Today's auto thieves need a lot more than a brick and some gall to steal the family truckster. The technology many of the largest automakers rely on has been doing an admirable job for almost two decades now, but does a recent security leak threaten to bring our collective peace of mind to a screeching halt, er, getaway?
The short answer is no, not just yet, but this should probably come as a bit of a wake up call to companies making their way supplying security measures.
Now, what do Toyota, Honda, Ford, GM and VW all have in common? Well, plenty as it turns out, but where automotive security (a favorite topic around here) is concerned, all these companies (and more) employ the proprietary Keeloq encoding technology for their remote key fobs.
A recent article in Wired describes how the master “code” for the technology, which was developed in the 1980’s, has recently been broken. Several automotive media outlets have grabbed a hold of the topic and after adding some editorial alarm in for good measure, have an interesting story of espionage and intrigue that starts in South Africa, makes its way to Russia and finally ends on in your driveway in anytown USA.
It is actually fitting that the scenario has taken on a spy novel guise as the technology or more appropriately, technique involved in actually electronically high-jacking a vehicle so equipped, is no more relevant to your average car thief than a banana, Frommer’s Guide to Chicago, and 99 Red Luft Balloons.
The actual procedure requires “sniffing” the radio signal when a vehicle is locked/unlocked or started, which presents a potential thief with some initial challenges, but from there, they must exploit vulnerability in the algorithm used to secure the locks that was recently discovered by Belgian and Israeli researchers. Yes, good Bond material indeed.
The larger principle at work here is Auguste Kerckhoff’s axiom from the late 19th century regarding cryptography, which states that a cryptosystem should be based on algorithms that are publicly known/available and that only the key to the code is hidden. According to Kerckhoff, this is the more secure system. Should one key be compromised, it may be easily replaced or discarded, but if the entire cipher itself is hidden and then compromised, then the whole system is shot.
Now this principle has been around for a long time and has stood the test of time regardless of how inventive auto thievery has become. Even the additional horsepower provided by modern-day computing hasn’t rewritten the rule book, at least until now.
Car companies actually employ two codes, one per manufacturer (or model) and one for the individual vehicle that are used to provide an extra layer of protection. The recent news suggests that the necessary information needed to decipher the initial make or model code has been compromised and from there, the individual code should be fairly easy (and quick) to break. Now it has taken a crack team of hackers and the initial security leak of the algorithm info to get this far and would still take someone with the know-how an hour at least to decode the initial chain.
Clearly not mainstream thug methodology in a day of car-jacking and other more efficient means.
This really isn’t an issue of your Corolla specifically, but how vehicles are guarded in general. The vehicles that still employ a mechanical key, for example, provide even one more layer of complexity that makes their vehicles that much less attractive. The cat and mouse game will, no doubt, go on forever if for jus the sport of it. And as Kerckhoff has shown, no system is completely safe, but the more open it actually is, the safer it will prove.
Chalk one up for the mouse. We anxiously await the cat’s next move, once he returns.
Recent Comments