Anybody got a keyless entry car?

Want to open any car or garage door? Seems the algorithm used in the Keeloq security system, used for keyless entry into several makes of cars and garage doors is fundamentally flawed. I love reading stuff like this:

  1. Closed source security algorithm has a weakness in it, by accident or intent.
  2. Someone finds the weakness.
  3. Someone notifies the vendor, and the weakness is patched.
  4. Someone publicizes an exploit to the world.

Often, 2. happens inside the vendor, and 4. never happens. Sometimes, like the google mail hijack bug, 2., 3. and 4. are the same person, who is just trying to warn you your security shoe is untied. Sometimes, 2. and 3-4. are different people, the weakness gets maliciously exploited for a while before 3. happens. Some times, like in the present case, the algorithm goes unpatched for 20 years, and is hard coded millions of devices, so a fix becomes completely infeasible. The exploit may be only a proof-of-concept right now, but perhaps master-keys for luxury cars are only a few weeks away on eBay….. Oh, the “intent” part came from the time back in ’97 when the NSA was accused of intentionally designing a weakness into the cell phone cryptography CMEA. Bless those grey-hats.

Oh, this algorithm was exposed to be flawed before, but this one is a bit worse, because “That [previous] method took closer to a day to crack the device key and required close proximity to the remote for about an hour. ” This one “..can be done from a distance of 100 meters or more and requires the capture of just two messages.”

Advertisements

One response to “Anybody got a keyless entry car?

  1. Nice blog!

    Sorry off-topic question. I am trying to get some responses from physicists about named magnitudes in physics and if the names of magnitudes are magnitudes themselves. I am trying to figure out where to look to find a formal test to test if a symbol is a label or if it is a magnitude. If you care to comment please take a look at this post. Thanks.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s