Keyless Entry Systems - how vulnerable are they?
Keyless Entry Systems - how vulnerable are they?
Author
Discussion

HuntsmanPH

Original Poster:

82 posts

238 months

Friday 2nd March 2012
quotequote all
Very excited to be starting my first-ever PH thread! I'm hoping to tap into the massed brainpower and experience of the PH collective...

A client has just raised some concerns about an article he read in the Sunday Times saying that car thieves are using a signal booster to amplify the radio signals used in keyless entry and starting systems. This apparently allows them to unlock and start the car from a much greater distance than the normal keycard would. A typical scenario: The driver parks up and is shadowed by one bad guy carrying the booster. Once they're far enough away, his accomplice jumps into the car, presses the start button and drives off. The cars won't start again once they're out of range, but are designed not to cut out whilst being driven so they can be taken to a lockup/breakers yard/whatever where they can be stripped down.

I hadn't heard of this before but thought somebody out there might have come across it. Any thoughts or suggestions as to how to minimise the risk? My client is particularly worried about insurance implications as a car can be stolen or broken into without any proof of damage or forced entry, giving considerable room for debate...

Somnophore

1,364 posts

199 months

Friday 2nd March 2012
quotequote all
I have a high end scanner that would probably pick up the frequency of the key so assuming I had the correct radio transmitter it's possible. Quite high end equipment though.

Somnophore

1,364 posts

199 months

Friday 2nd March 2012
quotequote all
Sorry I've just re read what you wrote, hmm, sounds possible, but I'm not aware of a commercial device that can scan for frequency and then transmit a signal simmultaneously.

fozzymandeus

1,087 posts

169 months

Friday 2nd March 2012
quotequote all
The code sent to a car to unlock it will be encrypted, so snooping one code would only give that code, which wouldnt unlock a car/start the engine once it had been used to do the same.

You'd need to snoop the code and then decrypt it, which is only as hard as the encryption algorithm that has been used to do it.

I don't know whether or not you'd be able to figure out that a car had been unlocked/started without the use of a legit key by interrogating the keys and the ignition control ECU, that would depend on what information they store after the event.