As cars become more complex and as systems like keyless entry, push-button ignition, and online connectivity become more pervasive, car thieves will find new and inventive ways of making off with vehicles. Jeep has recently had a number of problems, starting with the UConnect hack from last year. But those were modern vehicles with modern technology. Now though, researchers at the University of Birmingham in the UK have announced a vulnerability that affects more than 100 million older Volkswagen products going all the way back to 1995.
Simply put, thieves can use a reasonably affordable and available transmitter to intercept the wireless signal from a key fob, and then can retransmit the signal and unlock a vehicle. According to Wired, this affects Volkswagen products going back 20 years and includes vehicles like the current seventh-generation Golf. If the vehicle is equipped with a keyless ignition, then a previously known exploit can be used to start and drive off with the vehicle.
Intercepting the signal is harder than it sounds. First, the intercepting device must be within a few hundred feet of the targeted key fob, and that key fob must be pressed in order to capture the signal. Then, the signal must be combined with a cryptographic key in order to then fully clone the original signal. That key is difficult, but not impossible to obtain. Volkswagen only uses a handful throughout entire product range, from Audi to Škoda.
Researchers at the University of Birmingham also announced a second vulnerability, this time affecting vehicles from Alfa Romeo, Mitsubishi, Nissan, and others. This hack exploits an older cryptographic key call HiTag2 that has been used in vehicles for decades. A signal is intercepted using similar equipment to the Volkswagen hack. It can then be retransmitted to open a vehicle.
Both vulnerabilities will be fully revealed at the Usenix Security Symposium in Austin, Texas, this week. Volkswagen and NXP, the HiTag2 chip manufacturer, are both aware of the issue.
Update:
After the article was published, NXP reached out to Autoblog with the following statement:
Related Video:
Simply put, thieves can use a reasonably affordable and available transmitter to intercept the wireless signal from a key fob, and then can retransmit the signal and unlock a vehicle. According to Wired, this affects Volkswagen products going back 20 years and includes vehicles like the current seventh-generation Golf. If the vehicle is equipped with a keyless ignition, then a previously known exploit can be used to start and drive off with the vehicle.
Intercepting the signal is harder than it sounds. First, the intercepting device must be within a few hundred feet of the targeted key fob, and that key fob must be pressed in order to capture the signal. Then, the signal must be combined with a cryptographic key in order to then fully clone the original signal. That key is difficult, but not impossible to obtain. Volkswagen only uses a handful throughout entire product range, from Audi to Škoda.
Researchers at the University of Birmingham also announced a second vulnerability, this time affecting vehicles from Alfa Romeo, Mitsubishi, Nissan, and others. This hack exploits an older cryptographic key call HiTag2 that has been used in vehicles for decades. A signal is intercepted using similar equipment to the Volkswagen hack. It can then be retransmitted to open a vehicle.
Both vulnerabilities will be fully revealed at the Usenix Security Symposium in Austin, Texas, this week. Volkswagen and NXP, the HiTag2 chip manufacturer, are both aware of the issue.
Update:
After the article was published, NXP reached out to Autoblog with the following statement:
NXP is aware of the disclosure made at the USENIX 2016, August 10–12, in Austin-TX. It's important to keep in mind that the paper consists of two parts:
1. A case study of a specific car manufacturer not involving NXP technology
2. A description of the Hitag2 (HT2) rolling code which is a legacy NXP technology
With regards to the 2nd point, we can state that it criticizes the robustness of the HT2 security algorithm when used for Remote Keyless Entry systems and also highlights weakness in 3rd party security algorithms. HT2 is a legacy security algorithm, introduced 18 years ago (in 1998). It has been gradually replaced by more advanced algorithms from 2006 onwards. Our customers are aware as NXP has been recommending not to use HT2 for new projects and design-ins for years.
The HT2 security algorithm was introduced in 1998, after having passed extensive external security checks by independent experts. These results have been shared with automotive suppliers and manufacturers. Nevertheless, computing power has significantly increased since then so that attacks on the HT2 security algorithm have become possible using advanced equipment. There have already been publications in 2009, and again in 2012, about some security weaknesses found in HT2. Since 2009 customers and other parties have been advised by NXP and can have taken corresponding measures to replace HT2 based systems.
Since 2006, NXP's product portfolio has featured a new product family based on Advanced Encryption Standard, with AES128, encryption based on a 128-bit key. Also, since 2009, NXP added to its Hitag family the HT3 security algorithm in addition to HT2. NXP Immobilizer and Remote Keyless Entry solutions based on HT3 or AES128 have meanwhile allowed the phase out of HT2 systems in the market, but NXP cannot judge to which extent legacy systems are still using the HT2 security algorithm.
NXP product offerings are continuously aligned with the market and customer requirements. NXP does offer a range of products for remote keyless entry with varying degrees of functionality, performance and strength of encryption, so that our customers can select the appropriate product and configuration that suits their application and system implementation best. NXP continues to monitor the situation, evaluates its products and security measures on ongoing basis.
Related Video:
Sign in to post
Please sign in to leave a comment.
Continue