Keyless entry vulnerability: Manufacturers introduce fixes, but is your car still vulnerable?
Thatcham have tested six new vehicles with keyless entry/start function. The results are promising, but is it enough to beat thieves?
The aim of the tests was to determine what measures manufacturers have introduced to protect against weaknesses in vehicle technology.
Models from Audi, BMW, Ford and Volkswagen were all tested then placed into the category of either ‘superior’, ‘good’, ‘poor’, 'basic' or ‘unacceptable’.
The good news is all six vehicles tested in November scored superior ratings for all-round security, and for having a defence against a relay attack. But is this enough to stop criminals?
Compare car insurance quotes
What are the weaknesses in vehicle technology?
Thatcham conducts security tests that measure how vehicles respond to different types of illegal entry. For example, brute-force attacks on locks or identifying digital vulnerabilities.
Part of its research has focused on the keyless entry/start function, which is easily hacked into by criminals through what’s known as a ‘relay attack’.
This involves criminals usually working in pairs using two devices. They'll usually target vehicles that are parked near to the victim’s home, for example on their driveway or on the road nearby.
One of the devices is held against the car which captures the signal the car sends to the key.
The second device is held at the front of the victim’s home, which relays the signal from the car to the key inside. The car thinks the key is present and can be unlocked then started.
In March 2019, Thatcham began testing how new vehicles stood up to this kind of attack. The results of this test have formed the new consumer rating system. This second round of testing took place in November.
What models were tested for vulnerabilities
Thatcham tested six models in the second of their consumer tests, these included:
the Audi A6 Allroad
BMW 1 SERIES
BMW 8 SERIES
These models all scored a 'superior' rating for all-round security as they introduced a motion sensor fob.
The motion sensor detects when the fob has been stationary for a while, which triggers sleep mode.
During sleep mode the fob no longer responds to the relay signals, protecting the vehicle from relay attack. Full functionality is restored when the owner moves the key.
Richard Billyeald, Chief Technical Officer for Thatcham research comments:
“the models […] not only have strong all-round security but have also made motion sensor enabled fobs available as standard when buyers opt for keyless entry and start. It’s positive news for consumers that car makers, in increasing measure, are making this fix available”
Read more: The 10 most stolen cars in Britain
Keyless entry car owners should still be vigilant
However, Billyeald adds that this isn’t a complete fix.
“The motion sensor fob is a good short-term option, but the goal for carmakers must be to design out the vulnerability entirely. Until then, a fundamental security flaw remains.”
“We advise consumers to check how long it takes before the sleep mode on their keyless fob is engaged. Some go to sleep in one or two minutes, others in 15 or even as long as 30 minutes”
In addition, vehicle owners who have bought a car with the keyless entry system before the sleep mode was introduced will also still be vulnerable to attack.
If you have a keyless car without the motion sensor, you should:
Consider getting a faraday pouch to store the fob at night.
Check your owner's manual to see if it can be switched off completely
Keep fobs, including spares, away from household entry points
Some manufacturers, such as Ford, offer a software update that installs the sleep mode onto a new key.
“We urge manufacturers to bring keyless technology to the market in a secure form and remove from drivers the onus to provide additional security” says Billyeald.
Advice for drivers
Another great way to combat thieves is through a multi-layered approach to security
National Police Chiefs’ Council Lead for vehicle crime, Deputy Assistant Commissioner Graham McNulty says:
“Part of the reason for the recent increase in vehicle theft is the rapid development in technology.
“The significant reductions in vehicle crime in the 1990s were achieved by police working with manufacturers to ‘design out’ crime with innovations like immobilisers, alarms and central locking.
“This approach is as valid today as it was then.”
Immobilisers are electronic devices that prevent the car from being started unless the proper key is used. Although it won’t stop criminals trying to break in to your vehicle, they should prevent your car from being stolen.
Although seemingly obvious, it’s worth taking an extra two minutes to ensure your car is locked. Even if you’re only leaving it for two minutes while you fill up at the petrol station.
Traditional methods like steering locks/gearstick and handbrake locks also act as a visual deterrent for thieves, as well as adding an extra layer of security.