Scientists crack keyless entry security systems

Car keys and keyless entry fob

Car keys and keyless entry fob

Enlarge Photo
Scientists from Ruhr University Bochum (RUB) in Germany have revealed a major flaw in vehicle keyless entry systems by demonstrating a new device that can ‘learn and record’ radio codes used to lock and unlock car doors. In the same way that a universal remote control can mimic commands from your TV and DVD controller, the new device could enable thieves to access buildings and cars after remote eavesdropping from a distance of up to 100 meters.

The security system scientists cracked is based on KeeLoq RFID technology used in millions of cars around the world. Leading the research is RUB professor Christof Paar, who said “eavesdropping on as little as two messages enables illegitimate parties to duplicate your key and to open your garage or unlock your car.”

What’s worse is that with another malicious attack, a garage door or a car door can be remotely manipulated so that legitimate keys do not work anymore – in effect locking owners out of their own cars.

The KeeLoq system uses a unique radio frequency to send messages from a transponder mounted in a key fob to a receiver, usually embedded in a car door. Both the receiver and transponder use KeeLoq as the encryption method for securing the over-the-air communication. Scientists were able to remotely detect the electric power consumption of the receiver and by applying ‘side-channel analysis’ methods to the power traces were able to extract its unique manufacturer key code.

The official statement from KeeLoq’s developers is that "these theoretical attacks are not unique to the Keeloq system and could be applied to virtually any security system."

Remote keyless entry system for cars and buildings is hacked

RUB security experts discover major vulnerability

Access from a distance of 300 feet without traces

Researchers from Ruhr University Bochum, Germany, presented a complete break of remote keyless entry systems based on the KeeLoq RFID technology. The shown vulnerability applies to all known car and building access control systems that rely on the KeeLoq cipher. "The security hole allows illegitimate parties to access buildings and cars after remote eavesdropping from a distance of up to 100 meters" says Prof. Christof Paar. His Communication Security Group in the Electrical Engineering and Information Sciences Department has developed the break as part of their research in embedded security.

Two Intercepted Messages are Sufficient

Prof. Paar's team applied the newest code breaking technologies for developing several attacks. With the most devastating attack, car keys (or building keys) can be cloned from a distance of several 100 meters. "Eavesdropping on as little as two messages enables illegitimate parties to duplicate your key and to open your garage or unlock your car", says Prof. Paar. With another malicious attack, a garage door or a car door can be remotely manipulated so that legitimate keys do not work any more. As a consequence, access to the car or the building is not possible any more.

Newest Code Breaking Techniques

A KeeLoq system consists of an active Radio Frequency Identification (RFID) transponders (e.g., embedded in a car key) and a receiver (e.g., embedded in the car door). Both the receiver and transponder use KeeLoq as encryption method for securing the over-the-air communication. The attack by the Bochum team allows recovering the secret cryptographic keys embedded in both the receiver and the responder. The attack is based on measuring the electric power consumption of the receiver. Applying what is called side-channel analysis methods to the power traces, the researchers were able to extract the manufacturer key from the receivers. The attack - which combines side-channel cryptanalysis with specific properties of the KeeLoq algorithm - can be applied to all known variants in which KeeLoq is used in real world systems. The practicality of the attack has been confirmed by attacking actual systems which are using KeeLoq.

KeeLoq: widely used since the mid-1990s.

KeeLoq has been used for access control since the mid-1990s. By some estimates, it is the most popular of such systems in Europe and the US. Besides the frequent use of KeeLoq for garage door openers and other building access applications, it is also known that several automotive manufacturers like Toyota/Lexus base their anti-theft protection on assumed secure devices featuring KeeLoq.

IT Security Research in Bochum

Prof. Paar's group is part of the Horst Görtz Institute for IT Security (HGI), one of the largest university-based security research centres in Europe. Prof. Paar's group is internationally renowned for their work in securing and analysing embedded security systems. Ruhr University Bochum has the most comprehensive offerings in IT security education (Bachelor, Master, distance learning) in Germany.

More information about the KeeLoq attack
Posted in:
Follow Us

Comments (14)
  1. awesome...hopefully the results and how the radio waves are obtained arent posted on the web and we dont have a spate of gta's and break ins.
    Hopefully this will ensure that countermeasures can be implemented to stop the "waves" being picked....the real reason for the research into this topic !!

  2. Or maybe people could just stop being lazy and use a damn key.

    I mean is that really so hard? Sometimes the best technology is the oldest technology.

  3. Dammit, Skyline beat me to it.

    Back in my day (80's) there were no remote entry keyfobs, just keys...

    But if someone wants in bad enough, they'll find a way...

  4. German engineering ;D Just saw a few weeks ago how you could steel a Merc ML in less than 20 minutes. So whatever.

  5. What do you mean by "German engineering"? KeyLoq is not German. The ones who discovered the vulnerability are. However, this is totally irrelevant, it could happen to anyone.
    These cryptographic systems need to be update-able, like a computer BIOS.

  6. wouldn't finger scanners be a more secure method of locking it? your finger print is the key to the door and the ignition, and you don't need to carry any device for day to day driving.

  7. I don't think you can update current keeLoq, but I doubt it would have any affect on GTA rates.

    As for fingerprint system, it's VERY easy to "lift" car owner's fingerprint from any object
    he/she touched in some public place and use it to steal car.

  8. ok woah woah woah lets just hold on here... there's a lot of technical data missing from the article but if i'm filling in the pieces correctly here... the method they've used is quite "elaborate" to say the least. needless to say this technology wouldnt be cheap and any thief who used this to steal anything less than an aston would be a fool.

    That being said, I think it's about time that manufacturers swapped the remote fobs for HID access cards. I've had several jobs where these cards are used to gain access to buildings and i believe they are more secure because the card itself doesn't put out a signal. what happens is, once they are near a specific short range radio field, they resonate with the access code. this means that if anyone wanted to hijack your car like this article describes, they would have to be within the range of the reader (about 6 inches). yeah that means you cant keep remotely honking your horn for 10 minutes as you're walking towards your local bennigans, but it also means that you would be able to see anyone trying to "hijack" your signal.

    we've already got these sort of wireless keyless access deals in some cars. I'd assume those are running off the same system as the fob, just broadcasting away all the time. IF those remote cards ARE the HID type cards, then way to go car manufacturers. lets make that technology ubiquitous.

    but again; there are easier ways to steal a car. almost every new car today has a "master" key that dealers are privy to. mind you there are several master keys, but if you have the complete set, any one model or group of models from any one manufacturer are yours for the taking. but it's still scary none the less.

  9. ivan's right. even the touch sensor itself could be used to lift a print off of, and then re-apply it to the same sensor.

    another option, something that is set to debut on the lincoln mks, is the return of keypad entry. mind you the lincoln is going to be much more classy than the last generation of key pads. it's a touch sensitive LED display that will only become visible when you touch the screen. really slick system if you ask me. cant wait to see it in the show room in a couple months.

  10. They're getting the encryption code off of the power output of the receiver?? Why don't they just shield that component... sounds pretty simple to fix.

  11. to Chris...ala Transporter 2

  12. peste; by "shielding" the receiver you'd have to clad the thing in a couple inches of lead, and this would almost certainly block out the fob's signal in the first place

    cj; i saw transporter 2 but you're going to have to help me out here... dont know what you're refering to. btw, transporter 1 was so much better... wasnt completely cheesy.

  13. I know i have a really good idea...lets use keys to open locks on doors....Wow how revolutionary....the fact that people are talking about keyless entry and all that crap is because lazy bastards dont want to have to carry around a key !

  14. This is a great article.. A little old, but I am glad I found it..

Commenting is closed for old articles.

Take Us With You!


Get FREE Dealer Quotes

From dealers near you

Research New Cars


© 2015 MotorAuthority. All Rights Reserved. MotorAuthority is published by High Gear Media. Stock photography by izmo, Inc. Send us feedback.