Car "Keyless-Go" aka RKE - How it Works and Why it's Flawed by Design

[Benta]

Car theft, especially expensive cars, is at an all-time high because it's just so easy. Edited out, as it seems to divert a technical discussion into an emotional, opinionated one. My mistake.

"Keyless-Go" systems for unlocking and starting cars (the ones where you can leave the key fob in your pocket at all times) are very popular, and a lot of marketing have been invested in them (foot under the rear of the car to open the trunk etc.).
Problem is, they have a catastrophic security flaw by design that can only be addressed by means that eliminate all perceived advantages.

The classic remote control key fob is unproblematic, simply due to fact that it needs to be in the hand of the person unlocking the car. He/she needs to press a physical button on the fob. It's a one-way system, where the fob just contains a UHF transmitter and code generator, plus a passive RFID tag for starting the engine.
Sniffing and replaying the UHF signal doesn't work, as it's rolling code based. In short, it's very secure.

The "Keyless-Go" or RKE system (every car brand has its own name, but they're all the same) is a different story.
Why? Because the fob can be activated from a distance. It no longer needs to be in the hand of someone pressing a key.


How does RKE work?

Architecturally, it's simple.
The key fob has a UHF transmitter for sending the authentificaton code, the car has a corresponding receiver (just like the old-fashioned remote fob).
New is, that the car has a 125 kHz transmitter for activating/challenging the fob and initiating the unlock process. The fob has an active (battery powered) 125 kHz RFID receiver for receiving the car's challenge. This extends the RFID operating range from a couple of centimeters (1") to a couple of meters (6').

The whole process is started by someone touching the door handle (or a certain spot, whatever, depends on car brand) or putting a foot under the trunk, or...
Same thing when starting the car. You press the "Start" button, the 125 kHz challenge is sent to the fob with the UHF transmitter responding.

Sounds hunky-dory, right? The very limited range of the 125 kHz transmission (it's not really radio, but an electromagnetic field) ensures that the person touching the door handle is also holding the key fob (or someone else standing next to him/her). All within view, nice and secure.

So where's the fatal flaw?

If the key fob is a distance away from the car, the 125 kHz electromagnetic field is non-existent and everything is fine. Or is it?
What happens if you range-extend that signal? You'll need a 125 kHz receiver next to the car (easy). And a 125 kHz power transmitter next to the fob (not quite as easy, and you need to know where the fob is). And you'll need a link between the the two (easy, AM-modulated VHF/UHF Tx/Rx off-the-shelf modules).
The UHF signal from the fob also needs to be range-extended, but that's super-easy. Again, off-the-shelf module(s).

The attack itself needs two persons: one next to the car with the 125 kHz receiver, grabbing the door handle. And one next to the fob with the 125 kHz power transmitter.
Done. The person next to the car jumps in, starts the engine and is gone.

Can I protect myself against this?

Two options:
1: always store the fob in a Faraday pouch when not in use. This does not disable 125 kHz reception, but it will block UHF transmission, which is almost as good.
2: some newer cars have an option for turning off 125 kHz reception on the fob. Usually by pressing the "Lock" button three times in quick succession. Unfortunately, the "Look, Mom! I can unlock and start my car without a key!" effect goes away.

But both options completely defeat the "comfort" aspect of the dumbest feature ever invented.

I attach a Product Brief of the NXP PCF7953 IC for your reference. That's the key fob IC used by most major car manufacturers.

[ejeffrey]

Car theft, especially expensive cars, is at an all-time high.

It's actually not.  Car theft is down significantly since the 90s and early 2000s, at least in the US and Europe. It has risen in the past few years, possibly in part due to RKE, although at least in the US, older cars without RKE are by far the most common to be stolen, but it's still well below the rates of 20 years ago.

Everything else you said is fine, RKE is certainly an attack vector that can be used to steal cars, and your suggestions can protect your car. But the premise of the post is not actually correct.

[Andy Chee]

The attack itself needs two persons: one next to the car with the 125 kHz receiver, grabbing the door handle. And one next to the fob with the 125 kHz power transmitter.
Done. The person next to the car jumps in, starts the engine and is gone.

The technological attack vector is over-hyped.

You are far more likely to have your home burgled and the car keys stolen off the kitchen table, or be car jacked in a parking lot or stopped at the traffic lights.

[nctnico]

The attack itself needs two persons: one next to the car with the 125 kHz receiver, grabbing the door handle. And one next to the fob with the 125 kHz power transmitter.
Done. The person next to the car jumps in, starts the engine and is gone.

The technological attack vector is over-hyped.

You are far more likely to have your home burgled and the car keys stolen off the kitchen table, or be car jacked in a parking lot or stopped at the traffic lights.

Not always. The repeater trick is being used however, the keyfobs don't use 125kHz as this works only for short distances (less than 1 meter). Keyfobs for cars use the ISM bands with 433MHz being the most likely choice.

As a counter measure, modern keyfobs have a motion sensors so they only work when they are in motion.

[Andy Chee]

Although technology has progressed in 8 years, this video is still relevant to vehicle security.  In ten words or less, vehicle security is fundamentally flawed because they use one-way communication.



Of course the flip side is, does vehicle security even need to be as secure as an internet banking transaction?

[tszaboo]

The attack itself needs two persons: one next to the car with the 125 kHz receiver, grabbing the door handle. And one next to the fob with the 125 kHz power transmitter.
Done. The person next to the car jumps in, starts the engine and is gone.

The technological attack vector is over-hyped.

You are far more likely to have your home burgled and the car keys stolen off the kitchen table, or be car jacked in a parking lot or stopped at the traffic lights.

No, because that's violent, and you need to be an entirely different class of criminal to do that.
They have been in my car, that's parking in the driveway twice. Once I caught it on camera, they are in and out in like two minutes, throw everything around the car looking for spare cash or anything valuable. I guess a team of 2-3 people can run through an entire neighborhood overnight. They know which cars to target. Police does nothing. Insurance tell you that you probably forgot to lock the car, and "no damage". It's a real issue.

[Postal2]

... The technological attack vector is over-hyped. ...

Not quite. A thief can order a device from Benta that records the request codes of several cars. Then the thief, going around people and locker rooms, can easily see which pocket the key fob is in.

[themadhippy]

much easier in the 80's,all you needed was half a tennis ball.

[jpanhalt]

Here's a chart of car theft in the US per 100,000 (https://www.statista.com/statistics/191216/reported-motor-vehicle-theft-rate-in-the-us-since-1990/ ):

The top visible line is 400/100,000.

Note in the period of decline, most new cars still relied on mechanical keys.  My 2012 model had remote electric locks, and a mechanical ignition key that required the fob in near proximity.  The source gave no reason for the increase in the past 4 years.  I suspect some of that is due to lax enforcement and little or no penalty.   It is also reported that carjackings have also increased in the past few years.

[NiHaoMike]

A good part of the recent spike likely has to do with Hyundai/Kia implementing no security. https://www.nhtsa.gov/press-releases/hyundai-kia-campaign-prevent-vehicle-theft

[coppice]

Here's a chart of car theft in the US per 100,000 (https://www.statista.com/statistics/191216/reported-motor-vehicle-theft-rate-in-the-us-since-1990/ ):

The top visible line is 400/100,000.

Note in the period of decline, most new cars still relied on mechanical keys.  My 2012 model had remote electric locks, and a mechanical ignition key that required the fob in near proximity.  The source gave no reason for the increase in the past 4 years.  I suspect some of that is due to lax enforcement and little or no penalty.   It is also reported that carjackings have also increased in the past few years.

In the early 2000s they got the early flaws of remote entry sorted out (issues like poorly thought out rolling code schemes), and down went the thefts. Then in about 2015 the luxury market started going for completely keyless entry in a big way, and you see an uptick in thefts. I assume if the entire market had gone for it in a big way the uptick would have been more pronounced. Right now Jaguar Land Rover has such a huge problem, owners can't easily get insurance, and their resale values are going downhill fast.

[Postal2]

From the diagram I can see that Benta started his work in 2019.

[Andy Chee]

... The technological attack vector is over-hyped. ...

Not quite. A thief can order a device from Benta that records the request codes of several cars. Then the thief, going around people and locker rooms, can easily see which pocket the key fob is in.

Irrelevant.

The pertinent question is how many thieves need such sophisticated tools to steal a car.  As I suggested, a thief is more likely to steal your keys when breaking into your home/residence/workplace, or carjack you with a 3D printed gun, real gun, or machete knife.

[Andy Chee]

No, because that's violent, and you need to be an entirely different class of criminal to do that.

And that's my whole point.  If you drew a venn diagram of car thieves and classified them according to theft methodology, technology would probably be less than 10-15% of vehicle thefts.

Most criminals are non-professional (i.e. teenagers stealing a car for a joyride)

Yes, professional thieves exist and they will use such technological tools to steal cars to order.  But as I said, they are over-hyped.

[mikeselectricstuff]

... The technological attack vector is over-hyped. ...

Not quite. A thief can order a device from Benta that records the request codes of several cars. Then the thief, going around people and locker rooms, can easily see which pocket the key fob is in.

Irrelevant.

The pertinent question is how many thieves need such sophisticated tools to steal a car.  As I suggested, a thief is more likely to steal your keys when breaking into your home/residence/workplace, or carjack you with a 3D printed gun, real gun, or machete knife.

Theft by relay attacks is common in the UK, as well as CAN bus attacks on high-end cars, especially Range Rovers ( where the CAN bus can be accessed by cutting a plastic bumper) , which are all but uninsurable now

  I doubt you need anything that sophisticated - I haven't tried it but have a hunch that a 125KHz relay could be as simple as a couple of coils. Even if it did require some amplification, the electronics would be trivially simple  and I have no doubt this equipment is readily available if you know where to look.
AFAIK even now, few keyfobs have motion sensing to prevent this - this is just ridiculous considering how simple and cheap it is to implement.
 Car manufacturers have always been criminally negligent on security, the cynical view being that more cars stolen = more cars sold.

I was surprised to read about the Kia/Hyundia fiasco in the US, as immobilisers have been mandatory in the EU since 1998. Hard to fathom why the US doesn't have the same requirement.

ISTR reading that some recent VW fobs use some sort of UWB thing to make them immune due to increased turnaround time if repeated at a distance .

[tszaboo]

No, because that's violent, and you need to be an entirely different class of criminal to do that.

And that's my whole point.  If you drew a venn diagram of car thieves and classified them according to theft methodology, technology would probably be less than 10-15% of vehicle thefts.

Most criminals are non-professional (i.e. teenagers stealing a car for a joyride)

Yes, professional thieves exist and they will use such technological tools to steal cars to order.  But as I said, they are over-hyped.

You were talking about car theft, I was talking about car entry and burglary. While someone getting into your car and grabbing that 50 EUR that you stashed away is not comparable of stealing the car. Trust me it doesn't leave you with good feelings when it happens to you. And getting into your car is very-very low effort because of this keyless entry and technology.

[Andy Chee]

No, because that's violent, and you need to be an entirely different class of criminal to do that.

And that's my whole point.  If you drew a venn diagram of car thieves and classified them according to theft methodology, technology would probably be less than 10-15% of vehicle thefts.

Most criminals are non-professional (i.e. teenagers stealing a car for a joyride)

Yes, professional thieves exist and they will use such technological tools to steal cars to order.  But as I said, they are over-hyped.

You were talking about car theft, I was talking about car entry and burglary. While someone getting into your car and grabbing that 50 EUR that you stashed away is not comparable of stealing the car. Trust me it doesn't leave you with good feelings when it happens to you. And getting into your car is very-very low effort because of this keyless entry and technology.

As I said multiple times already, technological tools & hacks are often not required (over-hyped).  The thief can easily take the car key fob from inside your house while you are sleeping.

[mendip_discovery]

I have always had a bit of unease with statistics as they don't lie but they can be misrepresented. I know in the UK that "reported" thefts is funny because for a few years, the Police were actively discouraging people from reporting it as a crime.

Keyless entry is a bit of a solution that was looking for a problem and now people need it and the criminals soon learn a way to get into them. I am not sure about the number of cars that are actually stolen this way, sadly the data is limited. I often get told my car is the most stolen car in the UK but that may partly be because there are so many of them around and the criminals love to break them down for parts. But I am also aware of the tree falling in the woods and if you hang around various forums you would be led to believe one is stolen every 60 seconds.

I just wish the car manufacturers thought about the security when designing them and if it is found to have a wide-open fault then there should be regulatory pressure to fix it and not leave it to the owners to deal with.

[HighVoltage]

As I said multiple times already, technological tools & hacks are often not required (over-hyped).  The thief can easily take the car key fob from inside your house while you are sleeping.

They are NOT over-hyped at all, they are easy to use for those in the know.
Once you have seen such a system, you can only be amazed how simple it is.

No need to break in to a house, that is just too much hassle and old school.

[jpanhalt]

I was surprised to read about the Kia/Hyundia fiasco in the US, as immobilisers have been mandatory in the EU since 1998. Hard to fathom why the US doesn't have the same requirement.

I suspect but cannot document that the NTSB is mandated to regulate safety, not thievery, and our law enforcement agencies do not make such mandates either.  Thus, such a mandate by the NTSB would likely be challenged as overreach by interested parties.  However, insurance companies and publishing the fault certainly had an effect.

Personally, I prefer that system.  Mandates are slowly, if ever removed entirely even when the need has long passed. 

[mikeselectricstuff]

I was surprised to read about the Kia/Hyundia fiasco in the US, as immobilisers have been mandatory in the EU since 1998. Hard to fathom why the US doesn't have the same requirement.

I suspect but cannot document that the NTSB is mandated to regulate safety, not thievery,

An easily-stolen car is a very clear safety issue

[Postal2]

... An easily-stolen car is a very clear safety issue

The problem is not the ease of theft, but why, with all the modern means, the police can't catch anyone?

[tszaboo]

No, because that's violent, and you need to be an entirely different class of criminal to do that.

And that's my whole point.  If you drew a venn diagram of car thieves and classified them according to theft methodology, technology would probably be less than 10-15% of vehicle thefts.

Most criminals are non-professional (i.e. teenagers stealing a car for a joyride)

Yes, professional thieves exist and they will use such technological tools to steal cars to order.  But as I said, they are over-hyped.

You were talking about car theft, I was talking about car entry and burglary. While someone getting into your car and grabbing that 50 EUR that you stashed away is not comparable of stealing the car. Trust me it doesn't leave you with good feelings when it happens to you. And getting into your car is very-very low effort because of this keyless entry and technology.

As I said multiple times already, technological tools & hacks are often not required (over-hyped).  The thief can easily take the car key fob from inside your house while you are sleeping.

The skill required to open a front door is much higher than buying a gadget from silk road or whichever online marketplace, and pressing a button to open a car.
And the criminal charge is much more different. And it doesn't matter how many times you say it, because your though process is just wrong.
You can steal cryptocurrency by hitting someone with a wrench several times until they give it to you, or through a malicious website. Guess which one is the bigger monetary problem?

[snarkysparky]

I have been thinking of finding a critical circuit in the car and interrupting it with a hidden toggle switch.  Maybe the brake switch.  Just anything that keeps the car from starting.

[themadhippy]

a hidden toggle switch

use a switch that matches those already in the vehicle and hide it in plain sight