I can only assume KeeLoq uses a challenge response technique, or else this kind of attack would not be necessary. The gold standard would be using a PKI algorythm, but apparently the poultry processors powered by milliwatts of RF can't do the number crunching (at least in a reasonable time frame).

is the solder up a resistor pack and clamp it to the ignition cable under the dash. Costs about $2.00 and works every time. All the hokey-pokey about secure codes and such comes down to a single in-line resistor under the dash. If you jump around it with the resistor pack you completely disable the system.

Obviously I'm not going to give away all the details but all new auto dealer shops have one of these devices to disable the security when doing repairs on the cars. Granted it's a bit more crude than the technique described in this article but it sure is faster and more reliable. With a bit of online research you can find which wire needs the pack and have it clamped and ready in under 30 seconds.

Capturing & replaying won't work - car keyfobs have been using rolling-code systems for well over a decade. Once the car receives a message, it will ignore any subsequent copies.

The Keeloq crack is about predicting the next code in the sequence.

"poultry processors" do they make turkey twizlers ?

Yep fine but you need to be in the car first without the alarm wailing away or have balls, like coconuts and twice as hairy

obvioulsy this being a tech site i would assume we all go for the tech way...

but as always i would go the easy route and find the car i would like to have.....

then wait nearby for the owner to come prancing up with his key in hand and as most people pop the locks about 20 meters away i would just run up at the back of him with half a building brick. I then have his car and car keys with house keys (as it will be an aston martin i'm having) i also have the inbuilt gps take me to his house so i could do the house over aswell

...who, exactly, pays a moments notice to a wailing car alarm?

The easiest solution is to hit the key owner over the head with a suitably dense object and steal the key. Or kick down their front door and nick it as happened to a friend of mine.

18 billion billion combinations of numbers but how many combinations of foot/door or billiard ball/sock?

While a resistor pack may allow for the car to be started, you still have an alarm to shut off.

On many cars, a chipped key or the remote code is required to silence the alarm... When the chip in one of my Honda keys failed, I was surprised to find that the car was still driveable, even though the alarm was still blaring.

Naturally, nobody cared about the ruckus.

Maybe a simple resistor pack works on cars in some parts of the world, not sure it'd work elsewhere.

Although it's a while since I've looked at them, as I remember it the only accessible cables on most current models were the feeds to the transponder induction coil from the PCM, and the basic power switching and control lines from the ignition switch.

Given these wires, you could get the electrics turned on (i.e. 'Key On, Engine Off') but not much else, unless you managed to get the transponder code into the PCM nothing much more would happen. And a simple resistor pack is unlikely to help with this.

The PCM won't do anything much until the key code is correct, and quite likely some ancillary components will get in the way too e.g. the ignition pack and instrument cluster may also do a code check before the system will work. Given that very little now works directly from the controls, but rather is driven via software in the power or body control modules, it's quite simple to completely cripple the vehicle if a transponder key code isn't provided.

While this sort of brute force attack is relatively interesting, the real world impact is zero. Real criminals will just steal your keys and use them, rather than wasting an hour to try to get data that will take a day or two of processing on a cluster to be useful.

Bear in mind we're talking about very low range transponder modules here so the possible attack range is minimal, probably 50cm max with modified equipment. Remote locking systems have a longer range but are a separate system and being a transmitter in the key (the bit with the battery) rather than a transponder (the small plastic or glass capsule in the key) can't be remotely probed for data.

There are all sort of methods out there for triggering the central locking system, and disabling the alarm system - usually down to poor design e.g. ways to zap the system via accessible wires, or using a firm kick in the right place to bounce relays, or even a false crash signal from the airbag system - but actually *starting* the car is a separate problem and generally much harder (if not impossible) to do without a properly coded key.

As far as I can tell this attack is against the remote locking rolling code system. Apart from (as mentioned) there already being ways of working around this bit, given that the part in the key is only a transmitter you'd need actual physical access to the key to push the button(s) repeatedly to get the source data. Not exactly practical! There's also the small matter of the *rolling code* aspect; unless you get the keys correct *and* manage to synchronise the codes, it won't be much use - even a real key can become useless if the synchronisation drifts too far, until you trigger a resync.

Anyway, it's all nice and good but I suspect more of academic interest rather than a practical concern.

With the wide spread availability of guns -- surely just find the owner and get the key.

Keeloq is a previously very secure rolling code encryption system so replay attacks don't work, you need to be able to predict the code sequence and blasting it with too many guesses *can* lock it out so you need a physical key to reset it (it's usually used in conjunction with an RFID chip in the key)

Resistor packs and simple 555 based attacks only work on antiquated third world and US vehicles, not sure if they ever worked in Europe.

It's far easier to whack the owner with something solid and nick his keys these days or pick up the car with a recovery truck and decode the alarm/immobiliser later using a diagnostic or reprogramming tool (Easily available or nicked from your local garage).

Some bright spark mentioned using fingerprint recognition on some supercars a few years ago, you'd then be able to spot a supercar owner not by the expensive key ring they flaunt but by counting the number of fingers they own.

The whole system boils down to an extra relay in the fuel pump circuit. It's in series with the normal, ignition-operated relay. A spare relay with a wire soldered across the contacts can be swapped in a matter of seconds.

The rest of the car theft job is routine for any streetwise kid.

Best, IMO, is a homebrew immobilization system which isn't documented anywhere. I've been rigging my vehicles with various devices since my first new car purchase in 1965. Here's one non-current example: a crowbar circuit which blows the fuel pump and ignition fuses if the ignition is turned on without a key in the ignition lock. The score so far: two attempts, both of which went nowhere.

So I hear something here about 'nicking' cars, but the latest rage in my neighborhood, one that I've heard little about in the news, is stealing the catalytic converter. We've had a few already stolen, and it seems they're worth a few dozen dollars to the thief. But the owner has to pay a thousand dollars or more for the replacements especially if the car as dual exhausts. Someone saws them off in the parking lots, usually from a SUV or truck, since they're easy to crawl under. And then there are some thieves stealing the fire plug caps for the brass. Someone should get the recycling companies to turn these guys in.

Must we put up with this fowl-mouthed language?

...steals my 250 quid clunker. This, even though the passenger window will slide down with a bit of pressure. Who needs electronics at all? I think the only chip in my car is the half-eaten one, going steadily green, under the back seat.

> "...who, exactly, pays a moments notice to a wailing car alarm?"

The other week, the folk in our block of flats definitely noticed the rag top Merc in our car park with the knackered alarm wailing away. For more than a moment too. For approximately 3 minutes, at roughly 40 minute intervals every other day.

And I should think the owner paid more than a moments notice one morning too, after some folk decided to reciprocate by way of an egging.

It set my day off nicely when I saw that. :-) No wailing Merc since, either.

Complete and utter tosh !

That **may** have been the case with some early **cheap and nasty** systems but it certainly is not the case on modern systems (like the article is dealing with). Most new vehicles have multiple computers all networked together - when you lock the car, the security system tellsethe engine management, and the engine management shuts down the engine. No amount of 'jiggling with wires' is going to make the engine run until the security system tells the engine management to re-enable itself - or at least something the engine management **thinks** is the security system. By the time you get to that level, there are far easier and cheaper methods available.

Like the anonymous poster above, my 1997 VW Polo is resistant to this attack by relying on a metal key to be inserted to gain access.

I've got plenty of friends who have preposterously expensive cars, but is it worth the worry? Or the expense? I can go on holiday a few dozen times with the money saved by not keeping up with the Joneses!

The article covered the Batman/Bourne Conspiracy technique. The "Mission Impossible" technique is much more entertaining and practical:

1. Be a ravishingly attractive super-spy.

2. Seduce car-owner.

3. Rumpy-pump said owner into unconsciousness.

4. Take car keys.

5. Drive off.