Poor security on keyless entry - Please be careful!

[Craiglxviii]

Unless it was a £20k Mondeo with keyless entry...

Apples to apples.

 

[turbopete]

Unless it was a £20k Mondeo with keyless entry...

Apples to apples.

the Ford system, as far as im aware, still requires a button to be pressed on the fob, rather than a button on the car, to unlock the car. the keyless bit just removes the need for a key to be in the ignition. dads Kuga is like that, as is the kids mothers C-Max.

 

[LostKiwi]

the point though, being that whilst all you have said is sound advice, it should NOT BE NECESSARY!!!!! a case in point, your own car is, at a guess, £60k+ brand new. it SHOULD be harder to steal (or at least break into without damaging the car), in factory spec, than a £20k Ford Mondeo, (for example) BUT without aftermarket add-ons or a garage, having read this thread, id take a chance on the Ford over the Mercedes for security!

If the Mondeo had keyless go it would be no more secure. The only positive thing is you would potentially be out of pocket less.

 

[JBell]

Yup, likely right there. Neural lace or nanonics, whatever name it ends up going by. Enhanced humans aren't far off.

I want poison darts in my fingertips me. Oh so many targets.

We are all being turned into mindless drones!!!!!!

 

[LostKiwi]

We are all being turned into mindless drones!!!!!!

Given some I know are already mindless would the drone bit be an enhancement?

 

[JBell]

Given some I know are already mindless would the drone bit be an enhancement?

I am trying to be a little politically correct, it won't last!!!!!

 

[Yugguy]

All these things are symptoms of the 24x7 connected society we are told me must have and can't live with out.

I've been looking seriously into mindfulness. And before everyone mocks, go and have a look at what it really is.

It's not sitting there crosslegged going "om".

It's about immersing yourself in the moment and concentrating on that single thing. Which is something we simply don't do any more. How many of us are facebooking as we watch TV for instance. Or if we go for a run we listen to music, rather than thinking about the wind on our faces and the strike of our feet and even the tiredness of our legs.

I am interested in it because I can be a worrier, always thinking about the future. Mindfulness can be a simple as sitting down, closing your eyes and for a minute or too focus your mind on your breathing.

It's not necessarily a modern thing either:

What is this life if, full of care,
We have no time to stand and stare.
No time to stand beneath the boughs
And stare as long as sheep or cows.
No time to see, when woods we pass,
Where squirrels hide their nuts in grass.
No time to see, in broad daylight,
Streams full of stars, like skies at night.
No time to turn at Beauty's glance,
And watch her feet, how they can dance.
No time to wait till her mouth can
Enrich that smile her eyes began.
A poor life this if, full of care,
We have no time to stand and stare

But it is getting more and more true as we are bombarded with more and more data 24x7.

 

[LostKiwi]

William Henry Davies got it spot on with Leisure.

 

[John Laidlaw]

^ Lovely that...deep for a Thursday morning!

 

[Submariner1]

From my own testing with a new 2017 MB car and research into protecting it.

* The "double tap" on the lock car button on the Keyless-Go key does deactivate the Keyless-Go function on that key and works as intended. It only deactivates that specific key and not the car. Press any button on the key to make the Keyless-Go function active. This is why I use a Faraday cage pouch, since it is very easy to accidentally press a button on a deactivated Keyless-Go key, which then reactivates it.

* A good Faraday cage pouch works perfectly as intended, jamming all signals from the key. I bought two for about £10 from China. the You can hold the active Keyless-Go key in the pouch right up to the car and it will not be detected by the car. But you have to use the pouch properly - make sure that the key is in the blocking part of the pitch and the cover is closed. Convenience: it takes me two seconds as I'm walking to/away from the car to remove/secure the active Keyless-Go key from/into the pouch. It's easy and doesn't waste any time whatsoever.

* A solid metal box also works which is obviously not convenient as a mobile blocker for most car drivers, but it is good for home use. Any solid metal container, even foil lined will work. It is, of course, easy to make your own pouch out of aluminium foil. Don't forget to always test your device! (by taking it to your car with the active Keyless-Go key inside it). Metal foil or sheet works because the metal crystal lattice is smaller than the wavelength of the radio waves used by these 433MHz devices.

* Electronic scanners are straightforward to assemble to detect radio waves from your key/pouch/tin. Basically a device is composed of: Receiver + processor + software, eg DVB-T USB TV stick + laptop/Raspberry Pi/Android phone + SDR (software defined radio) software/app. Instructions are all over the internet. These are legal and not attacking drive they do not transmit, they are defensive. I have set one up for less than £10 and detected the transmissions from my active Keyless-Go keys (as well as my old Saab and garage keys).

* Scumbag thieves can use off-the-shelf hardware. Two units can be bought over the internet from other scumbags who make them. They do not need to have any technical expertise whatsoever. There is nothing professional in what they do, except get paid, with as much skill as a beggar.

* Other preventative and immobilising methods include (and, of course, do different things):
- temporarily removing one or more essential fuses
- GHOST or other action-based immobiliser
- ODBII port lock or move (put dummy port in its place)
- steering lock
- special alarm not connected to Keyless-Go
- geofence car and alarm on phone
- put car in a secure garage! (I've not yet seen a reported Keyless-Go car theft froma garage - they have all been from the street or drive)

Hope that helps someone choose the best solutions for themselves


------------------------------------------------------------------------------------
* 2017 W222 S350d SWB AMG Line Premium Plus
* Ashford, Kent & Mons, Belgium
Sent from my Moto G using Tapatalk

Thanks for the detailed reply, (as I cant test mine yet, as she is jacked up fiddling with brakes ).
So in summary
1. One needs to deactivate each key, by double pressing lockbutton.
2. The keys in my Chubb safe are secure.
3. The double press only deactivates the Push Start, not the door opening.

Would I be correct in saying.
As a cheap alternative one could just pull out the Keyless Plug, and put that in the safe!
Naturally that means one then has to put the key in the ign. hole; and use it as a normal key?
Then I assume the door opener would work, but a thief would need the physical key to drive off?

I have to say if I had repeated my usual practice, of buying a new SL500; and this issue cropped up I would be writing to Mercedes insisting that they paid for the Ghost system or came up with an equally secure alternative, on the grounds of gross negligence. Hey they own an Insurance company, so they must have had feedback to Mercedes technical for some time now.

Likewise, if my current old car got stolen in this manner, I would not accept any penalties on the insured loss from Mercedes Insurance; as I would expect them to claim against the guilty party in this case MB!
Just like if a dealer fitting my brakes incorrectly and caused a loss; they pay me, but then go hunting for the culprit to recover the loss.

Maybe if everyone did this then MB would do something.

 

[gr1nch]

the point though, being that whilst all you have said is sound advice, it should NOT BE NECESSARY!!!!! a case in point, your own car is, at a guess, £60k+ brand new. it SHOULD be harder to steal (or at least break into without damaging the car), in factory spec, than a £20k Ford Mondeo, (for example) BUT without aftermarket add-ons or a garage, having read this thread, id take a chance on the Ford over the Mercedes for security!

There are a number of conversations in this thread and the one I'm addressing is the OP that if you have a Keyless-Go car (or any that relies on zero button press, proximity tokens), then there are measures one can take to protect it.

I agree that marques can do more, though the technology (wireless tokens) are inherently insecure. It is the same principal as unlocking your PC display with the proximity of your phone or watch using Bluetooth or RFID.

Here's what I think they can do:

* Publicly warn customers of the dangers and perfective solutions known to work.
* Indemnify customers so that they are not disadvantaged by thefts via Keyless-Go.
* Work with the insurance industry that customers are not penalised for effects via Keyless-Go, where the customer is using the system as intended by the marque.
* Enable customers to disable Keyless-Go on the car (and not just each key) and for that configuration to stick, even over car restarting or battery replacement, until the customer re-enables it via COMAND. This change to the car should be delivered as a software update to all affected cars.

There's probably more that they can do. What we can do is position MB UK and Germany. I'm at Sindelfingen in a few days as a customer and I am going to bring the subject of Keyless-Go thefts up.

I believe it is likely there are thousands of cars getting stolen by electronic means. The rolljam attack works on vulnerable button-press keys that rely on one-way authentication.







------------------------------------------------------------------------------------
* 2017 W222 S350d SWB AMG Line Premium Plus
* Ashford, Kent & Mons, Belgium
Sent from my Moto G using Tapatalk

 

[Yugguy]

Yes - I would not want to deactivate keyless go every single time.

Give me the option to disable permanently.

This is all I ever ask of new tech - give me a CHOICE.

 

[Scoob]

Quite scary really, sorry OP has had to experience this.

I dimly recall reading that early keyless entry car were refused a Thatcham rating back in the day due to security flaws. I'd assumed such flaws had been long patched though.

In theory the tech used in the hack is quite simple, there's no decoding of they signal, no number-crunching decryption work, just a listen and repeat.

This would work if you're out at a pub / restaurant etc. too. The scum spot your car in the car park, then one of them stands by the car, while the other wanders around the establishment "listening" for the keyless device.

Keyless Go seem a nice convenience feature, but fails to take the tech-savvy criminal element into account. If I ever end up with Keyless Go - because it becomes the norm - I'd take the precautions many have suggested here.

Scoob.

 

[gr1nch]

Hi Submariner1

Thanks for the detailed reply, (as I cant test mine yet, as she is jacked up fiddling with brakes ).
So in summary
1. One needs to deactivate each key, by double pressing lockbutton.
2. The keys in my Chubb safe are secure.
3. The double press only deactivates the Push Start, not the door opening.

1. and 2. are correct, but 3. only partially as the key is totally disabled (with the double tap on lock, until any one of the buttons is pressed), i.e. opening the doors and starting the car won't work whilst the Keyless-Go is disabled.

Would I be correct in saying.
As a cheap alternative one could just pull out the Keyless Plug, and put that in the safe!
Naturally that means one then has to put the key in the ign. hole; and use it as a normal key?
Then I assume the door opener would work, but a thief would need the physical key to drive off?

I haven't tried it or tested it, but I think that's likely to be correct. The transmitter is in the body of the key with the battery - so remove that and the remaining physical, metal key has no active electronics. You'd have to open the door manually of course and keep the Push button out of the ignition slot - don't lose the button though! I've not tested if the button has any electronics in it, perhaps someone knows?

Oddly enough within a week of getting the car my Keyless-Go totally failed on the car itself. The keys batteries were both fine and reach key was emitting appropriate radio waves. I had to use the regular button operation which was fine (and solved my disable Keyless-Go on the car requirement) but I wanted to retain the option to use it for its convenience with my security measures.

I have to say if I had repeated my usual practice, of buying a new SL500; and this issue cropped up I would be writing to Mercedes insisting that they paid for the Ghost system or came up with an equally secure alternative, on the grounds of gross negligence. Hey they own an Insurance company, so they must have had feedback to Mercedes technical for some time now.

Likewise, if my current old car got stolen in this manner, I would not accept any penalties on the insured loss from Mercedes Insurance; as I would expect them to claim against the guilty party in this case MB!
Just like if a dealer fitting my brakes incorrectly and caused a loss; they pay me, but then go hunting for the culprit to recover the loss.

Maybe if everyone did this then MB would do something.

I doubt Mercedes will listen to handfuls of owners, however good or influential customers they may be. But a few thousand via petition or demonstration (!) combined via the various clubs and forums, with the attendant publicity, would do it


------------------------------------------------------------------------------------
* 2017 W222 S350d SWB AMG Line Premium Plus
* Ashford, Kent & Mons, Belgium
Sent from my Moto G using Tapatalk

 

[V6Matty]

All these things are symptoms of the 24x7 connected society we are told me must have and can't live with out.

I've been looking seriously into mindfulness. And before everyone mocks, go and have a look at what it really is.

It's not sitting there crosslegged going "om".

It's about immersing yourself in the moment and concentrating on that single thing. Which is something we simply don't do any more. How many of us are facebooking as we watch TV for instance. Or if we go for a run we listen to music, rather than thinking about the wind on our faces and the strike of our feet and even the tiredness of our legs.

I am interested in it because I can be a worrier, always thinking about the future. Mindfulness can be a simple as sitting down, closing your eyes and for a minute or too focus your mind on your breathing.

It's not necessarily a modern thing either:

What is this life if, full of care,
We have no time to stand and stare.
No time to stand beneath the boughs
And stare as long as sheep or cows.
No time to see, when woods we pass,
Where squirrels hide their nuts in grass.
No time to see, in broad daylight,
Streams full of stars, like skies at night.
No time to turn at Beauty's glance,
And watch her feet, how they can dance.
No time to wait till her mouth can
Enrich that smile her eyes began.
A poor life this if, full of care,
We have no time to stand and stare

But it is getting more and more true as we are bombarded with more and more data 24x7.

Did a lot of things with mindfulness a few years ago when dad was ill and before he passed, really helped me just take a moment for myself

 

[eman]

There has just been a piece on the one show where they got into a new C class cabriolet before the chap could make a cuppa, all they said to do was put your keys in the house where pushing the button will not open the car.

 

[turbopete]

If the Mondeo had keyless go it would be no more secure. The only positive thing is you would potentially be out of pocket less.

how? My experience of the Ford keyless go system is that its used for STARTING ONLY, and NOT unlocking. ive not tried the range on the key for starting but first the thieves have to physically get into the car without triggering the alarm which, unlike the MB system, isnt as simple as basically using a device to boost the signal of the keyless go 'fob' to unlock the doors, as it appears is the case with the MB system. with the Ford you physically have to press a button on the FOB to activate the locks, as opposed to pressing the button on the door handle because the 'fob' transmits constantly, as seems to be the case with the MB system.

 

[LostKiwi]

I'm not familiar with the Ford system (my only experiences of Ford's have left me too unimpressed to ever contemplate them again).

 

[John Laidlaw]

Ouch!....I suspect there will be a long reply to that one......

 

[Submariner1]

There has just been a piece on the one show where they got into a new C class cabriolet before the chap could make a cuppa, all they said to do was put your keys in the house where pushing the button will not open the car.

Hmm thats a long way!