BMW owners hit by hi-tech theft

Monty Burnz

Courtesy of the BBC, a rather worrying story for BMW owners:

A device for sale on the internet is allowing thieves to steal BMWs and other high-end cars without the need for the owner's keys, a BBC Watchdog investigation has found.

In some parts of the country police have been leafleting BMW owners, warning them of the possibility of this kind of theft.

Responding to the investigation BMW said: "Certain criminal threats, like the one you have highlighted, simply do not exist when cars are designed and developed.

"This does not mean the car companies have done anything wrong, neither are they legally obliged to take any action.

A video on the linked page shows a bit more, but we don't learn anything about this device that you can buy on the web...

ShadowHearth

Dunno about BMW only device, but I have seen on Russian tv about car alarm code readers. They just scan all the area and as soon as owner of the car opens or closes his door the device catches that signal and makes car it's biitch. Owner of device get full control of the car.
They showed device in action, the salesman gave a lovely product showcase in carpark.

I would not be surprised of some sort of BMW device. More electronics in cars make them even Easyer for thief to steal them.

Honey-ec

Monty Burnz wrote: »

A video on the linked page shows a bit more, but we don't learn anything about this device that you can buy on the web...

I'd imagine that's because they don't want to link a load of potential car thieves directly to the product...

Monty Burnz

Honey-ec wrote: »

I'd imagine that's because they don't want to link a load of potential car thieves directly to the product...

Uh...yes...

keithclancy

Old news.

http://www.1addicts.com/forums/showthread.php?t=712717

bijapos

The old BMW alarms were the most efficient ones IMO.

https://www.youtube.com/watch?v=fDrzMGdYWZc

Monty Burnz

From Keith's link:

rebel.ranter

Beat this simply by pitting a switch on one of the wires going to the OBC port in your car, pin 16 is a good one to choose . Hide the switch away & only turn it on when you're sending the car away for service/diagnostics.
By disabling communication via the OBC it means that that cannot read the car & therefore cannot create a working key.
They use frequency jammers to block you remotely locking the car. The idea is that they watch you, see you parking the car up & you think you've locked it. Then they use the device above to program their "spare" key. Enable the audible "chirp" to ensure that you have a way to hear the car being locked.
Cheap, simple & effective.

Cuddlesworth

ShadowHearth wrote: »

Dunno about BMW only device, but I have seen on Russian tv about car alarm code readers. They just scan all the area and as soon as owner of the car opens or closes his door the device catches that signal and makes car it's biitch. Owner of device get full control of the car.
They showed device in action, the salesman gave a lovely product showcase in carpark.

I would not be surprised of some sort of BMW device. More electronics in cars make them even Easyer for thief to steal them.

Not possible. The codes used are rolling, capturing a single code and response is useless without the cypher they both have. I do remember reading about two way transmitters bypassing that problem.

ShadowHearth

Cuddlesworth wrote: »

Not possible. The codes used are rolling, capturing a single code and response is useless without the cypher they both have. I do remember reading about two way transmitters bypassing that problem.

i have seen that done.

Gran Hermano

On BBC 1 now

bladespin

IIRC the first kefob locking cars could be opened by a tv remote Beleive it was Renault who pioneered the tech. Good to see they history repeating itself.

CJhaughey

Was this not in the Film 'Ghost Dog, way of the Samurai' ?

Myrddin

Crazy stuff. As I understood it, the codes involved were 'rolling' meaning they change all the time, therefore if a scanner is used, it'll only catch a used & now invalid code.

Also, the tordial coil around the ignition barrel must also detect a valid key, which then sends a validation signal to the ews control unit to allow the car to start.

So how are they doing it?

Leonard Hofstadter

Good to see that BMW are going to fix this problem for free, well for UK owners anyway!

Any hope watchdog would cover the well known timing chain problems the N47 and N57 diesels are having, and embarrass BMW into fixing that absolutely f%%%up of a design for free as well?

Cuddlesworth

EnterNow wrote: »

Crazy stuff. As I understood it, the codes involved were 'rolling' meaning they change all the time, therefore if a scanner is used, it'll only catch a used & now invalid code.

Also, the tordial coil around the ignition barrel must also detect a valid key, which then sends a validation signal to the ews control unit to allow the car to start.

So how are they doing it?

Only way it could work is if the person was already in the car and had programmed a new fob for it.

Mar4ix

With fake dockets, make "spare" key for "wife" in dealership in another country. beat that.....happened before.

Hi-tech thieves around since hi tech security alarms made. , so not surprised.

you can get scanner in one of cheap Chinese online shops for 100 ish quid, which reads fob, and based on info what it gets , make unlock code, and tools for starting a car without braking steering lock and hotwiring.

Myrddin

Cuddlesworth wrote: »

Only way it could work is if the person was already in the car and had programmed a new fob for it.

By fob do you mean key? Sure the keys are laser cut & tied to the chassis number, plus you'd need id & proof of ownership to order a key in a main dealer.

Without the key you'd need to break the steering lock, & still find a way to trick the coil around the ignition barrel into allowing the car to start. Also without a key, you can't get into the car without setting the alarm off because the codes roll every time

Mar4ix wrote: »

With fake dockets, make "spare" key for "wife" in dealership in another country. beat that.....happened before.

I suppose in a lax/corrupt dealer, thats very possible.

you can get scanner in one of cheap Chinese online shops for 100 ish quid, which reads fob, and based on info what it gets , make unlock code, and tools for starting a car without braking steering lock and hotwiring.

But again, its a rolling code that changes every time.

CrowdedHouse

EnterNow wrote: »

By fob do you mean key? Sure the keys are laser cut & tied to the chassis number, plus you'd need id & proof of ownership to order a key in a main dealer.

The newer BMWs are keyless ignition - just needs the fob inside the car

Mar4ix

EnterNow wrote: »

..................

But again, its a rolling code that changes every time.

Unfortunately there is techniques work around this.

Myrddin

CrowdedHouse wrote: »

The newer BMWs are keyless ignition - just needs the fob inside the car

Ah Keyless GO...I'd forgotten about this! So if the keys transponder signal can be cloned as such, the system will validate its credentials? That must be how they're doing it as it negates the coil on the barrel & the ignition lock too in one foul swoop.

Mar4ix wrote: »

Unfortunately there is techniques work around this.

As in the code generation algorithm is cracked & duplicated?

Mar4ix

EnterNow wrote: »

.......



As in the code generation algorithm is cracked & duplicated?

as far as i know , generated code is not random code, it uses certain algorithm , to change code, alarm box in has to know also what code will be next. If smart device pick up 2 -3 samples of code(jamming signal, causing owner number times press fob) , it will have no difficulties to find out usable code.
I am not specialist , wont argue.

colm_mcm

http://www.pistonheads.com/news/default.asp?storyId=26357

dredg

EnterNow wrote: »

Ah Keyless GO...I'd forgotten about this!

My car doesn't have keyless entry, and the key looks like this:


You just need a blank and can code it up in the car.

TJJP

High-tech car theft.
12/09/2012

You might have heard about reports in the media about BMWs being stolen by a new kind of theft. BMW, like other manufacturers, has become the target of organised criminal operations who are targeting specific vehicles and using highly sophisticated equipment illegally to steal vehicles.

BMW prides itself on its vehicle security systems and all BMWs meet all UK and global security standards. Our engineers and technicians review all aspects of our vehicles constantly, including security systems, and after extensive research we are clear that none of our latest models - new 1 Series Hatch, 3 Series, 5 Series, 6 Series and 7 Series - nor any other BMW built after September 2011 can be stolen using the method highlighted. However, as responsible manufacturers we are looking at ways of mitigating against this new kind of attack. We are now in the process of offering to any concerned customers of targeted models, extra technical measures which will mean the car cannot be taken using the piece of equipment highlighted in these stories, although of course there is no such thing as the unstealable car.

If you are concerned about this issue, you can contact our Customer Service department on 0800 083 4397 or your local BMW dealer, either of which will happy to advise.

We also recommend following general advice given by the Police:

- When using remote locking, ensure the car has actually locked by checking a door.
- Be careful with your keys and who you give them too keys (e.g. valet parking). There is a risk that they could be cloned.
- Where ever possible park your car out of sight, in a locked garage or under the cover of CCTV cameras.

In addition: We recommend servicing your car at authorised BMW dealerships on a regular basis to give the opportunity of further enhancing theft protection.

BMW Group UK

http://www.bmw.co.uk/bmwuk/about/news/0,,1156___co-181270000,00.html

Cuddlesworth

Mar4ix wrote: »

as far as i know , generated code is not random code, it uses certain algorithm , to change code, alarm box in has to know also what code will be next. If smart device pick up 2 -3 samples of code(jamming signal, causing owner number times press fob) , it will have no difficulties to find out usable code.
I am not specialist , wont argue.

Lets say its a simple 16bit algorithm. You only have the possibility of 65536 combinations. Or 32 bit, that's 4294967296 possibility's. Its far more likely either a 128bit or 256bit strength key transmitting with a 32 bit code. I don't have enough screen space for the amount of possibility's needed to comprehend this. And computers are a far way off cracking it on the fly.

There is only three ways this is possible.

Every BMW has the same algorithm key or a severely limited number of them and the readers simply pick out where in which sequence it is and give the next code because they already have the key. If this is the case, its possibly the most stupid thing I have ever heard off. Most garage door openers would have better security then a car make which sells millions of vehicles. Yeah it is possible, if the system was done back in the late eighty's by a moron.

The remotes are part of a two way system with the other close to the actual car remote. There are ways around this but it can work.

The car was accessed and a new fob was programmed off the car itself with the correct encryption key and sequence point. Once inside and with access to the onboard computer this is relatively easy to do. It has to be, people do lose their keys. If they had to order a new onboard computer every time there would be uproar. I don't know how fast this could be done, possibly very.

colm_mcm

TJJP wrote: »

In addition: We recommend servicing your car at authorised BMW dealerships on a regular basis to give the opportunity of further enhancing theft protection.

BMW Group UK

]

Love this bit they won't fix it unless you get your car serviced in the dealers?

Boots2006

First hand experience here: they break drivers window and plug into OBD port. don't worry, the alarm won't go off cos its a blind spot around there.
They then code the car to accept the key, not the other way round ...
Plip - unlock - key in slot - start- drive away.

wonski

Boots2006 wrote: »

First hand experience here: they break drivers window and plug into OBD port. don't worry, the alarm won't go off cos its a blind spot around there.
They then code the car to accept the key, not the other way round ...
Plip - unlock - key in slot - start- drive away.

I think the blind spot made it easy. Should not happen in modern car.
But, in reality, if no car could be stolen without the original key, these "people" would always have to go after the keys.
Most - if not all people- prefer to have the car stolen without them noticing rather than bunch of scumbags breaking into the house and "ask" for the keys.

Cuddlesworth

Some interesting information on this, this guy took a look at the ODB network last year and highlighted the problems with it. Then it looks like others took his work, built either a Bluetooth or wireless transmission system to go in either through the stereo or tyre sensors. Once inside, you can do what you want. The problem has nothing to do with the keys or the system they use. The problem is the ODB network inside the car and the wireless avenues that can be used for entry to it.

BMW are not the only make that should have this problem either.

Myrddin

Cuddlesworth wrote: »

Some interesting information on this, this guy took a look at the ODB network last year and highlighted the problems with it. Then it looks like others took his work, built either a Bluetooth or wireless transmission system to go in either through the stereo or tyre sensors. Once inside, you can do what you want. The problem has nothing to do with the keys or the system they use. The problem is the ODB network inside the car and the wireless avenues that can be used for entry to it.

BMW are not the only make that should have this problem either.

Pretty high tech stuff, it it wasn't so nefarious, it'd actually be impressive

langdang

EnterNow wrote: »

Pretty high tech stuff, it it wasn't so nefarious, it'd actually be impressive

Indeed!
There was another set of guys proved in the US that some cars (example case was a Subaru Outback IIRC) could be remote accessed through built in Satnavs with cellular modems.