car keyless entry system attack - home - hack in the box ... · ch2 ch1 ch2 ch1 125khz 125khz 315...
TRANSCRIPT
![Page 1: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/1.jpg)
Car keyless entry system attack
Yingtao Zeng,Qing Yang,Jun LiUnicornTeam,Qihoo360
![Page 2: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/2.jpg)
Passive Keyless Entry System
Image source:http://www.nxp.com/documents/leaflet/75017275.pdf
![Page 3: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/3.jpg)
Normal Authentication Flow
![Page 4: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/4.jpg)
Choose the Suitable Antenna
![Page 5: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/5.jpg)
The 125Khz Carrier Signal
![Page 6: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/6.jpg)
Decode The Data
![Page 7: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/7.jpg)
The Relay Attack Scenario
![Page 8: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/8.jpg)
The Relay Attack Scenario
Noticetherearetimingconstraintsenforced!!!
![Page 9: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/9.jpg)
•
![Page 10: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/10.jpg)
Blue:CC1101Red:EM4095White:AS3933
![Page 11: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/11.jpg)
CH1 CH1CH2CH2
125Khz
125Khz315Mhz
315Mhz
315Mhz
![Page 12: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/12.jpg)
DEMO
![Page 13: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/13.jpg)
DEMO
![Page 14: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/14.jpg)
DEMO
![Page 15: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/15.jpg)
COST
• BQ241701.3• CC11011.3*6• EM40950.6• as39330.95• 125KhzAnt 0.95
• 125Khz3DAnt 2.2• atmega3280p0.75*2• 2.5dbAnt 0.41*6• PCBbord 0.7*2• ~20EUR
![Page 16: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/16.jpg)
ANT2.5DBi~320M
RANGE1
![Page 17: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/17.jpg)
RANGE2
![Page 18: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/18.jpg)
Real world Attack scenarios
CarisparkedinParkinglot/Roadside/etc
Ownner isinHome/Shoppingmall/Starbuck/etc
Oncethecarisstarted,ifthecarisbeingdrivenoutoftherelayrange,thecarwillonlywarningyouthatthekeyfob cannotbedetected,butitwon’tstoptheengine,sothethief(ie .us;))candriveutill outofgas.
![Page 19: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/19.jpg)
Reference• http://ams.com/eng/Products/Wireless-Connectivity/Wireless-Sensor-Connectivity/AS3933• http://cache.nxp.com/documents/leaflet/75017275.pdf?fsrch=1&sr=1&pageNum=1• http://www.nxp.com/documents/leaflet/75017275.pdf• http://www.ti.com/lit/ds/swrs061i/swrs061i.pdf• https://eprint.iacr.org/2010/332.pdf
![Page 20: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/20.jpg)
PossibleCountermeasures?Putthekeyfob insideafaradaycage/bagRemove the batteryStricter timing constraintsFor manufactures:take relative positionbetween the car and keyfob into consideration
![Page 21: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •](https://reader035.vdocuments.site/reader035/viewer/2022062415/6049b64cdcdaa62d663463b2/html5/thumbnails/21.jpg)
Q&A