back to article 'Open sesame'... Subaru key fobs vulnerable, says engineer

A Dutch electronics engineer reckons Japanese auto-maker Subaru isn't acting on a key-fob cloning vulnerability he discovered. Tom Wimmenhove claims to have discovered that Subaru's electronic keys don't use a random number. The “rolling code” instead merely increments codes. Wimmenhove says he's built a cloning device ( …

  1. Anonymous Coward
    Anonymous Coward

    This won't be addressed

    Cost of replacement vs. low risk makes it unlikely to be addressed:

    - Subaru are nice cars, but hardly on the hotlist of most stolen cars

    - it takes effort to do this for a low return value

    - you need to be close enough to catch the signal when transmitted to have the initial count

    - they're older cars: it could get interesting if that's still the case with new cars.

    I can't see Subaru pay too much attention to this.

    1. Voland's right hand Silver badge

      Re: This won't be addressed

      It was from the days before it was offloaded to Toyota. In addition to everything, it now uses a different ECU and different transmitters - the Toyota ones. So, the "current" Subaru does not have the relationship with the manufacturers of the parts used in the old ECU and keyfobs to start off with.

      1. Deej

        Re: This won't be addressed

        Er.. I'm not sure Subaru has been "offloaded". Sure, they've done a couple of joint ventures with Toyota (like the BRZ/GT86), but they're still very much independent and a brand in their own right.

        However, you are right that they could well use different ECUs and transmitters, just as the technology has naturally evolved over time.

    2. Tim99 Silver badge

      Re: This won't be addressed

      "Subaru are nice cars, but hardly on the hotlist of most stolen cars

      "Jack the Lad" likes older Impreza WRX/STI to joyride with his mates.

      1. Anonymous Coward
        Anonymous Coward

        Re: This won't be addressed

        The term "Clitoris"* vehicle, when describing the Impreza is the most accurtate after market name ever given to a vehicle.

        *Only C**** have them.

        1. Anonymous Coward
          Anonymous Coward

          Re: This won't be addressed

          So, you were overtaken by one and without it´s wing you would not even have had time to identify it?

        2. rsole

          Re: This won't be addressed

          Do you even know what "accurtate" means?

      2. JamesPond

        Re: This won't be addressed

        A mate of mine had his Subaru RB320 stolen by thieves that broke into his house, took the keys and used the car for a post office robbery. Police rammed it several times, came back with every panel but the roof damaged, all 4 alloys bent! Very nice fast car but if you ever watch police car chase programs, the thieves are usually driving a Subaru WRX or Mitsubishi Evo, although maybe now Audi RS3's seem to be preferred.

    3. Adam 1 Silver badge

      Re: This won't be addressed

      But a decade before these models the Rex would have been close to the most stolen vehicle on sale. It's a bit hard to judge on popularity amongst car theives because cars are broken into for different reasons (joy ride/use in a crime/rebirthing/theft of contents/stereo etc)

      The first two are much harder now due to immobilisers. The third is harder because of datadot. The fifth is less of an issue in modern cars, especially those where the stock head unit supports Bluetooth and Android auto/Apple car play (there isn't much of a second hand back of the truck market for stock head units). Smash and grab is still an issue but frankly a secure rolling code isn't going to help you avoid that.

    4. Anonymous Coward
      Anonymous Coward

      Re: This won't be addressed

      "- Subaru are nice cars, but hardly on the hotlist of most stolen cars"

      They weren't on the hotlist until someone publicised a vulnerability that allowed key-fob cloning using cheap off the shelf hardware. I wonder whether the third party central locking kits you can get have similar vulnerabilities, or whether there will be a sudden burst of people fitting them to old Subarus.

    5. Alan Brown Silver badge

      Re: This won't be addressed

      "Cost of replacement vs. low risk makes it unlikely to be addressed:"

      The insurance industry has recently noted an uptick in car thefts without keys and aren't happy that it's due to poor security in car immobilisers and remote unlocking systems finally being exploited by cheap tech like RasPis

      In a parallel vein, sales of things like "The Club" are on the rise again.

    6. Aodhhan Bronze badge

      Re: This won't be addressed

      Stop and think about it for just 5 minutes, instead of throwing in a comment which isn't even worth 2 cents.

      Follow Suburu cars pulling into mall parking lots, movie lots or anywhere else around Christmas time with this vulnerability, and you'll gather up enough merchandise to make back your $25 easily.

      Plenty of people drive older cars, and just because he published older car models, doesn't mean it doesn't work with newer models.

      If you can't think like a criminal, then you're not going to do well in information security.

    7. Robert Carnegie Silver badge

      Re: This won't be addressed

      It's fairly easy to attach a small package of electronics to a car to do mischief on its own. Spider-Man would do it using his special spider web that lasts for an hour. Indeed he's been using electronic "spider-tracers" on people as well as vehicles for decades - the device makes his secret spider-sense buzz.

      Oddly though he tends to ride on the outside of buses, trains, and private motor vehicles to get around, when he isn't swinging on web-lines around town like an urban Tarzan with lianas.

  2. Anonymous Coward
    Anonymous Coward

    Re. Rolling codes

    I am in the process of implementing this on i10, seems that my problems with random failure of the keyfob

    might be attempts to get into the car by a third party as well as radar interference.

    Its feasible to use optical buffers (ie rapidly spinning GITD disk) and simple blue / IR LEDs with SMD diode pickup to store codes avoiding the need for a more expensive setup.

    Also the advantage here is that even if someone finds the device you can claim its just a regular laptop HDD in a caddy as the RF circuitry and antenna can be disguised as part of the cable.

    1. Flocke Kroes Silver badge

      Re: Home made CD-RW

      For £6 you can get an 8GB μSDHC card that will store the boot code needed to access your improvised optical storage device. If you delete the rest of the rest of the improvised storage device and just keep the μSDHC card to store codes then you have saved space, money, made the device more robust and drastically cut the power requirements.

      People gave up trying to develop a competitive RW optical disk years ago.

  3. This post has been deleted by its author

  4. Anonymous Coward
    Anonymous Coward

    All your Subaru

    are belong to us.

  5. Anonymous Coward
    Anonymous Coward

    Weakest link...

    This hack seems a lot more complicated than the traditional brick or hammer approach. I always wondered if you’re smart enough to do this kind of thing, you can probably get a job that pays better than breaking and entering...

    1. Maventi

      Re: Weakest link...

      Possibly - but if done right this has some very sneaky potential.

      It won't really speed up someone stealing the car outright (and that would be obvious anyway) but if you say left a wallet (or valuable item) in the car and a thief was able to unlock the car, steal the item and then lock the car afterwards, a lot of folks wouldn't even immediately notice and would likely have a hard time trying to remember where they actually last left with said wallet or item.

      Certainly a locked car with no trace of tampering would not be high on the initial suspect list, and by the time the victim takes any decisive action, the thief has already had plenty of time to spend up large on their credit card or fob off stolen item. It's likely the car would remain completely unsuspected even well after the fact.

      1. Pascal Monett Silver badge

        Re: "a locked car with no trace of tampering"

        Would also not figure very high on the list of important things to investigate from a Police Dept. point of view.

        Not to mention that every single insurance company would point to absence of break-in and leave you up the creek without a paddle.

        So not good in any sense of the word.

    2. Anonymous Coward
      Anonymous Coward

      Re: Weakest link...

      "if you’re smart enough to do this kind of thing, you can probably get a job that pays better than breaking and entering..."

      Like making the devices to sell to others?

      1. StephenTompsett

        Re: Weakest link...

        Some criminals appear to be willing to expend an awful amount of effort for very small return.

        Some will do almost anything anything to avoid 'working'!

        1. MJI Silver badge

          Re: Weakest link...

          I don't get this. They put in days of work at well under minimum wage to make money.

          They would be better off fruit picking or something else of that type

  6. Zog_but_not_the_first Silver badge
    Thumb Up

    Country Joe...

    and the Scoobie?????

    Top marks for arcane references.

    1. Zippy's Sausage Factory
      Thumb Up

      Re: Country Joe...

      "You now you're never gonna stop the war if we can't hear you" or words to that effect? :)

    2. ArchieTheAlbatross
      Thumb Up

      Re: Country Joe...

      Best reference of the week so far, old guys rule!

      (The only people who drive Subarus round here are farmers, who never lock them anyway).

    3. Captain Badmouth
      Thumb Up

      Re: Country Joe...

      Country Joe... and the Scoobie?????

      and the phish, shirley?

      Upvote for the arcane reference reference.

      1. Antron Argaiv Silver badge

        Re: Country Joe...

        Gimme an F....

  7. David Roberts Silver badge

    Cheap components?

    I was sceptical about building the whole thing for $25 so I had a quick search.

    Damn, but there is some cheap kit around.

    Now wondering if a DVB-T stick would work with my Android tablet.

    1. Jason Bloomberg Silver badge

      Re: Cheap components?

      I was wondering why he needed a DVB-T stick to handle 433MHz signals when a suitable receiver can be bought on eBay for around a dollar with free shipping.

      1. Anonymous Coward
        Anonymous Coward

        Re: Cheap components?

        Because it can handle a very wide range of frequencies.

      2. Alan Brown Silver badge

        Re: Cheap components?

        "I was wondering why he needed a DVB-T stick to handle 433MHz "

        Because purchasing one draws less attention than buying a 433MHz module when the rozzers start poking into purchase histories.

  8. John Smith 19 Gold badge
    Coat

    The Rasberry Pi

    Is there no end to what it can do in the hands of the clueful?

  9. 0laf Silver badge
    FAIL

    Remember how VAG fixed the Megamos vulnerability that affected millions of cars from Skodas and Audis to Bugattis?

    Nope me either

  10. bitmap animal

    This will only open the doors

    I'm almost certain that they also have a separate immobiliser 'chip' in the physical key. This technique will open the doors which means you can steal whatever is in the car car and will also disable the alarm making it easier to tow but still won't let you drive it away.

    1. VaalDonkie

      Re: This will only open the doors

      You will be surprised to learn how many Subaru models do not have an immobiliser

      1. wyatt

        Re: This will only open the doors

        My mondeo has decided to implement its own immobiliser. Fecking thing is a witch to start at the moment.

        1. inmypjs Silver badge

          Re: This will only open the doors

          " Fecking thing is a witch to start "

          Mate had a beat up Mondeo parked outside his house. Early hours of the morning Police knock on the door saying neighbours had reported someone trying to steal his car.

          Car was still there, it had been broken into. Police asked if anything was missing. Mate replied the ignition key. Police say 'what'.

          Mate explains ignition lock is dicky and it takes ages fiddling around to get the key in it so he leaves the key in the lock. Thief must have thought my mate an idiot then pulled out the key and triggered the car's immobiliser :)

        2. Solmyr ibn Wali Barad

          Re: Fecking thing is a witch to start

          Once upon a time there was a rusty Lada standing by the street. It had a note on it: "If you can start it, the pint's on me". Yet nobody seemed to accept the challenge.

          1. MyffyW Silver badge

            Re: Fecking thing is a witch to start

            My friend Dom had a Vauxhall Ashtray which he parked unlocked around the city back when car theft was the North East's chief youth training scheme. He'd flip the bonnet and remove the HT lead. Never had a problem. That said, the car was a total shit tip.

        3. nijam

          Re: This will only open the doors

          > My mondeo has decided to implement its own immobiliser

          It's built in to the Ford badge.

      2. inmypjs Silver badge

        Re: This will only open the doors

        "You will be surprised to learn how many Subaru models do not have an immobiliser"

        Mine does although you wouldn't know it is there. Won't start without the car coded chip in the key being close to the steering column.

    2. Alan Brown Silver badge

      Re: This will only open the doors

      "I'm almost certain that they also have a separate immobiliser 'chip' in the physical key."

      Yup, but if you have access to the interior of the car then you also have access to the ODB2 port and you can teach it that the key transponder you just taped to the pickup ring is legitimate.

      Professional outfits will just disable the alarm and lift the car, but the real problem will be when cheap kits start circulating allowing 20-30 recidivist sociopaths to raise mayhem by stealing any scooby they want.

      FWIW: the most stolen cars are not the high performance ones. Those attract too much attention. Hardened car theives steal boring econoboxes that noone looks twice at.

  11. iron Silver badge

    A vulnerability found in a old model also works on other models created years before the vulnerability was found? Well colour me shocked. Surely Subaru should have fixed it before he found it.

    Is it necessary to be a complete dick to be a security researcher or does it just help?

  12. Velv Silver badge
    Boffin

    Maybe I missed something here...

    You can unlock the vehicle right? OK, so you can get at any possessions stored in the boot, glove box etc.

    But this doesn't bypass the immobiliser? You still need the correct key in the ignition to start the thing?

  13. Anonymous Coward
    Anonymous Coward

    This is not new....

    ...this was an issue on plenty of older makes of cars.

    Heck many 12 year old cars you can easily brute force the locks.

    How many owners are going to pay for a service to pay for the fix, even if there is one?

  14. EnviableOne Bronze badge

    Subaru is owned by

    Toyota Motor (16.48%)

    The Master Trust Bank of Japan (5.40%)

    Japan Trustee Services Bank (4.38%)

    Mizuho Bank, Ltd. (2.05%)

    Suzuki Motor Corporation (1.75%)

    Sompo Japan Nipponkoa Insurance Inc. (1.55%)

    FHI's Client Stock Ownership (1.40%)

    Toyota Marine & Nichido Fire Insurance Co., Ltd. (1.32%)

    And on the Nikkei 225

  15. ChrisC

    Can the fob *really* be "bricked"...

    ...or is it merely rendered temporarily useless until the owner recodes it to the car using the procedure documented in the user manual?

  16. DrM
    WTF?

    WTF?

    The “rolling code” instead merely increments codes.

    Ah -- yes, that is how rolling codes work, the whole idea behind them. They roll, they don't hop.

    You think a randomly selected code can work with a one-way data link? If you can use a random number for the next key, why not just use the random number? What do you need a rolling code for??

    Rolling code hacking is nothing new. https://en.wikipedia.org/wiki/Rolling_code#Vulnerabilities

    1. druck Silver badge
      Facepalm

      Re: WTF?

      Rolling codes are normally encrypted or hashed in some way these days, so an observer doesn't just see 1,2,3 being sent over the air.

  17. Alan Brown Silver badge

    bricking attacks

    "the attacker can brick the owner's key fob with an integer overrun"

    Only temporarily. Reintroducing the key to the car using the standard pairing sequence will fix that (it can happen in 2 key households with virtually any car if there are more than ~50 lock/unlocks from one fob before the other is used.)

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019