{"id":14964,"date":"2017-11-28T08:58:25","date_gmt":"2017-11-28T15:58:25","guid":{"rendered":"http:\/\/blog.cucollector.com\/?p=14964"},"modified":"2023-06-12T04:26:33","modified_gmt":"2023-06-12T04:26:33","slug":"11-gadget-can-relay-hack-a-car","status":"publish","type":"post","link":"https:\/\/curepossession.com\/11-gadget-can-relay-hack-a-car\/","title":{"rendered":"$11 Gadget Can Relay Hack a Car"},"content":{"rendered":"<p><span style=\"margin: 0px; color: black; line-height: 150%; font-family: 'Verdana',sans-serif; font-size: 10pt;\">For years, automakers <\/span><span style=\"margin: 0px; color: black; line-height: 150%; font-family: 'Verdana',sans-serif; font-size: 10pt;\">and hackers have known about a clever attack that spoofs the signal from a wireless car key fob to open a vehicle&#8217;s doors, and even drive it away. But even after repeated demonstrations\u2014and <a href=\"https:\/\/www.nytimes.com\/2015\/04\/16\/style\/keeping-your-car-safe-from-electronic-thieves.html\" target=\"_blank\" rel=\"noopener\">real thefts<\/a>\u2014the technique still works on a number of models. Now a team of Chinese researchers has not only demonstrated the attack again but also made it cheaper and easier than ever.<\/span><\/p>\n<p>A group of researchers at the Beijing-based security firm Qihoo 360 recently pulled off the so-called relay hack with a pair of gadgets they built for just $22. That\u2019s far cheaper than previous versions of the key-spoofing hardware. The Qihoo researchers, who recently showed their results at Amsterdam\u2019s Hack in the Box conference, say their upgrade also significantly multiplies the radio attack\u2019s range, allowing them to steal cars parked more than a thousand feet away from the owner\u2019s key fob.<\/p>\n<p>The attack essentially tricks both the car and real key into thinking they\u2019re in close proximity. One hacker holds a device a few feet from the victim\u2019s key, while a thief holds the other near the target car. The device near the car spoofs a signal from the key. That elicits a radio signal from the car\u2019s keyless entry system, which seeks a certain signal back from the key before it will open. Rather than try to crack that radio code, the hacker\u2019s devices instead copy it, then transmit it via radio from one of the hackers\u2019 devices to the other, and then to the key. Then they immediately transmit the key\u2019s response back along the chain, effectively telling the car that the key is in the driver\u2019s hand.<\/p>\n<p><iframe loading=\"lazy\" title=\"YouTube video player\" src=\"https:\/\/www.youtube.com\/embed\/bXfp8F4J2eI\" width=\"560\" height=\"315\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>\u201cThe attack uses the two devices to extend the effective range of the key fob,\u201d says Jun Li, one of the researchers in the Qihoo group, who call themselves Team Unicorn. \u201cYou\u2019re working in your office or shopping in the supermarket, and your car is parked outside. Someone slips near you and then someone else can open up and drive your car. It\u2019s simple.\u201d<\/p>\n<figure id=\"attachment_14961\" class=\"wp-caption alignleft\" aria-describedby=\"caption-attachment-14961\"><a href=\"https:\/\/blog.cucollector.com\/hot-topics\/11592-2\/11-gadget-can-relay-hack-a-car\/uncorn\/#main\" rel=\"attachment wp-att-14961\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-14961 size-medium\" src=\"https:\/\/blog.cucollector.com\/wp-content\/uploads\/2017\/11\/uncorn-300x225.jpg\" sizes=\"(max-width: 300px) 100vw, 300px\" srcset=\"https:\/\/blog.cucollector.com\/wp-content\/uploads\/2017\/11\/uncorn-300x225.jpg 300w, https:\/\/blog.cucollector.com\/wp-content\/uploads\/2017\/11\/uncorn.jpg 729w\" alt=\"$11 Gadget Can Relay Hack a Car\" width=\"300\" height=\"225\" \/><\/a><figcaption id=\"caption-attachment-14961\" class=\"wp-caption-text\">HackKey<\/figcaption><\/figure>\n<p><b>Speaking the Language<\/b><\/p>\n<p>That relay attack on keyless entry systems dates back to at least 2011, when Swiss researchers pulled it off with multi-thousand-dollar software-defined radios. Last year, researchers at the German car-owners group the\u00a0<a href=\"https:\/\/www.wired.com\/2016\/03\/study-finds-24-car-models-open-unlocking-ignition-hack\/\">ADAC showed they could achieve<\/a>\u00a0the same results with what they described at the time as just $225 in equipment. They also found that it still worked on 24 different vehicles. Given the broad scope of the problem and the rarity of software or hardware automotive security fixes, many of the cars and trucks on their list\u2014sold by companies ranging from Audi to BMW to Ford to Volkswagen\u2014likely remain vulnerable to the attack.<\/p>\n<p>But Team Unicorn has taken radio relay theft a step further. Instead of merely copying the raw radio signal and sending it whole, they built their own custom devices that include chips to demodulate the signal, unpacking it into ones and zeros. That reverse engineering, they say, means they can send the decomposed signal bit by bit at a much lower frequency, which allows longer range signals\u20141,000 feet compared with 300 feet in the ADAC tests\u2014while using less energy. The hardware also comes much cheaper. In total, the Beijing-based researchers say they spent about 150 Chinese yuan on chips, transmitters, antennas, and batteries for both devices. That\u2019s about $11 each.<\/p>\n<p>It\u2019s particularly impressive that the team reverse-engineered the signal, says Samy Kamkar, a well-known independent security researcher who has himself developed his own keyless entry hacks. \u201cThe original attacks took a tape recorder and hit record, and then played it back,\u201d says Kamkar. \u201cThese guys understand the language: It\u2019s like they write down the words and speak it on the other end.\u201d That distinction could lead to more research into vulnerabilities in the protocol.<\/p>\n<h3>Cheap and Easy<\/h3>\n<p>In their tests, the Qihoo researchers say they were able to remotely open the doors and drive off with two vehicles: A Qing gas-electric hybrid sedan from the Chinese automaker BYD and a Chevrolet Captiva SUV. But the researchers emphasized that the problem reaches further than the two vehicles they tested. They point instead to NXP, the Dutch chipmaker that builds the keyless entry system used in the Qing, Captiva and dozens of other vehicles. They also emphasized that NXP likely isn\u2019t alone in leaving vehicles vulnerable to the attack.<\/p>\n<p>\u201cThe industry is aware that the complexity and cost associated with mounting a relay attack has dropped over recent years,\u201d says NXP spokesperson Birgit Ahlborn. \u201cCarmakers and car access system integrators are introducing solutions that counter these attacks.\u201d But the company referred any questions about existing vulnerabilities in specific cars to the carmakers themselves. Neither BYD nor Chevrolet has yet responded to WIRED\u2019s request for comment.<\/p>\n<p>Qihoo\u2019s researchers suggest that carmakers and component companies like NXP could prevent the relay attack by requiring tighter timing constraints in the call-and-response communications between key and car. Relay the signal from too far, and those limits could prevent the fraudulent transmission from being accepted.<\/p>\n<p>The other method to foil the attack falls to the car owner: Keep your keys in a Faraday bag that blocks radio transmissions\u2014or, in a pinch, in a\u00a0<a href=\"https:\/\/www.wired.com\/2016\/03\/study-finds-24-car-models-open-unlocking-ignition-hack\/\">metal box, like a fridge, that performs the same function<\/a>. Storing your keys in the equivalent of a tin-foil hat may sound paranoid. But if the Chinese researchers\u2019 work is any indication, attacks on automotive keyless entry systems may get significantly easier\u2014and more common\u2014before they get fixed.<\/p>\n<p>Source:\u00a0<a href=\"https:\/\/www.wired.com\/2017\/04\/just-pair-11-radio-gadgets-can-steal-car\/\">Wired<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2><\/h2>\n<h2><span style=\"color: #ffffff;\">$11 Gadget Can Relay Hack a Car &#8211; <a style=\"color: #ffffff;\" href=\"https:\/\/blog.cucollector.com\/hot-topics\/11592-2\/fraud\" target=\"_blank\" rel=\"noopener\">Fraud<\/a> &#8211;\u00a0<a style=\"color: #ffffff;\" href=\"https:\/\/blog.cucollector.com\/?s=repossess\">Repossession &#8211;\u00a0<\/a><a style=\"color: #ffffff;\" href=\"https:\/\/curepossession.com\/?s=repossess\">Repossess<\/a> \u2013 <\/span><a href=\"https:\/\/curepossession.com\/?s=Repossession\"><span style=\"color: #ffffff;\">Repossession<\/span><\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"<p>For years, automakers and hackers have known about a clever attack that spoofs the signal&#8230;<\/p>\n","protected":false},"author":1,"featured_media":14961,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[311,636,637,638,218,639,323,215,216,640,641,6,8,9,10,7,11,57,109],"class_list":["post-14964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-auto-theft","tag-fob","tag-fobs","tag-hackkey","tag-key-codes","tag-key-fobs","tag-keys","tag-locksmith","tag-locksmithing","tag-relay","tag-relay-attack","tag-repo","tag-repo-agency","tag-repo-agent","tag-repo-man","tag-repossession","tag-repossessor","tag-technology","tag-theft"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/posts\/14964"}],"collection":[{"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/comments?post=14964"}],"version-history":[{"count":2,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/posts\/14964\/revisions"}],"predecessor-version":[{"id":26798,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/posts\/14964\/revisions\/26798"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/media\/14961"}],"wp:attachment":[{"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/media?parent=14964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/categories?post=14964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/curepossession.com\/wp-json\/wp\/v2\/tags?post=14964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}