Proximity Keys

[ian]

I had an interesting discussion with a master. Lock. Smith. About cutting a spare key. For my Tiguan I only need a blade cut. So I can carry it in my wallet. He asked me if my car was one with the proximinity. Keys. I told him no He went on to tell me how easy they were to reposse he then show me the code breakers he had which could open any car. But he said the ones with steering locks were a lot harder to reposse where as once you cracked the I mobilizer and opened the door all he had to do was. Push the start button.

[brad]

There was a fair bit of publicity in the newspapers not long back & a couple of threads on the forum.

It isn't a code breaker, more like a signal booster. Keep your keys in a tin can. It will act as a faraday cage and block the signal

[ian]

The. Lock smith does repo work for finance. Company's He does not need your key. I suppose it's like those after market. Remotes for your TV / dvd. They just scroll the signal being sent. From the car and lock onto it. He said he could open any. Car. And drive away.

[brad]

fair enough.

[Sunny43.5]

Don't you just love modern technology some genius comes up with a supposed great idea only to find someone smarter can defeat it so easily . I personally hate the bloody things with a vengeance we have been putting a key in our ignition and turning it to start for the last hundred years and now someone wants to make us get in with a remote and press a button to start . Same number of actions I think because at least when you stop you turn of with key and grab it and go . I have lost track of how many times I have gotten out of a car only to have the bloody thing start honking the damn horn because the remote is left inside DUMB . My first car wasa Morris minor and it had apush button start so most of this technology is nothing too new . {OH and no I don't have a car with smart remote these experiences are with customers cars } Bring back the KEY . keep it simple .

[ian]

Yes my first car was an Austin. A40 Devin. Heater demister. Sunroof. Am radio. Yes it had a key to turn on the ignition and a button to engage the starter motor. Not. Keyless. Which can be over ridden. With some bode with a rolling code breaker and steal or reposse your car with ease.

[brad]

If someone wants to take your car they will.

I think it somewhat stupid of the locksmith to show off what he can do. One of my relatives is a locksmith and was assaulted earlier this year when he refused to break into a garage as he thought the people were a bit suspect. 1 week in hospital & 3 weeks off work.

[fillmore]

I have a friend who has this modern technology in a Mazda CX5. His wife got him to drop her to work one day. They both get in car and he drives her to work. On the way home he decides to fill up with fuel. Purchases fuel, goes to start car and then remembers that his proximity key is still at home. He has started the car on his wife's key, which was in her handbag, and dropped her off leaving him keyless. Had to catch a taxi home and back to get his key. Lesson learnt.

Sent from my Nexus 7 using Tapatalk

[brad]

I have a friend who has this modern technology in a Mazda CX5. His wife got him to drop her to work one day. They both get in car and he drives her to work. On the way home he decides to fill up with fuel. Purchases fuel, goes to start car and then remembers that his proximity key is still at home. He has started the car on his wife's key, which was in her handbag, and dropped her off leaving him keyless. Had to catch a taxi home and back to get his key. Lesson learnt.

Sent from my Nexus 7 using Tapatalk

He mustn't pay attention to what it says on the dashboard. We've had three cars with proximity keys & the dashboard always flashes a continuous warning when the the key goes out of range.

[RolfGolf]

I can understand the convenience of a proximity key for getting into your car, but just the fact that people are getting stranded without a key when driving shows that it's a good idea to have something to start the car with - some kind of physical interaction - whether that's with a key, a card, or a chip embedded in your body ...

[Idle]

we have been putting a key in our ignition and turning it to start for the last hundred years and now someone wants to make us get in with a remote and press a button to start . .

Hardly a hundred years — my first car had a magneto and a starting handle. Key starts trickled in after WW2.

Somewhat in the same vein is the experience of one of my relatives a couple of days ago — she betook herself to the local golden arches for a snack, parked the car (which she's only had for a couple of weeks,) unbuckled, tried to open the door and found herself locked in.
Panic Stations! Rang No 2 son who, as is his habit, didn't answer his phone.
Tried again, same result.
Rang RACV and explained the situation. "How long will it take someone to get here?'
Call taker: "Do you have your car key with you?"
"Yes, I do."
Call taker: "Press the button." Problem solved.

Automation is the name of the game nowadays — I think it's a bit brain-numbing.

[jamesatfish]

The. Lock smith does repo work for finance. Company's He does not need your key. I suppose it's like those after market. Remotes for your TV / dvd. They just scroll the signal being sent. From the car and lock onto it. He said he could open any. Car. And drive away.

Breaking into a modern KESSY system in a VW without a key nearby is a bit harder than that. The key length (that's the bits-and-bytes encryption key) is too long to brute force attack (test each possible key in sequence), and KESSY includes measures that will slow down responses to rapid key requests to prevent this kind of attack. I doubt a pure electronic attack without a physical key would be a fruitful exercise against most rolling code systems.

A good locksmith would more likely compromise the physical door lock to gain access to the cabin, at which point your options increase rapidly. In some VWs at this point the easiest way to drive off with the car is to bring a dash cluster (which is where the immobiliser is housed) and a key coded to that cluster. Swap the dash cluster (30 second job), use your own key to start the car.

With a key nearby it's much easier. You can use a signal booster to bridge the physical gap between car and key, so if the key is within the range of your antennas you can start the car as if it was in your pocket. Useful if stealing a car when the owner is home.

Another more recent innovation is a key storer. Essentially it's a device with 3 radios and some shaped antennas that captures digital keys and plays them back at a future time.

It works like this - as the car thief you hide the device near the car. It sends out a signal on one radio that provides background noise on the frequency the car key uses to communicate with KESSY to prevent the real key talking to the car.

When the real key comes close and the owner goes to unlock their car, a second radio captures the encryption key. The car doesn't unlock though as the noisy radio has blocked the signal.

The owner tries again, and again a new encryption key is captured by the device, but this time it plays back the first key on the 3rd radio. The car recognises the valid key and unlocks.

Sometime in the future the owner goes away, taking their keys and leaving the car. Your device has one valid encryption key stored, so you play that back, the car unlocks and off you drive.

All scary stuff, though unless you're a professional targeting high-end cars you'd probably just as easily break into the house, grab the actual car keys and go from there.

[ian]

Well the Master Locksmith. I spoke to he has the latest equipment available

[AALocksmiths]

Breaking into a modern KESSY system in a VW without a key nearby is a bit harder than that. The key length (that's the bits-and-bytes encryption key) is too long to brute force attack (test each possible key in sequence), and KESSY includes measures that will slow down responses to rapid key requests to prevent this kind of attack. I doubt a pure electronic attack without a physical key would be a fruitful exercise against most rolling code systems.

A good locksmith would more likely compromise the physical door lock to gain access to the cabin, at which point your options increase rapidly. In some VWs at this point the easiest way to drive off with the car is to bring a dash cluster (which is where the immobiliser is housed) and a key coded to that cluster. Swap the dash cluster (30 second job), use your own key to start the car.

With a key nearby it's much easier. You can use a signal booster to bridge the physical gap between car and key, so if the key is within the range of your antennas you can start the car as if it was in your pocket. Useful if stealing a car when the owner is home.

Another more recent innovation is a key storer. Essentially it's a device with 3 radios and some shaped antennas that captures digital keys and plays them back at a future time.

It works like this - as the car thief you hide the device near the car. It sends out a signal on one radio that provides background noise on the frequency the car key uses to communicate with KESSY to prevent the real key talking to the car.

When the real key comes close and the owner goes to unlock their car, a second radio captures the encryption key. The car doesn't unlock though as the noisy radio has blocked the signal.

The owner tries again, and again a new encryption key is captured by the device, but this time it plays back the first key on the 3rd radio. The car recognises the valid key and unlocks.

Sometime in the future the owner goes away, taking their keys and leaving the car. Your device has one valid encryption key stored, so you play that back, the car unlocks and off you drive.

All scary stuff, though unless you're a professional targeting high-end cars you'd probably just as easily break into the house, grab the actual car keys and go from there.

KESSY is the immo not the dash. Changing the dash or the KESSY to get the car started is also not that straight forward. VAG cars use what is called component security where a lot of the electronic components ( Like the key) are coded together, so if you changed out any of these you will have to adapt it to the car, not a quick job.

As you said, brute forcing a cars security system is not that straight forward, there are some cars that are simpler and there have been a few cases of them being easily stolen.

Well the Master Locksmith. I spoke to he has the latest equipment available

Sorry, but there is no such thing as a tool that will do it all, a lot of these security systems are very complex, however once the car is open and you have access to the OBD they can then become an easier job. But not easy like walk up to it, press a button on a little black box and then drive off. What he most likely have is what has been mentioned and he is amplifying the signal from an existing key, this is a much simpler process.

[jamesatfish]

KESSY is the immo not the dash. Changing the dash or the KESSY to get the car started is also not that straight forward. VAG cars use what is called component security where a lot of the electronic components ( Like the key) are coded together, so if you changed out any of these you will have to adapt it to the car, not a quick job.

My bad, my comment about replacing the dash to swap the immobiliser was based on non-KESSY, older VWs - Mk5 and earlier, or other models where the immobiliser process happens in the dash cluster.

You're right of course about the component security - though that can be somewhat avoided using a man-in-the-middle device at the right point on the CAN bus to replace key data in the authentication / security CAN packets with the appropriate key data from your known cluster/ignition key.

Yet again of course simpler is better - a flatbed truck will bypass every one of those electronic anti-theft devices.