That adds a layer of complexity, but the researchers note that a thief could simply turn the barrel with a screwdriver, or hotwire the car’s ignition switch, just as car thieves did before the introduction of immobilizers neutered those techniques. “You’re downgrading the security to what it was in the ’80s,” says University of Birmingham computer science professor Flavio Garcia. And unlike relay attacks, which only work when within range of the original key, once a thief has derived the cryptographic value of a fob they can start and drive the targeted car repeatedly.
The researchers developed their technique by buying a collection of immobilizers’ electronic control units from eBay and reverse engineering the firmware to analyze how they communicated with key fobs. They often found it far too easy to crack the secret value that Texas Instruments DST80 encryption used for authentication. The problem lies not in DST80 itself, but in how the carmakers implemented it: The Toyota fobs’ cryptographic key was based on their serial number, for instance, and also openly transmitted that serial number when scanned with an RFID reader. And Kia and Hyundai key fobs only used 24 bits of randomness rather than the 80 bits that the DST80 offers, making their secret values easy to guess. “That’s a blunder,” says Garcia. “Twenty-four bits is a couple of milliseconds on a laptop.”
When WIRED reached out to the affected carmakers and Texas Instruments for comment, Kia and Texas Instruments didn’t respond. But Hyundai noted in a statement that none of its affected models are sold in the US. It added that the company “continues to monitor the field for recent exploits and we make significant efforts to stay ahead of potential attackers,” and reminded customers “to be diligent with who has access to their vehicle’s key fob.
Toyota responded in a statement that “the described vulnerability applies to older models, as current models have a different configuration.” The company added that “this vulnerability constitutes a low risk for customers, as the methodology requires both access to the physical key and to a highly specialized device that is not commonly available on the market.” On that point, the researchers disagreed, noting that no part of their research required hardware that wasn’t easily available.
To prevent car thieves from replicating their work, the researchers say they left certain parts of their method for cracking the carmakers’ key fob encryption out of their published paper—though that wouldn’t necessarily prevent less ethical hackers from reverse engineering the same hardware the researchers did to find the same flaws. With the exception of Tesla, the researchers say, none of the cars whose immobilizers they studied had the ability to fix the program with a software patch downloaded directly to cars. They could reprogram immobilizers if owners take them to dealerships, but in some cases might have to replace key fobs. (None of the affected carmakers contacted by WIRED mentioned any intention of offering to do so.)
Even so, the researchers say that they decided to publish their findings to reveal the real state of immobilizer security and allow car owners to decide for themselves if it’s enough. Protective car owners with hackable immobilizers might decide, for instance, to use a steering wheel lock. “It’s better to be in a place where we know what kind of security we’re getting from our security devices,” Garcia says. “Otherwise, only the criminals know.”
More Great WIRED Stories