The security system scientists cracked is based on KeeLoq RFID technology used in millions of cars around the world. Leading the research is RUB professor Christof Paar, who said “eavesdropping on as little as two messages enables illegitimate parties to duplicate your key and to open your garage or unlock your car.”
What’s worse is that with another malicious attack, a garage door or a car door can be remotely manipulated so that legitimate keys do not work anymore – in effect locking owners out of their own cars.
The KeeLoq system uses a unique radio frequency to send messages from a transponder mounted in a key fob to a receiver, usually embedded in a car door. Both the receiver and transponder use KeeLoq as the encryption method for securing the over-the-air communication. Scientists were able to remotely detect the electric power consumption of the receiver and by applying ‘side-channel analysis’ methods to the power traces were able to extract its unique manufacturer key code.
The official statement from KeeLoq’s developers is that "these theoretical attacks are not unique to the Keeloq system and could be applied to virtually any security system."
Remote keyless entry system for cars and buildings is hacked
RUB security experts discover major vulnerability
Access from a distance of 300 feet without traces
Researchers from Ruhr University Bochum, Germany, presented a complete break of remote keyless entry systems based on the KeeLoq RFID technology. The shown vulnerability applies to all known car and building access control systems that rely on the KeeLoq cipher. "The security hole allows illegitimate parties to access buildings and cars after remote eavesdropping from a distance of up to 100 meters" says Prof. Christof Paar. His Communication Security Group in the Electrical Engineering and Information Sciences Department has developed the break as part of their research in embedded security.
Two Intercepted Messages are Sufficient
Prof. Paar's team applied the newest code breaking technologies for developing several attacks. With the most devastating attack, car keys (or building keys) can be cloned from a distance of several 100 meters. "Eavesdropping on as little as two messages enables illegitimate parties to duplicate your key and to open your garage or unlock your car", says Prof. Paar. With another malicious attack, a garage door or a car door can be remotely manipulated so that legitimate keys do not work any more. As a consequence, access to the car or the building is not possible any more.
Newest Code Breaking Techniques
A KeeLoq system consists of an active Radio Frequency Identification (RFID) transponders (e.g., embedded in a car key) and a receiver (e.g., embedded in the car door). Both the receiver and transponder use KeeLoq as encryption method for securing the over-the-air communication. The attack by the Bochum team allows recovering the secret cryptographic keys embedded in both the receiver and the responder. The attack is based on measuring the electric power consumption of the receiver. Applying what is called side-channel analysis methods to the power traces, the researchers were able to extract the manufacturer key from the receivers. The attack - which combines side-channel cryptanalysis with specific properties of the KeeLoq algorithm - can be applied to all known variants in which KeeLoq is used in real world systems. The practicality of the attack has been confirmed by attacking actual systems which are using KeeLoq.
KeeLoq: widely used since the mid-1990s.
KeeLoq has been used for access control since the mid-1990s. By some estimates, it is the most popular of such systems in Europe and the US. Besides the frequent use of KeeLoq for garage door openers and other building access applications, it is also known that several automotive manufacturers like Toyota/Lexus base their anti-theft protection on assumed secure devices featuring KeeLoq.
IT Security Research in Bochum
Prof. Paar's group is part of the Horst Görtz Institute for IT Security (HGI), one of the largest university-based security research centres in Europe. Prof. Paar's group is internationally renowned for their work in securing and analysing embedded security systems. Ruhr University Bochum has the most comprehensive offerings in IT security education (Bachelor, Master, distance learning) in Germany.
More information about the KeeLoq attack
http://www.crypto.rub.de/keeloq
Reader Comments
Tue Apr 8 2008 1:56 AM
Wizards Lore says
awesome...hopefully the results and how the radio waves are obtained arent posted on the web and we dont have a spate of gta's and break ins.
Hopefully this will ensure that countermeasures can be implemented to stop the "waves" being picked....the real reason for the research into this topic !!
Tue Apr 8 2008 2:19 AM
SuperSkyline89 says
Or maybe people could just stop being lazy and use a damn key.
I mean is that really so hard? Sometimes the best technology is the oldest technology.
Tue Apr 8 2008 3:03 AM
Gus says
Dammit, Skyline beat me to it.
Back in my day (80's) there were no remote entry keyfobs, just keys...
But if someone wants in bad enough, they'll find a way...
Tue Apr 8 2008 3:17 AM
CK says
German engineering ;D Just saw a few weeks ago how you could steel a Merc ML in less than 20 minutes. So whatever.
Tue Apr 8 2008 6:39 AM
SMC says
What do you mean by "German engineering"? KeyLoq is not German. The ones who discovered the vulnerability are. However, this is totally irrelevant, it could happen to anyone.
These cryptographic systems need to be update-able, like a computer BIOS.
http://en.wikipedia.org/wiki/KeeLoq
Tue Apr 8 2008 9:03 AM
lfann says
wouldn't finger scanners be a more secure method of locking it? your finger print is the key to the door and the ignition, and you don't need to carry any device for day to day driving.
Tue Apr 8 2008 10:39 AM
Ivan says
I don't think you can update current keeLoq, but I doubt it would have any affect on GTA rates.
As for fingerprint system, it's VERY easy to "lift" car owner's fingerprint from any object
he/she touched in some public place and use it to steal car.
Tue Apr 8 2008 10:45 AM
chris says
ok woah woah woah lets just hold on here... there's a lot of technical data missing from the article but if i'm filling in the pieces correctly here... the method they've used is quite "elaborate" to say the least. needless to say this technology wouldnt be cheap and any thief who used this to steal anything less than an aston would be a fool.
That being said, I think it's about time that manufacturers swapped the remote fobs for HID access cards. I've had several jobs where these cards are used to gain access to buildings and i believe they are more secure because the card itself doesn't put out a signal. what happens is, once they are near a specific short range radio field, they resonate with the access code. this means that if anyone wanted to hijack your car like this article describes, they would have to be within the range of the reader (about 6 inches). yeah that means you cant keep remotely honking your horn for 10 minutes as you're walking towards your local bennigans, but it also means that you would be able to see anyone trying to "hijack" your signal.
we've already got these sort of wireless keyless access deals in some cars. I'd assume those are running off the same system as the fob, just broadcasting away all the time. IF those remote cards ARE the HID type cards, then way to go car manufacturers. lets make that technology ubiquitous.
but again; there are easier ways to steal a car. almost every new car today has a "master" key that dealers are privy to. mind you there are several master keys, but if you have the complete set, any one model or group of models from any one manufacturer are yours for the taking. but it's still scary none the less.
Tue Apr 8 2008 10:48 AM
chris says
ivan's right. even the touch sensor itself could be used to lift a print off of, and then re-apply it to the same sensor.
another option, something that is set to debut on the lincoln mks, is the return of keypad entry. mind you the lincoln is going to be much more classy than the last generation of key pads. it's a touch sensitive LED display that will only become visible when you touch the screen. really slick system if you ask me. cant wait to see it in the show room in a couple months.
Tue Apr 8 2008 1:13 PM
peste says
They're getting the encryption code off of the power output of the receiver?? Why don't they just shield that component... sounds pretty simple to fix.
Tue Apr 8 2008 1:20 PM
cj says
to Chris...ala Transporter 2
Tue Apr 8 2008 2:03 PM
chris says
peste; by "shielding" the receiver you'd have to clad the thing in a couple inches of lead, and this would almost certainly block out the fob's signal in the first place
cj; i saw transporter 2 but you're going to have to help me out here... dont know what you're refering to. btw, transporter 1 was so much better... wasnt completely cheesy.
Thu Apr 10 2008 11:01 PM
Wizards Lore says
I know i have a really good idea...lets use keys to open locks on doors....Wow how revolutionary....the fact that people are talking about keyless entry and all that crap is because lazy bastards dont want to have to carry around a key !
Leave a Comment
Login or register to leave comments.
Please keep your comments on topic. Your involvement is governed by our Privacy Policy and Terms.