: Keyless Entry Shenanigans
red '69 Mar 21st, 06, 9:10 AM I just got back from visiting my sister in San Diego. While we were there, we went to the San Diego Zoo. We parked the Tahoe, locked it (I know, because I checked it myself), and went in. When we came out 5 hours later, it was UNLOCKED and my iPod, the FM transmitter thingie for my iPod, and my sister's video camera were gone. Just about $1100 worth of stuff. Not a real mind blower that a car got broken into, but the weird thing is there were no signs of forced entry. The caked dust on the windows from the ocean salt and sand was undisturbed and I started to second guess that it was locked (Even though I know it was). We went to the security office and sure enough when we told them it was a Tahoe, all five people turned around and the guy asked if it had keyless entry. I said yes and he proceeded to tell me this has happened a couple other times in recent weeks. Anyone else heard about this? It wouldn't surprise me, as there are devices to jam other people's cell phones, change the traffic lights to green, etc.
Byfield Mar 21st, 06, 9:48 AM Man, that sucks. Sorry to hear it.
Remember the old stories of how people would get into the wrong car because their key would unlock a similar looking vehicle to the one they owned? Something about there being a limited # of keys profiles?
Maybe something like that is happening? That there's only X number of codes and if you walk thru a parking lot with it and try it on every Tahoe, sooner or later one will unlock?
Olle Mar 21st, 06, 9:57 AM That there's only X number of codes and if you walk thru a parking lot with it and try it on every Tahoe, sooner or later one will unlock?
Those keypads only have four or five keys, right? That means that the number of combinations is pretty limited. Correct me if I'm wrong, but if you have four keys, you'll have 4*4*4*4 = 256 combinations. It would still take some time to try them all.
bisjoe Mar 21st, 06, 10:03 AM It sounds like some thief has specialized in specifically opening Tahoes. On the other hand I have heard of cases where the body control module on various cars can act up making doors and windows lock and unlock randomly.
Maybe an aftermarket alarm that's not working with the BCM would help.
KAA Mar 21st, 06, 10:15 AM Correct me if I'm wrong, but if you have four keys, you'll have 4*4*4*4 = 256 combinations. It would still take some time to try them all.It depends on the number of possibilities each key has. Assuming it's 0-9 and there are four keys on the keypad, that's 10,000 possible combinations. 10 to the 4th power 10 ^ 4).
However, I don't think Tahoe's have a keypad entry system. My 2002 does not. It only has the keyless entry transmitter (fob). I have no idea how many different codes there are for the keyless transmitters but there has to be millions. We're probably talking about hex numbers where there are 16 possibilites for each digit. 0-9 and A-F. You only need a 5 digit hex number to get over 1 million different combos. 16 ^ 5 = 1,048,576.
The other thing to consider is this Onstar crap. I will NOT give anyone the power to unlock or track my vehicle in any way. I don't care how secure they claim their system is.
KAA Mar 21st, 06, 10:30 AM I just looked this up on www.howstuffworks.com. I love that site. Anyways, here is what they say about modern keyless entry systems:
"The controller chip in any modern controller uses something called a hopping code or a rolling code to provide security. For example, if you read this PDF, it describes a system that uses a 40-bit rolling code. Forty bits provide 240 (about 1 trillion) possible codes. Here's how it works:
The transmitter's controller chip has a memory location that holds the current 40-bit code. When you push a button on your key fob, it sends that 40-bit code along with a function code that tells the car what you want to do (lock the doors, unlock the doors, open the trunk, etc.).
The receiver's controller chip also has a memory location that holds the current 40-bit code. If the receiver gets the 40-bit code it expects, then it performs the requested function. If not, it does nothing.
Both the transmitter and the receiver use the same pseudo-random number generator. When the transmitter sends a 40-bit code, it uses the pseudo-random number generator to pick a new code, which it stores in memory. On the other end, when the receiver receives a valid code, it uses the same pseudo-random number generator to pick a new one. In this way, the transmitter and the receiver are synchronized. The receiver only opens the door if it receives the code it expects.
If you are a mile away from your car and accidentally push the button on the transmitter, the transmitter and receiver are no longer synchronized. The receiver solves this problem by accepting any of the next 256 possible valid codes in the pseudo-random number sequence. This way, you (or your three-year-old child) could "accidentally" push a button on the transmitter up to 256 times and it would be okay -- the receiver would still accept the transmission and perform the requested function. However, if you accidentally push the button 257 times, the receiver will totally ignore your transmitter. It won't work anymore."
"Given a 40-bit code, four transmitters and up to 256 levels of look-ahead in the pseudo-random number generator to avoid desynchronization, there is a one-in-a-billion chance of your transmitter opening another car's doors. When you take into account the fact that all car manufacturers use different systems and that the newest systems use many more bits, you can see that it is nearly impossible for any given key fob to open any other car door. "
Sounds pretty secure to me. Here's a link to the whole article:
http://auto.howstuffworks.com/remote-entry.htm
Olle Mar 21st, 06, 11:23 AM It depends on the number of possibilities each key has. Assuming it's 0-9 and there are four keys on the keypad, that's 10,000 possible combinations. 10 to the 4th power 10 ^ 4).
No, not really. You can put 100 numbers on each key if you want to, but it won't give you more actual combinations. In a way, there will be thousands of possible combinations, but most of them will be duplicates.
Byfield Mar 21st, 06, 11:42 AM I emailed a friend who works for a GM dealer and this is what he said:
Theoretically this is impossible on the newer vehicles (99 and up) as they have "rolling code" keyless entry systems........though there might, but I don't think so, to override something with the OnStar system to get an "unlock" signal....though the OnStar stuff is digitally encrypted also......not really sure how that could be done unless the "thief" is a GM dealership employee with access to VIN files and key code files......and that is all behind "password" protected links.....if I really wanted to get paranoid I could work out a somewhat elaborate scenario for getting this information and breaking into a vehicle....I would more likely suspect that either they left a door unlocked or had some other event occur that allowed access to the vehicle without overriding the RKE system......
camaroman7d Mar 21st, 06, 11:50 AM I don;t think there is a key pad. So that pretty much eliminates that option. Sounds to me like someone has a "master" key fob of some sort for GM vehicles. If it was a key they alarm would go off. If I open the door on my GMC with the "alarm" set, it will go off. Whoever is openeing these cars has a fob or transmitter of some sort to disarm and unlock the doors. that's pretty scary. I have heard that by getting your vin number they can have a fob made and or get keys for your vehicle. It is actually suggested that you cover part of your VIN (or all of it) so crooks don't use it to get access to your vehicle. I doubt someone could have had a key made or fob programmed that fast but, if they have friends at the dealership, it is very possible. They watch you park get your VIN, run down to the dealer get a key or fob made up run back and rip you off. At a place like the SD Zoo they know you will be gone for a few hours.
Man I hate low life crooks.
Edit: Kurt I was posting at the same time. Here is a scenario, I am on a team of crooks 2 or more. My assignment is to watch for victims. I see a GM vehicle pull in, my job is to get the VIN and call my "teamate" with the info he is at or near the dealership. He goes in with the VIN tells him he lost the keys and fob, they make him a new one for a very small fee and off he goes to open the dorrs and steal what he wants. That would only take a very short amount of time. I would think if they went through that much trouble they would just take the whole truck/car though. For your friend at GM to say it's ot possible to get codes etc... he has his head barried in the sand. They said that about cell phones and all types of other devices in the past, crooks are often pretty smart (but always make a mistake or get gready and get caught) so, I wouldn't say it is impossible. I am leaning toward thinking someone has come up with a master fob of some sort. This would explain why the aren't taking the whole vehicle. If you pop the hood and disconnect the battery and reconnect it would that pop the door locks? Were the station presets still saved after the theft?
1BLACKHARLEY Mar 21st, 06, 12:05 PM you are all way over thinking this. a slim jim and five seconds and he's in. and after five hours any dust you think you might see moved would have been replaced. plus a slim jim can be as small as 1" wide, if he went threw a back door, then unlocked the doors, went on to the next car, as his team went from car to car, taking everything, they can get thier hands on. they took electronics, and they hit many vehicles, this was a team effort, somebody familiar with the area. i'm surprised they don't have cameras in the parking lot, especially with liability the way it is today. i find it hard to believe, they don't have it on film......
Byfield Mar 21st, 06, 12:11 PM FOllowup from friend at GM dealer
Yes, there is a way to get into a vehicle with RKE.....the thief needs a "transceiver" to "lock" onto the signal from the vehicle keyless entry transmitter fob....as long as the thief "stays within range"....about 50 feet or less of the vehicle they can then use the "transmitter" portion of this device to "Unlock" the vehicle......once the "transceiver" moves out of range it can no longer be used for entry into that vehicle.......according to our service manager, O'Hare has been having this problem lately.....people parking cars/trucks and unloading and getting ready to catch a flight are more concerned with getting to the ticket counter than with other people around them......this problem is apparently not unique to GM but is an inherent fault in almost all RKE systems......I suppose some sort of 128 or 256 bit encryption would foil the thieves for a while but would be a whole bunch more expensive than the current iteration of RKE systems......
Bowtie-72 Mar 21st, 06, 12:45 PM Here is a scenario, I am on a team of crooks 2 or more. My assignment is to watch for victims. I see a GM vehicle pull in, my job is to get the VIN and call my "teamate" with the info he is at or near the dealership. He goes in with the VIN tells him he lost the keys and fob, they make him a new one for a very small fee and off he goes to open the dorrs and steal what he wants. That would only take a very short amount of time. I would think if they went through that much trouble they would just take the whole truck/car though. For your friend at GM to say it's ot possible to get codes etc... he has his head barried in the sand. They said that about cell phones and all types of other devices in the past, crooks are often pretty smart (but always make a mistake or get gready and get caught) so, I wouldn't say it is impossible. I am leaning toward thinking someone has come up with a master fob of some sort. This would explain why the aren't taking the whole vehicle. If you pop the hood and disconnect the battery and reconnect it would that pop the door locks? Were the station presets still saved after the theft?
Not to be a spoilsport, but...
GM requires not only the VIN, but now also the owner's name, license plate number and state issued, as well as proof of ownership. Also, the key fob needs to be re-programmed, which is done after you have key and are inside car/truck. Also, some keys have chips embedded in them, and need to be programmed to vehicle before they will work, as the ignition switch may have a module.
J70Chev Mar 21st, 06, 12:48 PM Not that it's totally relavant, but a long time ago when I used to do car stereos and alarms, I was working on a NICE porsche road racer that had a system and alarm. I was mounting an amp under the hood and when I hit my makita drill to screw it down the alarm chirped and the windows rolled down. Then I did it again and it chirped again and they rolled up. Somehow the drill was putting out a frequency that armed, and disarmed the alarm. I think it was an UngoBox alarm. This was probably in 1995 or so
red '69 Mar 21st, 06, 1:56 PM To answer a couple of questions, the Tahoe is a '98, so possibly(?) it doesn't have rolling codes, and it's not a keypad on the door. It is a remote (key fob). Also, the dust wasn't just "dust". It's the caked on stuff from the saltwater and the beach. I'm certain it wasn't jimmy sticked but the more I think about it maybe they just unlocked it with a master key or some punk kid has access to locksmith tools and hit the power locks to open the other doors. If they haven't caught anyone yet, how do they know the keyless entry is the way these people have gotten in? I guess I need to call and ask them that. Also, they said the parking lot is city property so they cannot patrol it. Sounds like a copout to me.
bisjoe Mar 21st, 06, 2:21 PM I think Kurt's dealership friend hit upon the answer. A device can easily be made by an electronics expert that will read and display or record the code sent by the fob to lock the door. It would also be easy for them to make a unit that would tranmit that same code. They would only have to be standing or sitting in a car within range when the victim pushed the lock button on their fob. A simple solution is, when in a large parking lot where there could be such thieves, don't lock by remote, push the button on the door or use the key to lock it.
Bowtie-72 Mar 21st, 06, 2:44 PM I think Kurt's dealership friend hit upon the answer. A device can easily be made by an electronics expert that will read and display or record the code sent by the fob to lock the door. It would also be easy for them to make a unit that would tranmit that same code. They would only have to be standing or sitting in a car within range when the victim pushed the lock button on their fob. A simple solution is, when in a large parking lot where there could be such thieves, don't lock by remote, push the button on the door or use the key to lock it.
I know there's alreaders out there that will read a garage door opener, which I believe is he same premise as keyless remotes. They read the RF frequency, and then are able to re-broadcast.
as for a "master key" -nope. I do coding for lock cylinders, and it just wouldn't be possible to make one. there's 4-5 different depth tumblers in the cylinder, and up to 9 different tumblers per cylinder. they are pretty finicky too. I vote for slim-jim or the very unlikely code reader. more probably, a door lock actuator didn't lock a particlular door, and t was opened that way.
Olle Mar 21st, 06, 3:01 PM I know there's alreaders out there that will read a garage door opener, which I believe is he same premise as keyless remotes. They read the RF frequency, and then are able to re-broadcast.
Many new cars come with those programable garage door opener remotes built in. Wonder if the same principle can be used for remote car locks? Like parking next to a vehicle at Walmart and read and record the signal when the owner opens his car. Then follow him, and next time he parks you can pop the locks. I'm hoping it's not that easy.
Philip Mar 21st, 06, 3:23 PM Sounds like you only have remote entry and not an alarm system. My truck makes loud noises if it is disturbed in any way after the remote locks the doors and sets the alarm.
An easy solution is not leave anything of value in the vehicle. If you do not need it leave it home or in the hotel. If a break in occurs you will have lost nothing. If there were any papers in the car with your name and home address (or your sisters) on them I would worry about the same thieves showing up at your home to remove more of your stuff.
17Again Mar 21st, 06, 8:33 PM It could be as simple as clicking the remote operator, doors are locked as you checked, then as you put the keys in your pocket the button got pushed again unlocking the Tahoe, thief finds unlocked vehicle and makes off with contents.
I have accidently unlocked cars before in this manner.
The fact that it is a Tahoe is just coincidence for the location.
Does the horn sound while locking and unlocking? My Honda does not chirp when unlocking.
Rob
Olle Mar 21st, 06, 8:45 PM It could be as simple as clicking the remote operator, doors are locked as you checked, then as you put the keys in your pocket the button got pushed again unlocking the Tahoe, thief finds unlocked vehicle and makes off with contents.
I have accidently unlocked cars before in this manner.
The fact that it is a Tahoe is just coincidence for the location.
Does the horn sound while locking and unlocking? My Honda does not chirp when unlocking.
Rob
If you unlock the doors on a Honda, they will lock again if you don't open the door within a minute or so. Pretty neat feature, prevents you from accidentally leaving the car unlocked if you happen to push the button.
I think the "chirp" can be enabled/disabled on most cars.
17Again Mar 21st, 06, 8:52 PM That is true Olle.
Quick story, wife comes home sets keys on counter top at about 6:30pm, before long my 2 yr old daughter is playing with the keys. I always double check the alarm before going to bed. At 11pm I hit the button, but no chirp, look outside and find that the power sliding doors are open and its raining pretty good.
Keys are now kept well out reach of little people.
pdq67 Mar 21st, 06, 9:25 PM Just think, if we all had manual locks and arm-strong windows, we wouldn't be worrying how they got in!!
Either somebody punched a lock or used a slim-Jim!!
pdq67
Finally Mar 21st, 06, 9:28 PM As 1blackharley said you don't need a remote to open the door. There are only so many keys, not remotes, keys. If you have the right key you can open the door. Now if it's just keyless entry, no alarm, the door is open and no alarm or siren. If all you want to do is steal the contents then you're all set.
If you want to steal the car that's different. If you locked the car with the remote but open with a key, then you have to have a key with the right chip in it to start the car.
Walk down any line of GM vehicles and see just how many doors your key will unlock, you'd be surprised.
pdq67 Mar 21st, 06, 10:54 PM To me, this ain't worth a *
Tell me I'm wrong to not want power locks... I know they are convenient but still if my car isn't secure then what the hey???
AND I love power windows except they break and have to be fixed every so often!!
pdq67
Slowpoke70 Mar 22nd, 06, 12:30 AM I've tried the "use your key on other GM's" excercise, its fun.
Want to get more worried? I can open the locks on MOST of my friends'/family 69-9? cars with my Chevelle's key, or most any GM key of that style. I've only got one or two ignitions to turn though.
charbilly2001 Mar 22nd, 06, 2:14 AM Seems to me that it would be prudent to locate the fuse in the fuse box that supplies your keyless entry system and take it with you next time.
The only caution I would give would be to check what "depowering" the system might cause in the way of additional problems. :)
| |