There's not much that people can do to prevent someone stealing their vehicle with this hack.
The National Insurance Crime Bureau, which fights insurance fraud, has discovered a method for thieves to steal vehicles from a significant number of automakers. Using a so-called “mystery device,” a nefarious person could capture the code from the key fob and gain access to the automobile. Modern push-button-start systems would then allow the criminal to drive away.
The NICB obtained one of these devices from “a third-party security expert from an overseas company.” It consists of two parts. One portion detects the key fob’s code, and needs to be within a close distance of it to work. The other half broadcasts the data back at the vehicle. The gadgets are supposed to be for automakers and security experts to check the vulnerability of the locking system.
The NICB tested the device on 35 new and used vehicles from various automakers. In 19 cases, the investigators were able to unlock the model, and they were able to drive away 18 of those examples. In 12 instances, the researchers were able to shut off the engine and restart it. The bureau's evaluation found that four 2017 Chevrolet vehicles were immune from this hack.
However, the group admitted that this test was not scientific. There are other versions of these devices that could be even more effective or work on different vehicles.
A separate group of researchers found that a similar hack worked on around 100 million Volkswagen Group vehicles. The group discovered company used just four cryptographic keys for its fobs.
“We’ve now seen for ourselves that these devices work,” NICB President Joe Wehrle said in the group's announcement. “Maybe they don’t work on all makes and models, but certainly on enough that car thieves can target and steal them with relative ease."
The only way to prevent these thefts on existing vehicles is to keep criminals from getting your key fob’s code. To avoid being a victim, the NICB recommends common-sense tactics. For example, people should hide valuables in their automobile and keep an eye out for anyone suspicious.
Source: The National Insurance Crime Bureau
National Insurance Crime Bureau (NICB) Reveals Mystery Device
That Opens and Starts Vehicles
DES PLAINES, Ill., Dec. 7, 2016 – The National Insurance Crime Bureau (NICB) says new technology is being used to not only unlock and open vehicles, but to also start and steal them.
NICB recently obtained one of the so-called “mystery devices” that the public was first warned about over two years ago (release). At the time, thieves were being seen on security cameras across the country, using unknown devices to unlock vehicles and steal valuables inside. In recent months, NICB has noted reports of thieves not only opening the vehicles, but also starting them and driving away.
The device obtained by NICB was purchased via a third-party security expert from an overseas company. It was developed by engineers in an effort to provide manufacturers and other anti-theft organizations the ability to test the vulnerability of various vehicles’ systems. Called a “Relay Attack” unit, this particular model only works on cars and trucks that use a keyless remote and a push-button ignition.
In a series of unscientific tests at different locations over a two-week period, 35 different makes and models of cars, SUVs, minivans and a pickup truck were tested. We partnered with NICB member company CarMax, because they are the nation's largest used car retailer and have nearly every make and model in their inventory. Tests were also done at a new car dealership, an independent used car dealer, at an auto auction and on NICB employee vehicles and ones owned by private individuals.
The vehicles were tested to see if the device could:
open the door
start the vehicle
drive it away
turn off and restart the engine without the original fob present
The NICB was able to open 19 (54 percent) of the vehicles and start and drive away 18 (51 percent) of them. Of the 18 that were started, after driving them away and turning off the ignition, the device was used to restart 12 (34 percent) of the vehicles.
NICB says there are a number of different devices believed to be offered for sale to thieves. Some use different technology and may work on different makes and models and ignition systems. More expensive models may have a greater range and better capabilities for opening and starting a vehicle.
Click to see the video report.
“We’ve now seen for ourselves that these devices work,” said NICB President and CEO Joe Wehrle. “Maybe they don’t work on all makes and models, but certainly on enough that car thieves can target and steal them with relative ease. And the scary part is that there’s no warning or explanation for the owner. Unless someone catches the crime on a security camera, there’s no way for the owner or the police to really know what happened. Many times, they think the vehicle has been towed.”
Wehrle says it’s important for law enforcement officers to be aware of this threat and be on the lookout for thieves who may be using the technology.
According to NICB’s Chief Operating Officer Jim Schweitzer, who oversees all NICB investigations, vehicle manufacturers must continue their efforts to counter the attacks on anti-theft technology.
“Vehicles are a valuable commodity and thieves will continue to wage a tug of war with the manufacturers to find a way to steal them,” said Schweitzer. “Anti-theft technology has been a major factor in reducing the number of thefts over the past 25 years. The manufacturers have made tremendous strides with their technology, but now they have to adapt and develop countermeasures as threats like this surface.”
While there may not be an effective way of preventing this kind of theft at this time, NICB advises drivers to always lock their vehicles and take the remote fob or keys with them. Drivers should also be on the lookout for suspicious persons or activity and alert law enforcement rather than confronting a possible thief.
It’s also a good idea to never invite a break-in by leaving valuables in plain sight. And once thieves get inside, they can easily steal a garage door opener and valuable papers such as the vehicle registration that could lead them to your home. So take the garage door opener with you and take a picture of your registration on your cell phone rather than keeping it in the glove compartment.
Anyone with information concerning insurance fraud or vehicle theft can report it anonymously by calling toll-free 800-TEL-NICB (800-835-6422), texting keyword “fraud” to TIP411 (847411) or submitting a form on our website. Or, download the NICB Fraud Tips app on your iPhone or Android device.
About the National Insurance Crime Bureau: Headquartered in Des Plaines, Ill., the NICB is the nation's leading not-for-profit organization exclusively dedicated to preventing, detecting and defeating insurance fraud and vehicle theft through data analytics, investigations, training, legislative advocacy and public awareness. The NICB is supported by more than 1,100 property and casualty insurance companies and self-insured organizations. NICB member companies wrote over $413 billion in insurance premiums in 2015, or more than 79 percent of the nation's property/casualty insurance. That includes more than 94 percent ($187 billion) of the nation's personal auto insurance. To learn more visit www.nicb.org.