Key Fob Cloned - Car Broken Into

[aromillo]

I'm sorry this happened. I guess the only for sure way to prevent this is to park their Taycan in a private garage. Unfortunately, not everyone can do that.

always in the garage next to all the other toys, BUT got home late and was lazy and well S*h! happens.

Sponsored

 

[satchurator]

So how would the "amplification" method work? Surely there isn't a signal being sent by the key unless the owner is actually pressing "unlock"? And if the thief manages to capture this signal it's still no good later on as the time based tokens would not be correct?

Or does the amplification method only work for comfort access?

The vulnerability I described above only exists if you have Comfort Access enabled = keyless entry enabled.

Comfort access requires the fob to periodically announce itself over a particular radio frequency.

The bad guy/gal rolls up to your home with your Taycan parked outside. They use a laptop and software defined radio, along with two antennas. Antenna 1 is directional and quite sensitive. It is capturing your fob’s feint proximity transmission, and the software+hardware of the SDR is merely boosting the amplitude of that signal, transmitting on the same frequency via antenna 2, pointed at the car.

 

[legataycan]

The vulnerability I described above only exists if you have Comfort Access enabled, with keyless entry enabled.

Comfort access requires the fob to periodically announce itself over a particular radio frequency.

The bad guy/gal rolls up to your home with your Taycan parked outside. They use a laptop and software defined radio, along with two antennas. Antenna 1 is directional and quite sensitive. It is capturing your fob’s feint proximity transmission, and the software+hardware of the SDR is merely boosting the amplitude of that signal, transmitting on the same frequency via antenna 2, pointed at the car.

Got it, yeah sadly this happened to my cousin's Range Rover fairly recently and spooked me out of including comfort access on the spec.

Thanks for the explanation!

 

[Fish Fingers]

Sorry to hear this OP, but glad you are ok.

Comfort access is not popular in the UK due to the massive amount of relay thefts nowadays.

But, it all depends to what extent the crims will go.

If they really want your car bad enough, they will just break into your house for the keys, like they did with us (Golf R32 and Mini Cooper S) many years ago.

Trust me, its no fun fighting an armed gang in your bedroom at 3am on a Monday morning!

 

[legataycan]

Sorry to hear this OP, but glad you are ok.

Comfort access is not popular in the UK due to the massive amount of relay thefts nowadays.

But, it all depends to what extent the crims will go.

If they really want your car bad enough, they will just break into your house for the keys, like they did with us (Golf R32 and Mini Cooper S) many years ago.

Trust me, its no fun fighting an armed gang in your bedroom at 3am on a Monday morning!

Did they get away with the cars? I'm about to move from a top floor apartment where I feel very safe to a detached house and I'm not excited about the prospect of these kinds of incidents!

 

[Fish Fingers]

Got it, yeah sadly this happened to my cousin's Range Rover fairly recently and spooked me out of including comfort access on the spec.

Thanks for the explanation!

Here's how it's done in the UK.
Range Rovers are very popular for it!

 

[PorscheCH]

Here's how it's done in the UK.
Range Rovers are very popular for it!

That's very strange and worrying. I remember walking around some neighbourhoods in London not a long ago and see sports and luxury cars (even a Ferrari TDF) parked overnight one next to the other on the streets.

 

[Fish Fingers]

Did they get away with the cars? I'm about to move from a top floor apartment where I feel very safe to a detached house and I'm not excited about the prospect of these kinds of incidents!

Yes... They got both cars.

But you can't rule your life by what these tossers might do - otherwise they have won and you have lost!

We have Ring Cctv now which is great.
I have a few cameras covering all access points which will alert me at night if a person is detected.

It has its own distinct notification alert and phone is always by the bed. It's been a great purchase.

Really helps with my sleeping and recurring dreams of people breaking in!

 

[BigBob]

I th

Does your Taycan have comfort access?

I think cars have comfort access as standard in the US.

I left it off (UK) as i don't really see point of putting in faraday bag after you get out of car - may as well just use the key to lock/unlock.

It is a nice feature were it not for the vulnerabilities. Our other car (Range Rover) does have it and the key goes on a faraday box in the house.

 

[satchurator]

A bit more clarification:

• Cloning is mitigated by the cryptographic private key, baked into the key fob and never shared with any other device. That private key is used to generate crypto-signed tokens that change over time and can be validated by the car (technically, by anything that possesses the key fob’s crypto public key, which can only be established by pairing).
• Replay, is the recording of, and subsequently replaying of transmissions from the key fob. This is mitigated by the time-component of the identity token. What was valid 30 seconds ago, won’t work now because it has expired. Bad guy can’t record your key transmission at the grocery store, follow you home and replay that to gain access.
• Relay is real-time amplification of the fob’s proximity identity token.

 

[Archimedes]

Not a clone, just the garden variety amplification.

 

[Fish Fingers]

We extended the system, when the kitchen camera caught this w@nker a couple of years back.

He actually ran off when he saw the lights on the Ring camera recording him. I legged after him, but he was gone.

He got caught shortly after though.

 

[satchurator]

As I understand it, I believe that Comfort Access (keyless entry) and Comfort Entry (steering wheel and seat moving to easy your physical entey/exit) are tied together.

IMO it’s worth getting the Comfort Access option, even if you don’t intend to use it. You can leave it disabled, or embrace heightened personal OpSec of a faraday pouch.

Consider that your living situation might change (gaining private/secure garage space), or when you sell the car, the buyer might value that feature.

 

[Fish Fingers]

I also thought the new keys were secure with Comfort Access - something to do with motion sensors and shutting off?

 

[TaycanHero]

The vulnerability I described above only exists if you have Comfort Access enabled = keyless entry enabled.

Comfort access requires the fob to periodically announce itself over a particular radio frequency.

The bad guy/gal rolls up to your home with your Taycan parked outside. They use a laptop and software defined radio, along with two antennas. Antenna 1 is directional and quite sensitive. It is capturing your fob’s feint proximity transmission, and the software+hardware of the SDR is merely boosting the amplitude of that signal, transmitting on the same frequency via antenna 2, pointed at the car.

Super useful posts and good to know when I eventually get my Taycan.

I decided even on my original build to omit Comfort Access for the risk of theft. Based on what you have said, that probably is the right decision.

I really don't care about reaching into my pocket to press a button, and it gives me an excuse to actually use a really nice key fob.

Presumably with Comfort Access deleted/disabled, this type of theft isn't possible?

Sponsored