Car Key Codes Cracked

Laminge · 31-01-2005, 04:14 PM

Quote:

Car key code cracked
Brian Witte in Baltimore
JANUARY 31, 2005

RESEARCHERS have found a way to crack the code used in millions of car keys, a development that could allow thieves to bypass the security systems on newer car models.

The research team at Johns Hopkins University said it discovered that the "immobiliser" security system developed by Texas Instruments could be cracked using a "relatively inexpensive electronic device" that acquires information hidden in the microchips that make the system work.
The radio-frequency security system being used in more than 150 million new Fords, Toyotas and Nissans involves a transponder chip embedded in the key and a reader inside the car. If the reader does not recognise the transponder, the car will not start, even if the key inserted in the ignition is the correct one.

It's similar to the new petrol purchase system being used in the US in which a reader inside the pump is able to recognise a small key-chain tag when the tag is waved in front of it. The transaction is then charged to the tag owner's credit card.

Researchers said they were also able to crack the petrol tag code.

"We stole our own car, and we bought gas stealing from our own credit card," said Avi Rubin, a professor of computer science at Johns Hopkins who led the research team.

Texas Instruments was recently given demonstrations of the team's code cracking capabilities, but the company maintains its system is secure.

The hardware used to crack the codes is cumbersome, expensive and not practical for common thieves, Texas Instruments business manager Tony Sabetti said.

"I think the way in which it's presented as being inexpensive to do and quick and all the rest of that is an exaggeration," Mr Sabetti said. "And because of that, we believe the technology still is extremely secure for the applications that it's used in."

But Professor Rubin said the code-breaking demonstrations illustrated that developers did not pay enough attention to security.

"I think the implications are that it sets us back about 10 years ago where we were with car security," Mr Rubin said.

In the seven years the technology has been in use, Texas Instruments has never had a reported incident where a car has been stolen or a gasoline-purchasing tag has been duplicated, company spokesman Bill Allen said.

The Johns Hopkins team, which was funded by RSA Security, recommended distributing free metallic sheaths to cover the radio frequency devices when they are not being used.

The Associated Press

Obviously in the states, but how long before it hits here?

XA-Coupe · 31-01-2005, 04:17 PM

I would reckon it would already be here. Like most things ... once someone figures it can be done ... a billion copy cats move in.

EA2BA · 31-01-2005, 04:22 PM

Quote:

The Johns Hopkins team, which was funded by RSA Security, recommended distributing free metallic sheaths to cover the radio frequency devices when they are not being used.

So you lock your car, go to the shops, get followed, your code grabbed, and no car when you go back to where it was, difficult or not, scary stuff.

rag top · 31-01-2005, 04:29 PM

It's always the same. As soon as new technology is released, there are those out there who try to overcome it, and seem to succeed... Sad but true.

RED_EL_XR8 · 31-01-2005, 04:38 PM

There is no code system that cannot be cracked, and its always going to be a battle to stay 1 step ahead. Reading the article I dont see any widespread outbreak of code cracking, just that it has been proven possible.

The improvement we have seen with with smart-lock and smart-shield have been huge, they are not impossible to beat, but are just too difficult for all but the most determined.

If researchers are cracking codes it usually means, developments will be soon made to close another loop-hole. The article mentions researchers rather than real world instances.

i'd still recommend additional third party immobilisation devices, to supplement any factory system. You will never make anything totally secure without at least a moat & crocodiles. The secret is to make your car, home etc more difficult than the majority so theives try somewhere else.

Working with weigand cards etc you soon realise the gaping holes in security are the people elements rather than the system technology. Whats the point of tibbe locks etc when car key are left in the ignition in the kitchen, on a kitchen key-tel all weekend, or on an office desktop for an entire day. As for RF security you only have to look at Wi-Fi to see rarely the available security is actually utilised.

Either way it is an interesting article.

Casper · 31-01-2005, 04:42 PM

Quote:

The hardware used to crack the codes is cumbersome, expensive and not practical for common thieves, Texas Instruments business manager Tony Sabetti said.

Yeah, so were calculators, computers and clocks. Not to mention mobile phones. Somehow I doubt it would take long to shrink to the size of a pack of smokes or mobile phone.

3Toed · 31-01-2005, 07:54 PM

Quote:

Originally Posted by Casper

Yeah, so were calculators, computers and clocks. Not to mention mobile phones. Somehow I doubt it would take long to shrink to the size of a pack of smokes or mobile phone.

Not only that, but for a car theiving ring that could steal 100's of cars to order, it's a small investment to make. Sure it might be cumbersome and expensive for Joe Blow on the street but not for an organised ring.

/me hopes the layer of filth on the Slothmobile™ will act as a thief deterrent!

Racecraft · 31-01-2005, 04:45 PM

most of the good quality diagnostic equipement (ie Snap On) can already to do it.. Our mechanic only needs to plug in his briefcase of goodies and within 3 minutes he has already 'cut' us a new key... I dont know the ins and out of the proceedure nor would I post it if I did, but it is a very fast process....

RED_EL_XR8 · 31-01-2005, 04:56 PM

Quote:

Originally Posted by Racecraft

most of the good quality diagnostic equipement (ie Snap On) can already to do it.. Our mechanic only needs to plug in his briefcase of goodies and within 3 minutes he has already 'cut' us a new key... I dont know the ins and out of the proceedure nor would I post it if I did, but it is a very fast process....

I was under the impression smart-shield was difficult but not impossible to re-key without an existing key. (I could be wrong...)

The thing is we hand over keys at all sorts of places , valet parking, tyre shops, lots more places than the Ford dealer. Quick question here, who has ever recoded their keyfob (as shown in the handbook) after other have had access to the car? Have access to the car and a key and your pretty much set to create a clone.

BlueRaven · 31-01-2005, 05:38 PM

Quote:

Originally Posted by Racecraft

most of the good quality diagnostic equipement (ie Snap On) can already to do it.. Our mechanic only needs to plug in his briefcase of goodies and within 3 minutes he has already 'cut' us a new key... I dont know the ins and out of the proceedure nor would I post it if I did, but it is a very fast process....

This is more what I thought would come of it. Sure, the equipment they used was comberson, however shrink it a bit, add a nice plastic package, a set of easy to follow instructions and bam! Its that easy!

Plus they could even sell it on the internet if it was called something like "key backup software - incase you loose your keys and need to make a new set!" (going on that dvd/cd backup software)... that way it isnt illegal to sell the tools :

:

Sourbastard · 31-01-2005, 05:25 PM

id be more worried about being carjacked then i would about having my code stolen. At the end of the day, john Q thief finds it easier to stick a 45 in your face at the traffic lights then build his own data capture device.

RED_EL_XR8 · 31-01-2005, 05:29 PM

Quote:

Originally Posted by sourbastard

id be more worried about being carjacked then i would about having my code stolen. At the end of the day, john Q thief finds it easier to stick a 45 in your face at the traffic lights then build his own data capture device.

There are a few electronic surprises for John Q Thief once he and the pistol are out of earshot. :Up_to_som

XRQTOR · 31-01-2005, 05:33 PM

It's here, a local HSV dealer had a huge amount of cars being knocked off from their yard and new owners houses within month's of buying them. 1st time round the window tinting company was copying keys, then two young blokes that worked at the dealer were busted selling Programed keypad's & cut key's. Funny part is the cops couldn't explain how they were going missing, looked sus when both these blokes come to work the next week one with broken hands the other with a broken leg. They got greedy and ripped a bloke off they shouldn't have

Not sure how good the ford system is but iv'e only heard of a few Ba's walking and all 3 were taken with key's. HSV's on the other hand walk all the time.

paul7v7 · 31-01-2005, 07:52 PM

i have heard of this before. however no matter what there is in the market there is someone already trying ot by pass it. nothing will stop car theives. if they really want your car they will get it. even if they have to resort to a tow truck.

BlueRaven · 31-01-2005, 08:48 PM

Quote:

Originally Posted by paul7v7

i have heard of this before. however no matter what there is in the market there is someone already trying ot by pass it. nothing will stop car theives. if they really want your car they will get it. even if they have to resort to a tow truck.

This is true... the better the car, the more desperate they will get. I've heard of thieves following cars to traffic lights and hijacking cars that way...

XRQTOR · 31-01-2005, 09:02 PM

Quote:

Originally Posted by BlueRaven

This is true... the better the car, the more desperate they will get. I've heard of thieves following cars to traffic lights and hijacking cars that way...

Doesn't happen really often, when it does the driver will mostly know the theif. Most wait till the car is home and the owner is asleep then walk in grab the keys and bye bye. The only real deterent is Quick trac (i know their broke), or the alternative system. Needs lots of time to disable, unit is mounted in 3 locatins in the car.

RED_EL_XR8 · 31-01-2005, 09:12 PM

Quote:

Originally Posted by XRQTOR

Doesn't happen really often, when it does the driver will mostly know the theif. Most wait till the car is home and the owner is asleep then walk in grab the keys and bye bye. The only real deterent is Quick trac (i know their broke), or the alternative system. Needs lots of time to disable, unit is mounted in 3 locatins in the car.

Quick Trac has lots of limitations, but there are better alternatives, especially if your prepared to pay the up front costs.

: Tracking will not be a deterent but it will greatly increase the chances of recovery and capture/conviction. there is lots more subtle things you can do than kill an engine which is frowned upon by police unless under their instruction.

:

XRQTOR · 31-01-2005, 09:24 PM

Quote:

Originally Posted by RED_EL_XR8

Quick Trac has lots of limitations, but there are better alternatives, especially if your prepared to pay the up front costs.

: Tracking will not be a deterent but it will greatly increase the chances of recovery and capture/conviction. there is lots more subtle things you can do than kill an engine which is frowned upon by police unless under their instruction.

:

If a theif knows a car has a tracking device ie quicktrac they wont touch it. If they are capable of stealing the car they'll move on to a easier target why risk it. Limitation's, most of what you hear s rubbish like putting them in container's. Enlighten me to a better alternative, Pm if you like i would like to know.

Racecraft · 31-01-2005, 08:19 PM

To put it in perspective the tool my mechanic uses is hand held, about 1 and 1/2 times the size of an EFTPOS pin pad, it all folds neatly into a standard size briefcase and is alittle under $12000 complete with all the pin adapters for about 25 cars....
All he needs is access to the terminal inside the car which even when locked takes the whole of about 15 seconds to access.
Now 12k is not much money when knocking off one car worth 50 grand is it?

The best deterent we have in Australia is the database of VIN and engine numbers.. It makes selling 'hot' cars and parts so much harder.. The problem lies with your modifications. Engrave everything and register them at your local police station, in QLd anyhow they even loan you the engraving tool...
Like Paul7v7 said there is really nothing you can do to stop a thief if he really wants something but aleast if you register and engrave everything should it ever turn up the police notify you

b2tf · 31-01-2005, 08:40 PM

Yes but you cant crack a tyre iron can you?

The tyre iron does the cracking!

XRQTOR · 31-01-2005, 09:07 PM

Quote:

Originally Posted by Racecraft

To put it in perspective the tool my mechanic uses is hand held, about 1 and 1/2 times the size of an EFTPOS pin pad, it all folds neatly into a standard size briefcase and is alittle under $12000 complete with all the pin adapters for about 25 cars....
All he needs is access to the terminal inside the car which even when locked takes the whole of about 15 seconds to access.
Now 12k is not much money when knocking off one car worth 50 grand is it?

The best deterent we have in Australia is the database of VIN and engine numbers.. It makes selling 'hot' cars and parts so much harder.. The problem lies with your modifications. Engrave everything and register them at your local police station, in QLd anyhow they even loan you the engraving tool...
Like Paul7v7 said there is really nothing you can do to stop a thief if he really wants something but aleast if you register and engrave everything should it ever turn up the police notify you

And how many cars dont have a factory alarm where if a window is popped or a door opened (When locked) an alarm of sorts is activated, oh how easy it is for them to access a car. Heard of a similar setup used to steal subaru's, althought the unit was worth about $5ok. If there is a market for it & money to be made people will develope ways around thing's.

Smoked · 31-01-2005, 09:06 PM

I like to have a physical prevention, such as a kill switch. Had this on my mums Suzuki Vitara soft top, which had several attempts by low life scum to take. Usually they got annoyed and left, once we caught a guy trying desperatly to start the car.

Its effective, but again, its crackable.

b2tf · 31-01-2005, 09:15 PM

Quote:

Originally Posted by Smoked

I like to have a physical prevention, such as a kill switch. Had this on my mums Suzuki Vitara soft top, which had several attempts by low life scum to take. Usually they got annoyed and left, once we caught a guy trying desperatly to start the car.

Its effective, but again, its crackable.

Yeah, it is an olide but a goodie when it comes to stopping people. Thankfully ive never even had an attempted breakin on my car, but there is a killswitch on it, so im reasonably confident that even if they did get in (which wouldnt be that hard), they wouldnt be able to start it.

RED_EL_XR8 · 31-01-2005, 09:30 PM

Quote:

Originally Posted by back2thefutura

Yeah, it is an olide but a goodie when it comes to stopping people. Thankfully ive never even had an attempted breakin on my car, but there is a killswitch on it, so im reasonably confident that even if they did get in (which wouldnt be that hard), they wouldnt be able to start it.

The newer car electrics especially as they migrate to full buss systems will give secure remote control immobilisation options never dreamed of. The days of the toggle switch under the seat or dash are numbered.

Smoked · 31-01-2005, 10:10 PM

Quote:

Originally Posted by RED_EL_XR8

The newer car electrics especially as they migrate to full buss systems will give secure remote control immobilisation options never dreamed of. The days of the toggle switch under the seat or dash are numbered.

Not necessarily. Electronic control or not, there will always be a way to physically stop a car being started. As i said, im thankful our Vitara had one, saved us 3 times. got the idea off a Mechanic Friend when we live in Qld. He was into Diesels and 4WD's and had had 2 stolen, so started building and installing ignition kill switches. Funnily enough, he was a real bastard, in his Land Cruiser, he put in the switch and 3 dummies. And as it would happen, he caught 2 thugs trying to figure out WTF was goin on, coz they found 1 dummy switch in the glove box and kept flicking it from on to off. Needless to say, when the police arrived and the 2 idiots were K.O'd, he explained how they "ATTACKED" him and he was only defending himself.

_2:

**Captain Stubing** · 31-01-2005, 09:29 PM

There's some very smart and intelligent people out there, but there will always be a percentage who will use their powers for evil, rather than good! Some see it as a challenge, others for financial gain.

XRQTOR · 31-01-2005, 09:37 PM

Quote:

Originally Posted by swanny

There's some very smart and intelligent people out there, but there will always be a percentage who will use their powers for evil, rather than good! Some see it as a challenge, others for financial gain.

Spot on.

Racecraft · 31-01-2005, 09:30 PM

Does quicktrac work on GPS? GPS is so easy to scramble I doubt a decent crook would care... We use 7 satellites just for Brisbane and the system can loose cars quite easily..

They would want to use some super boosters to pin point a car with GPS only

RED_EL_XR8 · 31-01-2005, 09:39 PM

Quote:

Originally Posted by Racecraft

Does quicktrac work on GPS? GPS is so easy to scramble I doubt a decent crook would care... We use 7 satellites just for Brisbane and the system can loose cars quite easily..

They would want to use some super boosters to pin point a car with GPS only

quick trac is hybrid mostly radio technology.

GPS wont work in basement car parks, or some freeway tunnels and is dubious in the urban canyon environment. But a good system with fast establish GPS unit will still give lots of locations.

The achilles heal of Quicktrac was it limited range it only barely covers some outer suburbs.

Hybrid GPS/GSM-GPRS systems offer the best all over coverage. And if the system installed in a steathy manner there will be no knowledge of its existance or a rush to disable it.

**Stav** · 31-01-2005, 10:01 PM

Quote:

Originally Posted by RED_EL_XR8

quick trac is hybrid mostly radio technology.

GPS wont work in basement car parks, or some freeway tunnels and is dubious in the urban canyon environment. But a good system with fast establish GPS unit will still give lots of locations.

The achilles heal of Quicktrac was it limited range it only barely covers some outer suburbs.

Hybrid GPS/GSM-GPRS systems offer the best all over coverage. And if the system installed in a steathy manner there will be no knowledge of its existance or a rush to disable it.

Absolutely agreed. If you think smart, thieves will have a much lesser chance.