Security Flaw in Automotive Keyless Entry

Recently there was a security exploit identified in automotive keyless systems. 

Normally, the car sends out an RF ping to the fob on a low frequency, to which the fob responds on UHF.  If the system determines that the fob is nearby AND a hand is detected by a capacitive sensor, the car unlocks.  Also, if the fob is inside the car AND the ignition button is pressed, the car will start. 

The fallacy of this system is that signal strength implies distance.  The exploit involves amplifying the ping from the car such that the fob will respond even at a large distance.  The UHF back-channel is very strong, and needs no further help up to 50 meters away, or so.

Others on the web have described the expolits in detail, but to me, the restaurant scenario is scariest.  The perpetrators observe the “mark” going in to a restaurant for dinner after parking his car.  Bad Guy A goes in and stands next to the mark with a briefcase.  Bad Guy B stands next to the car with another briefcase.  Briefcase contains... “electronic stuff”.  Open car and burgle. This has been demonstrated.

Steve Gibson covers this and provides pointers to resources at his site HERE, Episode #508.

You can also watch the video of his podcast at HERE.

And finally, here is a video of a simple shield solution costing less than $2 that I tested....


Design versus Engineering

Seen in Fast Company Magazine, OCT 2013, "Apple Breaks the Mold", p. 152...

I would like to meet Jon Rubinstein, and buy him lunch.




Breezy Point Update...

This update from Cynthia Hill...  (read original blog entry HERE)

We left Wayland on Tuesday the 13th....raining, but with two tractor trailers filled to the brim - the 40' and the 53'!
We followed the little one and 4 firefighters from Ashby followed the big one to North Haven where we made a driver change - unions !!! Following these trucks thru Queens and Brooklyn was something else!
Our FDNY escort was waiting with lights flashing to take us over the bridge - the Rockaways - to Breezy Point. The sheer number of emergency vehicles was mind blowing, but none belonged to FEMA or the Red Cross!!! Mostly fire and National Guard, back hoes, front end loaders, fire hoses everywhere, and destruction everywhere.
This is a beach community made into a year-round community because fire, EMT's, and police have to live x number of miles from their assigned station and costs were off the the Rockaway area is now a year-round part of the city. Only problem is that the homes are on slabs or 2-3 foot foundations, and were swept aside by 15' storm surge - BOOM, and they were 100' from where they belonged - one house was split in two, and on the second floor the bed was still made ~ it looked more like tornados mixed with fire and up to 8' of sand left behind.
While the Guard emptied our mother lode, our firefighter Sean took us down to walk the beach....not near the fire, as it's still under a state of emergency, but passed the Army hummers parked on the sand....low tide is over a 1/4 mile from homes and its can picture the water coming toward you! We walked for a least a mile, some homes completely not there, just a piece of fence and a house number written in the sand - 206 I remember! Broken everything, everywhere and this was two weeks after the storm...huge piles of stoves, water heaters, car parts, stereos, furniture bits, then a house pretty much intact, but 6' of sand throughout...
No private companies allowed at that point - no water, no gas, no electric, no tools - you could see where everything we brought could and would be used. No insurance people in either...these people felt forgotten, and they had been.
David wants to go back Christmas Eve with nothing but toys, but we need to see what will help them doing badly as many are still not in school - well they're living there, but no teaching is being done! They are so displaced and sad... all their "things" are gone and you know how much covet their treasures.
Steve, please know that every single thing you and Spencer brought was in good hands within 2 days...everything was gone!
Only thing they don't need is I need to know what and when!
Hope you all had the best Thanksgiving.
Big hugs and a ton of thanks.
And more...
This was born yesterday, but we now have a 40 footer to take new toys to Breezy! They have an old traditional Christmas tree lighting that the entire community attends, and celebrates. When I called my civilian liaison, Theresa, yesterday she told me of the party then mentioned they had nothing to give the kids as holiday presents!!!
Their need has been for things to survive, but now it's time to care for the kids!
We are leaving Wayland on Friday, December 14th at 8am...hopefully with the 40' full of gifts, unwrapped.
We placed a maximum amount of $20.00 -$25.00 per gift. We didn't want to see one bike, or an IPhone show up...this way everything will be pretty much equal.
Suggestions only:
Age groups:
0-2 years            stuffed animals
3-6 years            Fisher - Price, and  Cabbage Patch  Dolls
7-9 years            Lego's - Barbie for the girls
10-13 years        Lego's
14+                   Sport's Equipment- footballs, baseball equipment(gloves, balls and bats), soccer balls and several portable nets
Two things to remember NO SPORTS TEAM LOGOS on sports equipment. These kids have absolutely nothing. NOTHING THAT REQUIRES ELECTRICITY, they have none!
Sports equipment works for all ages from 6 on...they are all very involved in sports.  We were even thinking that several of those movable basketball hoops would be great.
You and Spencer were so wonderful with our first load, we'd love it if you could spread the word for this Holiday trip!
Yes, we'll take checks - made payable to Cynthia Hill ~ I'll happily go shopping for these children who have no idea we're coming!
Steve and Spencer, thank you from me and from our Breezy Point friends. They really can't believe people care about them...
Read the attached Letter to the Editor!
Huge hugs,
And a letter to the editor written by Cynthia:

A journey to Breezy Point

To the residents of Wayland, and surrounding communities, the residents of Breezy Point NY, thank you.

They thank you for the two tractor trailer loads filled to the brim with generators, space heaters, work gloves, shovels, 22 wheelbarrows, pallets of bleach, electrical cords, boots, winter clothing for men, women and kids, diapers, pallets of paper towels and toilet paper, antibacterial gel, pet food, and so much more.

You loving brought cars, SUV's, and trucks full of necessities for our neighbors in New York who had nothing left after Hurricane Sandy. Stop & Shop, just days before they opened, not only donated the trucks, but drivers, gas, and their employees to help you unload your car...the General Manager, Mike Bussell, saw people in a horrific mess and along with his corporate team, when to work...he even made sure pallets of drinking water were in both trucks. Mike, also a volunteer Chief with the Ashby Fire Department, knew what these people needed after water, fire and up to 6 feet of sand swept away part or all of their homes.

I wish you could have seen the faces of the FDNY, National Guard and civilian volunteers as those huge trucks pulled in to an area still under a State of Emergency...we lifted the doors and people started to cry. With destruction everywhere they couldn't believe people cared about them....

A woman came up to me and told me I was her angel - I'm sure a few in town would disagree - now she could begin to dig out her house. I certainly wasn't her angel but I could hug her and let her know that so many wonderful people cared what happened to her, that we'd be there for Breezy.

The people of Breezy Point are a strong, proud and caring community, but looking around me, I couldn't imagine what courage it would take to keep going day after day.

It's been almost a month now ~ Breezy still has no electricity and all must leave before dark. You've probably heard about the looting, Theresa tells me it's not too bad. What do you mean "not too bad" I shouted to myself, you've worked for days to find odds and ends of your life, and someone steals it!

As the sun set on Breezy Point, November 13th 2012, several of us knew we'd be back, with whatever they needed, whenever they needed it.

Thank you for all that you've done, and all that we have left to do.

Cynthia Hill, the Breezy Point Project



A pictoral history of cell phones...

Please check out an excellent graphical history of the cell phone entitled "evolution of the mobile phone by docomo".  Watch for when all the antennas become internal.


Helping Breezy Point...

I recieved a note from my friend Steve Golson about a donation drive for vicitms of Superstorm Sandy in Breezy Point, NY.  I grew up in Coney Island, Brooklyn, NYC, and when you looked out across the water (I lived on the 12th floor of a 23-story apartment building) you would see Sandy Hook NJ on the right and Breezy Point on the left.  Pictures of my old neighborhood in Coney Island were stunning in their depiction of the damage from the storm.  So, when I had the opportunity to do something to help I volunteered AntennaSys' resources.

Steve send me a link to an article about his friend and travel agent Cynthia Hill.  Cynthia knows some firefighters who live in Breezy Point and work in Manhattan.  She organized a drive for items that were sorely needed in the recovery efforts, got the Stop-and-Shop supermarket chain to donate trucks, and got locals firefighters to help with loading efforts in Wayland MA.

Of all the available AntennaSys resources, the most important for this mission were three: a credit card, an enclosed trailer (which we use to transport equipment and supplies for the courses we teach) and cheap labor.  These were immediately pressed into service.  With a shopping list in hand, and additional text messages relayed to me from Cynthia via Steve, my daughter Samantha and I headed to Cyr Lumber to load up.

As keeper of the list, Samantha made sure we got the highest priority items.  We were time-limited and needed to be on the road at 2pm in order to make the drop.

Cynthia not only got Stop-and-Shop to donate trucks, but these trucks were staged in the brand-new parking lot of a supermarket that was not yet open.  

What an amazing operation.  We were unloaded in four minutes and watched one of TWO 40-foot trailers hit it's limit.

Best of luck Breezy Point.  Thank you Cynthia, Stop-and-Shop, and the Firefighters.

Now, back to antennas...