back to article Thieves can wirelessly unlock up to 100 million Volkswagens, each at the press of a button

Security researchers will demonstrate how crooks can break into cars at will using wireless signals that can unlock millions of vulnerable vehicles. The eggheads, led by University of Birmingham computer scientist Flavio Garcia alongside colleagues from German engineering firm Kasper & Oswald, have managed to clone a VW Group …

Page:

  1. Magani
    Coat

    "... protection against theft of millions of cars at a conference tomorrow."

    So if no one drives to the conference, there will be no cars stolen? I was just leaving...

    1. Anonymous Coward
      Anonymous Coward

      They are clearly expecting a lot of people will drive there to listen to the talk and drive home in each others cars.

  2. EvilGardenGnome
    Mushroom

    So long and thanks for all the fish

    Welp, it was nice knowing VW. Between faking diesel numbers and this, it'll be interesting to see them survive the lawsuits.

    1. Anonymous Coward
      Anonymous Coward

      Re: So long and thanks for all the fish

      Welp, it was nice knowing VW. Between faking diesel numbers and this, it'll be interesting to see them survive the lawsuits.

      Investors might take a haircut, but as one of Germany's largest companies (probably THE largest German company), anybody who thinks that the German government will just watch VW shrivel into the hands of a US vulture fund is kidding themselves.

      1. Anonymous Coward
        Anonymous Coward

        Re: So long and thanks for all the fish

        I see... then VW will take the entire German economy down with it.

        Get ready for....... Gerxit

      2. William 3 Bronze badge

        Re: So long and thanks for all the fish

        Why would the German Government protect a German Manufacturer when they can't even be bothered to protect the German Culture or Country?

        1. Bronek Kozicki

          Re: So long and thanks for all the fish

          You do not seem to be aware of the relation between German economy and car manufacturers. Also, 20% of VW is effectively state-owned

          1. Anonymous Coward
            Anonymous Coward

            Re: So long and thanks for all the fish

            > Also, 20% of VW is effectively state-owned

            How do they get round the EU rules on that then?

            Oh - hang on - EU rules don't apply to Germany or France..

            1. BebopWeBop

              Re: So long and thanks for all the fish

              I don't know enough about counties like Denmark, but France, Germany, Italy and Greece seem to have very relaxed views of the interpretation of EU wide legislation, in their favour. The U.K. Uniquely, amongst the larger nations tends not to (although they do seem to be taking a much more reasonable point of view over vaping legislation - disclaimer, I don't). If I was writing a sketch for Yes Minister, Sir Humphrey would be organising it all..... In the name of unity of course.

            2. big_D Silver badge

              Re: So long and thanks for all the fish

              It is the regional state governments that hold shares in VW, the investment is not at the Federal level.

              Oh, and the German courts have given the OK for those investors to sue the board for misleading them and trashing their investments.

  3. Anonymous Coward
    Anonymous Coward

    Quick Release or build it like it is in my head

    What if car manufacturers take a leaf out of Formula 1's book and develop detachable steering wheels for family saloons etc? The steering wheel could have a unique serial number that hardware in the steering column could detect and would only allow that wheel to operate the vehicle? No steering wheel, no worries!

    1. Adam 52 Silver badge

      Re: Quick Release or build it like it is in my head

      The manufacturers would use a few, easily hacked master keys to validate the steering wheel and we'd be back to square one.

      Or was that a joke that's gone over my head?

    2. Ben Tasker

      Re: Quick Release or build it like it is in my head

      Inevitably leading to someone having to stand at the tobacco counter at Tesco's as their icecream nelts and say, errr... has anyone handed in a steering wheel? I'm sure I had it when I paid, but can't find it anywhere

      Not that I once realised I'd left my wallet on the counter once I'd driven 100 miles. Thankfully there was enough diesel in the tank to get back

      1. David 132 Silver badge
        Happy

        Re: Quick Release or build it like it is in my head

        Inevitably leading to someone having to stand at the tobacco counter at Tesco's as their icecream nelts and say, errr... has anyone handed in a steering wheel? I'm sure I had it when I paid, but can't find it anywhere

        "Nah mate, but we've had this old quartic one from an Allegro knocking around spare since the rest of the car rusted away - you can have it to get you home..."

        "Thanks, but I'd rather walk."

      2. 's water music

        Re: Quick Release or build it like it is in my head

        Not that I once realised I'd left my wallet on the counter once I'd driven 100 miles

        Well better that than getting to 100 miles before realising that you have left the removable steering wheel behind.

        Incidentally, does this mean that if I use this technique to steal a VW I would be able to to join the class action suit for the emissions fiddling?

    3. Anonymous Coward
      Anonymous Coward

      Re: Quick Release or build it like it is in my head PT2

      Ok then, how about a FREE Rottweiler with every Golf GTi?

      Wireless, wireless, wireless, you're all fuckin wireless mad!!!

      1. PNGuinn
        Trollface

        FREE Rottweiler

        But would you want to trust the security features of another german designed dog?

        And what about the emissions?

        1. CrazyOldCatMan Silver badge

          Re: FREE Rottweiler

          > features of another german designed dog?

          Rotties are (pretty much) Roman cattle dogs - one of the oldest extant breeds from what I can remember.

          I like Rotties.

    4. GitMeMyShootinIrons

      Re: Quick Release or build it like it is in my head

      Too bulky. I remember removable car radios (or facias in many cases). Often left in place or stuffed in the 'secure location' of the glove box.

      Needs a DNA reader - a nice big needle stabs into your hand, drawing half a pint of blood....

    5. Anonymous Coward
      Anonymous Coward

      Re: Quick Release or build it like it is in my head

      Do self-driving cars need steering wheels?

    6. hplasm
      Happy

      Re: Quick Release or build it like it is in my head

      You are Mr Bean and I claim my Five Pounds!

      1. AMBxx Silver badge
        Coat

        Re: Quick Release or build it like it is in my head

        Plenty of LR Defender owners remove the steering wheel at night to prevent theft. Those of us with poor in-built security are well versed in using layers of security. Looks like those with more modern vehicles need to do the same.

        Mine's the one with 2 trackers, smart water sprinkled liberally, etched windows, huge sterring immobiliser and steel grills over the rear windows.

        1. Alister

          Re: Quick Release or build it like it is in my head

          Plenty of LR Defender owners remove the steering wheel at night to prevent theft.

          Well I've driven a Land Rover with just a pair of mole-grips on the end of the steering column, so I'm sure a thief would get around it.

    7. Prst. V.Jeltz Silver badge

      Re: develop detachable steering wheels

      " develop detachable steering wheels"

      well I remember when car stereos used to be removable - and people would plonk them on the bar in a pub like a status symbol. (pinstripe shirt and braces wearing types) .

      Somewhere down the line the stereo manufactured realised you didnt have to drag the whole stereo around with you and the "removable front panel" was invented.

      Further down the line, ie today , for those who still want the "take it with you" security placebo its now just a small "KEY" that comes out of the stereo.

      Full circle.

      1. SImon Hobson Bronze badge

        Re: develop detachable steering wheels

        ... and the "removable front panel" was invented

        And not long afterwards, there came a new market down the pub selling "replacement" front panels ...

    8. Erlang Lacod

      Re: Quick Release or build it like it is in my head

      It used to be practical to do this for family cars up until driver's side airbags became steering wheel mounted. detachable steering wheels are quite a common site for kit cars and some classic cars.

      1. Anonymous Coward
        Happy

        Re: Quick Release or build it like it is in my head

        "detachable steering wheels are quite a common site for kit cars and some classic cars"

        Mine was locked to the roll bar and spare wheel by a bad ass lock and chain.

    9. ChrisBedford

      Re: Quick Release or build it like it is in my head

      The steering wheel could have a unique serial number that hardware in the steering column could detect

      Or in other words, exactly like the immobiliser chip in the key currently works? I have to point out, a key is a lot more convenient to carry in your pocket than a steering wheel.

    10. x 7

      Re: Quick Release or build it like it is in my head

      "What if car manufacturers take a leaf out of Formula 1's book and develop detachable steering wheels for family saloons etc? "

      the siting of airbags in the wheel would stop that......

      however many years ago in a pub alongside the docks in Dublin I was amused to see a rack of steering wheels hanging on the wall while their owners drank excess amounts of Guinness. The steering wheels were routinely removed on parking to prevent the local teen joyriders........

    11. big_D Silver badge

      Re: Quick Release or build it like it is in my head

      So, you want to replace a small, pocketable key for a big one that people will just leave in the car? I can't see people wandering around the local supermarket, steeringwheel in hand.

      The problem isn't the form factor of the key, but the fact that the serial numbers in the keys are based on a very small number of master serial numbers, which means they can be easily cracked. Whether you put the serial number (generator) in the key or the steering wheel doesn't make any difference, you would just need a steeringwheel with the software hack, as opposed to a key with the software hack.

  4. Adam 52 Silver badge

    "Garcia was previously blocked from giving a talk about weaknesses in car immobilisers following a successful application to a British court by Volkswagen"

    Slightly more detail on this here:

    https://www.theguardian.com/technology/2013/jul/26/scientist-banned-revealing-codes-cars

    Very dodgy decision if you ask me.

    1. Cynic_999

      Why was it a dodgy decision? VW did not want the entire paper suppressed, but merely wanted the actual code (cryptographic key) redacted. That would not have reduced the academic purpose of the paper one bit, but would have prevented criminals having the actual key needed to steal cars. The researchers refused to publish the paper without the key.

      1. Anonymous Coward
        Anonymous Coward

        The researchers refused to publish the paper without the key.

        .. which shows the ever present gap between academics and the real world. Sadly, because if the two could occasionally meet properly, both would gain. Now only the lawyers did..

        1. werdsmith Silver badge

          The academics needed to prove what they were saying and needed the real details to do that.

          Otherwise they could be just making it up.

        2. Anonymous Coward
          Anonymous Coward

          Actually in the real world the crooks already have the key. By redacting it from the paper VW could have pretended their security isn't entirely broken and continue to do nothing to protect their customers.

      2. Aitor 1

        Is this a joke?

        If you publish a paper, other scientists must be able to reproduce your claims, and you must basically prove what you say.. no key no prove.

        1. Bry-Itech

          Re: Is this a joke?

          Redact the key and advise others who wish to prove the paper to apply for the key from the key holder in order continue their research

        2. Stevie

          Re: Is this a joke? 4 Altor 1

          Reproducing the results would surely start with finding the key for yourself. That is the vulnerability, after all.

          So I can't agree with your position.

  5. Nunyabiznes
    Joke

    From the Department of Redundancy Department

    I'm glad they didn't have to wired unlock a wireless unlock.

    1. Will Godfrey Silver badge
      Happy

      Re: From the Department of Redundancy Department

      Incidentally, I too, picked that up as well, incidentally.

    2. Anonymous Coward
      Anonymous Coward

      Re: From the Department of Redundancy Department

      Beat me to it, have an upvote.

      Original headline: Thieves can wirelessly unlock up to 100 million Volkswagens wirelessly at the press of a button

      1. Woodnag

        And...

        ...I upvoted you for your courtesy. Call it an untroll point :)

      2. David 132 Silver badge
        Happy

        Re: From the Department of Redundancy Department

        Original headline: Thieves can wirelessly unlock up to 100 million Volkswagens wirelessly at the press of a button

        "..across a wireless WLAN network, using just a PIN number..."

  6. Anonymous Coward
    Anonymous Coward

    Just give me a physical key, please

    Personally I'm not a fan of keyless entry. I prefer some mechanics, also because it gives me an emergency power switch in case things go wrong. In a keyless car it should actually mandated they have the same sort of kill switch installed as is required on racing cars, for the same reason: in case of problems, kill the damn thing.

    Admittedly that'll be a bit harder with electric cars, though (imagine the cabling), but I've worked long enough with electronics and computers to know that a last resort ability to kick the plug out of the socket is not as much a luxury or overengineering as it appears.

    1. Andy Non Silver badge

      Re: Just give me a physical key, please

      I can see those mechanical crooklock type steering wheel locks becoming popular again.

      1. John Brown (no body) Silver badge

        Re: Just give me a physical key, please

        "mechanical crooklock type steering wheel locks"

        Most of which could be removed by an experienced car thief quicker than the real owner could with the key.

    2. Anonymous Coward
      Anonymous Coward

      Re: Just give me a physical key, please

      "In a keyless car it should actually mandated they have the same sort of kill switch installed"

      The engines of keyless Fords can be turned off by pressing and holding the Start button, or by pressing it quickly three times.

      1. Stoneshop

        Re: Just give me a physical key, please

        The engines of keyless Fords can be turned off by pressing and holding the Start button, or by pressing it quickly three times.

        That's not an emergency cutout; it still relies on some piece of software to not have gone titsup. It's not something I'd trust to kill the engine, unless it's some dedicated, separate piece of hardware that controls a Big Chunky Relay killing power to vital parts of the engine (but not braking and steering). But a direct mechanical way to get the relay to disconnect would still be on my requirements list.

      2. Fluffy Cactus

        Re: Just give me a physical key, please

        Kill switch, huh?

        Well, you could attach a mechanical device that cuts the battery cables, the radiator fan belt and a few

        spark plugs, when you pull on that string. Or install a hand grenade that literally blows the engine exactly when you want it to happen. The "sugar in the tank", "sand into the crank case", or "sausage into the

        exhaust pipe" methods work slower, but could also be updated and robotized. So many ways to kill an engine.

    3. Fluffy Cactus

      Re: Just give me a physical key, please

      Yup, that's right. The battery on my FOB died, and I haven't found the time to replace it, so I am using my physical key again.

      It's a whole new world, because no sneaky FOB-radio-listening-hacker can ever get my code. They can of course use physical methods to steal my car, but, hey, who would want to steal a 20 year old rust bucket with a resale value of close to nada, zero and zilch. I am so safe, it's unbelievable.

      But merely as an engineering idea, I think one could come up with an ever-changing random code, such that each time the FOB is used, the code changes. Something with PGP and such with an extra allotment of whatnot.. With radio waves that lie when listened to, in a quantum jumpy sort of way.

      (Yes, your honor, my FOB is smarter than me, yes, my FOB lied, because we told it to.) With a code that is embedded in a bunch of random garbage, and only the car and the FOB knows where it begins or ends. As in: 512 bits of garbage, 5 bits of code, 463 bitsa garbage, 7 bits of code, 585 bits of garbage, 39 bitsa code, 4567 bitsa garbage, 85 bitsa code, plus extra garbage, with the beginning and end of garbage changing based on random crap, time of day, the measurment of marigolds and the weight of sunspots. How hard can it be, when you are inspired?

      Like tomato sauce, except without garbage, it's all in there, salted, spiced, amazing and undoable.

      I wish I wan't too dumb to be a genius.

      Of course, anything will eventually get cracked, just to keep people on their toes.

      Until then, thieves have to go for the obvious and quietly break the mostly still breakable windows.

      Shhhhhh! Be very very quiet, we are hunting VW's...

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like