Security

[Layor]

Hi all,
I found this article in Computer Shopper by David Ludlow the other day and thought it may be a useful warning to all BMW owners, be they Z3, Z4 or the 'hoi polloi' . The Editor, Madeline Bennett, kindly gave permission to use it on our forum
I'm not sure what model David has other than a BMW:

I came out of my house the other day to find that my driver's side door hadn't been closed properly. This was strange, as I'd definitely closed it and had absolutely locked the car the day before. Grabbing the keys, the remote no longer responded, and jumping in the car, it wouldn't start.
Looking down, the light switch had been turned from automatic mode to off, and the flap for the OBD port (used for diagnostics) was open. My spider sense was tingling, but at this point my thought was that the battery was dead.
Out comes the charger. Nothing. So, I call a breakdown service who check the battery: full charge on it. Explaining about the open OBD port, the breakdown guy immediately says, "Someone's tried to clone your car key and steal the car."
Plugging in his OBD reader, my car fails to respond to anything; the computer has been corrupted in the attempt to steal the car. So, I call the BMW garage and explain the situation, where I'm told that this has happened to other customers before and they've seen it a few times. In all likelihood, the fix is to replace the Car Access System (CAS) and keys, all for the tune of over £1,000.
So, what happened? Looking online, as my car has comfort access (you just stand next to it with the key), the most likely explanation is that the thieves used an amplifier. Placing one person next to the house to pick up the signal from the key, the thieves transmit the signal to another person standing next to the car and they're in. It's an attack that works against multiple brands, so it's not a BMW-only issue.
Once inside the car, a laptop was plugged into the OBD port, with software attempting to hack the CAS and create a brand-new key so that the car could be driven away. In this case, either the thieves were interrupted and yanked out the laptop before the key could be created, or the software just corrupted the car's systems. Either way, the car was so dead that it had to be picked up and put on the back of a flatbed truck, as there was no way of starting it.
Hi-tech thieves seem to be one step ahead of the car manufacturers, and the fact that they can get into a car without the keys and clone new ones is terrifying and simply shouldn't happen. For starters, the OBD port probably shouldn't be live if there's no key in the ignition.
And, why not have two-factor authentication on any firmware updates or attempts to write a new key? Surely, the owner could be sent a unique one-off code to prevent this kind of attack, providing the information to a garage when needed. Or, car companies could provide a code generator, as banks do, that ships with the car and is kept securely inside. Amplification attacks shouldn't work, either, and should have been accounted for when the cars were built.
The solution, for now, is to wrap the key in tinfoil to prevent it from transmitting, and to use a steering wheel lock as an additional, visual form of protection. That's, frankly, useless and car security needs to dramatically improve.

I certainly agree with the last sentence, and wondered if anyone else has had a similar experience?
Colin.

 

[pgunter]

There are now ‘rfid’ wallets for contactless cards so I would say get yourself a key box and key your keys in it when you are at home. Line the box with thick foil and then maybe something like a cloth to make it look nice. Easy fix... lesson here.. the lazier you get the easier it will be to hack you account and cards / car.

 

[t-tony]

There are now ‘rfid’ wallets for contactless cards so I would say get yourself a key box and key your keys in it when you are at home. Line the box with thick foil and then maybe something like a cloth to make it look nice. Easy fix... lesson here.. the lazier you get the easier it will be to hack you account and cards / car.

Exactly what these people rely on Paul and up to a point we're probably all guilty of being "lazy". Mainly through ignorance of the need to do something preventative I would say, especially for people of a certain age.

Tony.

 

[Layor]

......especially for people of a certain age.
Oi! you 'avin a go at me, Tony.
But, in all seriousness, for every bit of new tech that someone produces for good, someone else makes use of it for criminal purposes.
By the way, David has an X5, so one of the Hoi Poloi, then. The attempted break-in and the damage caused, cost him £1,300. Although he said the insurance covered most of it. But it will certainly pay you to be alert as to what can happen.
Colin.

 

[t-tony]

Hi Colin, me too at that age.. Is it that old law of physics coming into play that every action has a reaction which is equal and opposite maybe?
You can't fault the inventiveness of these lowlife even if you do despise them.

Tony.

 

[Layor]

Hi Tony,
In that case, does Newton's third law mean that when we reach a certain age we start getting younger? After all, the old adage: Man is born of woman's womb..... and spends the rest of his life trying to get back in!
Colin.

 

[t-tony]

Hope so mate, that'd make me about 10 !!


Tony.

 

[hard top]

wondered if anyone else has had a similar experience?

@brilie had his 320d nicked but they did it the 'old fashioned' way, broke into his house to get the keys if I remember correctly.
To be honest, the way car theft is done as you describe above, is preferable in my book to the Runts also breaking into your home.

Link: https://zroadster.org/threads/look-what-i-got-back-today.18018/

 

[Layor]

That, Mike, is very true. Still not nice though.
But like Tony said; You can't fault the inventiveness of these lowlife even if you do despise them.
And, from the way they cocked it up, these lowlife's were following an instruction leaflet and were using a Sinclair Spectrum to do the job!

Colin.

 

[andyglym]

Not good news for all/most modern cars I suppose I think it's more that car crime had decreased due to this new Tec and sadly we've all been caught with our pants down as we all thought we (car security)was ahead of the game. Not any more but I suspect we'll see something soon from manufacturers as this is bad news for them. As said, some basic precautions can be taken.

 

[t-tony]

Probably a secondary security "fence" is needed as someone suggested. To log into the M.O.T. System you now need your ID, your password (which has to be changed every 3 months) and your security card which generates a 6 digit code for each log in. This code is only active for a few seconds then it's useless.
Problem is, we all just want to get in our car and drive not mess around producing a secure start code. Even the old code pads in Peugeots were easily circumnavigated, an AA man showed me how to do that 20 years ago.

Tony.

 

[pgunter]

I remember when I was working in Environmental Health and a brand new bmw cars alarm was causing a nuisance. I got the call with the police in the early hours. A mechanic turned up, reached under the car and pulled a wire, shorted the chassis out with it, the doors opened and the alarm went off. Could not believe it. Something todo with a collision system that opens the car after an accident. Could not believe it was that simple. The car was that new, the owners details were not on the pnc. The owner was not impressed that his pride and joy could be opened so easy. Some things never change.

 

[pgunter]

Seems that others have thought along the same lines.

https://rover.ebay.com/rover/0/0/0?mpre=https://www.ebay.co.uk/ulk/itm/253344681731

 

[GazHyde]

Probably a secondary security "fence" is needed as someone suggested. To log into the M.O.T. System you now need your ID, your password (which has to be changed every 3 months) and your security card which generates a 6 digit code for each log in. This code is only active for a few seconds then it's useless.

2FA (2 factor authentication) or MFA (multi factor), which relies on 3 pieces of information rather than 2. Something you are (your email or account name), something you know (your chosen password) and something you have (the authentication code or device).

It should be mainstream everywhere now, the forum supports 2FA/MFA and maybe I should look at enabling it for people who want the extra security. I enable it on a lot of systems I use, and once you get used to it it becomes second nature.

Of course, the biggest potential killer out there is "password reuse", where you use the same username and password for all your persona accounts...

 

[t-tony]

Yes you're right Gaz, but it still takes a few seconds, which people will find a nuisance. But a price which has to worth paying?

Tony.

 

[t-tony]

I remember when I was working in Environmental Health and a brand new bmw cars alarm was causing a nuisance. I got the call with the police in the early hours. A mechanic turned up, reached under the car and pulled a wire, shorted the chassis out with it, the doors opened and the alarm went off. Could not believe it. Something todo with a collision system that opens the car after an accident. Could not believe it was that simple. The car was that new, the owners details were not on the pnc. The owner was not impressed that his pride and joy could be opened so easy. Some things never change.

On VERY old cars when air bags were first fitted all you needed to do was screw in a towing eye and belt it with a sledge hammer. Doors unlocked and alarm disabled in one go and I'm talking 20 year old cars here

Tony.

 

[Redline]

The issue is that even after you have locked the car, the key continues to communicate with it until it is a decent distance away. It is this communication link that the thieves are now exploiting.
I was bought a security device this Christmas by my sister to stop this exploit - it’s simply a dummy tin can. Undo the bottom, put the keys inside and the Metal interrupts the communication.
I didn’t have a car with this kind of key so I’ve had to go and buy a new car

I just hope my keys don’t end up in a pan of boiling water

 

[andyglym]

The issue is that even after you have locked the car, the key continues to communicate with it until it is a decent distance away. It is this communication link that the thieves are now exploiting.
I was bought a security device this Christmas by my sister to stop this exploit - it’s simply a dummy tin can. Undo the bottom, put the keys inside and the Metal interrupts the communication.
I didn’t have a car with this kind of key so I’ve had to go and buy a new car

I just hope my keys don’t end up in a pan of boiling water

Sound economics mate

 

[Redline]

Sound economics mate

Any excuse however small

The FL has gone - Did 138k out of 146k miles in it and never failed me.

 

[EssexZed]

I have keyless entry on my Zed so I bought this https://rover.ebay.com/rover/0/0/0?mpre=https://www.ebay.co.uk/ulk/itm/192398434269

Put my key in it and standing next to my car tried to open the door and no response.