back to article Crypto boffins break car cypher

Cryptographic researchers have identified a practical attack against the KeeLoq car anti-theft cypher. KeeLoq serves as the cryptographic underpinning of several car anti-theft mechanisms distributed by Microchip Technology. The technology is used in a wide variety of car remote controls from manufacturers including Chrysler …


This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward

    Replay attack...

    I can only assume KeeLoq uses a challenge response technique, or else this kind of attack would not be necessary. The gold standard would be using a PKI algorythm, but apparently the poultry processors powered by milliwatts of RF can't do the number crunching (at least in a reasonable time frame).

  2. Anonymous Coward
    Anonymous Coward

    Even easier

    is the solder up a resistor pack and clamp it to the ignition cable under the dash. Costs about $2.00 and works every time. All the hokey-pokey about secure codes and such comes down to a single in-line resistor under the dash. If you jump around it with the resistor pack you completely disable the system.

    Obviously I'm not going to give away all the details but all new auto dealer shops have one of these devices to disable the security when doing repairs on the cars. Granted it's a bit more crude than the technique described in this article but it sure is faster and more reliable. With a bit of online research you can find which wire needs the pack and have it clamped and ready in under 30 seconds.

  3. Mike

    Crafty Cockney will be out of luck

    Capturing & replaying won't work - car keyfobs have been using rolling-code systems for well over a decade. Once the car receives a message, it will ignore any subsequent copies.

    The Keeloq crack is about predicting the next code in the sequence.

  4. Robin


    "poultry processors" do they make turkey twizlers ?

  5. Anonymous Coward
    Anonymous Coward

    re: Even Easier

    Yep fine but you need to be in the car first without the alarm wailing away or have balls, like coconuts and twice as hairy

  6. This post has been deleted by its author

  7. Gilbert Wham


    ...who, exactly, pays a moments notice to a wailing car alarm?

  8. Anonymous Coward
    Anonymous Coward

    The weakest link

    The easiest solution is to hit the key owner over the head with a suitably dense object and steal the key. Or kick down their front door and nick it as happened to a friend of mine.

    18 billion billion combinations of numbers but how many combinations of foot/door or billiard ball/sock?

  9. Anonymous Coward
    Anonymous Coward

    re: resistor pack

    While a resistor pack may allow for the car to be started, you still have an alarm to shut off.

    On many cars, a chipped key or the remote code is required to silence the alarm... When the chip in one of my Honda keys failed, I was surprised to find that the car was still driveable, even though the alarm was still blaring.

    Naturally, nobody cared about the ruckus.

  10. Starace

    Re:Even easier

    Maybe a simple resistor pack works on cars in some parts of the world, not sure it'd work elsewhere.

    Although it's a while since I've looked at them, as I remember it the only accessible cables on most current models were the feeds to the transponder induction coil from the PCM, and the basic power switching and control lines from the ignition switch.

    Given these wires, you could get the electrics turned on (i.e. 'Key On, Engine Off') but not much else, unless you managed to get the transponder code into the PCM nothing much more would happen. And a simple resistor pack is unlikely to help with this.

    The PCM won't do anything much until the key code is correct, and quite likely some ancillary components will get in the way too e.g. the ignition pack and instrument cluster may also do a code check before the system will work. Given that very little now works directly from the controls, but rather is driven via software in the power or body control modules, it's quite simple to completely cripple the vehicle if a transponder key code isn't provided.

    While this sort of brute force attack is relatively interesting, the real world impact is zero. Real criminals will just steal your keys and use them, rather than wasting an hour to try to get data that will take a day or two of processing on a cluster to be useful.

    Bear in mind we're talking about very low range transponder modules here so the possible attack range is minimal, probably 50cm max with modified equipment. Remote locking systems have a longer range but are a separate system and being a transmitter in the key (the bit with the battery) rather than a transponder (the small plastic or glass capsule in the key) can't be remotely probed for data.

    There are all sort of methods out there for triggering the central locking system, and disabling the alarm system - usually down to poor design e.g. ways to zap the system via accessible wires, or using a firm kick in the right place to bounce relays, or even a false crash signal from the airbag system - but actually *starting* the car is a separate problem and generally much harder (if not impossible) to do without a properly coded key.

    As far as I can tell this attack is against the remote locking rolling code system. Apart from (as mentioned) there already being ways of working around this bit, given that the part in the key is only a transmitter you'd need actual physical access to the key to push the button(s) repeatedly to get the source data. Not exactly practical! There's also the small matter of the *rolling code* aspect; unless you get the keys correct *and* manage to synchronise the codes, it won't be much use - even a real key can become useless if the synchronisation drifts too far, until you trigger a resync.

    Anyway, it's all nice and good but I suspect more of academic interest rather than a practical concern.

  11. Dan Hardiker

    If you want to steal a car ...

    With the wide spread availability of guns -- surely just find the owner and get the key.

  12. Anonymous Coward
    Anonymous Coward

    Real Security... Not.

    Keeloq is a previously very secure rolling code encryption system so replay attacks don't work, you need to be able to predict the code sequence and blasting it with too many guesses *can* lock it out so you need a physical key to reset it (it's usually used in conjunction with an RFID chip in the key)

    Resistor packs and simple 555 based attacks only work on antiquated third world and US vehicles, not sure if they ever worked in Europe.

    It's far easier to whack the owner with something solid and nick his keys these days or pick up the car with a recovery truck and decode the alarm/immobiliser later using a diagnostic or reprogramming tool (Easily available or nicked from your local garage).

    Some bright spark mentioned using fingerprint recognition on some supercars a few years ago, you'd then be able to spot a supercar owner not by the expensive key ring they flaunt but by counting the number of fingers they own.

  13. Anonymous Coward
    Anonymous Coward

    No need to decrypt the key

    The whole system boils down to an extra relay in the fuel pump circuit. It's in series with the normal, ignition-operated relay. A spare relay with a wire soldered across the contacts can be swapped in a matter of seconds.

    The rest of the car theft job is routine for any streetwise kid.

    Best, IMO, is a homebrew immobilization system which isn't documented anywhere. I've been rigging my vehicles with various devices since my first new car purchase in 1965. Here's one non-current example: a crowbar circuit which blows the fuel pump and ignition fuses if the ignition is turned on without a key in the ignition lock. The score so far: two attempts, both of which went nowhere.

  14. Acme Fixer

    Something Else

    So I hear something here about 'nicking' cars, but the latest rage in my neighborhood, one that I've heard little about in the news, is stealing the catalytic converter. We've had a few already stolen, and it seems they're worth a few dozen dollars to the thief. But the owner has to pay a thousand dollars or more for the replacements especially if the car as dual exhausts. Someone saws them off in the parking lots, usually from a SUV or truck, since they're easy to crawl under. And then there are some thieves stealing the fire plug caps for the brass. Someone should get the recycling companies to turn these guys in.

  15. Anonymous Coward
    Anonymous Coward

    poultry processors

    Must we put up with this fowl-mouthed language?

  16. Anonymous Coward
    Anonymous Coward


    ...steals my 250 quid clunker. This, even though the passenger window will slide down with a bit of pressure. Who needs electronics at all? I think the only chip in my car is the half-eaten one, going steadily green, under the back seat.

  17. This post has been deleted by its author

  18. SImon Hobson Silver badge

    Re: The whole system boils down to an extra relay in the fuel pump circuit.

    Complete and utter tosh !

    That **may** have been the case with some early **cheap and nasty** systems but it certainly is not the case on modern systems (like the article is dealing with). Most new vehicles have multiple computers all networked together - when you lock the car, the security system tellsethe engine management, and the engine management shuts down the engine. No amount of 'jiggling with wires' is going to make the engine run until the security system tells the engine management to re-enable itself - or at least something the engine management **thinks** is the security system. By the time you get to that level, there are far easier and cheaper methods available.

  19. Joe

    My car will not succumb to this attack!

    Like the anonymous poster above, my 1997 VW Polo is resistant to this attack by relying on a metal key to be inserted to gain access.

    I've got plenty of friends who have preposterously expensive cars, but is it worth the worry? Or the expense? I can go on holiday a few dozen times with the money saved by not keeping up with the Joneses!

  20. salman ali

    Hollywood has better techniques:

    The article covered the Batman/Bourne Conspiracy technique. The "Mission Impossible" technique is much more entertaining and practical:

    1. Be a ravishingly attractive super-spy.

    2. Seduce car-owner.

    3. Rumpy-pump said owner into unconsciousness.

    4. Take car keys.

    5. Drive off.

This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2020