Saturday, May 06, 2006

RFID Ignition For Thieves

Turns out that most of the keyless ignition systems (often found in high-dollar cars, such as Mercedes-Benz [Keyless Go] and Lexus [SmartAccess]) use a really basic 40-bit encryption key(*). This means they can generally be hacked in minutes or less by a modern laptop and a motivated individual with an RFID reader. A little bit of knowledge of a car's particular system, and the ability to come into close-enough proximity with the "key fob" without being detected, can make the hack even easier. So -- do you trust Mercedes' statement in the Edmunds article that "It's nearly impossible to unlock the steering column or start the engine without the owner's remote unit," or do you believe that it's a little too easy to clone said remote unit...

*: A 40-bit key is equivalent to the original WEP standard for Wi-Fi, and we have countless examples of how lazy implementation of code rolling made that easily hackable...