Keyless entry pwned! Researchers say it takes less than an hour
We all take for granted that the little plastic key fob in our pockets is a secure way of locking and unlocking our car doors. But a group of researchers say they have devised a way to relatively quickly decipher your car's unique code and totally pwn everything inside it.
The group says most car manufacturers are still using KeeLoq, an encryption technology developed in the 1980s, for their keyless systems. It's pretty good technology, they say, that normally would take 100 computers several decades to break. But by listening in to communication between key fobs and cars, the researchers say they can narrow down the number of code options and, instead of say, 50 years, they're in your car in about 50 minutes.
While they admit it's much easier and quicker to break into a single car with an old-fashioned baseball bat, their new, high-tech method has one merry advantage. They lay out a scenario of a packed holiday-shopping-season parking lot. Parked in the center, a van full of snooping equipment and computers listens to hundreds of keyfobs wirelessly locking car doors. Then, with little more than a few keystrokes and an hour or so later, the crooks sing "Jingle Bells" to the tune of hundreds of car doors opening in harmony.
The group claims its intentions aren't to ruin everybody's Christmas morning, but instead hopes car manufacturers wake up and update their 20-year-old technology. So this holiday season, remember to keep your valuables and packages hidden well, and lock your cars' doors the old-fashioned way.
The research group's short press release is available after the jump.
[Source: MSNBC via Gizmodo]
KeeLoq is a cipher used in several car anti-theft mechanisms distributed by Microchip Technology Inc. It may protect your car if you own a Chrysler, Daewoo, Fiat, General Motors, Honda, Toyota, Volvo, Volkswagen, or Jaguar. The cipher is included in the remote control device that opens and locks your car and that activates the anti-theft mechanisms.
Each device has a unique key that takes 18 billion billion values. With 100 computers, it would take several decades to find such a key. Therefore KeeLoq was widely believed to be secure. In our research we have found a method to identify the key in less than a day. The attack requires access for about 1 hour to the remote control (for example, while it is stored in your pocket). Once we have found the key, we can deactivate the alarm and drive away with your car.
This research is the joint work between 3 research groups: the computer science department of the Technion, Israel, the research group COSIC of the Katholieke Universiteit Leuven, Belgium, and the math department of the Hebrew University, Israel.
_opt_thumbnail.jpg)
_thumbnail.jpg "2011 Audi A8: Live from Miami")
Reader Comments (Page 1 of 3)
Frustrated Consumer 8:05PM (8/29/2007)
For those of us actually old enough to drive, you mind actually telling us what "pwn" means?
Reply
Donald 8:09PM (8/29/2007)
it means beat real bad...
Im still young =D
SocalObserver 8:52PM (8/29/2007)
From our good friends at Wikipedia:
The slang term "Pwn," used primarily in the Internet gaming culture, means to own, have ownage over, and/or soundly defeat an opponent. It is sometimes used for taunting of an in-game enemy and gloating over victories. It can also be used, especially by non-gamers, in the context of getting "pwned" by The Man.
James Sonne 8:53PM (8/29/2007)
It's a common misspelling of "own" as in to defeat.
Guenther 9:00AM (8/30/2007)
That said, can we stop using terms like that instead of, well, English?
F451 8:06PM (8/29/2007)
Damnit! There goes Christmas!
Reply
EMG 8:15PM (8/29/2007)
I heard about this method at least 5 years ago. (in Russia)
Reply
m. 8:19PM (8/29/2007)
To prevent sad Christmas - You drive an empty car to big shopping center, where you buy all your presents for everybody at once, I understand it will take a great amount of strenght, focus, dedication - wheel them out carefully and drive home. Do not stop and leave your car alone - the presents might very well be gone when you return to your keyless car.
Reply
Ben H. 8:48AM (8/30/2007)
OR..
We can forgo the 20th century practice of shopping and order our gifts online and just use the car for visiting family.
RockStoneSteel 8:52PM (8/29/2007)
Is that supposed to be "pawn" instead of "pwn"? Or is that some acronym?
Reply
Icheb 9:11PM (8/29/2007)
"pwn" is leet speak for "own" you moron.
Jon 9:59PM (8/29/2007)
Please read the first comment.
mayday83 10:03PM (8/29/2007)
...and "Icheb" roughly translates into "I never get laid."
Icheb 8:44PM (8/29/2007)
So what you mean are the REMOTE CONTROLS in the cars and not the KEYLESS ENTRY SYSTEMS which are in use in some cars nowadays?
Reply
Barney 9:20PM (8/29/2007)
Loose your keys in the parking lot and it will be a while before anyone will find the car it belongs to. Loose the remote in a parking lot and it will be only minutes to locate the car and get in. I'm not certain a fob/remote is all that much more secure.
Reply
Henry 9:32PM (8/29/2007)
What dp the Leet's pwn? The fpbs pr the prpgramming?
Reply
Alex 9:32PM (8/29/2007)
man... and today was such a good day.
now that the "code has been cracked"
it's only a matter of time =[
even if their intentions weren't malicious
the information's bound to get out there somehow
Reply
paul34 9:48PM (8/29/2007)
Lol, autoblog... you can't expect to use "pwn" on an auto site and except most of your readers to understand what it means =D
Reply
Frustrated Consumer 9:56PM (8/29/2007)
Yep, another great website being dumbed down to appeal to the 18-24 male. I guess that explains the Nick Hogan celebrity coverage...
ender 12:06PM (8/30/2007)
I agree with Dave, the slang was fitting for the topic. I'm not sure why some people are upset about the use of the slang term in one post. I haven't seen Autoblog use internet slang in many other posts so I personally don't consider this isolated event a sign of the site being "dumbed down".