Using technology to steal high-tech cars is not new. In my book, When Gadgets Betray Us, I use the example of Radko Soucek, a car thief from the Czech Republic who would steal luxury cars off the streets of Prague in about twenty minutes. Soucek used a laptop preloaded with an algorithm for specific makes and models of cars to help him decipher the keyless entry and ignition sequence. He managed to steal about 150 cars before his arrest in 2006.
What the hackers are doing with car theft today is much more old school, but also much more effective.
In a video within a blog posted by 1addicts, a group of men first physically break a BMW’s window in order to gain access to the vehicle’s On-Board Diagnostic (OBD) port located under the steering column. This is the diagnostics port which mechanics glean error codes from the car’s computer. It is also the port sometimes used to update automotive software.
OBDs, in various forms, have been in cars since the early 1970s, mostly to monitor airbags and components related to air quality control. Today there are at least 70 separate electrical systems within our cars, monitoring everything from whether or not our seatbelts are engaged to our use of turn indicators and headlights.
However, there is no sensor to determine whether or not the window glass intact, and further no sensor to tell the car (or remote entities) whether or not someone is attempting to use the ODB port. And apparently the ODB port is always powered, even when the car is turned off, allowing any criminal who gains physical access to the port the ability to compromise the car’s computer system. That is what the hackers did in the video: First, smash the window then compromise the onboard computer system.
According to ZDNet, BMW has acknowledged these flaws but so far has not committed to making changes.
The OBD scenario has always existed: a parking valet might have physical access to the OBD port as well, with minimal damage to the car. Physical access is always preferable to remote access. What’s different is that in March 2012 alone over 300 cars have already been stolen using physical access to the OBD port, according to 1addicts. Even less technical is another story out of the United Kingdom, of a car theft ring that created false registrations — a practice known as ‘ringing — for some 300 stolen luxury cars. According to the Telegraph, the thieves would sit in parking lots and would clone the wireless signal used to lock the car to unlock it without he owner present. “The thief would then enter the unlocked car, and hack into its computer system to access information about its key before installing a covert GPS tracking device,” the article said.
The thief would copy the key codes from the computer so that the thieves didn’t have to smash the window—they could use the cloned key to get in and drive off. Better yet, they installed a remote access to the GPS system, allowing the thieves to pick an opportune time to steal the vehicle. By not stealing the car from parking lot, presumably they could mark several dozen cars for later retrieval.
Just because a car has an antitheft system doesn’t mean it won’t be stolen. In my book I cite the two instances in which soccer star David Beckham trusted his very expensive anti-theft alarm system only to have each car stolen, one event occurred in broad daylight. Which begs a question: what good are the anti theft systems if don’t always work?
The answer is we have to remember all the lessons learned before chips were first installed inside our cars: always park in a well-lit area, use a steering-wheel lock, and hide all valuables in the trunk. Only by layering security—practicing defense in depth—can you avoid being a victim.
