Cars with ‘keyless’ entry easy to crack
Keyless-type car locks are convenient. They’re also not that secure, according to a new study. Richard Bosselman reports.
Potential for vehicles with keyless entry and start becoming easy marks for break-in speaks less about the quality of the autos’ security and more to the tech thieves can lay hands on.
This conclusion arises in the wake of an investigation whose findings have been delivered in the United Kingdom, where vehicle theft from using smart electronics to overcome their locking and starting protections is on the rise.
The just-released report highlighting the issue there has sent ripples around the industry; not least because of the high count of vehicles that gave in a practice known as ‘‘relay attacks’’ – all but three out of 237 passenger models in a just-conducted experiment.
The organisation representing new vehicle distributors in New Zealand is nonetheless taking this shocking outcome calmly, saying it has never known of these electronic defeat devices being used here.
David Crawford, chief executive officer of the Motor Industry Association, says this level of activity is more a speciality of organised crime, often intent of shipping vehicles out of the country (with Eastern Europe and Africa being favoured destinations for cars stolen from the UK) than run-of-the-mill car thieves.
He also believes the industry has the strength to stay one step ahead of miscreants were they to use these methods.
The MIA was keen to engage with Government if this did become a national issue and he admits, also, that it is not clear if the devices that defeat vehicle electronics by cloning the complex series of radio signals that match the key and car are even illegal.
‘‘We have not heard of it occurring here. I’m aware of it being happening in countries where there is a lot of organised crime, but I have not seen or heard of it in New Zealand.
‘‘What I do know is that security of vehicles is something manufacturers take quite seriously and while staying ahead of organised crime is obviously a bit of a task, vehicles are generally a hell of a lot safer and secure than what they were.’’
The investigation had experts put their kit and skills against keyless car systems of a wide selection of models, many likely to also be available in New Zealand.
They found only three passenger vehicles with keyless entry and go systems were wholly invulnerable, whereas 230 were relatively easily susceptible to being unlocked and fired up without having the actual key. A further four could be either unlocked or started.
The three models that withstood all attempts were Jaguar Land Rover vehicles – the Jaguar I-Pace electric car and latest versions of the Land Rover Discovery and Range Rover.
The threat of relay theft attacks is on the rise in the UK, and some are saying this report outwardly exposes the known vulnerabilities in the signals transmitted by wireless keys, which are typically sending a weak signal for their respective cars to recognise.
However, others suggest the testing does not necessarily suggest the automotive tech is easily breached.
They say it simply reminds that systems can be overcome when thieves have access to highly sophisticated electronic scanners that zero in on, then mimic, the signals that the bone fide key delivers to the host vehicle.
The UK study, disturbingly, says devices that scan for and then amplify these signals to convince the car the key is nearby, gain access and drive off with the vehicle are easily obtainable in Britain.
Whether that is yet the case in New Zealand is not clear. Even if the outright retail sale of such equipment is prohibited, yet that perhaps does not exclude potential for such items being illicitly imported as mail order, most likely from China.
The research not being considered by British audiences was conducted by the German General Automobile Club (ADAC) and analysed by a UK consumer publication, Which?
It found four out of the top five best-selling cars in the UK – the Ford Fiesta, VW Golf, Nissan Qashqai and Ford Focus – were vulnerable.
The ADAC advises concerned owners that wrapping keyless keys in tinfoil is no guarantee the signals will be blocked from potential thieves’ equipment, as even the smallest gap in the foil could allow signals to escape. Instead, the ADAC advises owners to find out either in their manual, or from their dealer, if the keyless system can be deactivated.
BMW and Mercedes are already on the counter-attack; they have added motion sensors to their wireless key fobs, so only generate signals when the key is moving, meaning thieves shouldn’t be able to clone the keys’ signal when they are sitting dormant at home.
Car trackers, hidden devices that send out a GPS signal, have also proven invaluable in locating stolen vehicles, though more than 50 per cent of keyless models stolen in the UK are never relocated.
Calling car theft ‘‘an ongoing battle’’, an industry expert in Britain explained that ‘‘manufacturers continue to invest billions in ever more sophisticated security features’’, but that ‘‘technology can only do so much’’.
The UK car industry is calling for Government action to ‘‘stop the open sale of equipment with no legal purpose that helps criminals steal cars’’.