Thieves using a $17 power amplifier to break into cars with remote keyless systems

[///M Power-Belgium]

Originally Posted by BNBM3

Again, get a hidden GPS locator and don't leave anything expensive in your car.

Agreed with you, I have this and yearly I need to pay for it => http://www.securitas.com/be/nl-be/Pa...Track--Trace-/
But even with this..and like I mentioned above , I never park my car where I don't see it !

[nthretourNAFTW]

Originally Posted by Tracyis300

If you have the DCT, it won't allow you to put it in drive, until the key is present

Wrong assumption.
..The car is spoofed to thinks a key is inside the car when the thief steps in with his RF Repeater.
The car has windows it is not a perfect faraday cage.
And even if the FOB RF signal cannot be picked up by the theft device from inside the car, I can already think of two ways to still get it to work (knowing RF radios).
..And a third one.. they now have access to OBD and can reprogram a key in less than a minute.

6MT FTW

[Tracyis300]

Originally Posted by nthretourNAFTW

Wrong assumption.
..The car is spoofed to thinks a key is inside the car when the thief steps in with his RF Repeater.
The car has windows it is not a perfect faraday cage.
And even if the FOB RF signal cannot be picked up by the theft device from inside the car, I can already think of two ways to still get it to work (knowing RF radios).
..And a third one.. they now have access to OBD and can reprogram a key in less than a minute.

6MT FTW

Damn! You sound like you've done this before?
But yeah, i miss driving a MT some times.

[whats77inaname]

Mmmmmmmmmm....how about the low tech fix of pulling the battery out of the remote.

[jdamore]

Originally Posted by whats77inaname

Mmmmmmmmmm....how about the low tech fix of pulling the battery out of the remote.

Not a bad idea lol. How about a "security switch" (battery disconnect)?

[whats77inaname]

Originally Posted by jdamore

Not a bad idea lol. How about a "security switch" (battery disconnect)?

Hmmmmmmmmmm....

[SenorFunkyPants]

Originally Posted by nthretourNAFTW

..And a third one.. they now have access to OBD and can reprogram a key in less than a minute.

There is a BMW software security update you can get (at least in the UK) that disables the facility to program a new blank key from the OBD port unless there is an existing key present.

[nthretourNAFTW]

Originally Posted by SenorFunkyPants

There is a BMW software security update you can get (at least in the UK) that disables the facility to program a new blank key from the OBD port unless there is an existing key present.

My understanding is that it's limited to the UK. No car in the usa has that software upgrade. The motion sensor has a blind spot with right side drive cars making it possible for thieves to break a window and connect to the OBD without triggering the alarm. That update is not available anywhere else in the world. Besides.. it's no longer sufficient.

This new RF repeater device can give door access to any bmw by relaying the FOB signal inside a house, as with any RF system it can be easily fitted with a handheld antenna to work from inside the car too, fooling the car to believe there is an existing key present. They wouldn't even need to program a blank key. uk, usa, 6mt, dct does not matter.

What I do is store both FOBs at home in a candy cylindrical metal box with a tight lid (faraday cage).

[SenorFunkyPants]

The other part of the (UK) security update was to disable the facility to drop the windows by using the key in the drivers door lock - turns out a screw driver jammed into the lock worked just the same.
I used to quite like the comfort access that my wife has for her car...now it seems the old style (non comfort access) car key I have is the way to go.

[1MOREMOD]

How about store your car in a garage that locks?

[tdott]

Originally Posted by nthretourNAFTW

What I do is store both FOBs at home in a candy cylindrical metal box with a tight lid (faraday cage).

Would a drawer in a metal filing cabinet work as well?

Originally Posted by 1MOREMOD

How about store your car in a garage that locks?

Agreed, but I guess it's still possible to when you park your car at work or anywhere else that you are within enough distance for the RF repeater to pick up your key and fool the car into thinking it's there.

[1MOREMOD]

Park further away, this stuff could happen but will it and why worry so?

[jdamore]

Guys stop believing this crap.

Is it possible sure...

First off, to amplify (or repeat) a beacon from a fob that is far out of its range (what.. 8-10ft?), above the noise floor of every other frequency transmitting or emitting device, and the car clearly receiving is so far fetched, its HIGHLY unlikely it would work. The analogy would be like trying to listen to a person talking in a room full of people talking... turn up your hearing-aid and you hear the same thing, just louder. You would have to be in the middle of NOWHERE with a extremely low noise floor to have a chance of this working.

Second, there is no way 17$ can buy the equipment to do this.
IF you were to find equipment that can pin-point the EXACT frequency, it would be so expensive that the user could buckle down, pull his shit together, buy some nice clothes, go to a job interview, get a job, and make decent money because if you are smart enough to do that, you're smart enough for a decent job.

Third, stop putting your keys in the freezer like a retard. That is terrible for the electronics. The remote being cold instantly starts to build condensation when you pull it out.

The only real method is "brut force". The problem is the amount of time it could take.. or it could take just a second.

Rest easy.. You have a better chance of spinning a bearing


BONUS: To extend the range of your remote, putting it under your chin really works!! Try it!

[whats77inaname]

Originally Posted by nthretourNAFTW

The motion sensor has a blind spot with right side drive cars making it possible for thieves to break a window and connect to the OBD without triggering the alarm.

Easily remedied by:
a) adding a second motion sensor near that location www.e90post.com/forums/showthread.php?t=117196 for around $54,
b) adding a shock sensor (or 2) close to the locations that will pick up the force necessary to break the glass http://www.e90post.com/forums/showthread.php?t=45815 for $11/sensor, or
c) both.

Neither are difficult to do. I speak from experience.

[Groundpilot]

Originally Posted by Tracyis300

If you have the DCT, it won't allow you to put it in drive, until the key is present

Another reason to forget about MT

[whats77inaname]

Originally Posted by Groundpilot

Another reason to forget about MT

Except for if your battery dies and you need to pop the clutch

[Haywood]

Originally Posted by jdamore

Guys stop believing this crap.

Is it possible sure...

First off, to amplify (or repeat) a beacon from a fob that is far out of its range (what.. 8-10ft?), above the noise floor of every other frequency transmitting or emitting device, and the car clearly receiving is so far fetched, its HIGHLY unlikely it would work. The analogy would be like trying to listen to a person talking in a room full of people talking... turn up your hearing-aid and you hear the same thing, just louder. You would have to be in the middle of NOWHERE with a extremely low noise floor to have a chance of this working.

Second, there is no way 17$ can buy the equipment to do this.
IF you were to find equipment that can pin-point the EXACT frequency, it would be so expensive that the user could buckle down, pull his shit together, buy some nice clothes, go to a job interview, get a job, and make decent money because if you are smart enough to do that, you're smart enough for a decent job.

Third, stop putting your keys in the freezer like a retard. That is terrible for the electronics. The remote being cold instantly starts to build condensation when you pull it out.

The only real method is "brut force". The problem is the amount of time it could take.. or it could take just a second.

Rest easy.. You have a better chance of spinning a bearing


BONUS: To extend the range of your remote, putting it under your chin really works!! Try it!

The chances of this happening to you is pretty remote. However, it is possible and if you think it doesn't work, you're fooling yourself. I'm in cyber security and you have to know that if hackers want to get something, they will figure out a way. Technology today is designed for convenience and security is either not thought of or it's an afterthought. I won't change what I'm doing since I also have a locked garage. But, don't be surprise if these tools get better.

[nthretourNAFTW]

Originally Posted by tdott

Would a drawer in a metal filing cabinet work as well?

Yes that would completely block any transmission path.

[jdamore]

Originally Posted by Haywood

The chances of this happening to you is pretty remote. However, it is possible and if you think it doesn't work, you're fooling yourself. I'm in cyber security and you have to know that if hackers want to get something, they will figure out a way. Technology today is designed for convenience and security is either not thought of or it's an afterthought. I won't change what I'm doing since I also have a locked garage. But, don't be surprise if these tools get better.

No pun intended?

My point is more on the physical side of amplifying a signal that is lower than the ambient noise, is just not possible.

Ever use a wifi repeater? The repeater must be in range if the wifi router. Same concept. If I put the key fob on the ground about 10 ft away, I cannot open the door. That tells me the range of the comfort access beacon is only about 10 ft, no? Through a wall, it would be even shorter.

It's not about cracking an encryption which, I agree, can and will always be broken. It's that the repeater must be located within ear shot of the fob which is very short.

If you wanted to start the car, you would have to record the signal and play it back while inside the car. Maybe the thief stands next to his victims, records his signal, and follows him home.

[nthretourNAFTW]

Originally Posted by jdamore

Guys stop believing this crap.

Nope, you make your own crap.

I can warrant that this is not as difficult a technological feat as you depicted, even with a modest budget. Don't use RF generalizations to make blanket statement about feasibility. One has to look exactly at the application: ISM band, very low transmission data rates (RKE, FOB), frequency hopping spread spectrum. Spread-spectrum transmissions can share a frequency band with many types of conventional transmissions with minimal interference. Furthermore FCC part 15 for ISM band permits a thousand times increased power than non-spread-spectrum systems. The data a FOB needs to transmit is very short (very low duty cycle).
An RF repeater system can use a RF wideband ADC for digitization (sampling) in its receiver. no need to demodulate the down mixed data just recording it in one arbitrary channel from the target band. It doesn't need to know the hopping frequency sequence. Eventually the FOB will hit that channel. While recording the repeater could be closer to dwellings where the FOB is presumed to be. Not nearby the car. It's only brought near the car after it has recorded sufficient data. It could then be switched to transmit mode and would use the recorded minutes long sample that could have been recorded over different locations. Memory is cheap and very light weight and RF ADC's are faster, lower noise floor, lower distortion higher performance than ever.
The FOB does not use RX when outside the car only TX, there is no handshaking..

This is real. Better safe than sorry. Protect your key FOB inside any closed metallic container when you are parked outside.

[1MOREMOD]

Oh brother

[burtonsbs5114]

If someone wants to steal your car, they are going to steal your car. Yes, putting your keys in a metal container is a easy and simple way to protect against this, regardless how feasible the transmission actually is.

If you are concerned, then put your keys in a metal box, if not, carry on with you life.