Hackers & Grand Theft Auto

Posted: Sun May 07, 2006 11:03 am

If you try to relate a hacker and auto theft in 1980s when the first remote keyless entry system was made which used a circuit board, a coded RFID(Radio Frequency Identification) technology chip, a battery and a small antenna. These RFID codes are rolling 40 bit strings. With each use,the code changes slightly,creating about 1 trillionpossible combinations in total.When you push the unlock button, the keyfob sends a 40-bit code, along with an instruction to unlock the cardoors. If the synced-up receivergets the 40-bit code it isexpecting, the vehicle performsthe instruction. If not, the car does not respond.

But in the modern age car like a Mercedes S550 now these RFID's not only unlock doors but also as vehicle immobilizer and with a chip and set of codes getting control over your iginition/door lock and other system in your car it has turned out to be a major attraction for hackers.

These tiny chips,embedded inside the plastic head of the ignition keys, are used with more than 150 million vehicles today. Improper use prevents the car's fuel pump from operating correctly. Unless the driver has the correct key chip installed, the car will run out of fuel a fewblocks from the attempted theft. (That's why valet keysdon't have the chips installed;valets need to drive the caronly short distances.)
One estimate suggests thatsince their introduction in thelate 1990s, vehicle immobilizers have resulted in a 90 percent decrease in autothefts nationwide.

But can this system bedefeated? Yes.

Keyless ignition systems allow you the convenience of starting your car with the touch of a button, without removing the chip from your pocket or purse or backpack. Like vehicle immobilizers, keyless ignition systems work only in the presence of the proper chip. Unlike remote keyless entrysystems, they are passive, don't require a battery and have much shorter ranges (usuallysix feet or less). And instead of sending a signal, they rely on asignal being emitted from the car itself.
Given that the car is more orless broadcasting its code and looking for a response, it seems possible that a thief could try different codes and see what the responses are. Last fall, the authors of a study from Johns Hopkins Universityand the security company RSA carried out an experimentu sing a laptop equipped with a microreader. They were able to capture and decrypt the code sequence, then disengage the alarm and unlock and start a 2005 Ford Escape SUV without the key. They evenprovided an online video of their"car theft."

But if you think that such a hack might occur only in apristine academic environment, with the right equipment, you'rewrong.

Real-world examples Meet Radko Soucek, a32-year-old car thief from the Czech Republic. He's alleged to have stolen several expensive cars in and around Prague using a laptop and a reader. Soucek is not new to auto theft--he has been stealing cars since he was 11 years old. But he recently turned high-tech when he realized how easily it could be done.
Ironically, what led to his downfall was his own laptop, which held evidence of all his past encryption attempts. With a database of successful encryption strings already stored on his hard drive, he had the ability to crack cars he'd never seen before in a relatively short amount of time.

And Soucek isn't an isolated example. Recently, soccer player David Beckham had not one, but two,antitheft-engineered BMW S5SUVs stolen. The most recent theft occurred in Madrid, Spain.Police believe an auto theft gang using software instead of hardware pinched both of Beckham's BMWs.

How a keyless car gets stolen isn't exactly a state secret--much of the required knowledge is Basic Encryption 101. The authors of the JohnsHopkins/RSA study needed only to capture two challenge-and-response pairs from their intended target before cracking the encryption.
In an example from the paper, they wanted to see if they could swipe the passive code off the keyless ignition device itself. To do so, the authors simulated a car's ignitionsystem (the RFID reader) on a laptop. By sitting close to someone with a keyless ignition device in his pocket, the authors were able to perform several scans in less than one second without the victim knowing. They then began decrypting the sampled challenge-response pairs. Using brute-force attack techniques, the researchers had the laptop try different combinations of symbols until they found combinations that matched. Once they had the matching codes, they couldt hen predict the sequence and were soon able to gain entrance to the target car andstart it.

In the case of Beckham, police think the criminals waited until he left his car, then proceeded to use a brute-force attack until the car was disarmed,unlocked and stolen.

Hear no evil, speak no evil, The authors of the JohnsHopkins/RSA study suggest that the RFID industry move away from the relatively simple 40-bit encryption technology now in use and adopt a more established encryption standard, such as the 128-bit Advanced Encryption Standard(AES). The longer the encryption code, the harder it is to crack.
The authors concede that this change would require a higher power consumption and therefore might be harder to implement; and it wouldn't be backward-compatible with all the 40-bit ignition systems already available.

The authors also suggest that car owners wrap their keyless ignition fobs in tin foil when not in use to prevent active scanning attacks, and that automobile manufacturers place a protective cylinder around the ignition slot. This latter step would limit the RFID broadcast range and make it harder for someone outside the car to eaves drop on the codesequence.
Unfortunately, the companies making RFID systems for cars don't think there's a problem.The 17th annual Card Tech SecureTech conference took place this past week in San Francisco, and CNET had anopportunity to talk with a handful of RFID vendors. None wanted to be quoted, nor would any talk about 128-bit AES encryption replacing the current 40-bit code any time soon. Few were familiar with the Johns Hopkins/RSA study we cited, and even fewer knew about keyless ignition cars being stolen in Europe.
Even Consumer Reports acknowledges that keyless ignition systems might not be secure enough for prime time, yet the RFID industry adamantly continues to whistle its happy little tune. Until changes are made in the keyless systems, any car we buy will definitely have an ignition key that can't becopied by a laptop.

Resource: Cnet