Poor security on keyless entry - Please be careful!

[John Laidlaw]

When I was on a Volvo forum years ago I posted about throttle body failures and had the picks hosted on my own domain. I could look at the analytics and it showed visits from an ip address in Sweden which when checked belonged to Volvo.

Interesting! I just wonder if the MB crew are a little too arrogant to bother what we're saying on here?
Lit the touch paper and retire.......

 

[turbopete]

I wonder if anybody from Mercedes HQ ever reads any of these forums?

unlikely. if they did, then surely they would see the issues being talked about and set people to work on resolving the issues, rather than try to deny that they exist!

 

[turbopete]

When I was on a Volvo forum years ago I posted about throttle body failures and had the picks hosted on my own domain. I could look at the analytics and it showed visits from an ip address in Sweden which when checked belonged to Volvo.

I think the difference is, Volvo are known for safety and for caring (about people and the environment) so would probably view forums as a form of feedback.
MB on the other hand, don't seem to give a $h!t either way!

 

[SunnyDee]

I am sorry to hear your pain dude, my W203 C Class got stolen right under my nose many years ago. When I signed the paper work for the W204 Coupé I demanded that tracker was fitted for free and Kingston MB did it for me (after telling them that my car got nicked! Also MercedesME would of been a good idea to get at the time of the purchased? As it tells you where the car is parked?

Once again sorry to hear your GLE got stolen, and it will be a long insurance battle too dude. My clamed too three months but got all the money back two weeks before Christmas 2008

 

[John Laidlaw]

Mercedes me is fine, but as a retrofit adapter all the tea leaves know to remove it from the OBD

 

[SunnyDee]

- these thieving skums bags need to be kicked in their nuts

 

[John Laidlaw]

^ twice!

 

[eman]

Hmm thats a long way!

Yes I live in a bungalow and there is no where in the houseold that the fob won't unlock the car. I know Ill keep them in the shed

 

[Botus]

so theoretically, if you were to leave it running constantly, once it was started, the car could be driven FOREVER without the key? surely they put in some sort of power kill/engine shut down on the system once the distance got over, say, 50m between the 'fob' and the vehicle? or the fob went out of range?

always been this way on all makes,

go back 10 years and loads of road testers drove to Scotland just to realise they had left the keys at home, its quite easy to do if 2 people regularly use the car. you have to try harder if you're the only user

trouble is with a manual you might stall at the lights and then you cause a road block... with autobox no issues till you reach destination, either way you can't even lock it either

 

[Botus]

Audi have the same issues.

was a follow up article in a fairly recent watchdog programme about BMW's infamous code a blank key after Lord somebody had his 2012 X5 taken

Originally they found 2006 to 2011 cars you can very easily hack the convenience window function to open the windows, plug a gadget in diagnostic OBDC port and within 2 minutes code a £20 quid blank off ebay and drive off as if the owner. BMW were to release a software update to resolve and roll out on all cars. They never bothered. The patch was to just turn off the convenience function and was only applied if you went in and asked for it.

What they actually did was update later cars to make cloning a key hard work. But its still didn't work as found by Lord someone with the X5 and thus watchdog's follow up programme.

They got a new BM and tried to hack the car on the programme. It took 12 minutes to code a blank key and drive off for a bloke having the right tools and equipment and knowledge of how to do it.

To prove there wasn't bias toward BM they tried a few other brands

on an Audi, you need to open the boot and fiddle with something first (they didn't say what) once done, using ODBC port you can code a blank and drive off in 40 seconds ...

but the best one was Range Rover, it took 9 seconds from opening to coding a blank key and driving off.... they followed up saying NO insurer is paying out for theft on these cars

Merc have got off this bad press lightly until now. But the new method is clearly the way forward...

 

[John Laidlaw]

Our new Volvo scares me! If someone nicks the wifes phone all they need to do is start it remotely then open the doors from the phone too....I'm not sure at which point the car will stop working when there's no key present, but I suspect only when it's already stopped by a thief...
I need to RTFM to put my mind at rest (or fit a Ghost to it too)

 

[turbopete]

was a follow up article in a fairly recent watchdog programme about BMW's infamous code a blank key after Lord somebody had his 2012 X5 taken

Originally they found 2006 to 2011 cars you can very easily hack the convenience window function to open the windows, plug a gadget in diagnostic OBDC port and within 2 minutes code a £20 quid blank off ebay and drive off as if the owner. BMW were to release a software update to resolve and roll out on all cars. They never bothered. The patch was to just turn off the convenience function and was only applied if you went in and asked for it.

What they actually did was update later cars to make cloning a key hard work. But its still didn't work as found by Lord someone with the X5 and thus watchdog's follow up programme.

They got a new BM and tried to hack the car on the programme. It took 12 minutes to code a blank key and drive off for a bloke having the right tools and equipment and knowledge of how to do it.

To prove there wasn't bias toward BM they tried a few other brands

on an Audi, you need to open the boot and fiddle with something first (they didn't say what) once done, using ODBC port you can code a blank and drive off in 40 seconds ...

but the best one was Range Rover, it took 9 seconds from opening to coding a blank key and driving off.... they followed up saying NO insurer is paying out for theft on these cars

Merc have got off this bad press lightly until now. But the new method is clearly the way forward...

a guy at work used to work in an Audi dealership. apparently every 10th key will open each car on average, so theoretically, a bunch of 10 Audi keys, non being yours, 1 will open your car!!! (according to him at least)

 

[Wolverine]

Just an update - Insurance paid up but only after a police investigation which didn't take long at all. The police checked my salary, checked with my employer that I was still employed etc. A bit of a hassle but I understand that some people lose their jobs and can't make repayments so turn to insurance. Apparently that happens quite often.

If I didn't have CCTV, then it could have taken a lot longer to resolve.

Managed to find another GLE (I didn't want another one after that experience but the wife drives it more than me and this was always her choice) to the same spec we had being delivered in a few weeks. Used the same branch and told them this time I expect a full valet before delivery (delivery guy left us a fiver to get it cleaned last time - A fiver !!!).

First port of call I'm thinking Autowatch Ghost. I wish the service option lasted longer though as I can see that causing an issue especially since I always use a collect/deliver and go on roads that are 40mph to get to dealer which would turn off the service mode as it's above 30.

I'd prefer a fob on the key that an immobilizer can detect in the car but I'm taking advice from here that Ghost is the way to go.

Any other recommendations before I go ahead and book the installers for the ghost and can someone recommend any good installers in the East London / Essex area?

Thanks!

 

[John Laidlaw]

Glad you got it sorted, and havent been put off MB for good!
On the Ghost, I understand what you're saying on service mode. It does cause me some concern too.
What you could do is reset it yourself before service to a simple code which you could share/thereby giving the service guy full access. Then when you get the car back, reset it to your own more complicated code.
Downside is that it's vulnerable during the service time a bit, but that exposure is minimal.
Sorry can't help on the installers, but I found Simon Pettersson at Autowatch very helpful when recommending in my area- simon@autowatch.co.uk

 

[Wolverine]

Glad you got it sorted, and havent been put off MB for good!
On the Ghost, I understand what you're saying on service mode. It does cause me some concern too.
What you could do is reset it yourself before service to a simple code which you could share/thereby giving the service guy full access. Then when you get the car back, reset it to your own more complicated code.
Downside is that it's vulnerable during the service time a bit, but that exposure is minimal.
Sorry can't help on the installers, but I found Simon Pettersson at Autowatch very helpful when recommending in my area- simon@autowatch.co.uk

Thanks! I'll give him a shout. Good call about changing the code, hope it's not too tricky to change it. I tried calling www.autodefence.co.uk a few times today but they don't answer the phone at all.

 

[mikestrivens]

autowatch.co.uk and autodefence.co.uk seem to be two completely different organisations.

 

[Wolverine]

autowatch.co.uk and autodefence.co.uk seem to be two completely different organisations.

Yeah sorry I meant I tried to call autodefence to come and install autowatch. Autowatch pretty helpful, gave me two options.

 

[mikestrivens]

oh!

 

[John Laidlaw]

Comand in Surrey were doing these, and I hear from other members that they'd trust them 100% to work on their cars- here was their post last year, gotta be worth checking them out, worth the travel..
http://forums.mercedesclub.org.uk/i...-your-car-even-if-the-keys-are-stolen.157655/

 

[Simon Barry]

I am just getting to grips with Keyless Go on an old W211 (04).

Sitting in the car with the key in my pocket, foot on brake & pressing "Start"
on gear knob, a message flashes up "Key not registered".

How is that rectified please?