This happened to a family member of mine, here in Toronto. Lost their gorgeous M5.
Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way."
Sure enough, enough, key fob attack and theft. Caught on their video cameras. Filed the police report, claimed insurance, cried internally about the loss of a gorgeous vehicle. In all seriousness though, it's just a car, so no big deal, but nothing will fix the violation you feel, and the fact that you were being targeted.
If I were the insurance companies, I'd be putting pressure on the car companies, but hey, maybe it's just the cost of doing business for them. Better to pay out for a vehicle theft, vs. actual injuries from a collision. That's probably why there's little incentive to fix it, especially if fixing it makes your product less convenient.
> If I were the insurance companies, I'd be putting pressure on the car companies
And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution.
I remember back in the 80s my parents got a discount on their insurance for installing a third brake light in the back window of their old Camaro. If my insurance gave me a discount, I'd get a faraday cage for my keys. I'm considering doing it anyway, even though my house is pretty far from my driveway, and we have cameras.
I've searched for nice-looking faraday cages but haven't found anything good. I think there's a market for fashionable key/phone faraday cages, between this car theft issue and the push to digital detox.
EDIT: curious why this is downvoted? I'm not saying that this shouldn't be fixed by car manufacturers going forward, but we need to do something about the millions of cars on the road already. Is there another solution that would make more sense? Or is there something I'm missing here?
It's unclear how the insurance company would verify you're using the faraday cage. Presumably you're not willing to accept responsibility for the loss.
Sure, this wouldn't mean I'm responsible for any theft of my vehicle, just that it would reduce the likelihood that it would happen — benefiting both the insurer and insured.
The companies could even give away nice-looking faraday boxes that cost them next to nothing to make, and which would probably have decent adoption among people who have requested them. That would cut the hard costs to be very low, and give them a branding/perception benefit.
Imagine seeing "Mercury Insurance is giving away a Fob Box to any customer who wants one." It wouldn't make me switch to Mercury, but it would make me think more highly of them. And if I were just out of college and choosing my first insurance company, I'd undoubtedly choose them.
Given the spate of thefts and the likelihood that it continues, a promo like this could resonate for a long time and get mentioned in lots of news stories.
> And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution.
Why is it always up to us to deal with the consequences of all this poorly thought out new crap?
It sort of reminds me of the way they want us to believe that "identity theft" should be our problem to clean up, when its really caused by banks poor security practices.
I do exactly this. I lined a cookie tin with foil, and tested it by holding the closed box (with the keys inside) next to the car. It didn’t unlock. Then I opened the box, and it did unlock. The box has to be closed (lid fully on, no gaps) or the car will still unlock.
Of course this only foils overnight theft. I imagine it would be trivial for someone to follow me from a car park to a public location and sit next to me to get the key signal from my pocket.
I would imagine the signal emmitted from the fob is time sensitive. The codes should be invalid within a few seconds. If not, shame on them for such a terrible step backwards in security.
I've watched some DIY videos and am considering doing just this. I'm not sure how tight a seal you need though (one video said you want overlap from lid to sides/bottom), and the draws we have there aren't super tight. Maybe we'd make an enclosure within the drawer and be able to line that sufficiently?
If anyone knows how much leakage there would be for fobs/phones, and whether it makes a difference for this application (where the sniffer/attacker would be 10+ feet away), I'd love to know it!
What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key?
Once they got very far away from the house, the car should shut off. Or so I would think.
> but do the cars not continually (or at least every minute or two) revalidate the presence of the key?
Mine will beep for a bit if I leave the car with the key. But the vehicle also works when the fob's battery is depleted (it has an RFID tag and an embedded physical key for the door). Having the car randomly shut off based on something so potentially flakey seems like a worse idea.
> Once they got very far away from the house, the car should shut off. Or so I would think.
In the event that the actual owner of the car left their fob at their previous stop and discovers this fact 40 miles down the highway later, if the car were to stop, the driver is now stranded with a car that won't start. As it is now, as long as there is enough gas in the tank, the owner can just drive back and get it.
That's why the car should stop after less than a mile, or even not go into drive at all, rather than driving 40 miles. In your scenario, how will the driver discover that the key is missing without turning the car off and then finding herself unable to turn it back on?
So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?
Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.
No, it is not reasonable for the car to stop suddenly without the key. Even if it stops by going into an emergency limp mode, this could seriously endanger the occupants by leaving them in a dangerous traffic situation, a dangerous location, or with other issues.
This is why every car company has examined it and chosen to not do it.
This feature actually saved huge inconvenience for us once. While visiting the other coast for wife's mom in the hospital, we used one of her parent's cars to drive to the airport with her brother to drive it back. We get out at the airport, get luggage, hugs, bye, head into terminal -- with the key still in her purse. Car running, doesn't notify him until too late to chase. If it stopped after 2min, he'd be stuck somewhere outside an airport 100mi away from anyone he knew. Instead, he just drove it home, got & used the other key for a few days, and we mailed back the first key when we arrived.
Well, it means that a simple presence of a key in the vicinity of a car isn’t enough to answer the question of “will this key be present there” by the ene of the journey.
It means the key has to he inserted somewhere. That makes it both safe and predictable.
As someone who turns their car on by inserting their key into a slot in it, all this seems quite convoluted just for the convenience of pushing a button. I don't understand why the car would even let you accelerate at all if the key isn't inside the actual car (even if it's just in your pocket, if you insist on pressing a button).
Sorry, perhaps I should've put my commment higher up. I was referring to the general problem of the article, which I understood to be enabled (among other things) by the possibility of unlocking, turning on, and driving a car without the car having a means of verifying the key is inside/very close to the car.
I got myself in a bad situation where I set my key fob on the top of my car after a run, changed, jumped into the car, and got onto the highway before realizing my mistake. The fob fell onto the road and was run over and destroyed before I could get to it. Thankfully I left my car running during this time and was still able to get home.
The way it works is reasonable. Maybe tighten up the proximity. But honestly, I miss my classic keys.
In the article, the first car mentioned the car was found in a parking lot, contents emptied. If they wanted to take it to a chop shop, easy enough to take it far enough to put on a flatbed.
> Better to pay out for a vehicle theft, vs. actual injuries from a collision.
What do you mean? It's not as if anyone will be driving less... the insurance company will pay for a new car, the family will buy a new car (presumably they need it), and still be just as statistically likely to collide with the new car.
Sure, if a car theft for one car spread the cost to _all_ insurance companies, but it doesn't. So to stay competitive, companies have to 1) insure good drivers so the rates stay low and 2) invest in customers who have good car security (note the discount one gets for having their car garaged).
Insurance companies pressure drivers who have these misfeatures, drivers pressure car manufactures. See also: discounts for anti-theft tech and airbags.
The latest insurance "incentive" is a tracking device in your car that tracks when and where you drive, how fast, how hard you corner and stop, etc.
I've declined this but expect that insurers will push for it to become mandatory. They would love to be able to charge unsafe drivers more money, and in the abstract I don't have a problem with that, but the tracking is creepy.
No no no, they would love to charge everyone more until they prove to be safe drivers — ready to withdraw the discount at the first doubt.
This is why I am not going to get one, nor a “smart” water or electricity meter: give more data to corporations, and you can be sure that they will use it against you.
This is an idea that I do not see getting enough attention. “Big Data” has a lot of possible benefits but only if companies collect limited and relevant data. I’m comfortable telling my insurance company where and how I drive as long as they cannot share that or combine it with any other data.
Wait until your insurance suspends their coverage for 24 hours because the road conditions aren’t meeting their requirements, or you didn’t evacuate quickly enough, or there’s a forest fire nearby.
Does the mileage number have to be accurate in terms of wheel rotations? Can a hard braking event add miles? Is miles just an abstract representation of risk?
Whats the yield on the secondary markets for these hot vehicles since the VIN is compromised, a new license plate is needed and a thorough scrubbing has to happen
Selling parts. Usually chop shops, then to shady body shops and mechanics. With exotics, many are exported to less principled markets, with minimal vin mitigation needed. Notice how the top stolen cars on every annual list are always ones with popular body styles (accord, etc), it is no accident. The parts are often worth more than the car, and can be sold at full market value, unlike a stolen car.
Their kid normally wakes up in the middle of the night, except this time, he freaked right out like he was scared. They were wondering what was going on with him, when one of the parents heard the M5 turn on (it's pretty distinct). "That's my car!" His wife said, "Naw, you're crazy, no way."
Sure enough, enough, key fob attack and theft. Caught on their video cameras. Filed the police report, claimed insurance, cried internally about the loss of a gorgeous vehicle. In all seriousness though, it's just a car, so no big deal, but nothing will fix the violation you feel, and the fact that you were being targeted.
If I were the insurance companies, I'd be putting pressure on the car companies, but hey, maybe it's just the cost of doing business for them. Better to pay out for a vehicle theft, vs. actual injuries from a collision. That's probably why there's little incentive to fix it, especially if fixing it makes your product less convenient.