Keyless entry in dire need of secury overhaul: report

Investigation showed some keyless entry systems bypassed in 10 seconds

Published: August 8, 2019, 5:30 PM
Updated: November 21, 2021, 2:53 PM

Relay Attack car theft

By now, everybody’s heard about the theft of cars using electronic devices to relay signals from a car key transponder inside a house to a car parked beside said house, and it can happen in as fast as 10 seconds, says a UK investigation.

Automobile publication What Car? Conducted research into several of today’s newer models, equipped with some of the latest keyless technology, and found that just about every one of their subjects could be accessed and driven away when their keyless modes were active (but not at all when they were deactivated).

That’s fine for models that use the key-fob with transponder, whereby you can use the key’s remote functions to unlock the doors and then insert the key in the ignition to start the car, but many of today’s cars are going to keys you simply have to have on you (or near you) to automatically unlock the doors as you walk up and then push a button to start the car.

As a result of the use of technology to gain access to and to steal vehicles, some manufacturers (Audi, BMW, Ford and Mercedes-Benz, to name a few) have started to include motion sensors into their transponders, which automatically render them inactive after a set time of lying motionless (like on a table at home), thus preventing thieves from stealing the digital code to unlock and start the vehicle. The transponder automatically reactivates after it’s moved.

For example, the Audi TT is completely inaccessible once its keyless entry is disabled but could be accessed in 10 seconds and then driven away another 10 seconds later when keyless entry is active. The DS3 Crossback (a Peugeot Group crossover that isn’t available in North America) can be accessed in 5 seconds and started another 5 seconds later.

“It is outrageous that some car makers have introduced keyless entry and start systems without making them anywhere near as secure as the traditional alternatives they’ve replaced,” said Steve Huntingford, editor of What Car?. “It is great news that a small number of brands are taking the problem of car theft seriously, but more needs to be done to improve security, particularly of desirable used models.”

But there is a solution for cars that don’t have the deactivation technology; it’s called a Faraday bag — a metal-lined pouch available in several sizes (using electromagnetic technology developed by English scientist Michael Faraday in the 1830s) that can lock away the key fob or a smartphone to prevent access from outside hackers. It’s available from electronics stores or on Amazon, priced between $12 and $30.

Other cars tested by the publication included the 2018 Land Rover Discovery Sport (no deactivation, accessed in 10 seconds then driven away 20 seconds later), Mercedes-Benz A-Class (not accessible with Keyless Go fob deactivated, otherwise entry was gained in 30 seconds and it was started 20 seconds later), BMW X3 (not accessible with the Digital Smart Key deactivated, accessed in 40 seconds otherwise, and driven off 20 seconds later), Ford Fiesta (not accessible with Sleeping Key Fob deactivated, otherwise 40 seconds to unlock and then 20 seconds to start) and the Land Rover Discovery (no deactivation technology, otherwise access gained in 20 seconds but couldn’t be driven).