...a team of researchers from the University of Birmingham and the German engineering firm Kasper & Oswald plan to reveal
two distinct vulnerabilities they say affect the keyless entry systems of an estimated nearly 100 million cars.
One of the attacks would allow resourceful thieves to wirelessly unlock practically every vehicle the Volkswagen group has sold for the last two decades, including makes like Audi and Škoda. The second attack affects millions more vehicles, including Alfa Romeo, Citroen, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot.
Both attacks use a cheap, easily available piece of radio hardware to intercept signals from a victim’s key fob, then employ those signals to clone the key. The attacks, the researchers say, can be performed with a software defined radio connected to a laptop, or in a cheaper and stealthier package,
an Arduino board with an attached radio receiver that can be purchased for $40. “The cost of the hardware is small, and the design is trivial,” says Garcia. “You can really build something that functions exactly like the original remote.”
...
they were able to extract a single cryptographic key value shared among
millions of Volkswagen vehicles. By then using their radio hardware to
intercept another value that’s unique to the target vehicle and included
in the signal sent every time a driver presses the key fob’s buttons,
they can combine the two supposedly secret numbers to clone the key fob
and access to the car. “
You only need to eavesdrop once,” says
Birmingham researcher David Oswald. “From that point on you can make a
clone of the original remote control that locks and unlocks a vehicle as
many times as you want.”
more
original paper
Mark L. Rogers, 56, of Abingdon, is on paid administrative leave from Abingdon-Avon School District 276 and has been charged with three felony counts of eavesdropping. Abingdon Police Chief Kenneth Jones testified...
