Thieves stealing car using relay attack - GIF

Thieves stealing a BMW X6 using relay attack. A relay attack bypasses keyless entry security by extending the signal of a key fob.

<video controls autoplay loop> <source src="https://diqn32j8nouaz.cloudfront.net/stealing_car_relay_attack_ma24.mp4" type="video/mp4"> Your browser does not support the video tag. </video>


Previously:

https://www.homemadetools.net/forum/...171#post221594
https://www.homemadetools.net/forum/...292#post138765
https://www.homemadetools.net/forum/...347#post215176
https://www.homemadetools.net/forum/...194#post153849
https://www.homemadetools.net/forum/...942#post206934

So then how far down the street could he go before he's out of range of the extender? Does the tablet capture then clone the key fob signature and rebroadcast it?

Once they capture the Fob signature it's just like having a key fob for that vehicle.
Anyone with a keyless start type vehicle should always store their key fob's in a faraday cage when at home. If you don't this is how easy it is to steal your vehicle.
You can look up what a Faraday cage is here: Faraday cage - Wikipedia
It's easy to build your own or you can purchase one for not allot.
The automotive industry needs to come up with a fix for this.

Cheers
Willy

Quote:

---

Originally Posted by willyb

Once they capture the Fob signature it's just like having a key fob for that vehicle.
Anyone with a keyless start type vehicle should always store their key fob's in a faraday cage when at home. If you don't this is how easy it is to steal your vehicle.
You can look up what a Faraday cage is here: Faraday cage - Wikipedia
It's easy to build your own or you can purchase one for not allot.
The automotive industry needs to come up with a fix for this.

Cheers
Willy

---

Especially if you own the kind of car they really want.

The best way to keep someone from stealing your vehicle is to have a normally closed solenoid valve installed at the tank that shuts off the fuel flow and vents the downstream line to air if the correct procedure is not followed, the solenoid can be controlled by a relay that requires another vehicle system to be switched on before starting use a system that normally would not be thought of. If you use a DPDT relay it can be made into a latching relay which will remain on after the vehicle is started until the ign. is switched off once again the secret system could be just about any electrical system and can be used only as momentary contact or left on.
Works on all vehicles even older carbureted with or without fuel pumps in the fuel tank. Even if the vehicle starts and runs it will only do so momentarily. Works especially well for vehicles owned by persons who might be inebriated. Will now work on vehicles you want to prestart before getting in.

Quote:

---

Originally Posted by Frank S

The best way to keep someone from stealing your vehicle is to have a normally closed solenoid valve installed at the tank that shuts off the fuel flow and vents the downstream line to air if the correct procedure is not followed, the solenoid can be controlled by a relay that requires another vehicle system to be switched on before starting use a system that normally would not be thought of. If you use a DPDT relay it can be made into a latching relay which will remain on after the vehicle is started until the ign. is switched off once again the secret system could be just about any electrical system and can be used only as momentary contact or left on.
Works on all vehicles even older carbureted with or without fuel pumps in the fuel tank. Even if the vehicle starts and runs it will only do so momentarily. Works especially well for vehicles owned by persons who might be inebriated. Will now work on vehicles you want to prestart before getting in.

---

A fuel shutoff with hidden switch is a good example of security through obscurity, which is pretty effective against the usual opportunists.
I did something similar to the latching relay circuit you described to a golf cart, except in this case it controlled the ignition. They are notoriously easy to steal because each manufacturer generally uses the same key for all of their models. The owner had a few carts stolen because the keys are readily available. He never went anywhere without a can of soda, so I put a pair of contacts in the bottom of one of the cup holders. It sometimes needed a little twist to make contact, but wouldn't start unless there was a can of something in the holder to complete the circuit. It worked a lot better than expected.

Quote:

---

Originally Posted by Frank S

The best way to keep someone from stealing your vehicle is to have a normally closed solenoid valve installed at the tank that shuts off the fuel flow and vents the downstream line to air if the correct procedure is not followed, the solenoid can be controlled by a relay that requires another vehicle system to be switched on before starting use a system that normally would not be thought of. If you use a DPDT relay it can be made into a latching relay which will remain on after the vehicle is started until the ign. is switched off once again the secret system could be just about any electrical system and can be used only as momentary contact or left on.
Works on all vehicles even older carbureted with or without fuel pumps in the fuel tank. Even if the vehicle starts and runs it will only do so momentarily. Works especially well for vehicles owned by persons who might be inebriated. Will now work on vehicles you want to prestart before getting in.

---

My 97 Town & Country had a system like that. It wasn't intentional, but it works. I had to hit the binnacle at just the right place and with the right energy before it would stay running. Otherwise it shut off as soon as it started. It's a known issue. Chrysler thought that it would be awesome to route the engine computer, transmission computer and body control module through the gauge cluster PSB. One of the traces on the the area where the computer signals route de-laminates and breaks. Banging the dash makes the broken traces reconnect. It's an easy fix, but required most of the dash be disassembled, and I'm too lazy for that. I wonder whether that trace could be interrupted with a hidden switch.


Neil

Quote:

---

Originally Posted by sossol

My 97 Town & Country had a system like that. It wasn't intentional, but it works. I had to hit the binnacle at just the right place and with the right energy before it would stay running. Otherwise it shut off as soon as it started. It's a known issue. Chrysler thought that it would be awesome to route the engine computer, transmission computer and body control module through the gauge cluster PSB. One of the traces on the the area where the computer signals route de-laminates and breaks. Banging the dash makes the broken traces reconnect. It's an easy fix, but required most of the dash be disassembled, and I'm too lazy for that. I wonder whether that trace could be interrupted with a hidden switch.


Neil

---

A lot would depend on how much or how little current is carried on the trace. soldering a wire to it then running said wires to a switch will drastically alter the resistance the additional lengths of wire might have too much resistance for the amount of voltage and current traveling through the trace.

Quote:

---

Originally Posted by Frank S

A lot would depend on how much or how little current is carried on the trace. soldering a wire to it then running said wires to a switch will drastically alter the resistance the additional lengths of wire might have too much resistance for the amount of voltage and current traveling through the trace.

---

That's what I figured since the traces on the CSB usually only carry low voltage. I have all the electronics skills of a pinecone, so I would never be attempting such a mod, but it's an interesting thought experiment.

Neil

I always thought switching coil power from the engine to coils under the driver's seat would be funny.