Need some advice about car security

[steinooo]

Hi all

There's a sharp upturn in car crime in my area, many reports of *signal jamming* I've had 2 separate occasions of breaking into my car's on my drive at night.

One time they succeeded on both cars (05 honda, 13 Audi) and nicked stuff, no sign of forced entry.....

One they failed but can't work out from my CCTV footage if he just bricks himself as the pir security light came on, but he's carrying what I can only assume is a "universal key fob" as he can be seen trying it on other neighbours' cars

What I'm struggling to understand is how they've got in. I don't have keyless entry on either car.

How may they have done it and more importantly how can I protect from it?

E.g. I started placing my keys inside a metal tin - is that worthwhile?!

 

[IAmATeaf]

If you don’t have comfort/keyless access and have to press a button on the fob to unlock then as far as I know you don’t need to place the key in any tin as it won’t be emitting.

I’ve had stuff taken from my car but it has been on occasions where I’ve forgotten to lock the car. This must mean that they must wander round all the streets in the dead of the night looking for opportunities.

 

[Luke]

There is a huge rise in using a relay that boosts the signal from your key (normally just inside the front door) to the car. That may well be what he was carrying.
I use an RF blocking pouch rather than a metal tin. I've put the key in it and stood at the car door and it certainly works.

 

[Luke]

There is a huge rise in using a relay that boosts the signal from your key (normally just inside the front door) to the car. That may well be what he was carrying.
I use an RF blocking pouch rather than a metal tin. I've put the key in it and stood at the car door and it certainly works.

Oh, just spotted both are not keyless. Pass then!

 

[Nasher]

It's keyless entry/start which has the weak security since they are constantly pinging the car.

It's kind of like a physical "man in the middle" hack.

 

[Kenai]

With a normal remote key, they need to be capture the signal when you press it, as far as I know. If it looks as if they're trying loads of cars and have previously successfully got into yours, maybe they're leaving a 'signal collector' somewhere nearby during the day and coming back round at night broadcasting all the signals and seeing what unlocks?

The other option being a jammer to prevent the car locking in the first place. The only way to defend against this is checking the car actually locked when you assume it should have. This is why I like my auto folding mirrors, you can see whether the car is locked or not and from a distance.

 

[FlapR]

My mum and dads X6 was taken off the drive couple of years ago. They blocked the signal for my mum locking it somehow, then came back about 11pm and used a loophole in the cars software to attatch a blank key to it. My mum realised 10 mins later when she went to bed and there was no car there and rang the police. It was found down a lane not far away early the next morning. My dad then got a viper alarm fitted which was one of the most horrendous things ever, absolute nightmare to deal with.

 

[Steampunk]

Hi all

There's a sharp upturn in car crime in my area, many reports of *signal jamming* I've had 2 separate occasions of breaking into my car's on my drive at night.

Signal jamming is nothing to do with relay theft or keyless entry. It's much simpler, and just involves jamming frequencies so that someone gets out of their car, presses the fob, and walks away without realising that their fob didn't lock the car. The thief then just steals from the car. It's often used in places like supermarket, train station, or service station car parks just to steal from cars, because the number of people that don't check their car is actually locked when walking away from it is pretty high.

You could use this method to then get into the car and reprogram a blank key or access the data port for that, but for most high end cars nowadays (ie the ones worth stealing), it's easier to use relay theft on keyless entry, or break into a house and steal the keys.

 

[Nasher]

Not being locked makes the car easier to steal as well though. They can plug something in to the OBD2 port without having to break in and trigger the alarm.

 

[Steampunk]

Not being locked makes the car easier to steal as well though. They can plug something in to the OBD2 port without having to break in and trigger the alarm.

Yeah, but it seems to have gone out of fashion, mainly because you need to wait somewhere like a car park where there are a lot of cars and see what randomly stops and who forgets to lock up properly. It's fine for randomly thieving from cars, but if you want to steal a particular car, keyless relay theft seems to be much more reliable and popular.

 

[Werewolf]

With a normal remote key, they need to be capture the signal when you press it, as far as I know. If it looks as if they're trying loads of cars and have previously successfully got into yours, maybe they're leaving a 'signal collector' somewhere nearby during the day and coming back round at night broadcasting all the signals and seeing what unlocks?

The other option being a jammer to prevent the car locking in the first place. The only way to defend against this is checking the car actually locked when you assume it should have. This is why I like my auto folding mirrors, you can see whether the car is locked or not and from a distance.

As far as I'm aware that shouldn't work with any car locks made in quite a while. don't remote keyfobs use rolling codes specifically to avoid this?

IIRC it was mainly an issue in the old days (going back to IR keyfobs* and early RF ones that simply changed the transmitter/receiver parts but kept the coder/decoder in the 80's and 90's) where they used the same code repeatedly, these days I believe the code changes in such a way that the car knows it's the right keyfob but the code only works once/doesn't work again for a very long time (I think it's some form of public key encryption).

It's why the relay's for keyless entries are used despite the risk compared to simply getting the code once**, as it's intercepting the currently valid code as opposed to trying to reuse an old one that's been copied.

Jamming would be blocking the frequency the remote uses to lock the car, far, far simpler to do as all you need is something that puts out a higher strength signal (or "noise") in the frequency the remotes use, and hope the car owner doesn't register the car isn't locking. Which can be defeated by simply checking the car door after you've pressed lock or using the key to lock it and if you notice the car isn't locking and are sure it's not your fob at fault maybe give the police non emergency number a bell, they may be willing to look into it if it's a known problem in the area as it could indicate the thieves are active in the street at that time.

I'm a little paranoid about locking doors (comes from various members of the family not locking them properly/not closing the door properly especially my mother before her dementia was obvious), so routinely check the handle as i walk away from the car, or at the very least make sure I hear the locks engage and see the lights flash.


*I believe with some you could copy the code using a learning IR remote.

**Thieves would prefer a box they could leave unobtrusively in a car park for a few hours than having to go up to people's front/back doors.

 

[Kenai]

As far as I'm aware that shouldn't work with any car locks made in quite a while. don't remote keyfobs use rolling codes specifically to avoid this?.

You may be right (probably are) but I'm struggling to think how else they'd get into both cars, neither being keyless, on the same night. Combined with footage of someone walking around with some sort of box, which suggests a method that wasn't relying on having jammed the signal earlier in the evening.

 

[Steampunk]

As far as I'm aware that shouldn't work with any car locks made in quite a while. don't remote keyfobs use rolling codes specifically to avoid this?

Yeah, but nowadays they're RF rather than IR, they are easier to block, and you're just trying to stop a car from locking. You don't care about capturing the code or copying it, you just need to block it. It's amazing the number of people that just walk away from a car and press the button on the fob from ten feet away and they're not even looking. That's why it's quite effective and people come back to their car to find it's been ransacked with no sign of forced entry. It nice and quiet in a busy car park where smashing a window would be noticed.

This is rarely used for stealing cars nowadays, just for looting cars. Relay theft is much more common nowadays because of many cars using keyless entry, and more cars being stolen to order. There's a nice little scam where you buy a written off car from an insurance company, steal one just like it for spares, fix the first car and sell it as legit. You've just laundered the stolen car into a repaired one.

 

[jpaul]

Even though they use rolling codes on non-keyless systems they can be open to crypotgraphic weaknesses like tesla were just last year; where you calculate the roll/sequence
the gear and knowledge to do this would probably be more expensive than relay attacks on the keyless systems though, but criminals move on.

Have/would manufacturers say if their cars can be compromised like this.

 

[Nasher]

Even though they use rolling codes on non-keyless systems they can be open to crypotgraphic weaknesses like tesla were just last year; where you calculate the roll/sequence
the gear and knowledge to do this would probably be more expensive than relay attacks on the keyless systems though, but criminals move on.

Have/would manufacturers say if their cars can be compromised like this.

I think eventually keyless systems on current cars will be like running a wifi router with WEP security today. It will be so in-secure you'll just have to disable it and go back to using a physical key to unlock it.

 

[snapdragon69]

>15 years ago, there was a BMW dealer in Nottingham (Sytners) on the edge of a horrifically diverse neighbourhood.
There was a block of flats next to it that emitted a signal blocking frequency and you could not lock your car with the remote for love or money and had to fallback and use the key. It happened every time I went for parts and I figured it was not a coincidence so I mentioned it to the parts staff who confirmed they had loads of problems with this - TBH, I can see how this would be really effective just for those who want to rummage through (or steal radios as it was back then) but not for stealing the car itself, the first time it happened, I just left the car unlocked thinking it was faulty and the chances of someone finding it in the 5 minutes I was there was too low, as I didn't realise it was actively being targeted until it happened the next time too.

 

[steinooo]

With a normal remote key, they need to be capture the signal when you press it, as far as I know. If it looks as if they're trying loads of cars and have previously successfully got into yours, maybe they're leaving a 'signal collector' somewhere nearby during the day and coming back round at night broadcasting all the signals and seeing what unlocks?

The other option being a jammer to prevent the car locking in the first place. The only way to defend against this is checking the car actually locked when you assume it should have. This is why I like my auto folding mirrors, you can see whether the car is locked or not and from a distance.

The "signal collector" idea is interesting, because 2 weeks after both my cars were looted, there was a news article in the paper and online for the area (Stoke Sentinel) about ASDA in the area having one afternoon where all hell broke loose with people's car locks, loads all of a sudden became unlocked, and people being able to lock and unlock other folk's cars : https://www.stokesentinel.co.uk/new.../police-called-car-doors-mysteriously-2506204

After reading this thread it makes me wonder if that was part of a code collection exercise?

 

[IAmATeaf]

My mum and dads X6 was taken off the drive couple of years ago. They blocked the signal for my mum locking it somehow, then came back about 11pm and used a loophole in the cars software to attatch a blank key to it. My mum realised 10 mins later when she went to bed and there was no car there and rang the police. It was found down a lane not far away early the next morning. My dad then got a viper alarm fitted which was one of the most horrendous things ever, absolute nightmare to deal with.

It was for this reason that I've enabled the audible chirp the alarm makes when arming/disarming. I used to walk away and lock and take it for granted that the car had locked, I now get a 'chirp' to confirm.

 

[Scania]

This thread has got me wondering about my newly acquired Focus, it’s a 61 plate Titanium X with the “Ford Power” push start button on the dashboard, I’m assuming the fob transmits a signal to say it’s in the car so I can hit the button and go.

I’m equally assuming that whilst the car is locked (by pressing a button on the fob) this is deactivated?

Again, I have to press a button on the fob to unlock it so assume I’m not at risk of it being fooled by a signal booster or whatever they use?

Or am I wrong? (Not that I’m particularly expecting it to get nicked tbh)

 

[Cyber-Mav]

Happened to me in tescos carpark. Id press the button to lock the car but its as if the remote was not working. Tried many times and still no luck. Locked with the key fine so then tried again with the remote and no good.
Had a look around and in the opposite row a few cars down i could see 2 blokes in an astra having a giggle.
Took a pipe wrench out of the car and started walking down to them. They sped off quick smart.
Surprise surprise the remote fob worked afterwards.
So yea these sort of signal jammers do work.