As Jacksonville Sheriff’s Office works to prosecute two men suspected of stealing more than ten cars from multiple dealerships in the area, the race surfaces once again between thieves going high-tech to swipe vehicles and owners using high-tech to protect them.
“As cars evolve, so does theft,” Aaron Nelson at Aaron’s Car Care center in Jacksonville told First Coast News. “If they can open these cars – a lot of these cars – they can start that car.”
What he means is that the remote devices, sometimes called ‘smart keys,’ that lock and unlock cars are often able to start the ignition with radio frequencies that are invisible but also interceptable.
“[Your frequencies] are out there for somebody to capture, any time you walk up to that car,” he continued.
That led us to Chris Hamer, a private high-tech security consultant, who elaborated on what Nelson was describing. The “sniffer” approach, Hamer explained, entails thieves getting close to their target vehicle while the victim unlocks it, perhaps in a parking lot. Using a device that detects the invisible code as the user ‘chirps’ the lock, the criminal is then able to use his or her device to enter the car, perhaps at a later time.
The bad news is, it can be very difficult to defend against this kind of ‘attack;’ the good news is, it’s generally most effective on vehicles whose frequency encoding is fixed (as opposed to those whose technology uses a rolling – ever-changing – code that re-generates with each use).
“Older vehicles are more vulnerable to that because they don’t use … the rolling code,” he said.
But, back to bad news, Hamer says thieves have a different method for later-model cars.
“Newer vehicles that use the rolling code, where every time you hit the button it generates a new code between the two, what they’ll do is send a jamming signal.”
The strategy, in this case, is the hope that the user isn’t paying enough attention to realize that they’ve failed to lock their car while walking away.
“So now your vehicle is left unlocked. That’s a popular attack in higher-density areas,” Hamer explained.
But alas, some of the most desirable key systems – the ones that allow the owner to unlock the car with the push of a button on the door handle and to start the ignition with the push of a button on the dashboard – can be the easiest for a thief to foil, using a method Hamer calls the “proxy” attack. The proxy attack, as the nickname implies, also involves close proximity to keys, but can be executed without the owner using the remote fob.
“You could be at home in bed, asleep, with your keys on your nightstand,” Hamer said.
The proxy usually involves two accomplices, each holding one of two twin devices about the size of a cell phone. One person simply has to be holding a device near the vehicle, the other carries his device as close as possible to where he thinks the remote fob is. That can include being outside a house, near the room where keys are stored.
The devices – some come with the brand name “Hack Key” - relay an amplified signal between remote and vehicle.
“Somebody is standing next to your car with box ‘A,’ while their associate goes with box ‘B’ around the back of your house,” Hamer exemplified. “And they keep pulling on the [car door] handle until it finally bridges that link. Your remote thinks it’s next to the car, the car thinks the remote’s next to it, the car unlocks, starts, and they drive away.”
In other words, the remote is a high-tech convenience that can lead to complacency and vulnerability.
But it doesn’t have to. Asked about potential remedies, Hamer has an immediate answer.
“It’s called a Faraday cage or a Faraday envelope,” he said. The moniker is a nod to 19th-century scientist Michael Faraday, who studied electromagnetism and electrochemistry.
Faraday devices incorporate a specially designed wire mesh embedded in their material, one that blocks signals from reaching or leaving whatever device – such as a car remote key fob – stored inside them.
More bad news: a quick look online by Hamer yielded a pair of Hack Key devices pricing at just $22.
The countering good news is, Hamer found Faraday products online costing about $11.
Both Nelson and Hamer agreed, the battle of high-tech one-upmanship between crooks and honest citizens is seemingly endless.
But, as much as his livelihood thrives on his technical expertise, Hamer finished by acknowledging a low-tech truth he implied as axiomatic.
“Vigilance is always the best defense,” he concluded.