Simple hack unlocks 100 million Volkswagen vehicles

[Deleted]

Link: http://www.dailydot.com/layer8/wirel...n-volkswagens/
Source: https://www.wired.com/2016/08/oh-goo...n-volkswagens/

Some 100 million Volkswagens are vulnerable to hackers who discovered key vulnerabilities that allow them to unlock the doors of the most popular cars on earth, according to a new research paper first reported by Wired.

University of Birmingham computer scientist Flavio Garcia was already widely known for working with colleagues to find major security flaws in Volkswagens last year that enabled hackers to quickly takeover a keyless car.

The new attack could result in the theft of anything kept in a car.

When you put the two attacks together, you have a recipe for getting into and driving off with a stolen car in less than 60 seconds—Nic Cage-caliber grand theft auto.

Actually, you don't need to be as good as Nic Cage at all. A thief can pull this off with cheap equipment like a TI Chronos smart watch.

"The attacks are ... highly scalable and could be potentially carried out by an unskilled adversary," the research claims. "Since they are executed solely via the wireless interface, with a t least the range of the original remote control (i.e. a few tens of meters), and leave no physical trace, they pose a severe threat in practice."

VW was told about the issues in 2015 and many car manufactures are using more secure chips of late.

Your Audi A1, however, is in trouble.

Paper: https://www.documentcloud.org/docume...ml#document/p1

3.5.1 Vulnerable Vehicles

Our findings affect amongst others the following
VW Group vehicles manufactured between
1995 and 2016. Cars that we have practically tested
are highlighted in bold. Note that this list is not exhaustive,
as we did not have access to all types and
model years of cars, and that it is unfortunately not
clear if and when a car model has been upgraded to
a newer scheme.

Audi: A1, Q3, R8, S3, TT, various other types of
Audi cars (e.g. remote control part number 4D0 837
231)
VW: Amarok, (New) Beetle, Bora, Caddy,
Crafter, e-Up, Eos, Fox, Golf 4, Golf 5, Golf
6, Golf Plus, Jetta, Lupo, Passat, Polo, T4, T5,
Scirocco, Sharan, Tiguan, Touran, Up
Seat: Alhambra, Altea, Arosa, Cordoba, Ibiza,
Leon, MII, Toledo
Škoda: City Go, Roomster, Fabia 1, Fabia 2,
Octavia, SuperB, Yeti

It is conceivable that all VW Group (except for
some Audi) cars manufactured in the past and partially
today rely on a “constant-key” scheme and are
thus vulnerable to the attacks described in this paper,
except for those cars that rely on the latest platform,
e.g., the Golf 7 for VW.

Note that identical VW Group cars are sold under
different names in other countries, e.g., some Golf
versions were sold as “Rabbit” in North America.
We have tested some remote controls operating at
315 MHz, e.g., for the US market, and found them to
be vulnerable to our attacks as well, i.e., the only difference
to their European counterparts is the operating
frequency. Furthermore, cars of different brands
may share the same basic technology, e.g., we found
some model years of Ford Galaxy that have the same
flawed RKE system as their VW Group derivatives
VW Sharan and Seat Alhambra

Volkswagen is really doing a number on that famed German engineering reputation!

[Kapadons]

And what does someone do with the car after they have stolen it ?

Chop it for parts? That floods the market and craters prices.
Drive it? Pretty sure every one of these has gps in it.
Sell it ? Unless it's to foreign shores, it won't really work out.

So really it's just about getting what is inside them? I can walk out to my 2016 F150 and have the door popped with tools I bought from Walmart in about 2 minutes.

It sucks that Volkswagen let this happen and obviously needs to find a way to fix it. But I'm not sure this is a huge deal.

[starlord]

computerized anything always introduces vulnerabilities. never trusted keyless cars anyhow.

[Glaziola]

Keyless, so we the people who drive "old" cars that still require a key are unaffected by this right?