Using Laptops to Steal Cars 455
Ant writes "Thieves are using laptops/notebooks to steal the most expensive luxury cars. Many of these cars have completely keyless ignitions and door locks, meaning it can all be done wirelessly. Thieves often follow a car until it gets left in a quiet area, and they can steal it in about 20 minutes..."
and then what? (Score:2, Interesting)
Are parts for luxury cars that specialized? I thought most parts were more or less universal these days. Does a H3 take a special spark plug or something?
Yea, right (Score:5, Interesting)
It's not like 99% of keyed systems were very secure. Except for the newer laser/dimple keys, thieves are going to easily get into your car.
I remember seeing on TV a news thing they did with a former car thief. He said that a car with a club, a brake pedal lock and an alarm system were the most secure. Not because they were un-stealeable, but because it wasn't worth the time or effort.
Maybe Car MFGs will get serious about security in the future, but I doubt it. The only business they lose is from people who see the top ten most stolen cars and think "I don't want one of those". Otherwise, stolen cars = money for them, mechanics and part manufacturers.
couple of points (Score:2, Interesting)
2. It seems that this problem is more solvable than attacks on computers from the Internet, because the car hackers have the following disadvantages
*) less time to hack
*) less time to use the car after hacking
*) more visibility and danger of immediate apprehension
*) even the most luxurious cars are of a less source of income (after stealing) compared to what modern hackers can earn
20 *Minutes* is actually quite long... (Score:5, Interesting)
From that POV, give me the fancy-pants stuff any time.
Not so hard apparently (Score:5, Interesting)
This was really cool to see live. There is a something about seeing it done live that is very impressive.
Re:And thats why... (Score:5, Interesting)
One thing they're doing these days is to store some state information so that each code is different than the previous one. However, this only goes so far in terms of increasing the complexity of breaking in. There are generally a limited number of possible codes, so you can eventually guess the right one. And since the car will be ignoring bogus codes (to avoid being fooled by other cars' remotes), you can pretty much send it crap until you hit the right value with impunity.
If you really want your car to be secure, what they need to do is make the keyless entry devices carry a public/private key pair. On each key device, put a mini-USB jack on them and have a USB jack on the dashboard hooked up to the car's computer. Use this to copy the public key from each "key". Require that after the first key is loaded, one known key must be within radio range in order to associate a new key.
When you push the unlock button on the key, the device would send an unencrypted "unlock" message. Upon receiving this, the car would reply with a random string of data (say a 2k packet). The key device would receive this, sign the data using its private key, apply a random back-off timer to minimize collisions, then transmit the signed copy of the data, skipping a random time interval between each attempt, and stopping after 5 seconds or when the car transmits a "verified" message.
Of course, the car would stop listening after 5 seconds as well. Since the message to be encrypted changes each time, this would essentially thwart any attempts to fool the car by transmitting random data until it gets it right.
If you're really paranoid, you could design it so that the key also knows a public key for the car and uses that to get a session key so that the entire communication path is encrypted.
Re:And thats why... keys are no better (Score:5, Interesting)
No, they're not safe. The key merely turns a lock that closes a contact telling the computer it's okay to proceed. After my 2001 Sukuki GSXR was stolen and recovered, I had to learn a thing about hot-wiring ignitions because the thieves had changed the locks. Within the ignition tumbler was a small PCB that connected circuits to ground for parking lights, accessories and the ignition. The added "security" was that a resistor was used in the circuit for the ignition.
Turns out, the wiring harness for the ignition has a molex connector underneath the right side fairing, right about where my fairing had been shattered by blunt-force-trauma. With nothing more than some knowledge, a spare connector, some wires, a switch and a specifically rated resistor, you could build a plug that would "start" any modern GSXR in about 20 seconds.
Keys are no safer. As far as the computers are concerned, they're either on or off. RFID, challenge/response, better encryption, failed-attempt lockouts, these things are going to become more common because they do a better job slowing the thieves down.
Re:Far too long. (Score:3, Interesting)
Re:Far too long. (Score:5, Interesting)
That's very nice, but it has nothing to do with what we're talking about here, which is not alarm systems, but theft prevention devices built into the car's PCM, or Powertrain Control Module (formerly "ECU", or Engine Control Unit, but PCM is the OBD-II terminology and all cars are now OBD-II.)
Car alarms have two purposes: Inform everyone that the car is being tampered with, and stop the car from being driven. These systems have only one purpose: Stop the car from being driven. Either way, it's insignificant to the towing company. The ECU does not disable itself when the vehicle is at an angle. Personally I think that whole thing about car alarms disabling themselves is a myth anyway, because car alarms still work when cars are parked on steep-ass hills in san francisco.
Re:shens (Score:2, Interesting)
It was kinda cool to come across a vette upside down looking like an old crab shell with all the guts missing.
PenGun
Do What Now ???
Re:Far too long. (Score:3, Interesting)
Powertrain security is a joke from a security perspective. It might stop a casual thief, but its main purpose has always been to encourage the customer to pay the dealer for extra keys so that they can make more money. The fact is that, with the exception of tracking systems, alarm systems are the only viable line of defense.
If you can disable the alarm and tow the vehicle to a private location, the vehicle is as good as yours no matter what the manufacturer did to the PCM. Why? Because the dealer obviously has a way to reset the system and program it for new keys, and there are only two things preventing a thief from doing the same thing: lack of information and the inability to do it surreptitiously. The first one falls into the "security through obscurity" category, and thus is unlikely to stop car thieves at this level of sophistication for very long. The second one can be defeated with a tow truck.
Thus, while I left out a couple of steps in arriving at the conclusion before, my point is valid: powertrain security is a pointless exercise. Even requiring an ignition key is basically a pointless exercise except to prevent children from accidentally starting the car. It prevents naive abuse of the vehicle and nothing more.
getting noticed... (Score:5, Interesting)
A car getting towed often gets noticed, but a guy with a laptop parked in the next space doesn't...
If so, it won't last long... (Score:5, Interesting)
So you are looking at hitting a 1 in 2^42, or 1 in 4 trillion needle in a haystack.
Even if you rifle through codes, you're not going to hit one soon.
And if the system is designed to lock out after 3 failures, and make you wait 5 seconds to try another key, that means you won't stand much of a chance of rifling through the codes in your lifetime.
So, if these systems have flaws right now, it's in implementation, not design, and it'll be rapidly fixed.
BTW, for about 15 years there were only about 40 different door keys on all GM cars. We happened to have two at once that had the same door key (although they didn't use the same ignition key, GM used a two key system at the time). So this electronic system is still pretty much better, the only downside, is there is no deterrent to sitting a few feet from a car and trying to open it electronically versus putting a key in the door of the car and trying to turn it.
Re:20 *Minutes* is actually quite long... (Score:5, Interesting)
In reality the only differences between the two types of theft is the amount of money spent on the vehicle, and the amount of time no one notices (or cares about) someone working on it. 20 minutes or 2 minutes, either way your car is gone.
Re:Far too long. (Score:5, Interesting)
Re:Far too long. (Score:3, Interesting)
For example, if RocketChip (a certain ECU reprogramming company that the Volkswagen TDI crowd prefers) were to get a request to disable the immobilizer on an ECU, they'd do it.
So, pop the hood, take out the ECU, send it to a reprogramming company, ask for the immobilizer to be deleted, and voila, you have no immobilizer. Or, if you want to steal a certain model of vehicle, have an ECU ready to go.
Older immobilizer equipped cars are even more of a joke. Unplug the immobilizer control unit, short out the right pins, and drive off.
Not that I suggest stealing cars. I'm just saying that even your high-tech, impossible to defeat immobilizer systems are easily defeated.
Re:One system alone isn't enough (Score:3, Interesting)
This is very true - happened to me. You would not believe how expensive a factory steering wheel is! $1000+ Only insure companies ever buy them.
Re:Far too long. (Score:3, Interesting)
For pure griefing fun, if you can't steal the car, you make it so the owner can't drive it, either. You are doing the same microwaving that ECU.
I had a car that folks tried to steal at least 3 times. The first two failed, and broke something off in the ignition, forcing me to pay for a window and the ignition repair. The third failed, and may have gone and done a little joyriding, but by that time the turbocharger was going on the engine, so the police believe they actually brought it back.
Let's not give some enterprising folks the idea of running around and shorting out the ECUs of cars everywhere.
Besides, I wonder if something like this foils Lo-Jack. If not, no biggie. I mean, if you spend more than $25K on a car/truck, or have a vehicle that is high on the stolen list, and don't have Lo-Jack (at least if it is available) you are asking for it.
It works so well, most car theives steal a car and simply move it a few blocks, park it, and leave it for 24hrs. If nobody picks it up, then they take it to the chop-shop. That 24hrs is to keep from having the chop-shop raided. That's their method of stoping Lo-Jack. Which is why they usually recover the car in decent condition within 15 minutes most of the time.
Re:And thats why... (Score:2, Interesting)
Used to work in a shop (Score:4, Interesting)
No, car alarms don't disble themselves on an angle. In fact, a common accessory is an angle *detector* to make the alarm go off in case someone (legit or not) attempts to tow. Often this is just a ball bearing in an assembly that completes a circuit when tilted, although I've seen ones made out of mercury that work essentially the same way as the older-school a/c & heating thermostats.
When an alarm WILL disable itself is when you enable the courtesy feature. Say you have your sensitivity set high, and the night is unusually windy. Instead of going off all night, your car alarm will disble the inputs for that ZONE for an hour (or 2, whatever... programmable).
Note that door switches, window break sensors, motion detectors are all still active, since each of these is on its own zone.