Advancements in Modern Vehicle Theft

Your computer environment is safe; but is your vehicle still in the driveway? You may need to check.Having worked in the automotive security industry, and witnessing the rise of talks emerging at DefCon now covering vehicle data adaptation, now is the time to get forewarned about vehicle security. You know what they say, to be forewarned is to be forearmed.

Here's a hint... your pc is more secure than your car

Possible threats:

• Vehicle key data sniffing
• Remote unlocking/starting of vehicles
• Car stolen in under 2 minutes
• Automotive lockpicks easily purchased online

With legal organizations selling software which is meant for the use of automotive locksmiths and military personnel sold openly on the market, I will explain what to watch out for.

P.S - Get your tin foil hats guys n girls

Lockpicks have and will always have a place, but now the introduction of "turbo decoders" means your brand new BMW is open in less than 1 minute. Oh, and roughly only $400.Vehicle keys with proximity functionality (car opens when you walk up to it), the signal can be transmitted via a booster box, normally placed inside a laptop bag. Requiring two personnel, one within a certain distance of your key and the other within a certain distance of your vehicle. They boost your keys signal, allowing the vehicle to be remotely unlocked and started. Normally whilst you sleep in your house or out shopping in town. Quite scary, often £4000 - £50,000.Key learning. Keys will always need to be programmed via the dealership but some make it stupidly simple. Yes, you Range Rover! With equipment emulating the dealer diagnostics, key adaptation can be done within minutes. Often only requiring a key to be touched onto the start/stop button. You can purchase OBD blockers, which act as a counter, stopping attackers access into the vehicle.All items can be purchased online, often from eastern European locations. » No sources will be revealed, sorry.The security of the immobilizer is more often than not integrated within multiple ECU's (control units) fitted to the vehicle. Brute force into these systems can be a lengthy process, often needing time waiting to gain entry. The need for speed, and to be gone in 60 seconds is what has fueled the black market industry with illegal tools. (Notice the puns ;) )Comprised inside eeproms in hex, key data is stored and married to other control units in the vehicle. This hex data often contains rolling codes which synchronize with the key to allowing authorization to start the vehicle. The main dealer diagnostics jumps straight to the coding procedure, or may possibly even require dealers to order in keys pre-coded to the vehicle data (too much to explain here). Although you can now see the issues presented to steal a car.Given the right toolset, emulation or adaptation of a blank key can be done in quicker time than the dealership.I recall the issue of RangeRovers being stolen in major cities. RangeRover modified all their vehicles to counter this method. Yet in the first week of this major software rollout, the hacker's had already bypassed this measure. Often the case in cyberspace.

This touches the surface of what is out there.

Without wearing your eyes out on my poorly formatted write-up, I encourage you to check out the recent talks of Samy Kamkar and others detailing the security vulnerabilities in vehicles and their CAN-BUS networks.

Drive safe & stay safe people !

P.S »I hope this introduction to vehicle security encourages you all to take more interest in vehicle security matters, this is my first post to Cybrary, so gauging the reactions, may be last. Lol :)