Monday 2nd July 2012

Video: Key fob reprogrammers steal BMW in 3 mins

Why car theft using sophisticated key programming devices is a problem that won't go away

---

Recent chat on the PistonHeads forums about a worrying trend in the theft of BMWs with electronic keys has gained new traction as a PHer has posted a CCTV video on YouTube of his BMW 1M Coupe being stolen within three minutes.

PHer 'stolen 1m' (we see where they're going with that username) had their £43K M car stolen from their driveway when thieves smashed a small area of window glass in the car without activating the alarm and used a diagnostic device to reprogramme a key fob through the OBD port.

But a quick internet trawl reveals it's not just BMWs that are vulnerable. Devices similar to that used on BMWs are also available for Opel, Renault, Mercedes, Volkswagen, Toyota and Petrol-engined Porsche Cayennes.

The Society of Motor Manufacturers and Traders (SMMT) recognises the problem is a wider issue, though, telling us that they are working to tighten up the procedures for getting hold of these devices, in order to minimise the risk of them falling into undesirable hands. They also say that the industry is working on the technological side of the issue, with companies like Thatcham in particular liaising with police on ways to battle this technological crime.

The reason this form of theft is currently so rife - and admittedly this issue is not limited to BMWs - is that European competition rules require diagnostic and security reprogramming devices to be available to non-franchised garages. As we understand it, this effectively means that car companies cannot restrict access to or use of OBD ports.

Unfortunately it also means that, to a certain extent, the hands of car companies are tied, hence BMW can still only tell us that that they are "aware of recent claims that criminal gangs are targeting premium vehicles from a variety of manufacturers. This is an area under investigation. We have a constant dialogue with police forces to understand any patterns which may emerge. This data is used to enhance our defense (sic) systems accordingly. Currently BMW Group products meet or exceed all global legislative criteria concerning vehicle security."

 

[ZesPak]

... how do they de-activate the alarm before opening the door?

[ZesPak]

stolen 1m said:

There is a 'void' in the alarm. Almost like an area that isn't covered by it. This runs along the door from top to bottom and front to back and extends into the car by 4 inches (just enough to get your hand in and down to the OBD port) BMW won't admit it.

If that's true, that's some terrible cost-cutting from a manufacturer like BMW.

[ZesPak]

405dogvan said:

Interior 'scanning' alarms have always been shonky and crap for this stuff - the way the technology works it's VERY hard to cover the whole interior without making 'false' triggers commonplace.

False triggers keep dealers very busy - and having to take your car into the dealer because the alarm keeps going off is bloody annoying and tends to cause manufacturers to score poorly on those customers satisfaction indexes.

Of course in this case there's a super-super-simple solution - if the alarm is armed and something connects to the OBD port, it should go off surely?

Then there's no need to fk around with the interior sensors...

Agreed, that's what I was getting at, not that it omits 4 inches, I can understand that, but the fact that the OBD port can be accessed without triggering it so it is put out of sight of the interior sensors, and accessible through a window?
That's imho the biggest design flaw.

[ZesPak]

MarJay said:

Simple to sort, put a lockable cover over the OBD port. My BMW has a key that goes with the electronic doodad that passes for a key, so it wouldn't be beyond the wit of man to make the OBD port lockable...

, or like 405dogvan suggested:

alarm armed -> OBD port "used" -> sound alarm

Or, like you said, an alarm-triggered lockable cover.

[ZesPak]

misterdave said:

I love the fact these people can steal our cars easily and yet we re charged from the dealer £70ish minimum to programme a key for our cars!! what are we paying this amount for? if it just makes our cars easy to steal? If anyone is stealing VWs in cornwall and wants to progrmme my spare key for me drop me an email at [e-mail] thanks.

What car?
Exact address?
Closed garage or parking lot?

[ZesPak]

Slippydiff said:

Ahhh, PH, got to love it . . .

You've clearly got a big chip on your shoulder when it comes to BMW owners

I essence, he's right though. You shove the guilt at the EU for the cars needing a "universal" OBD port. Could you imagine what happens if they didn't?

If that would be the problem [u]all[/u] cars would be affected, as it's legislation for all new cars. Yet that's not the case, is it? What the thieves effectively can do now is "make" a key on the spot, in mere seconds. Physical keys would take longer and bigger equipment one way or another. So there are several solutions:

1. Make keys that can't be made in seconds with relatively cheap and portable equipment
2. Make sure the OBD port can't be accessed when the alarm is activated
3. For fk sake, put the OBD port somewhere where it can't be accessed without getting into the car

[ZesPak]

NGK210 said:

If the 1M's OBD port was located in the centre console, at the rear of the 'coin tray' - eg, as per VAG's Golf 4-based models - thus being in range of the alarm's motion sensor(s), then there wouldn't be a problem?

Well, it would still be "nickable", like any other car out there, it'll just be a lot harder to do in silence in the night like on the video.

Making it impossible isn't really possible imho. Making it harder is the true goal.

As someone said, why don't they need a code that is provided with the car to create new keys?

[ZesPak]

groucho said:

kambites said:

Then if an owners loses their keys, how do you program one?

It has got to be possible to "steal" a car, because it's the same process that one goes through when an owner loses the keys. The problem just seems to be that it's silent (because the alarm is rubbish) and too easy/fast. They could still just introduce a delay into the car-side of the OBD system so it takes 24 hours to program a key, or something similar.

What, both sets? Then tough frankly. You can always remove it on sale of vehicle.

The dealer of my Honda said that if I lose both my keys, they will need to remove/replace several parts, adding to a bill of about 1000 € (on a bike!). It's because of "HISS". I've heard similar stories for Ducati, if you want to steal those, it's a matter of "bring your own ECU".

[ZesPak]

kambites said:

What would be the odds of the third owner, ten years down the line, having the code when they lose their keys.

Ultimately, it has to be possible to get a car going again without the key or any special information when it's sitting there alarmed because that will usually be the state the car is in when someone loses the keys.

Disagree. My €2000 pioneer unit has a code for when the power is cut. Without the code, the unit will render itself useless. You then have to buy a new € 2000 unit.

Like I said, on new hondas and ducati, you would need to replace some ignition/ecu parts, costing about € 1000 to repair.

Agreed, for second hand selling buyers it's just something extra they need to be aware of.

Anybody knows how Alfa solved this? Last time I heard the 159 was very hard to steal, yet it hasn't got a regular key either... I think it was because there are no blank/reprogrammable keys available.

[ZesPak]

kambites said:

It would be a massive overreaction to simply make it so you can't program keys.

Well, as I see it, the "blank" fobs have to come from BMW one way or another, right?
So only available as an original part.

With the 159 key, iirc, Fiat will provide you with an extra BUT they will only provide one made to order, not a blank one that everyone could program.

So not every youth with his hat on backwards can get 10 blank ones.
Agreed, when the car is 30 years old and you can't order keys anymore you've got a big problem. But then again, if you don't have any spare blank ones (??) lying around, you've got the same problem.

[ZesPak]

So they should actually mirror the alarm sensors as well? Seems like a big thing to overlook. What baffles me most is actually that the thieves manage to find these sort of things.

[ZesPak]

Madmatt74 said:

Or you cant use the port unless the engine is running?

That would mean they would need an entirely different method to create extra keys. Preferable, but not plausible.

[ZesPak]

peteO said:

how will they break in? through a door/window perchance? and i doubt the average crim with a bat or a gun is @rsed about rousing the every day joe who doesnt have a gun in their house!

You'd be wrong. The average crim wants in-out without encountering anybody. If they see a light go on or hear something, their first plan will be to bolt.
If you caught them in a corner, then you might have a problem, otherwise most are intelligent enough to know the law isn't looking for "attempted theft", and even when they get caught they'll get minor punishment. Hit someone or use force to obtain the goods and it's a whole other level. And they know it.

[ZesPak]

Zod said:

Well, it's happened again. 19 months after the M5 got stolen, 1 month after the last attempt to steal the X5, it was stolen at 2.30 in the morning.

I cannot express how furious this makes me.

What kind of place was it in? Driveway? Garage? Any other security rather than the regular BMW 'security'?

Gutted for you!

[ZesPak]

I stated this before, but can people who like to blame the EU for this please elaborate how:

1. It's the EU's fault the OBD is accessible without opening a door?
2. It's the EU's fault the OBD is accessible without triggering the alarm?
3. It's the EU's fault it's that easy to program new keys in the car? No code required, no new key?

As for the last point, more than one manufacturers will warn you that there will be serious costs involved if you lose BOTH keys, and advise you to always have a spare one made if you lose one. Why? Without an original key, the entire unit will need replacement. That's not only costly, but a quite some work and not to be done without opening the door or activating the alarm.

Edited by ZesPak on Wednesday 4th July 11:01

[ZesPak]

Why don't you all go driving on the right side of the road, so you can have the proper, LHD BMW's

[ZesPak]

dasbimmerowner said:

...give £250 to a less than trusted alarm company or go without any further security? I'd pick the first option all day long.

Really, after this, you still trust BMW more than a "less than trusted alarm company"?

Anyway, aftermarket isn't bad most of the time, as, albeit some installs can be very crude, more than 90% of the cars are just equipped with manufacturers' security, so that's what the scrotes are mostly up-to-speed about.
For about £ 250 there are some very basic albeit efficient self-install GPS Trackers available. These days they are little bigger than a matchbox and can be hidden anywhere in the car.

[ZesPak]

dasbimmerowner said:

I've no interest in a tracker. If the car is stolen I really don't want it returned.

Really?

I can see a couple of upsides here though:

1. Car returned relatively fast without cost, no insurance bother either
2. Damage is usually minimal, a couple of hundred £
3. "they" won't return after a couple of months for your brand new insurance money car
4. insurance claims don't go up for EVERYBODY. Look at this 1M, imagine if you want one and insure one, turns out that in your area there's a 20% chance it'll get nicked without a chance of retrieval. Your insurance quote will eventually say £15000, because some people "rather have a new one than have one returned". Don't forget that, however you think of it, YOU pay for the new one, not the scrotes, not the insurance, YOU.
5. most of all: the fking scrotes don't have it, they've wasted an evening of their fking around and don't have any money in their pockets for it. This sends the message that MAYBE crime doesn't pay after all. Better still, they might even get caught with it (justice system aside, that's another matter). Imagine if the return/retrieval rate of cars is 60% instead of the current 5%, you'd think that thefts will drop? Now it's just so likely to get away with it it's ridiculous.

But as you said, it's easy to nick one, it's easy to have a new one through insurance, it's a circle that won't be broken until either one changes. In my opinion the insurance will strike first, posing very high quotes for theft insurance, having a lot of people not taking one and only then make it harder for the thieves to nick their car.

[ZesPak]

Scuffers said:

not sure I agree with these, having had a car stolen/recovered...

1. it took 12 weeks to recover it
2. it was supposedly un-damaged, but ended up being written off some months later when the fixing dealer discovered the shell was twisted (not before they had already spend a fortune on trying to fix it)
3. if only.....

appreciate my experience is probably not typical, but if I have a car stolen, I probably don't want it back.

Sorry, I was of course also speaking of anecdotal evidence. Having had my car stolen and retrieved once, it was stolen in the night and intercepted only 30km further (eastern european scrotes still inside), having it returned to us within 2 hours and all we had to do was replace two locks and get the stench out.

[ZesPak]

Steffan said:

Metro link now online EXCELLENT!!!

See

http://www.metro.co.uk/news/904576-thieves-using-g...

article said:

Despite a drop in car thefts, 314 BMWs have been stolen so far this year compared with 258 during 2011.

surely that can't be right, can it? If we'd extrapolate that number that would go to 600 this year, a rise of 130% in theft for BMW, while overall numbers are down.
Can't imagine that NOT showing in insurance quotes if the metro's numbers are correct...