Car security

[Tamworth-Pig]

After swapping my worthless but well loved VW Passat, for a Skoda Enyaq, I find myself feeling that `fear of theft’ of my valuable car again. Its not so long ago I used to see steering wheel locks on cars, but now hardly any at all: has anything changed, are cars more secure now, should I get some extra security fitted to my car ? What do you think folks ?

[RichR]

Almost all car theft these days involves theft of keys, or relay attacks to simulate having the key in the car. Cars really are a lot more secure than they used to be. With the need for electronics for a car to run as well as legislation changes in the 1990s, cars are electronically prevented from starting very effectively without the key being present.

VAG won a lot of praise from the industry for how good the security is on the MEB platform cars. The Enyaq's KESSY remote keys are immune to relay attacks as they use UWB radio which means the car knows how far the keys are from the car (if they're in range). If there's a relay attempt then the key will seem to suddenly appear close to the car and it'll reject that as unlikely. But the simplest mitigation measure they introduced is that if the key hasn't moved for a couple of minutes (ie not being carried), then it simply turns its radio circuit off. So it won't reply to the car checking for its presence.

[metalmadhammer]

I don't see Enyaq's as being particularly desirable to thieves but you never know what the future holds.
It may well be that Electric cars are targeted once the used battery market kicks into gear just like catalytic converters getting stolen from Prius's.
I have a steering lock on my other car as just 1 layer of security amongst a load and it is a deterrent to some would be thieves but not those armed with the tools you need to remove on in about 20 seconds. If you want real piece of mind and if it works on the Enyaq, I would recommend an Autowatch Ghost system which takes just 20 mins to instal and is pretty much fool proof - requires you to tap in a pre programmed PIN code using any switches on the car including steering wheel / window or console switches. Cheap too at about £400 fitted - I understand no Ghost system has been defeated apert from one which used the mobile phone link which I don't use. It is from South Africa and also has anti hijack (illegal to switch on in the UK but mine is on).https://autowatch.co.uk/veh-sec/ghost-2-menu

[scratch113]

Almost all car theft these days involves theft of keys, or relay attacks to simulate having the key in the car. Cars really are a lot more secure than they used to be. With the need for electronics for a car to run as well as legislation changes in the 1990s, cars are electronically prevented from starting very effectively without the key being present.

VAG won a lot of praise from the industry for how good the security is on the MEB platform cars. The Enyaq's KESSY remote keys are immune to relay attacks as they use UWB radio which means the car knows how far the keys are from the car (if they're in range). If there's a relay attempt then the key will seem to suddenly appear close to the car and it'll reject that as unlikely. But the simplest mitigation measure they introduced is that if the key hasn't moved for a couple of minutes (ie not being carried), then it simply turns its radio circuit off. So it won't reply to the car checking for its presence.

My understanding of how the UWB technology works and can't be fooled by a relay attack is that the signal that goes between the key and the car (assuming the key is in range) includes a 'time of flight' element to the signal. Relaying the signal closer to the car won't change this, it will just appear to be a stronger signal to the car, but the 'time of flight' element will remain the same as it's encoded into the signal. The relay attack therefore fails because the car still knows exactly how far away the key is situated at any given time. The car will only unlock if the 'time of flight' signal shows that the key is within a couple of feet of any one of the door or tailgate sensors. On that basis, it's not a case of the car wondering why the key suddenly got closer, it still knows exactly how far away the key is, even if the signal has been relayed to appear closer.

You can prove it works by standing next to the driver's door of a locked car, with the key in your hand and having someone else try to open the passenger door using the KESSY by pulling or touching the inside of the door handle - it won't unlock as the key isn't close enough to the passenger door sensor.

[Beninscotland]

And if that doesn't work...

[harkonen]

[RichR]

I think I might have got it slightly wrong - I typed that reply whilst in a dull meeting at work. My degree is in electronics with a particular focus on digital signal processing, but I'm easily distracted when trying to do too many things at once

The way I see it is that the car transmits an 'are you there' packet, and starts a timer. The key receives that, and replies after a fixed known time period with any keypresses. The car then receives the packet, and compares the time with what it was when it sent it (it will be nanoseconds, but measurable). That gives the distance to the key. If the key signal were relayed, then the time would increase because the relay receiver and transmitted will introduce a delay. So actually that might make it impossible to relay, as even if the key were only a few metres away, the time of flight is now further from the door than it was.

I guess that there is almost certainly going to be a signal strength element to it, as once the key is really close the time of flight may well be too short to measure reliably. But it'll still need the time of transmit-process-respond-receive-process to be valid for a nearby key to work, in addition to any time dependent encryption that's going on. Seeing the key suddenly change strength or distance I guess causes it to ignore the key for a certain amount of time or until it sees things it considers valid again.

It is however very difficult to relay an UWB signal anyway - because by it's nature, it's spread across many frequencies at a very low amplitude, and those frequencies change often. So unless you know which frequencies to listen on, and know how and when they change, it'd be tricky to work out what the car's doing and what the key's replying with.

I think the biggest protection from relaying is the simplest one - just turning off the RF bit of the circuit if the fob isn't moving. Very simple and elegant.

[Miket]

I wish somebody would pinch my enyaq, it’s the worst car I have ever owned

[Tamworth-Pig]

Amazing stuff in your posts, thanks all.

It makes me see how important physical possession of the cars key is. Grabbing data from the air wont work so well any more. So the threat gets closer to the individual, or any individual near a car who’s suspected by a transgressor of having that key. Simply having a big yellow steering wheel lock fitted could make an attacker reconsider. But if its possible to get hold of the cars key it would be possible to get the steering lock key lock as well, probably it'll be on the cars key bunch anyway. How about a tazar key-fob then.

[RichR]

Yes, definitely. Security of the key is the important thing now that cars are much more secure. Some makes of car have shifted to allowing you to use your phone's Bluetooth BLE functionality to unlock and lock the car (eg Tesla, BMW, Honda). But that just shifts the importance of keeping hold of your key to keeping hold of your phone. And I'm pretty sure I've mislaid my phone more often than I've mislaid my car key (especially with keyless entry as it never leaves my trouser pocket)