Technology Review

 

Interesting info, and not surprising at all. Thanks for posting it. I personally doubt it will become a huge issue, any more than thefts of mechnically keyed cars. If someone really wants my car bad enough to steal it, go ahead, just don't hurt me or my family. It's only a car.

FWIW, I REALLY like the keyless entry and start, and it has become a requirement for me when I buy cars now. Just like power windows and door locks uesd to be a "who needs it" item, are now requirements. LOL

 

Kind of reminds me of a line Jimmie Doohan spoke in 3rd Star trek movie as he 'fixed' the Excelsior:

(paraphrasing)
"The more the complicate system, the easier it is to 'gum up the works'.

Spoofing exploits aren't isolated to cars - it's a weakness for any 'near-field' wireless device. There are ways of preventing that sort of exploit, but they typically increase costs and complicate the circuitry. The most expedient is an encrypted 'challenge-response' strategy, which can be quite effective if the crypto is strong enough and varies sufficiently. Apparently, the systems hacked didn't have sufficient variability, or had enough of a back door to be susceptible to the hack.

 

Actually, this would be a "man in the middle" exploit, and a challenge-response strategy would not be effective as this exploit is a fully transparent man-in-the-middle. The exploit is not trying to inject, but only trying to relay. The crypto is fully transferred so long as the relay is fast enough, and in this exploit, the crypto is never cracked. This is just a simple range extender between the key and the car.

Alan

 

But wouldn't a secure setup be 'highly resistant' to a MIM exploit, if the 'challenge/response' generated a rotating, 'random' sequence, with frequent variability and a short time-out? That way, by the time the car is unattended again, the 'key phrase' is different.

Or am I missing your point?

 

This makes sense. The proximity detection system works by having the car transmit a 'poll' signal periodically -- several times per second. That poll signal that is transmitted by the car is intentionally weak, so that it travels only a meter or so and doesn't draw much power. The intent is that the key fob only receives the poll when it is within a meter or so. When the fob receives that challenge, it transmits a response that tells the car to unlock. The challenge-response is a cryptographic protocol, so it is supposed to be hard to simulate.

But this approach doesn't need to crack the crypto. By relaying the signal from the car to the distant key fob, the key fob is fooled into thinking that the car is close. Then the legitimate key fob transmits the encrypted authorization response (whatever that is). If the signal from the fob can also be relayed if needed. Then the car is convinced that they fob is near, and allows the door or 'start' button to be operated.

The attack is not a cryptographic attack. It simply copies the encoded signal from the car to the fob, and relays that signal over a longer distance than intended.

This is definitely a serious security problem. The car can be started and driven away while you are shopping or dining, or even at home. The fob never leaves your pocket. The car cannot be re-started later, but they sure could drive it once, perhaps to a chop-shop.

The immediate question is, how to defeat this attack.

One way would be to keep the fob in a "Faraday cage" when it is not being used. If you keep your key fob in a closed metal container, the radio signals cannot get to or from the fob. It cannot receive the challenge signal, and cannot transmit the response signal. That would be a PITA, of course. You would have to open the container every time you wanted to open the car, and close it when you leave the car.

There might be a way to attenuate the signal that is transmitted by the fob. This isn't definite -- just thinking. If the fob is inside a container that is not quite radio-opaque, the signal might be attenuated instead of being blocked entirely. Then it might work at short range, but not reach all the way across the parking lot. The attacker would then have to place a receiver near the fob to forward the reply signal. Placing a receiver near the fob would be more likely to attract attention. It still wouldn't be secure, but it would be less easy to break.

For the next generation, they are going to have to change the proximity detection algorithm, or require the user to poke a button on the key fob. High-resolution time measurement, to measure the actual distance and detect/prevent relay attack might work. Putting GPS receivers in both stations and comparing GPS coordinates inside crypto envelopes, might also work. There may be other approaches.

Basically, depending on the short range of a weak radio signal, is just a bad idea.

 

This is one of those "Possible, but not practical"

To use this exploit:
1. Track and correlate persons to cars.
2. Intercept the car-specific item and relay it to the car.
3. Do so out of the sight line of the driver.

To pull this off would require cooperation of several 'players', as well as command and control infrastructure. Such coordination makes getting caught virtually certain, as it leaves easily detectable 'footprints'. Much more expedient is a simple 'gun in the face' of the driver to get the keys.

 

Huh? The "Practical" part of this attack is very easy. No crypto is needed. The research article describes the apparatus, which can be built for a few hundred bucks, and can be small enough to be carried easily. The LF radio signal from the car is received, amplified, and then retransmitted. The transmitter may be up to 8 meters from the key fob. When the key fob detects the signal, it transmits the UHF response to unlock the car. The entire attack could be completed in just a few minutes during the night. The thieves might have to carry the transmitter around the perimeter of your house to find a place within a few meters of the fob.

I do agree that conducting this attack in a public place, such as a restaurant or shopping mall, would be more difficult. The article describes a scenario in a multi-level parking garage, though.

I think I'm going to start keeping my keys in a metal box at night. A closed metal box forms a Faraday cage, and stops all radio signals.

 

Why not just turn off the SKS system when you are not using it.

JeffD

 

And how does a person disable the SmartKey System?