RV News RVBusiness 2021 Top 10 RVs of the Year, plus 56 additional debuts and must-see units → ×
RV Trip Planning Discussions

Go Back   iRV2 Forums > MOTORHOME FORUMS > Toads and Motorhome Related Towing
Click Here to Login
Join iRV2 Today

Mission Statement: Supporting thoughtful exchange of knowledge, values and experience among RV enthusiasts.
Reply
 
Thread Tools Search this Thread Display Modes
 
Old 02-18-2021, 07:58 AM   #1
Junior Member
 
Join Date: Oct 2020
Posts: 10
Key FOB Security

I have read that hackers can get into and steal cars that use key FOBs. My understanding is that FOBs are always transmitting so scanners can pick up the signals.

If your FOB does NOT have a proximity feature, is this still true? I suppose if someone was scanning while I pushed the buttons, they could read the signals, but they would have to be nearby to do it and at the right time.

Just trying to secure my TOAD :-)
peco is offline   Reply With Quote
Join the #1 RV Forum Today - It's Totally Free!

iRV2.com RV Community - Are you about to start a new improvement on your RV or need some help with some maintenance? Do you need advice on what products to buy? Or maybe you can give others some advice? No matter where you fit in you'll find that iRV2 is a great community to join. Best of all it's totally FREE!

You are currently viewing our boards as a guest so you have limited access to our community. Please take the time to register and you will gain a lot of great new features including; the ability to participate in discussions, network with other RV owners, see fewer ads, upload photographs, create an RV blog, send private messages and so much, much more!

Old 02-18-2021, 08:19 AM   #2
Senior Member
 
Sweetbriar's Avatar
 
Thor Owners Club
Ford Super Duty Owner
Join Date: Jul 2011
Posts: 3,280
I wouldn't loose sleep over it. If they want your toad, grill, bikes, tow bar, beverage cooler, shore power cable or even the coach there isn't much you can do to stop a determined thief.
__________________
2006 Hurricane 31D built on a 2006 Ford F53
Sweetbriar is offline   Reply With Quote
Old 02-18-2021, 11:31 PM   #3
Decrepit Forum Advocate


 
Join Date: Jul 2003
Posts: 2,381
Quote:
Originally Posted by peco View Post
I have read that hackers can get into and steal cars that use key FOBs. My understanding is that FOBs are always transmitting so scanners can pick up the signals.

If your FOB does NOT have a proximity feature, is this still true? I suppose if someone was scanning while I pushed the buttons, they could read the signals, but they would have to be nearby to do it and at the right time.

Just trying to secure my TOAD :-)

I believe both your assumptions are correct. I'm not an expert but I'll explain it using my limited understanding and somebody who knows more can correct that which is in error.

From my understanding, if you have a more advanced FOB/locking-starting found on newer cars or even a key-less ignition (push button start) without the actual remote start feature, they can consistently send a faint signal even when they're idle waiting to be used or come to life once they detect or sense the vehicle is requesting to be accessed. Therefore, a thief can attempt to amplify and "capture" that signal in order to unlock the doors and depending on what system your car uses, access the ignition circuit where they can start the engine and drive away.

If you can't turn the FOB off while it's in your house or motorhome, it's recommended to use a shield such as a Faraday sleeve or pouch but even wrapping it in tin foil, putting it in a metal can/box will make it more difficult to retrieve the signal.

Some Faraday bags and sleeves through Amazon ...a friend of mine, however, says that he just keeps his keys and FOB in an empty Altoids tin which I suppose will help cut the distance of the signal.

If an older car (one of my cars is a 15 year old Subaru), yes, I believe a thief can only capture the code while you are activating the FOB. Therefore, what I do is not even use the FOB to lock the doors anymore. I can flip the electronic lock lever on the door to lock all the doors and then all I have to do is simply close the door and all doors will remain locked --this is actually easier than using the FOB. I've even reverted to the "old fashioned" method of unlocking the driver's door when I want to get in by just using the key to unlock ...so I no longer am using the FOB at all. But even if a thief were able to unlock the doors, on an older car, they'd still need the key to start the engine ...although our Subaru does have an immobilizer chip embedded in the key itself so the engine start is blocked without the primary key.


Here's a clip of a group of three stealing a BMW by amplifying and intercepting the signal from the FOB that is evidently located inside the house ...this is called a "relay attack":





Here's a diagram of one scenario that can happen that was floating around several years ago (do not have the source handy but was featured in many publications back then):
Attached Thumbnails
Click image for larger version

Name:	relay attack.png
Views:	5
Size:	514.7 KB
ID:	318555  
theroc is offline   Reply With Quote
Old 02-19-2021, 08:40 AM   #4
Junior Member
 
Join Date: Oct 2020
Posts: 10
Thank you. That's the kind of info I was interested in. I did order a Faraday bag just to feel a little more secure.

I'm sure if they want the Jeep, they'll get it, but a least I'll make it a little harder for them
peco is offline   Reply With Quote
Old 02-19-2021, 10:06 AM   #5
Senior Member/RVM #90
 
MSHappyCampers's Avatar


 
Monaco Owners Club
Join Date: Nov 2002
Location: Columbus, MS
Posts: 45,234
Quote:
Originally Posted by theroc View Post
I believe both your assumptions are correct. I'm not an expert but I'll explain it using my limited understanding and somebody who knows more can correct that which is in error.

From my understanding, if you have a more advanced FOB/locking-starting found on newer cars or even a key-less ignition (push button start) without the actual remote start feature, they can consistently send a faint signal even when they're idle waiting to be used or come to life once they detect or sense the vehicle is requesting to be accessed. Therefore, a thief can attempt to amplify and "capture" that signal in order to unlock the doors and depending on what system your car uses, access the ignition circuit where they can start the engine and drive away.

If you can't turn the FOB off while it's in your house or motorhome, it's recommended to use a shield such as a Faraday sleeve or pouch but even wrapping it in tin foil, putting it in a metal can/box will make it more difficult to retrieve the signal.

Some Faraday bags and sleeves through Amazon ...a friend of mine, however, says that he just keeps his keys and FOB in an empty Altoids tin which I suppose will help cut the distance of the signal.

If an older car (one of my cars is a 15 year old Subaru), yes, I believe a thief can only capture the code while you are activating the FOB. Therefore, what I do is not even use the FOB to lock the doors anymore. I can flip the electronic lock lever on the door to lock all the doors and then all I have to do is simply close the door and all doors will remain locked --this is actually easier than using the FOB. I've even reverted to the "old fashioned" method of unlocking the driver's door when I want to get in by just using the key to unlock ...so I no longer am using the FOB at all. But even if a thief were able to unlock the doors, on an older car, they'd still need the key to start the engine ...although our Subaru does have an immobilizer chip embedded in the key itself so the engine start is blocked without the primary key.


Here's a clip of a group of three stealing a BMW by amplifying and intercepting the signal from the FOB that is evidently located inside the house ...this is called a "relay attack":





Here's a diagram of one scenario that can happen that was floating around several years ago (do not have the source handy but was featured in many publications back then):
WOW! That's scary!
__________________
Joe & Annette
Sometimes I sits and thinks, sometimes I just sits.....
2002 Monaco Windsor 40PBT, 2013 Honda CRV AWD
MSHappyCampers is offline   Reply With Quote
Old 02-19-2021, 12:55 PM   #6
NXR
Senior Member
 
NXR's Avatar
 
Join Date: Mar 2019
Posts: 2,394
Actually, it's the car that is continually probing for the presence of a fob. Probing is actually done by a transmitter and that would clobber a fob battery fast.

Some cars are affected by relay attacks and others have been built with relay protection. The relay attack introduces a slight delay into the process of the car transmitting, the fob responding, and the car receiving the reply from the fob. That delay can be reliably detected and the car simply does not respond.

Ray
__________________
2020 Forest River Georgetown GT5 34H5
NXR is online now   Reply With Quote
Old 02-19-2021, 01:15 PM   #7
Moderator Emeritus
 
Gary RVRoamer's Avatar


 
Join Date: Jan 2000
Location: Silver Springs, FL. USA
Posts: 23,868
You would need to put the car in the Faraday bag, not the fob. The car computer is listening 24/7 for some fob to talk to it. An electronically skilled crook can use a scanner-type device to send counterfeit signals until the car responds to it, probably in two minutes or less.
__________________
Gary Brinck
Former owner of 2004 American Tradition and several other RVs
Home is in the Ocala Nat'l Forest near Ocala, FL
Summers in Black Mountain, NC
Gary RVRoamer is online now   Reply With Quote
Old 02-19-2021, 01:27 PM   #8
Senior Member
 
Join Date: Jul 2017
Location: Willamette Valley, Oregon
Posts: 171
Quote:
Originally Posted by Sweetbriar View Post
I wouldn't loose sleep over it. If they want your toad, grill, bikes, tow bar, beverage cooler, shore power cable or even the coach there isn't much you can do to stop a determined thief.

This is what insurance is for. I keep my policies paid up and don't lose any sleep over thieves. So far, I have not had any issues. But, the 'who knows' issue is why I have insurance.
__________________
2013 Tiffin 40 QBH
Escape Hybrid Toad
2 electric bikes and 1 pup
ClassAboater is offline   Reply With Quote
Old 02-19-2021, 03:57 PM   #9
Junior Member
 
Join Date: Dec 2020
Posts: 15
All I ask if they take it please burn it up when done because I want a new one. Not the old one back after it was trashed.
Rwjsim2003 is offline   Reply With Quote
Old 02-19-2021, 06:13 PM   #10
NXR
Senior Member
 
NXR's Avatar
 
Join Date: Mar 2019
Posts: 2,394
Quote:
Originally Posted by Gary RVRoamer View Post
You would need to put the car in the Faraday bag, not the fob. The car computer is listening 24/7 for some fob to talk to it. An electronically skilled crook can use a scanner-type device to send counterfeit signals until the car responds to it, probably in two minutes or less.
A basic protection is rate-limiting where the car only accepts a certain amount of codes per second. For keyless entry systems where you push a button on the door handle, the car is expecting a reply to its query and if none is received it sends another query. That alone limits someone trying to brute-force a car.

Another method now being used by some manufacturers is even more basic; they put a motion sensor in the fob itself. If the fob has not moved in forty seconds it goes to sleep and will not respond to being queried.

Honestly, this is not a big deal. Yes, it is another unintended side effect of convenience but that's about it. Communities all over are seeing spikes in auto theft and in almost every case the driver left the car outside, unlocked, and with the key or fob inside.

There was another one stolen in this area on the news today. The guy's mother's car got stolen out of his driveway. On TV he told the reporter "Everyone in this neighborhood leaves their keys in their car. This is a safe neighborhood."

You know, because no criminal ever goes to another place to commit their crime. And because going on TV and saying that no one locks their cars will not invite criminals to come on over.

You can't fix stupid.

Ray
__________________
2020 Forest River Georgetown GT5 34H5
NXR is online now   Reply With Quote
Old 02-20-2021, 06:59 AM   #11
Member
 
Join Date: Oct 2020
Posts: 39
Quote:
Originally Posted by peco View Post
I have read that hackers can get into and steal cars that use key FOBs. My understanding is that FOBs are always transmitting so scanners can pick up the signals.

If your FOB does NOT have a proximity feature, is this still true? I suppose if someone was scanning while I pushed the buttons, they could read the signals, but they would have to be nearby to do it and at the right time.

Just trying to secure my TOAD :-)
Snagging key fob codes out of the air doesn’t help a thief either. Key fobs use what computer nerds call a pseudorandom rolling code. Basically the transmitted code is different every time, and the pattern is millions of variations before it repeats. Both the fob and the car know the sequence of codes and move alnghrough them together. But transmitting an old code doesn’t work. Your garage door opener uses the same approach to prevent code snatching.
Shadow5501 is offline   Reply With Quote
Old 02-20-2021, 07:50 AM   #12
Senior Member
 
Join Date: Jul 2020
Posts: 234
Quote:
Originally Posted by Shadow5501 View Post
Snagging key fob codes out of the air doesn’t help a thief either. Key fobs use what computer nerds call a pseudorandom rolling code. Basically the transmitted code is different every time, and the pattern is millions of variations before it repeats. Both the fob and the car know the sequence of codes and move alnghrough them together. But transmitting an old code doesn’t work. Your garage door opener uses the same approach to prevent code snatching.
Yes that's true. Simple replay doesn't work. Years ago I went to a sales presentation by a company called Microchip who, among other things, make chips for these things. They explained how it works.

I'm sure there are variations but both the car and the fob key know how to calculate the next code from the previous code. That calculation is based on a unique digital key so each car is different. Each time you use it, both car and key calculate the next code so they are ready for the next use.

The obvious question then is what happens if you take the key out of range and press the button. The key will calculate the next code but the car won't so they're now out of sync. The solution is that they both calculate and store a limited number of codes ahead. It might be five or ten. The car will check all calculated codes so it doesn't really matter if one or two codes are "wasted".

But ... I'm sure you're wondering what happens if you take the key out of range and press it enough times so you've used up all the precalculated codes? Simple. The car always calculates the next codes even if it doesn't match an expected code. Therefore you just need to press it twice. First press gets it back in sync, second one unlocks. I've tested that on my Hyundai Elantra. I took the key out of range, pressed it plenty of times, came back and sure enough, I had to press it twice.

That system has a theoretical weakness that I think has been shown to work in a proof of concept experiment but I don't know if it's ever been used by a real thief. If someone hides a transmitter near the car transmitting an interfering signal that stops the key from working and also has a receiver to capture signals from the key then they wait for you to return and attempt to unlock the car. It doesn't work. You press it several times, giving them more data to collect. You eventually give up and go away. Now they really do have a signal that they can replay from their own transmitter and unlock the car. I guess if you stay with the car and call someone for help then the data they captured might still be useful when they show up some time later at your house. I think it's a difficult hack because things have to be arranged so that the thief's transmitter doesn't also block their own receiver.
tetranz is online now   Reply With Quote
Old 02-20-2021, 12:39 PM   #13
Moderator Emeritus
 
Gary RVRoamer's Avatar


 
Join Date: Jan 2000
Location: Silver Springs, FL. USA
Posts: 23,868
Quote:
Honestly, this is not a big deal. Yes, it is another unintended side effect of convenience but that's about it. Communities all over are seeing spikes in auto theft and in almost every case the driver left the car outside, unlocked, and with the key or fob inside.

Yeap, and car manufacturers are already taking measures to reduce the chances of electronic theft and tampering. Plus my insurance covers their mistakes & omissions. I just can't see losing sleep over the tiny risk of extraordinary electronic means. Or the thousands of other low-probability events I have no control over, or at least no practical alternatives.
__________________
Gary Brinck
Former owner of 2004 American Tradition and several other RVs
Home is in the Ocala Nat'l Forest near Ocala, FL
Summers in Black Mountain, NC
Gary RVRoamer is online now   Reply With Quote
Old 02-20-2021, 01:17 PM   #14
Decrepit Forum Advocate


 
Join Date: Jul 2003
Posts: 2,381
I appreciate everybody setting me straight. Like I mentioned, I'm far from an expert on this and the stuff I posted was actually from several years ago as that was what I had in my files. I tend to keep a lot of miscellaneous tidbits and online links ...a bad habit. I'm elderly with nothing better to do, what can I say. And those of you who are regulars know that I post a lot of frivolous and sometimes questionable information though I have good intentions.

I'm finding now that relay theft is not an issue nowadays. It was most prevalent in Europe three or four years ago. Automakers are making a lot of progress in trying to keep ahead of the thieves and companies like FCA, I read in one online article, is a leader in keeping on top of updating the systems they're installing in their vehicles. Therefore, those of you with newer Jeeps may even be less vulnerable than others ...??

At any rate, I'm now seeing from what you folks are posting and what I'm reading from more up-to-date sources that in fact, Faraday sleeves are a ridiculous countermeasure. Sorry, I'm embarrassed for even suggesting it.
theroc is offline   Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Door lock,not unlocking from key pad or key fob jeffnjen Entegra Owner's Forum 3 07-16-2017 11:57 AM
TriMark key FOB programming? nodine Monaco Owner's Forum 16 01-20-2017 09:00 PM
Ignition Key and Key Fob HzrdUs Entegra Owner's Forum 7 01-28-2016 11:56 PM
Wireless Key Fob Programming - Coltpeyt Winnebago Industries Owner's Forum 2 09-21-2008 05:55 PM
Key FOB's don't open door AKBrick Monaco Owner's Forum 12 01-25-2008 05:52 AM


All times are GMT -6. The time now is 09:16 PM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2021, vBulletin Solutions, Inc.