3

I’ve looked into the techniques of cloning the 315Mhz and 433Mhz remote car keys and I’m wondering what’s the countermeasure one can provide against wireless radio key lock? Since the radio signals do not seem to be unique and to have any sort of tokens or encryption.

6

Obviously nothing can prevent a broadcast RF signal from being copied, replayed, or studied. Any security has to be embedded in the protocol itself, but secure protocols are notoriously difficult to get right. The history of WiFi flaws in WEP, WPA, and even WPA2 shows that even a popular protocol can be broken in unexpected ways.

Current car remotes do have some encryption and defenses, but they're inadequate against modern attackers.

Automakers have relied on third party chips that developed a rolling-code technique about 20 years ago. They were designed by very smart software and electronics engineers, but not by cryptographers. (Perhaps they mistakenly thought that if they couldn't break their system then nobody could, but that's now how cryptanalysis works. This was a common failing in that era.) Rolling codes are very susceptible to a "Rolljam" replay attack.

Remote control locks have to meet price-point, reliability, convenience, size, power, and performance concerns. A pair of radios could perform a very secure TLS 1.2 key exchange, but transmitting 8000 bytes over 433MHz using current protocols and electronics would take thousands of milliseconds. Such a lengthy message would likely trigger dozens of packet resends due to interference, and the typical CR2032 coin cell battery in the typical remote wouldn't have enough power to last a year. (Using WiFi chips and 802.11 to operate the locks would be possible, but I don't know of any cars using this model.)

Modern attackers spread themselves wide, attacking not only the cryptography but the protocols, packet timing, jamming, power consumption, eavesdropping, and OSINT (reading published documentation.) The advent of Software Defined Radios means that anyone with a $20 radio and a laptop can now attack a system that used to require a bench full of RF gear and a ham radio operator. And the rapid spread of code and intel on the internet means that nothing remains secret once it's been discovered and revealed anywhere.

Attackers have matured greatly since these key fobs were first invented, but RF protocol engineering has not kept pace.

But you asked how you can defend yourself against current attacks? The glib answer is that it's almost impossible when the protocols themselves are so weak. Available options are extreme, and don't fit with most people's ideas of convenience or in their budgets. Here are some suggestions, with the most important at the top:

  1. Buy theft insurance. This transfers the risk of having your car stolen to your insurance company. Now it doesn't matter what kind of new attacks people invent, you have a financial defense that always protects you, instead of physical defenses that only protect your car against certain attacks.
  2. Don't use your remote dongle to lock the car doors. Push the button inside the door to lock them when you leave. This prevents the Rolljam attack from working.
  3. If your current key dongle can open your door locks by RF proximity, don't use the remote buttons on the dongle at all. Again, this prevents interception at a distance, including Rolljam.
  4. Leave the dongle at home and not use your RF buttons at all; use only the mechanical keys and locks that came with your car. Note that picking car door locks is a skill that many people practice just as much as hacking (see some of the locksport challenges offered by TOOOL as an example.)
  5. Study current attacks and develop technical countermethods. For example, to counteract a Rolljam attack, you might consider building a 433 MHz jammer detector. But that's only a defense against one type of attack.
  6. Get new a car that uses a cellular connection to the internet and protects its communications via TLS, then use your phone to lock and unlock the doors.
  7. Get a new car with a different security model built-in; like a Tesla that uses RFID cards and Bluetooth, instead of a remote keyfob. But note that RFID tags use their own security that comes with its own weaknesses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.