far too long. (Score:5, Interesting)

          by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Wednesday May 03, 2006 @04:59PM (#15257196) Homepage Journal

          Most car alarms automatically shut off if the car gets tilted to a certain angle to avoid alarms while being towed.

          That's very nice, but it has nothing to do with what we're talking about here, which is not alarm systems, but theft prevention devices built into the car's PCM, or Powertrain Control Module (formerly "ECU", or Engine Control Unit, but PCM is the OBD-II terminology and all cars are now OBD-II.)

          Car alarms have two purposes: Inform everyone that the car is being tampered with, and stop the car from being driven. These systems have only one purpose: Stop the car from being driven. Either way, it's insignificant to the towing company. The ECU does not disable itself when the vehicle is at an angle. Personally I think that whole thing about car alarms disabling themselves is a myth anyway, because car alarms still work when cars are parked on steep-ass hills in san francisco.

          • Re:Far too long. (Score:3, Interesting)

            by dgatwood ( 11270 )
            I've fixed my car using OBD-II and freediag. I'm quite familiar with the subject, and it DOES have EVERYTHING to do with what we're talking about. It doesn't require specialized scan tools to talk to the PCM/ECU. It requires some very inexpensive hardware, coupled with properly written software.

            Powertrain security is a joke from a security perspective. It might stop a casual thief, but its main purpose has always been to encourage the customer to pay the dealer for extra keys so that they can make mor

            • Re:Far too long. (Score:3, Informative)

              by drinkypoo ( 153816 )

              It doesn't require specialized scan tools to talk to the PCM/ECU. It requires some very inexpensive hardware, coupled with properly written software.

              Since it cannot be done through ordinary OBD-II codes, and can even require the use of nonstandard pins (since OBD-II doesn't regulate most of the pins on the connector) this is not necessarily true. You don't need anything special to pull and clear codes but you often do need something special to, say, reprogram the PCM.

              Why? Because the dealer obviou

          • Used to work in a shop (Score:4, Interesting)

            by Skadet ( 528657 ) on Wednesday May 03, 2006 @08:12PM (#15258717) Homepage
            Late to the punch, I realize, but I used to do odd (electronics) jobs for a car stereo/alarm dealer, where I learned a great deal about car alarms.

            No, car alarms don't disble themselves on an angle. In fact, a common accessory is an angle *detector* to make the alarm go off in case someone (legit or not) attempts to tow. Often this is just a ball bearing in an assembly that completes a circuit when tilted, although I've seen ones made out of mercury that work essentially the same way as the older-school a/c & heating thermostats.

            When an alarm WILL disable itself is when you enable the courtesy feature. Say you have your sensitivity set high, and the night is unusually windy. Instead of going off all night, your car alarm will disble the inputs for that ZONE for an hour (or 2, whatever... programmable).

            Note that door switches, window break sensors, motion detectors are all still active, since each of these is on its own zone.
      • So... when did you steal your first car? ;)
      • "If you had access to the computer, could you open the doors?"
        "Of course. Why?"
        "Just wondered how good you really were."
        "Don't try and manipulate me, Blake."
        "Now why should I try and do that?"
        "You need my help."
        "Only if you can open the doors."

        "I could open every door, blind all the scanners, knock out the security overrides, and control the computer. Control the computer and you control the ship."

      • did you read the article? (Score:5, Informative)

        by SuperBanana ( 662181 ) on Wednesday May 03, 2006 @05:46PM (#15257647)
        The point is that unless you have the proper equipment to unlock, the car can lock itself to the point where it can not be driven.

        And I can implement a system that locks out ssh from any IP address that tries more than 3 wrong passwords. That won't stop someone from exploiting a vulnerability in Apache or PHP, and rooting the box. It also won't stop someone from trying passwords from the console, if I didn't set that up as well...

        If you had bothered to read the article- the whole point is that theives are exploiting weaknesses in the systems and doing so successfully. Some early systems were hilariously bad; GM's first attempt involved a resistor at the base of the key, and the ECU would simply check if the resistance was correct.

        You remind me of the Iraqi Ambassador, with buildings getting shelled behind him, declaring that the Americans are being repelled and have not entered Baghdad. Cars are being stolen right now, despite all the lockouts and "rules" car manufacturers have imposed.

        See, modern cars have variable valve timing, coil-on-plug ignition, and a whole bunch of other stuff that simply will not work without the cooperation of the computer.

        Variable Valve timing and coil-on-plug ignition do not make a car harder to steal; you still need fuel and a spark, and if the ECU won't allow the car to start, it won't allow the car to start; a 2007 A6 with direct-injection, Variable Valve Timing, Variable Intake Geometry, Coil-on-Plug ignition, etc is no harder to "force" to start than my '91 Audi with none of the above; both ECUs will simply not allow fuel or spark. Plus all of these components are 'stupid'; they're just valves and whatnot. It is not cost-effective to make each coil-pack module demand authentication from the ECU. The manufacturer's job is to make it difficult to steal a car; the rest is society's job (ie low motivation to steal, public awareness ie people notice someone doing something they shouldn't, and last but not least, government- ie police, courts, jail, legislation.)

        Futhermore, dealerships use computerized scan tools to communicate with the various modules in the cars. When the owner uses the wrong key 6 times in a row to try and unlock his shiny new Mercedes- they don't package the car up, slap a UPS label on it, and send it back to Germany...nor do they do that with any of the computer modules like you implied; it honestly sounds like you had no idea what you were talking about and confusing RADIO lockouts (where MANY radios WOULD permanently lock themselves if too many incorrect keycodes were entered, and had to be sent to "repair" centers.) The dealer tech plugs in a computer, possibly calls a hotline and validates himself to get a code based off the vehicle VIN number or a code the ECU spits out, aka challenge/response - and then unlocks the security system. VW uses a particular system that is almost completely emulated by software packages like VAG-COM and ProDiag, and both can be used to re-associate a dashboard and ECU without any dealer involvement.

        Anti-theft is about theft deterrent; as we network people say, "you can't stop a big enough hammer." There are now towing/recovery companies using tow-trucks that have crane, reach over the car, the tow truck operator slips arms under each wheel, and then the crane picks the car directly up and plops it on the back of the tow truck. You can do almost the same thing with a regular flatbed tow truck and a set of wheel dollies (designed for moving cars that can't be started, have been crashed, etc.)

      • Re:Far too long. (Score:3, Interesting)

        by bhtooefr ( 649901 )
        Well, other companies can reprogram the ECU.

        For example, if RocketChip (a certain ECU reprogramming company that the Volkswagen TDI crowd prefers) were to get a request to disable the immobilizer on an ECU, they'd do it.

        So, pop the hood, take out the ECU, send it to a reprogramming company, ask for the immobilizer to be deleted, and voila, you have no immobilizer. Or, if you want to steal a certain model of vehicle, have an ECU ready to go.

        Older immobilizer equipped cars are even more of a joke. Unplug the

      • Re:Far too long. (Score:3, Interesting)

        by garylian ( 870843 )
        All very valid comments. However...

        For pure griefing fun, if you can't steal the car, you make it so the owner can't drive it, either. You are doing the same microwaving that ECU.

        I had a car that folks tried to steal at least 3 times. The first two failed, and broke something off in the ignition, forcing me to pay for a window and the ignition repair. The third failed, and may have gone and done a little joyriding, but by that time the turbocharger was going on the engine, so the police believe they act
    • Oh yeah like one of these? http://www.everymac.com/systems/apple/powerbook/s t ats/mac_portable.html [everymac.com]

      For the office-ready desktop alternative why not try the Macintosh XT? http://www.everymac.com/systems/apple/mac_classic/ stats/mac_xl.html [everymac.com]

      ;)

  • And thats why... (Score:2, Insightful)

    by Sinryc ( 834433 )
    And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.
    All they really need to do is start randomizing the locks on cars, and not just use the same pattern...
    yea, expensive, but safe.

    • Re:And thats why... (Score:4, Insightful)

      by $RANDOMLUSER ( 804576 ) on Wednesday May 03, 2006 @04:33PM (#15256935)
      Locks are for honest people. If a pro really wants to steal your car, whether the key is physical or software won't matter much.
      • I want use Cars to steal LAPTOPS!

      • Nice cars are for suckers (Score:4, Funny)

        by Anonymous Coward on Wednesday May 03, 2006 @05:01PM (#15257219)
        The first thing I do when I get a new car is I back it into a fire plug, then run it along side of a brick wall. Then I "key" it a bit and ding it up here and there with a 9 iron.

        Finally, I pour some cod liver oil on the upholstery and lock a couple of cats in it for a few days (with the windows cracked and plenty of food and water - I'm not mean.)

        That just about puts an end to anyone's desire to steal my cars.

        posted anonymously so THEY won't find me.

    • All they really need to do is start randomizing the locks on cars, and not just use the same pattern...

      Imagine replacing the existing locking system on the hundred of thousands of cars that use keyless entry. The auto manufacturers will resist.

      How many of us predicted this years ago? When I saw my first keyless system, I think the first thought on my head was "They better change the code every time the person enters the car". I'm sure the auto designers were told about this security flaw dozens of times--

    • Re:And thats why... (Score:5, Interesting)

      by dgatwood ( 11270 ) on Wednesday May 03, 2006 @04:47PM (#15257073) Homepage Journal
      Regular keys take seconds to defeat. The electronic ignitions take 20 minutes. That's a pretty big improvement in the grand scheme of things.

      One thing they're doing these days is to store some state information so that each code is different than the previous one. However, this only goes so far in terms of increasing the complexity of breaking in. There are generally a limited number of possible codes, so you can eventually guess the right one. And since the car will be ignoring bogus codes (to avoid being fooled by other cars' remotes), you can pretty much send it crap until you hit the right value with impunity.

      If you really want your car to be secure, what they need to do is make the keyless entry devices carry a public/private key pair. On each key device, put a mini-USB jack on them and have a USB jack on the dashboard hooked up to the car's computer. Use this to copy the public key from each "key". Require that after the first key is loaded, one known key must be within radio range in order to associate a new key.

      When you push the unlock button on the key, the device would send an unencrypted "unlock" message. Upon receiving this, the car would reply with a random string of data (say a 2k packet). The key device would receive this, sign the data using its private key, apply a random back-off timer to minimize collisions, then transmit the signed copy of the data, skipping a random time interval between each attempt, and stopping after 5 seconds or when the car transmits a "verified" message.

      Of course, the car would stop listening after 5 seconds as well. Since the message to be encrypted changes each time, this would essentially thwart any attempts to fool the car by transmitting random data until it gets it right.

      If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.

      • Re:And thats why... (Score:4, Funny)

        by iminplaya ( 723125 ) on Wednesday May 03, 2006 @04:57PM (#15257175) Journal
        If you really want your car to be secure...

        Just do what I used to do. Pop off the distributor cap, and remove the rotor. Not too many people carry a spare one of those around.

      • Re:And thats why... (Score:5, Funny)

        by Firehed ( 942385 ) on Wednesday May 03, 2006 @05:21PM (#15257425) Homepage
        ...
        If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.
        If you're THAT paranoid, you just walk.
      • You need to build up it's self esteem. Talk nicely to it, tell it what a good car it is. Buy it some premium when it's being good.

        Don't belittle or yell at your car when it's naughty, a firm "No!" perhaps followed up by thwacking it in the grill with a rolled up newspaper should suffice to let the poor auto know it has been bad without destroying it's self esteem.

        When the time comes and your car starts to notice cars of the opposite sex, do not make this a big deal, that can cause deep seated insecurities in any automobile. Let it know that the feelings it is having are natural and no big deal.

        It will also help if the car does not have to worry about it's old age and retirement. Let your car know you have invested some money for it to live off of when it leaves the workforce.

    • Re:And thats why... keys are no better (Score:5, Interesting)

      by stmfreak ( 230369 ) <stmfreak@@@gmail...com> on Wednesday May 03, 2006 @04:51PM (#15257113) Journal
      And thats why people will want a regular key. Its worked for hundreds of years on other things, so a car should be no problem.

      No, they're not safe. The key merely turns a lock that closes a contact telling the computer it's okay to proceed. After my 2001 Sukuki GSXR was stolen and recovered, I had to learn a thing about hot-wiring ignitions because the thieves had changed the locks. Within the ignition tumbler was a small PCB that connected circuits to ground for parking lights, accessories and the ignition. The added "security" was that a resistor was used in the circuit for the ignition.

      Turns out, the wiring harness for the ignition has a molex connector underneath the right side fairing, right about where my fairing had been shattered by blunt-force-trauma. With nothing more than some knowledge, a spare connector, some wires, a switch and a specifically rated resistor, you could build a plug that would "start" any modern GSXR in about 20 seconds.

      Keys are no safer. As far as the computers are concerned, they're either on or off. RFID, challenge/response, better encryption, failed-attempt lockouts, these things are going to become more common because they do a better job slowing the thieves down.

  • Moral: (Score:5, Funny)

    by Musteval ( 817324 ) on Wednesday May 03, 2006 @04:30PM (#15256901)
    Laptops are evil.

    Fortunately, friendly Republican senators are even now pushing a bill through Congress to outlaw these devil-machines. Always looking out for our interests, those guys.

  • Related video (Score:4, Informative)

    by Crussy ( 954015 ) on Wednesday May 03, 2006 @04:30PM (#15256905)
    I saw a video [media.ccc.de] from a conference in Germany that has to do with infared hacking. It's quite interesting if you have the time to watch it.

  • and then what? (Score:2, Interesting)

    by JeanBaptiste ( 537955 )
    I've been under the impression that thieves steal cars to strip them for parts, as its impractical to re-sell a stolen car as a whole.

    Are parts for luxury cars that specialized? I thought most parts were more or less universal these days. Does a H3 take a special spark plug or something? /20 minutes and a laptop? //more like 2 minutes, a brick and a screwdriver

    • Re:and then what? (Score:3, Informative)

      by deacon ( 40533 )
      These high end luxury cars are exported overseas to markets (North Africa for example) where the origin of the car is easily hidden, and the new owners might not even care.

      Crash parts are taken from cars that are very popular, like Toyota Camry, where there is a big demand due to the huge number of cars on the road.

      An original Toyota front fender is about $260. Add headlights, front bumper cover, hood, grill, and a stolen Camry is worth almost 2 K in just front end parts.

    • Another thing is that a lot of times parts from luxury cars are interchangeable with those of lower models. I remember hearing somewhere that thefts of Acuras was up because people would buy the parts for Honda automobiles. Sometimes this is buying a bigger engine or luxury parts that they do not sell in the lower end cars. I would imagine this sort of interchange can also be done with Toyota and Lexus and pretty much any other car line and its luxury counterpart.

      Some cars do make it overseas, but unle

  • And so it follows... (Score:5, Funny)

    by MudButt ( 853616 ) on Wednesday May 03, 2006 @04:31PM (#15256918)
    This is exactly why my daughter will not have a keyless chastity belt...

  • text of article (Score:5, Informative)

    by Anonymous Coward on Wednesday May 03, 2006 @04:33PM (#15256939)
    Text of article:

    High-tech thieves are becoming increasingly savvy when it comes to stealing automobiles equipped with keyless entry and ignition systems. While many computer-based security systems on automobiles require some type of key -- mechanical or otherwise -- to start the engine, so-called 'keyless' setups require only the presence of a key fob to start the engine.

    The expert gang suspected of stealing two of David Beckham's BMW X5 SUVs in the last six months did so by using software programs on a laptop to wirelessly break into the car's computer, open the doors, and start the engine.

    "It's difficult to steal cars with complex security, but not impossible. There are weaknesses in any system," Tim Hart of the Auto Locksmith Association told the U.K.'s Auto Express magazine. "At key steps the car's software can halt progress for up to 20 minutes as part of its in-built protection," said Hart.

    Because the decryption process can take a while -- up to 20 minutes, according to Hart -- the thieves usually wait to find the car in a secluded area where it will be left for a long period. That is believed to be what happened to Mr. Beckham -- the crooks followed him to the mall where he was to have lunch, and went to work on his X5 after it was parked.

    While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands.

    According to the Prague Post leaving such information on a laptop is what got Radko Souek caught for stealing several cars. "You could delete all the data from your laptop, but that's not good for you because the more data you have, the bigger your possibilities," he says. He says any car that relies on software to provide security can be circumvented by other software. "Every car has its weak spot," he says. Souek faces up to 12 years in prison.

    The Leftlane Perspective: Many modern cars now rely on software entirely for security. Gone are the days where microchips supplemented mechanical locks as an additional security measure. In the case of true 'keyless' systems, software is the only thing between a thief and your car. As computers become more powerful, will stealing cars become even easier? Never mind future cars with better security -- what about today's cars a few years down the road? With cars as inexpensive as the Toyota Camry offering entirely keyless systems, these concerns a relevant to all consumers.

    Posted anonymously to avoid karma whoring.

    • The demons of stupidity are loose (Score:5, Insightful)

      by Beryllium Sphere(tm) ( 193358 ) on Wednesday May 03, 2006 @05:24PM (#15257454) Journal
      >While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands.

      If you replicate a "secret" a few million times, put it in places outside your control, and if you have no way of changing it in the field then you do not have a secret!

      >"...There are weaknesses in any system," Tim Hart of the Auto Locksmith Association told the U.K.'s Auto Express magazine.

      What, Mr. Hart, are the weaknesses in OpenSSH public key authentication? It sounds like the automakers are trying to roll their own crypto, with the usual results. Designing a crypto system is like playing chess with a grandmaster. You'll make a mistake somewhere, and your opponent will find that mistake and use it to break you.

      As long as people make blunders like this we'll have fiascos like the TI chips with 40-bit encryption [rfidanalysis.org].

  • Gone in 20 Minutes... (Score:3, Funny)

    by im_mac ( 927998 ) on Wednesday May 03, 2006 @04:34PM (#15256944)
    Are they referring to their server? 5 minutes after the link arrived on /. and I already get a timeout error.
  • The keyless feature of the Prius was one of the main reasons I was considering it over the hybrid Honda models, but after considering the higher price of the Prius and reading about the insecurity of RFID I decided against it. Now I'm even more sure I made the right decision.
    • It's an option... You don't -have- to get the Smart Key. You have to pay extra to get it. There's tons of reasons not to get a Prius, but this isn't particularly one of them.
    • Im pretty sure the fact that it is a Prius is the best deterrent against theft you can have.....
    • What's wrong with the price of the Prius? Have you compared the cost vs included creature comforts item by item, inch by inch, to see how the price is justified versus whatever you were buying? Still cheaper than the other hybrid models.

      You don't see people complaining you're never make your money back buying that navigation/V6+/European/SUV/luxury type vehicle.

      You can turn off the RFID keyless entry. The only thing the RFID could then be used is engine ignition.

      Sounds like a weak straw-man argument you
      • The Prius with similar safety features to the hybrid Honda Civic I bought was $3,000-4,000 more in the Chicago area because they chose not to sell package 4 in this area--and anything less than that and I wasn't getting the safety features I wanted/needed. Estimated EPA of the Prius is higher, but not by that much more, and I'm getting higher than the EPA of the Civic hybrid. I actually thought the Civic was more comfortable to drive as it allows greater adjustment of the seat and steering wheel. The main t
      • Getting into a car isn't that hard. Getting it to move is tougher. So it's precisely the ignition that I'd be worried about, not the keyless entry.

        As far as the GP's logic goes, I understood it perfectly: not everyone wants/needs all of the add-ons. If you're looking at a Civic, you're probably worried about the bottom line you're paying right now, not in five years. I know I was when I got my hybrid. Which is part of why I didn't get a Prius myself.

        I don't think anyone is saying that the Prius is over

  • Security by Obscurity is no security at all. (Score:5, Insightful)

    by anubi ( 640541 ) on Wednesday May 03, 2006 @04:35PM (#15256959) Journal
    From the article...

    "While automakers and locksmiths are supposed to be the only groups that know where and how security information is stored in a car, the information eventually falls into the wrong hands."

  • I call shens on this article.

    Though what the author describes is technically possible, outside of test environments luxury cars are almost never stolen by strangers... friends or family members with grudges maybe, but professional car thieves avoid these cars because of their almost zero resell/chop-up value.

    • Re:shens (Score:3, Insightful)

      by TubeSteak ( 669689 )
      but professional car thieves avoid these cars because of their almost zero resell/chop-up value.
      Car thieves go after high end cars all the time.

      If for no other reason than to steal the headlights & rims.

      A friend of mine knew some people that would go out in a 4 man team to steal rims. They had an expensive hydralic jack and some power tools. He said they were shady guys, but would do a NASCAR Pit Crew proud.

      And that's not even the pro's.

    • Re:shens (Score:2, Interesting)

      by PenGun ( 794213 )
      The scam when I was young was to take a crane truck, grab a nice new vette and take it out to the toolies flip it upside down in a ditch and gut it. Took about 20 min to remove the running gear.

        It was kinda cool to come across a vette upside down looking like an old crab shell with all the guts missing.

          PenGun
        Do What Now ??? ... Standards and Practices !

  • does this mean (Score:3, Funny)

    by supe ( 163410 ) * on Wednesday May 03, 2006 @04:36PM (#15256977) Journal
    My updated keyless 1968 Rambler 550 classic is going to be stolen soon?
    Guess I'll havee to down grade.

  • Yea, right (Score:5, Interesting)

    by TubeSteak ( 669689 ) on Wednesday May 03, 2006 @04:38PM (#15256991) Journal
    The Leftlane Perspective: Many modern cars now rely on software entirely for security. Gone are the days where microchips supplemented mechanical locks as an additional security measure. In the case of true 'keyless' systems, software is the only thing between a thief and your car.
    So what?

    It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.

    I remember seeing on TV a news thing they did with a former car thief. He said that a car with a club, a brake pedal lock and an alarm system were the most secure. Not because they were un-stealeable, but because it wasn't worth the time or effort.

    Maybe Car MFGs will get serious about security in the future, but I doubt it. The only business they lose is from people who see the top ten most stolen cars and think "I don't want one of those". Otherwise, stolen cars = money for them, mechanics and part manufacturers.

    • Yep, right now keyless entry can be duped by a straight replay attack. They need to implement query/response and prevent replays with cryptographic salts.
    • My first car was a Ford Pinto with an unbreakable anti-theft system. Every so often, at seemingly random times, it would stall and couldn't be started for approx 24 hrs. It usually did this in the worst possible places (left lane of highway, busy intersection, etc). Any thief who could bypass this system could have had the car if he only told me how he did it because no mechanic was ever able to figure it out.

      On a good note I did get to use 100% of my free AAA tows for that year.

      My wife's Honda Civic has

    • Re:Yea, right (Score:4, Insightful)

      by poot_rootbeer ( 188613 ) on Wednesday May 03, 2006 @05:53PM (#15257727)
      It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.

      A rock through the window defeats even the newer laser/dimple key systems.

      The benefit of using a laptop, though, is that the thief doesn't have to engage in suspicious-looking activities like reaching through shattered safety glass on a car with a shrieking alarm, or fidgeting over the door lock with a bobby pin. Now they can just park a cargo van next to the target car, and sit in the back packet-sniffing to their heart's content without a passerby raising an eyebrow.

  • Insert... (Score:5, Funny)

    by Billosaur ( 927319 ) * <<wgrother> <at> <optonline.net>> on Wednesday May 03, 2006 @04:38PM (#15256992) Journal
    ...favorite Knight Rider joke here: "Michael, someone's trying to connect to me via Wi-Fi and and override my locking mechanism!"

  • couple of points (Score:2, Interesting)

    by mapkinase ( 958129 )
    1. What kind of embedded os they are running? I am at total loss with modern cars.

    2. It seems that this problem is more solvable than attacks on computers from the Internet, because the car hackers have the following disadvantages

    *) less time to hack
    *) less time to use the car after hacking
    *) more visibility and danger of immediate apprehension
    *) even the most luxurious cars are of a less source of income (after stealing) compared to what modern hackers can earn

    • "1. What kind of embedded os they are running? I am at total loss with modern cars."
      I can't say for sure but I'd guess Windows 95. It's the only OS that asks "Where do you want to go today?" and nothing else would make sense for a car.
      "Humanity to others" just doesn't seem likely, especially in an SUV.
    • 1. Usually custom everything, if for no other reason than to try and frustrate the aftermarket mod chip guys.

      2.

      - If they know the owner isn't coming back soon, they have all the time in the world

      - I'm not sure how you come to that conclusion.

      - Again, I'm not sure how you come to that conclusion. If anything, a laptop is less conspicuous than the normal regimen of car-stealing tools.

      - This is possible, but these aren't 'hackers', they're car thieves. I imagine your every day hacker wouldn't have a clue how t

  • 20 minutes? What, is it just sending some pre-generated random number? Are they really too lazy to use a simple challenge-response scheme like normal password authenication? Or would that take up too much battery power on the errr... key?

    Of course, as another poster mentioned, it does not really matter what you can do fancily and wirelessly because you can just smash the window.

    • No, the delays are part of (ironically) extra security on the part of the car's computer. Making the thief wait for 20 minutes gives the owner a chance to return to the car and discourages the thief from working on things in public. Mind you, chances are they simply park up near to the car they want to break into and play with their laptops.
    • But smashing the window will make a lot of noise, set off any car alarms, and you won't be able to start the car. Plus it's obvious it's not your car if you're smashing the window. Someone just sitting against their car using a laptop isn't that suspicious at all, if anyone asks you're just waiting for your friend.
      • But smashing the window will make a lot of noise, set off any car alarms, and you won't be able to start the car. Plus it's obvious it's not your car if you're smashing the window. Someone just sitting against their car using a laptop isn't that suspicious at all, if anyone asks you're just waiting for your friend.

        While yes, smashing a window would make much noise... and looks rather suspicious... what are bystanders going to do about it? You would "think" they would phone the police but if you actually

  • That's not all (Score:4, Funny)

    by From A Far Away Land ( 930780 ) on Wednesday May 03, 2006 @04:40PM (#15257013) Homepage Journal
    There are reports out of Nebraska today that people with laptops have been seen plugging them into airport electrical outlets, and stealing electrons in an unguarded airport. The Department of Homeland Insecurity has declined to comment on the matter.
    Details at 6:00

  • 20 *Minutes* is actually quite long... (Score:5, Interesting)

    by rblum ( 211213 ) on Wednesday May 03, 2006 @04:42PM (#15257024)
    And that's insecure? Your run-of-the-mill car can be broken into in about 20 seconds. How'd I know? I managed to leave my keys in my car and called AAA. The guy showed up and had it open in under 20 seconds, just using a coathanger.

    From that POV, give me the fancy-pants stuff any time.

  • Not so hard apparently (Score:5, Interesting)

    by Visaris ( 553352 ) on Wednesday May 03, 2006 @04:42PM (#15257025) Journal
    There is a student on campus that was bragging that he could do just as the article describes. A professor put down $100 and bet the student that he couldn't get into his car in 15 min without breaking anything. The student took the bet. Needless to say, the whole class was out in the parking lot 5 min later to watch. It took the student about 5 minutes. The car chirped and the lights flagshed. I assume this meant the doors had been unlocked. Next, the car started, the student opened the door and got it.

    This was really cool to see live. There is a something about seeing it done live that is very impressive.

  • Tow truck? (Score:3, Informative)

    by Anonymous Coward on Wednesday May 03, 2006 @04:45PM (#15257057)
    Why go through the hassle? It's WAY easier to back up to a car with a flatbed or wheel lifts to steal a car. You can lift the drive wheels and be gone in 30 seconds or less. You can then override the rest of the system at your leisure.

  • Comment removed (Score:3, Insightful)

    by account_deleted ( 4530225 ) on Wednesday May 03, 2006 @04:46PM (#15257064)
    Comment removed based on user account deletion
  • Frankly, I'd like to see how vulnerable my car is. If I can hack it in 20 minutes, well, ok so that'd be cool and stuff, but I can modify my car's computer through a tool made available from volkswagon. I'd like to expirement with my car. I dunno. Try to lock it down a bit if you'll pardon the pun.
  • Wow, who wrote this stuff?

    Unless I'm way off base here, this sentence:

    "You could delete all the data from your laptop, but that's not good for you because the more data you have, the bigger your possibilities," he said.

    Makes no sense or apparent relevance. Maybe an illusion to using security by obscurity? Dunno.

    Does anybody know more about the article than what it says?

    What kind of technology does the security software use? I'm assuming its wireless, RFID, bluetooth, retinal scan, or something. I don't

  • Halfway to my new Porsche... (Score:3, Funny)

    by BaronHethorSamedi ( 970820 ) <thebaronsamedi@gmail.com> on Wednesday May 03, 2006 @05:22PM (#15257434)
    Now all I need is an article explaining how to swipe a laptop.

  • If so, it won't last long... (Score:5, Interesting)

    by YesIAmAScript ( 886271 ) on Wednesday May 03, 2006 @05:37PM (#15257565)
    Cars use similar systems to garage door openers. They are immune to pure replay attacks. And they have a 48-bit keyspace, only about 6 bits worth of which is active at a time (about 30 or so codes out of the keyspace will work at a time).

    So you are looking at hitting a 1 in 2^42, or 1 in 4 trillion needle in a haystack.

    Even if you rifle through codes, you're not going to hit one soon.

    And if the system is designed to lock out after 3 failures, and make you wait 5 seconds to try another key, that means you won't stand much of a chance of rifling through the codes in your lifetime.

    So, if these systems have flaws right now, it's in implementation, not design, and it'll be rapidly fixed.

    BTW, for about 15 years there were only about 40 different door keys on all GM cars. We happened to have two at once that had the same door key (although they didn't use the same ignition key, GM used a two key system at the time). So this electronic system is still pretty much better, the only downside, is there is no deterrent to sitting a few feet from a car and trying to open it electronically versus putting a key in the door of the car and trying to turn it.

Slashdot Top Deals

To the systems programmer, users and applications serve only to provide a test load.

Close