Today's cars have loads of computer smarts built in. Like the chips that allow you, with the push of a button to unlock your car. And as new cars move down the assembly line, automakers program those functions into the car.
"They produce one car and they program a cryptographic secret in it, in order to secure it against thieves." Timo Kasper, a cryptographer and engineer at the security and IT consulting company Kasper & Oswald. "Then comes the next car on the production line and they put the same secrets into the second car. And then comes the third car on the production line and they again put the same secrets into this car. And they repeat this process for millions of cars in the world. And now millions of cars in the world share the same cryptographic secret. Of course, this secret is not so well protected anymore, because it's in every of these million cars, and in every remote control. And this is of course a typical example of how to not do it."
And yet, he says that's exactly how the Volkswagen Group did do it, for many cars manufactured in the last 20 years. Kasper and his colleagues decoded that shared cryptographic secret by studying the design and operation of chips from VW Group cars and remotes. After hacking the hardware, they were easily able to eavesdrop on and decrypt unlocking signals, clone the remote control and unlock cars. They presented the details August 12th at the USENIX Security Symposium, in Austin, Texas. [Flavio D. Garcia et al., Lock It and Still Lose It—on the (In)Security of Automotive Remote Keyless Entry Systems]
Kasper says VW is aware of the problem—and they're not alone. "This is not a VW bug but this is a red line, as we Germans say, through all the automotive industry." In fact, in the same study, they showed that another encryption system used by many other brands, including Ford, Chevy, Nissan and Mitsubishi, has a weak cryptographic algorithm—which, again, allowed the team to break into more than a dozen cars.
Bottom line? It's easier to hack into cars than many drivers might have imagined. So if you want to avoid eavesdropping, the researchers recommend simply ditching remote controls and cryptography, and just go back to the good old metal key.
—Christopher Intagliata
