New BMW's getting stolen using blank BMW keys

[blueacid]

So given this apparent risk, I wonder whether the cars can be updated to provide some line of defense? (Obviously the separate attack vector is fake documents permitting a new key to be dispatched)

[cptsideways]

aeropilot said:

With so many pages now in this thread..... I'm not sure if this has been posted yet?

Security camera footage of 1M getting nicked in 3 minutes.....

http://www.youtube.com/watch?feature=player_embedd...

Clearly showing one guy holding the key coder too, did they break in through the mirror?

[Pesty]

Just saw this for the first time. 54 pages now but sorry if this has already been covered.

Isn't this quite easy for BMW to stop?

Don't sell blank keys unless people can show a registration document?

[JC2012]

If they stop selling them someone will manufacture them i think their readily available on auction sites.

In technology and engineering there's always reverse technology and engineering - and no matter what BMW do there will always be a way.

They are just making it very easy to do by leaving the Port live with power when the vehicle is turned off and locked they should instead cut the power to the port and allow the alarm to sound if contact is made to the pins on the port when the vehicle is locked as a deterrent at least.

[TheEnd]

The blank keys aren't being sold by BMW, they are made in China, and you can get blanks of any electronic key.

[mrmr96]

Pesty said:

Just saw this for the first time. 54 pages now but sorry if this has already been covered.

Isn't this quite easy for BMW to stop?

Don't sell blank keys unless people can show a registration document?

This:

TheEnd said:

The blank keys aren't being sold by BMW, they are made in China, and you can get blanks of any electronic key.

But also, as someone else has already explained; you don't need a "Blank" key to pull it off.

I, like you, originally thought that an electronic key was like a metal key; blank until it's programmed to match the car you want to open with it. However it's been explained on this thread that this is not the case. Instead the CAR is coded to the KEY. That is to say the key has a unique identifier built into it from manufacture, and the car can store the details of up to ten keys. So there will be the original two that came with the car, and 8 blank slots. The thieves program one of the empty slots to accept the key they have in their possession.

This is why you don't need a "blank" key. It's also why one of the possible defence options is to over write all the remaining 8 key slots on your car with one of your existing keys. That way no more keys can be coded. (Apparently it would require an expnsive new chip to be able to get the 10 blank slots back.)

[TheEnd]

mrmr96 said:

However it's been explained on this thread that this is not the case. Instead the CAR is coded to the KEY.

That's a theory I disagree with...

[mrmr96]

TheEnd said:

mrmr96 said:

However it's been explained on this thread that this is not the case. Instead the CAR is coded to the KEY.

That's a theory I disagree with...

Ok, I don't know either way - I was just trying to summarise some of the content from the last x pages.

[contracttor]

TheEnd said:

That's a theory I disagree with...

Could you explain why you disagree with it?

[93Jay]

mrmr96 said:

TheEnd said:

mrmr96 said:

However it's been explained on this thread that this is not the case. Instead the CAR is coded to the KEY.

That's a theory I disagree with...

Ok, I don't know either way - I was just trying to summarise some of the content from the last x pages.

You're are correct, the two police officers that have posted, said exactly that.

Apparently one key is being used for multiple cars.

[jimbobsimmonds]

c7xlg said:

I can't believe no one has commented on this yet:

" my 6 month old 330im Sport conveertable had been stolen from my drive "

"the police basically told me not to buy another high end BMW"

Ummm... since when has a 1, 3 or even a 5 that doesn't have a M (at the front!) of it's model designation been considered a 'high end BMW'???

I'd consider 1 or 3 to be quite the opposite. Considering 7s start at £56K, M5/M6 are pushing £80-100,000 I don't' think a £20-40K 1er, 3er or 5 is anywhere near 'high end'.

Hate to dwell on this point and forgive me if this point has been made further on it the thread but...


£30-40k might not be a lot of money to you but to the majority of the population it is. Also they are stealing these cars to make money; and I would imagine theiving types like to have a quick turnaround of cars for obvious reasons. I would imagine they will find selling parts/entire cars off 1ers and 3ers easier than a 7 series (can't remember the last time I see a 7 series, whereas 1s and 3s are tenapenny).

[TheEnd]

93Jay said:

mrmr96 said:

TheEnd said:

mrmr96 said:

However it's been explained on this thread that this is not the case. Instead the CAR is coded to the KEY.

That's a theory I disagree with...

Ok, I don't know either way - I was just trying to summarise some of the content from the last x pages.

You're are correct, the two police officers that have posted, said exactly that.

Apparently one key is being used for multiple cars.

There are 5 versions of the CAS system, 1,2,3, 3+ and 4.
I know the CAS4 version can't be written to without removing it and programming it via BDM (a debugging connector that puts you in contact with the MCU processor)

The earlier versions can be read and written to through OBD, but the later versions can only be read.
In those cases, you read the expected "dealer" key, and make it up using the inbuilt key programmers, so it gets what it is expecting.
Older versions could use one key for everything as you can write the details of the "skeleton key" into the CAS as allowed.

So, there's two ways of doing it, you read a valid key, and make one up as a clone of this, or you have any key, and you program the CAS to accept it.

One key fits all works on old cars, only "dealer" keys work on new models so it is more likely that a mix of methods are used.


http://www.youtube.com/watch?v=dCGGpQUdlo0

There's the same process used on Mercedes, read the allowed keys from the immobiliser, then you can program that into a blank key.

[Riggers]

Guys: new homepage story on this. Take a look when you get a chance

http://www.pistonheads.com/news/default.asp?storyI...

[Billyray911]

t8cmf said:

I believe the Blackjax is connected to your drivers side door switch / interior light circuit. As soon as your door opens the Blackjax timer is activated. The upside is a quick reacting system but the downside is a system that means you can't just nip out of your car whilst leaving it idling as it will activate the Blackjax. The keypad fitted to the dash resets the system. I want one myself but a member of another forum tells me that the Blackjax 5 system will bring up errors on my E92 M3's iDrive system. I can't find anything about this online though nor can I find an E92 M3 with the system fitted.

First off,glad this issue is now getting the attention that it deserves on this site...
I've an E91 335d with Blackjax fitted.Ive had no issues whatsoever with the system or errors on my idrive.I don't think there will be any fundamental differences with our cars that would create issues with yours and not mine-could be wrong though!
All I'll say is get a decent installer to do the job and not a mobile who claims to be able to install it in a couple of hours on your driveway!
I've had no warranty issues either with bmw.It's a great bit of kit when you get used to it.
You are right about just popping out of the car as the system is very pro active and activates quickly.
However,it's worth the effort and may mean you modify how you use your car slightly ie if you have to pop out of your car,just turn the engine off!
Any questions,just ask...

Edited by Billyray911 on Monday 2nd July 15:51

[mrmr96]

Riggers said:

Guys: new homepage story on this. Take a look when you get a chance

http://www.pistonheads.com/news/default.asp?storyI...

Cheers Riggers. Thanks for having the balls to do the story. I think this will gain momentum now, so you've done us all a favour.

(This thread is 14 man sized pages after several weeks, the one on the story is already at 2 man sized pages in a couple of hours!)

[t8cmf]

Billyray911 said:

First off,glad this issue is now getting the attention that it deserves on this site...
I've an E91 335d with Blackjax fitted.Ive had no issues whatsoever with the system or errors on my idrive.I don't think there will be any fundamental differences with our cars that would create issues with yours and not mine-could be wrong though!
All I'll say is get a decent installer to do the job and not a mobile who claims to be able to install it in a couple of hours on your driveway!
I've had no warranty issues either with bmw.It's a great bit of kit when you get used to it.
You are right about just popping out of the car as the system is very pro active and activates quickly.
However,it's worth the effort and may mean you modify how you use your car slightly ie if you have to pop out of your car,just turn the engine off!
Any questions,just ask...

Edited by Billyray911 on Monday 2nd July 15:51

Yeah, I think I will take the plunge when I can get the time off for work and get it fitted. I like the pro-active operation of the system and as you say it will require a slight change in the way the car is used. It's something I can live with.

[Steffan]

mrmr96 said:

Riggers said:

Guys: new homepage story on this. Take a look when you get a chance

http://www.pistonheads.com/news/default.asp?storyI...

Cheers Riggers. Thanks for having the balls to do the story. I think this will gain momentum now, so you've done us all a favour.

(This thread is 14 man sized pages after several weeks, the one on the story is already at 2 man sized pages in a couple of hours!)

Excellent news for all BMW owners. I hope it galvanises some recognition of the problem from BMW.

[smashy]

Just double checking weve all seen this

http://www.youtube.com/watch?v=kVmPfCFFkqQ

[0a]

smashy said:

Just double checking weve all seen this

Bloody hell 8000 EUR and he sells the keys as well.

[NelsonR32]

Riggers said:

Guys: new homepage story on this. Take a look when you get a chance

http://www.pistonheads.com/news/default.asp?storyI...

Hmmm, seems more like an carefully worded apologist news story for BMW to me. The article suggests that other brands are at risk because of encoders on the market and that "this issue is not limited to BMWs".

There is a fundamental difference here; the other manufacturers that use "slot" keys have processes that stop them being recoded to different cars, BMW don't. The problem is not the encondors being available to your local Fred in a Shed, it's the lax systems BMW have put in place to prevent existing keys being coded to other vehicles.

In fact, I would go as far to say that out of the big three (Marc, Audi, BMW) not ONE Merc or Audi that uses a "slot key" has been stolen using this flaw, compared to the twelfthy billion BMW's...