"Once inside, an electronic device that police say is typically used by mechanics to reset a vehicle to factory settings...From there, the vehicle is programed to accept a key the suspects have brought with them that can then be used to start the car and drive away."
It seems like that's the more important device here? It doesn't feel like there's much point having a unique key if you can reprogram the car without it.
Even though there may be a legitimate use-case from a car serviceability standpoint, this does serve to illustrate the wider problem of creating backdoors in systems: they always end up getting abused and into the wrong hands.
I actually had a situation where the dealer disabled the electronic keys entirely (and by accident). They had disconnected the battery for some electrical diagnosis and neglected to re-enable the locks.
When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.
This is normally handled at the dealer level. Both because the dealer is the point of contact for the customer but also for speed and scalability.
So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon.
But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
But the dealer doesn’t have a stock of duplicate keys. That would be even worse!
They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
This is sort of a variation of the tradeoff if someone loses access to their Google (or whatever) account because they've lost their password, don't have access to a backup email, phone number, etc.
They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
Well, grandparent poster is arguing this is a backdoor. Sure it is, but for me it's an acceptable backdoor, not comparable to encryption backdoors that governments want, for example for messaging apps that use E2E encryption.
And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
Yes. For cars, the risk is low, and there are mitigations such as insurance that can alleviate the pain.
What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information.
As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have.
So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars.
> how backdoors in general can be abused. Probably acceptable for a car but not for one's life information.
While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor.
Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
In the US, the "proper" way to do this would be to present a state-issued title that matched the government-issued ID of the person making the request. However, I've never needed to do that and, as various people have remarked, there are all sorts of reasons why that might be hard to do without spending time and effort.
Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks).
I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox).
Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
Titles are certified by DMV and have authenticity markers usually, not so easily forged. If you can copy such documents, you should rather focus on copying cash currency.
And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
A $500 Epson SC-p600 inkjet printer will suffice for most titles, this is the same equipment used to produce most of the (Teslin-based) fake IDs in the US. If there are UV features, you'll just need another cheaper inkjet printer and UV inks from uvstuff.com. Holograms? OVI? Just hit up alibaba sellers, or talk to https://www.material-house.com/
To produce even somewhat convincing cash, you will have to invest hundreds of thousands to procure a Heidelberg offset printing machine and learn how to operate it (and fix it, because presumably your forgery operation will not be able to take advantage of support contracts). This isn't a simple task, and banks will still catch your fake money.
>And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
Of course, but the question at hand is whether or not the dealer asking for a title before providing new keys actually offers any meaningful security benefits or not. I believe that this is just security theatre.
>If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
Presumably the title doesn't play any meaningful part here. They could just call in with the VIN, no?
Think of the implications of throwing the car away once you lose your keys. Environmentalists will hunt you and rightfully so, most of the emissions a car produces happen during its manufacturing.
If they introduce a mechanism where the manufacturer only can unlock the car, it would mean that they will need to be involved in all kind of disputes people have over the ownership or usage of the car. You will also have people telling you that you don't own the car as with the case of the some agriculture manufacturers that lock down their systems against unauthorised repairs.
I'm more in favour of leaving the police work to the police, let's not integrate the law enforcement and manufacturers. There's already interest in disabling cars when authorities deem necessary. The problem here is that the authorities might not be or may not remain your favourites.
Say at some point there wasn't a proper title transfer. Maybe a relative gave it to you or loaned it indefinitely to you and no one thought about the title and the relative passed away. Or some other informal joint ownership. People's names change. Edge cases? Sure. But there are a lot of them and the manufacturer has every incentive to just go "Here's the rules. No exceptions."
Uhm, yeah, I'd absolutely expect an official dealership to refuse to produce a key for a car you cannot prove ownership of, regardless of whether it was loaned to you, inherited, or if you found it in a ditch - no proof of ownership, no key.
If you are one of those edge cases, there are tonnes of unofficial garages which will happily make you a new key for money. The manufacturer - and by extension, they official dealerships - should never make keys for anyone but the legal owner.
I've never owned a car with modern keyless fobs but I've certainly had new spare keys made and I'm sure I've never had to produce a title to do so. Of course in that case I already had a key and I was in their computer system in some manner.
I think it's a bit different if you turn up with the car and a working key already - in that case making you another key doesn't really change anything about the situation(although I suppose it could still be someone just borrowing a car intending to use the spare to steal it later....).
But yeah, I specifically mean a situation where someone doesn't have a key, turns up with the car on a trailer and asks for the key for it - in that case yeah, why would a dealership unlock and provide you with a key for a random car that you can't prove ownership of? That would be just weird.
Yeah. That would be very weird especially if it were a dealership you had no previous dealings with. (I don't actually know how interconnected a manufacturer's dealership network is at the back end.)
>all kind of disputes people have over the ownership
At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc.
Would this not stop whatever disputes over ownership you're referring to?
So a bit of a devil's advocate - when my dad passed away, my mum kept using his car but because it was registered in his name, and because the registration document was in his name, we ended up in an idiotic and bureaucratic situation where the car was due another annual inspection, but the registration document ran out of spaces for stamps the year before. Normally, this isn't an issue, you just go to the government office and they give you another blank registration document with more room for stamps(the stamps prove you had the car inspected basically). However, because the owner of the car(my dad) was deceased, there was no one who could do this, and the government official refused to issue the document to my mum as it wasn't her name on the document, not without the court documents proving that the inheritence proceedings have been settled(which took another 6 months). Yes, she could produce the death certificate, but that wasn't enough. So she couldn't get the car inspected, and therefore wasn't legally allowed to drive it.
I'm almost certain a car dealership would accept a death certificate if she needed another key made, but my point is - yes, even with an official document stating who is the owner, you can still end up in some weird edge case scenario.
>Yes, she could produce the death certificate, but that wasn't enough. So she couldn't get the car inspected, and therefore wasn't legally allowed to drive it.
What if your dad willed the car to someone else? I suppose a death certificate isn't evidence of being the successor.
There are edge cases to everything, and there are already other solutions to this issue. But yes, death or debilitating illness is something that should be (and generally is, from the bureaucratic side anyways) considered in the context of asset ownership.
Sure, you can works something out but it would also mean that the company will need to maintain a system for unlocking cars for each country according to the local regulations.
Then they will need to deal with stuff like "Toyota unlocked the car of a Putin critic", "Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died. They previously unlocked the car of Joe Rogan's girlfriend".
You also will have issues where the legal owner and the regular user are different people(i.e. father and son, romantic partners etc). Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years.
You will also have governments demanding you disable the cars of people who have problems with the regime. In Philippines the government might demand lock down the cars of LGBT people, in USA they might lock down the cars of people with debt.
Who knows? It makes the manufacturer part of the running the car just the way Apple and Google are part of running your phone.
I own X car, and key is lost/broken/whatever. I go to my dealership, show my ownership. They validate it with the systems they already have (again, at least in my country) that communicate with the ministry, and check my ID. Done. All handled at the local dealership level (where they are already familiar with local laws, so it's not onerous to follow local regulation).
>Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died.
Starting to get a bit out of hand with speculation, I think. I don't follow the logic with this one. If there is an emergency, emergency services would be called rather than Audi.
>Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years.
Dealership says "Please provide ownership documents". It's not a complicated thing or a novel concept.
You don't need to get into weird scenarios. There are a thousand reasons why someone may not have immediate access to the title of the car (a document issued by individual states in the US), have a different name on that title, or simply be using the car formally or informally but it belongs to someone else. Depending on the complexity of the situation it may take a week to months to get your hands on a proper title if the dealer requires you to present it.
>simply be using the car formally or informally but it belongs to someone else
And why in these cases should someone be able to claim ownership of the car, when they are not the owner?
I'm wondering if I mistyped something, or miscommunicated something. My whole point, originally, was that it is not some incredibly difficult thing to prove that you own the car.
The comment that I originally replied to said:
>all kind of disputes people have over the ownership
And all I said was
>At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc.Would this not stop whatever disputes over ownership you're referring to?
To sell a car, it's perfectly reasonable to require a proper title in the seller's name even if it requires jumping through some hoops in order to get a title reissued to that person. (And, if there's some dispute, that dispute will simply have to be resolved.)
However, I've never needed a title for any other purpose and I think the last car I traded in I actually had to get a new title because it wasn't in my file cabinet where it should have been.I certainly wouldn't expect to need one to get spare keys issued, the car inspected (though they need an insurance-stamped registration for that in my state), or anything else.
Sure thing, and what should or shouldn't require proof of ownership via title or proof of insurance, etc., was never the focus of my comment. Just that ownership disputes can generally be resolved quite easily* by reverting to ownership documents.
*Easily, but not necessarily quickly in the case where you need the document reissued or whatever.
Who knows what were the exact circumstances of that poor imaginary woman? Maybe The only ambulance driver in that little town she lives was her abusive BF?
Anyway, the idea is that you will have circumstances where unlocking the car would save somebodies lives but due to procedures not covering situations like this bad things will happen and people will blame the manufacturer. The way system works will be a constant debate.
>Who knows what were the exact circumstances of that poor imaginary woman? Maybe The only ambulance driver in that little town she lives was her abusive BF?
I can make up millions of wild scenarios, as well. I'm sure a few will be true here and there.
However, I don't think speculating about a hypothetical person with a hypothetical abusive partner who is the sole emergency responder in a hypothetical world where corporate Audi is the only other solution (what about taxi, uber, neighbor, cop, etc.?) to a hypothetical medical emergency is worth discussing.
Okay, what is need for centralised key production mechanism that leaves out any 3rd party?
Car theft? Big deal, insurance covers it. You can put the car into a garage, you can install your own tracker, the police can find it and there are many other ways to to steal the car and even if the car is not unlockable the "selling the parts" business model can still make it a target for the thief.
What's the argument for leaving it to the manufacturer?
My entire comment chain started with me saying that ownership should not be difficult to prove because ownership is recorded on an ownership document and with the government, at least in my country.
Just FYI, only super high end brands deal with trivial issues like producing spare keys themselves. If you lose a key to your Lamborghini then yes, you will be waiting a week to get a new key sent from Italy to you. But a normal Audi or KIA? The dealership does it - official dealerships have computers which can do this, and outside of authenticating with manufacturer's servers to issue a key, it's entirely within their purvue who they provide this service for. So no, Toyota doesn't really have any say as to who they make new keys for in Russia, other than providing official Toyota dealerships in that country with machines which can program new keys. After that point it's down to the dealer and to the local regulations.
I have absolutely no idea on how this all works, but assuming they're not replicating the current 'key' and forcing a new one - why not introduce a time delay on key changes? Like a reprogrammed key takes 3 hours before it works or something. No biggie if the car is on a mechanics forecourt, but what thief wants to wait 3 hours to drive away the car they've just screwdrivered into?
This makes me want to do the same thing back: I should put an AirTag in an inconspicuous spot on my car, myself. Then if a thief puts an AirTag on my car and steals it, I can do a Uno Reverse card.
Edit: Another idea: I should throw an AirTag on my Catalytic Converter, and cover it up with a dark plastic so it looks like it's from the factory... That could be a huge YouTube video that could launch a channel. "I AirTagged my stolen Catalytic Converter!"
Actually, Apple, that's your chance. You've got CarPlay, announce the new CarTag specification. It's just AirTag, built-into your Car in multiple spots that, while it can be removed, would require hours and hours of work pulling stuff apart.
Edit: Also, you could always find your parked car!
As an aside, I thought it was funny shopping for an electric bike. I looked at Van Moof, and they seem great. But I saw many reviews that said they are not for "short" people. Problem is, they're designed in the Netherlands, so my pretty average 5'9" is too short for them!
I had that thought but a quick test suggested it didn't work all that well. But, as I say, it was just a quick test.
The other thing I found was useful was throwing one in checked luggage. Not that I check luggage very often but it did tell me my luggage got transferred at a connection.
(Of course, the airlines' own tracking systems are increasingly making it easier to check directly.)
While AirTags don't really add new capabilities that thieves with this level of sophistication didn't have access to before, one does wonder to what degree the attention AirTags brought to tracking devices caused various people to go "Hmm. I could track something/someone with that."
I have wondered to what degree they have been used to recover stolen devices as well.
I wished I had AirTagged the bike I bought for my youngest daughter before she left for college. It was stolen within weeks of her arriving. (Made more painful because the bicycle I bought for her older sister a few years earlier too was stolen her first semester in college...)
The problem is that the police probably aren't going to do anything and, assuming it's a serious/professional thief as opposed to just another student in this situation, it's likely best to just let it go.
The photo in the article is of a pickup with the trailer light cover circled in red. That only makes me question its veracity.
The OBD-II port “locks” I could find with a quick search are >$100, and most are made of thin plastic. Oh, and there is often a second OBD-II port under the hood of modern vehicles.
If you’re actually worried about this, the best solution would be a hidden “kill switch” that prevents the vehicle from starting or driving away. Either a toggle switch that shuts off the electric fuel pump (in which case they’ll get it started and move it a few feet at most before it dies) or a momentary switch that prevents it from starting. Either of those can be installed by someone with basic electrical ability for <$10 in parts.
Kill switch, or pull the fuse for the fuel pump. One requires adding parts, while the other is removing required pieces. Id suggest considering the frequency of risky parking to determine which approach is needed. The fuel pump fuse is usually listed on the fuse box cover or manual.
The problem with all of the above is - what are you actually guarding yourself against. I've owned some pretty expensive vehicles in the past, and the advice you usually see around is to literally make it as easy as physically possible to steal your car, without actually leaving the keys in the car, and let the insurance handle it. IE - keys next to the main door of your house, in clear view, no fancy schmancy kill switches, no faraday cages, nothing like that - with the idea being that if someone is coming to get your fancy AMG or a Ferrari or whatever, they aren't an opportunistic thief that just happened to walk by - the car is being stolen either on specific order, or in general by people who know what they are doing. And if they get in your car and it doesn't start, or if their relay attack doesn't work, you know what's the next step? You get a gun to your head to start the car for them. You don't want them to enter your house to look for the key, or if they do, you want them to find it instantly and GTFO. Like, yes, the chances are low - but it's just not worth it. Have a good insurance policy instead.
If you are guarding yourself against opportunistic theft however, then the above doesn't apply - install all kinds of gadgets that you can.
Part of that policy is having gap coverage. Nothing worse than having your recently purchased vehicle stolen while the deprecated value is way less than the financed amount owed so you wind up paying the bank for a car that was stolen from you. Same applies to wrecks.
Yeah. Unbeknownst to me(I would have advised him had I known) my sister's boyfriend didn't have GAP on his brand new motorbike, it got stolen, he was in for a nasty shock when he found that even after insurance paid out, he still owed money to the bank because the value of the bike was lower than what he owed. GAP is essential if you own anything on finance.
1 - Eye roll - It said if you own one. It's part of their features.
2 - Eye roll, less severe. It said if possible. If not, protect yourself better.
3 - lol these things have always made me laugh with their as-seen-on-tv style advertising.
4 - at least you're somewhat reasonable.
What’s the deal with leading with AirTags? It’s the least interesting part of the process. I can also use my eyes driving around neighbourhoods looking for high end cars. Or any other tracking device that’s existed since the 70s.
Is it supposed to create FUD around the dangerous world we live in now that we have AirTags?
Other scary technology listed in the article:
- the device used to factory reset the car
- blank keys
- a screw driver
It'd be more interesting to use 2 AirTags, and try to figure out when the owner is away from the car, e.g. if you can see them take an Uber to the airport and their car is in the driveway.
To turn on my criminal mind: you driving around neighborhoods: a witness might notice you cruising around a few evenings ago and note your license plate (you'd have to go at night because during the day the cars wouldn't be there, you might have to go a few times to see what cars are available).
The AirTag/any tracking device is quite ingenous, just go to the mall carpark (no one will be suspicious, it's just someone at the mall) and have a better selection of cars at one place, plant the AirTags (riskiest part) and then wait. Even if they found it at home, you already know where the car can be found, and if you're worried the cops might be waiting, just wait a few more months, statistically the car will still be there.
"Use a steering wheel lock, which will also work as a visual deterrent."
For years, my friends and spouse derided my use of "the Club." After all, there are so many more technically sophisticated mechanisms to deter and prevent theft. Now, the irony is that the technology is redeployed in the service of the criminal rather than the owner!
Does the pendulum swing back the other way? In a world where all mechanisms of security are digital and criminals look for digital surfaces to attack, the ultimate trump card is a physical obstacle?
I have read that brake pedal locks are actually more effective. Those steering wheel clubs are easier to cut off, compared to trying to get a saw down in the footwell to cut off something under the brake pedal. Without being able to depress the brakes, one cannot shift the car from park into drive.
The way the club works is by telling the potential thief "The owner is determined enough to make his own life a little bit more difficult. You don't know what else might be there, just go along and find an easier target."
The best way to secure your car is to think like a thief. Look at it and ask yourself, "Is this a good target?"
Thieves evaluate the car through risk / reward but mostly risk. The cost of being caught is very high and opportunity cost is very low -- there is a lot of other cars available so there is almost never a reason to steal this particular one.
So naturally if they see any warning signs that this might be risky (even something like an out of place pulsing light) they might want to skip it for something else.
Thus, the best way to not have your car stolen is:
1) Do not drive expensive car (low reward)
2) Display something in your car that tells the thief you are determined owner and you will make the thief's life difficult (high risk)
3) Remove absolutely everything from your car that can be stolen. When I go on vacation (ie. car with foreign license plates more likely to have valuables in the trunk) I even removed the shelf above the trunk so that a thief can look and see the trunk is empty. (no easy, risk-free, alternative payoff)
4) Have an actual safety like a concealed switch that prevents the car from being started. Do not ever use anything that has visible elements -- the thief must try to start the car, see that it does not start and see that it is not easily possible to identify the mechanism that prevents starting. This should deter potential thief to try any further.
When I bought my first car, during months my usual routine when parking it for an extended period of time was opening the engine compartment and removing either a fuse or a relay from a essential circuit like starter, ignition or fuel pump.
After some six months of endless ridicule from friends and dirty fingers I eventually relaxed.
Is it not possible to determine the identities of the thieves (or at least a lot of information about them) from the associated Apple account? I don't understand why they wouldn't use a less consumer-oriented tracking device that is easier to use anonymously.
The image with the red circle? I think that's part of the car, a cap that covers a plug where you can wire up your trailer (for lights). It's showing where a thief could hide an AirTag.
Yeah location trackers have always been a thing, but the same way Apple made the desktop computer mainstream (back in the 80's) and then again with smartphones, their AirTag is making location tracking mainstream, so now everyone can be a stalker or a car thief ;-) . Is it their fault? IMO not really, but, a little bit?
really isn't true. While Apple was one of the companies (see also Commodore, Tandy, ...) that first popularized home computers, it was really the IBM PC followed by its clones like Compaq that replaced terminals in offices.
If the owner has an iPhone, aren’t they notified that somebody’s placed an AirTag near them that’s following them? I thought this was one of the anti-stalking measures.
I love how the author of the article included a picture of a truck with a red circle surrounding the trailer connection plug - which has nothing to do with OBD2 connectivity - the technology the thieves are using to reprogram vehicles.
Why do we have journalists reporting on things they know little about? Seems counter-intuitive doesn't it?
>Why do we have journalists reporting on things they know little about?
Because unless you're at a major publication (or other media) like the Wall Street Journal (or at least focused magazines), you being paid not much to report on and write quickly about a wide range of subjects.
Makes sense. I guess 'lower' prestige publications just are reporting on what they can with as much info they can glean from some google searches/staff on hand.
It's similar technology but there are more people with iPhones (who haven't disabled the find network capability) than have the requisite Tile app installed.
Some of the most stolen cars are the cheap old ones. A quick search[1] shows that 1997 Civic and 2000 Accord are the #1 and #2 most stolen in 2020. From the personal experience, the only people I know who had cars stolen had old Hondas.
These cars are easy to steal, unlikely to be found and make good money as parts.
If someone can fit an AirTag in some crevice, they can probably also fit a cellular Apple Watch (without wristband) in that same crevice.
Now granted the price of a cellular Watch ($329) is an order of magnitude higher than an AirTag ($29), but still pales in comparison to the street price of a high-end car.
The real story is them being able to use the data port to reset the car.
It seems like that's the more important device here? It doesn't feel like there's much point having a unique key if you can reprogram the car without it.