Thieves cloning Honda key fobs

[MY03C5Z]

Jeesus….now you have to keep your key fob in a f-n faraday bag!!!!

https://6abc.com/amp/post/thieves-cloning-key-fob-signals-steal-locked-vehicles-montgomery-county-pennsylvania/16020797/


ROYERSFORD, Pa. (WPVI) -- Police in Montgomery County are searching for thieves accused of using technology to clone the signals of key fobs to unlock and steal several vehicles in Royersford, Pennsylvania.

Action News has been covering similar cases since early last year in different areas of the suburbs from Gulph Mills, to Upper Merion, Conshohocken and now in Upper Providence Township.
Police said three people seen walking in surveillance video might be responsible for stealing three Hondas during the overnight hours of Wednesday into Thursday morning.

They said it happened in the area of Roboda Blvd. and Vaughn Rd.

One resident said, "You'd think if you lock your doors, you're safe but apparently they're always one step ahead."

Police said the thieves are targeting modern cars with keyless entry and do not need the actual fob to pull it off.

They stand near someone's home and use a device that clones the signal of a fob that might be in someone's entryway, giving the thieves the ability to unlock and start the vehicle.

"It sounds more sophisticated, like planned out, like people are scoping the place out kind of thing. That's what it feels like," another resident said.

[FLEXjs]

Is this news?

Up here in Canuckistan we've been keeping our fobs in faraday cases for years now.

[Over140mph]

Can anyone say "Flipper" ?

[MY03C5Z]

Is this news?

Up here in Canuckistan we've been keeping our fobs in faraday cases for years now.



News to me….thats f’n crazy! I have never heard of such a thing. They are saying to keep them in one of these even in your home. Unbelievable.

Is that how your car(s) got stolen?

[FLEXjs]

News to me….thats f’n crazy! I have never heard of such a thing. They are saying to keep them in one of these even in your home. Unbelievable.

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.


Is that how your car(s) got stolen?

No. Like i said, we've been keeping our fobs in faraday cases for years.

The SRT, they re-programmed the car.

The Z06, I have no idea, I think they might have used a tow truck or something. They didn't start it.

[MY03C5Z]

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.



No. Like i said, we've been keeping our fobs in faraday cases for years.

The SRT, they re-programmed the car.

The Z06, I have no idea, I think they might have used a tow truck or something. They didn't start it.




Damn…..F that liberal feel good nonsense. I don’t know how anyone there stands for that shit. Funny….everyone around me owns firearms….and I can’t remember EVER hearing anyone’s door was broken down and robbed. Seriously. That shit happens in Philly but almost unheard of in the rural suburbs where I live. Intruders know what they’re in for if they try that out here….and it doesn’t happen.

[Onebadcad]

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.



No. Like i said, we've been keeping our fobs in faraday cases for years.

The SRT, they re-programmed the car.

The Z06, I have no idea, I think they might have used a tow truck or something. They didn't start it.

I hope your national elections comes VERY SOON!!

[owc6]

Still, to this day, there are no verified instances of either a C6 or C7 theft by fob cloning.

This, That, and The Other Place have discussed this ad nauseam.

There may be technology out there to do so, but if there is, no one has been able to prove any thefts occurred, my guess is that if it does exist, it's too pricy to target a car that is fairly thin on the ground that isn't worth much, if any, more than other cars.

[Humanoid 3.0]

been going on for a long time now :yesnod:

[MY03C5Z]

been going on for a long time now :yesnod:



The only issue I was aware of like this was with Hyundai. Didn’t know this was happening with other manufacturers. Good to know they probably can’t do it to my C6 GS. This story happened relatively close to me though, was pretty surprised they could do this. Especially that they’re getting the signal from outside your house. Crazy stuff….

[Humanoid 3.0]

Well it been happening when they intercept a signal, meaning you have to press a button, now that i read it more closely, they are saying they are cloning a fob from just outside the home. If they are using NFC/RFID, you have to been within a few cm. Unless those fobs are bordasting a periodic signal. But i would think they have a sleep mode powering down to conserve battery.

[Vince Clortho]

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.



You could cross check them in the teeth. There's no way that's illegal in Canada, five minute major at most.


125770

[DJ_Critterus]

Is this news?

Up here in Canuckistan we've been keeping our fobs in faraday cases for years now.

How'd that work out for you? Seems like it's only a "feel" good protection measure that doesn't amount to much at all.

[DJ_Critterus]

The only issue I was aware of like this was with Hyundai. Didn’t know this was happening with other manufacturers. Good to know they probably can’t do it to my C6 GS. This story happened relatively close to me though, was pretty surprised they could do this. Especially that they’re getting the signal from outside your house. Crazy stuff….

I do have a question about how this happens, though. How ae they getting the signal from the FOB if standing outside. Does the FOB constantly put one out whether buttons are pressed or not? Seems like they'd have to get really, REALLY close to pick it up to get the signal used to open the door when the fob is within a very short proximity of the car.

[FLEXjs]

How'd that work out for you? Seems like it's only a "feel" good protection measure that doesn't amount to much at all.

My cars were not stolen using fob cloning technology.

And yes, it exists and it is used extensively up here.

Lots of home security videos show them doing it.

[Humanoid 3.0]

Well it been happening when they intercept a signal, meaning you have to press a button, now that i read it more closely, they are saying they are cloning a fob from just outside the home. If they are using NFC/RFID, you have to been within a few cm. Unless those fobs are bordasting a periodic signal. But i would think they have a sleep mode powering down to conserve battery.

How'd that work out for you? Seems like it's only a "feel" good protection measure that doesn't amount to much at all.

:waiting:

[MY03C5Z]

I do have a question about how this happens, though. How ae they getting the signal from the FOB if standing outside. Does the FOB constantly put one out whether buttons are pressed or not? Seems like they'd have to get really, REALLY close to pick it up to get the signal used to open the door when the fob is within a very short proximity of the car.



Maybe when people are remote starting their cars in the morning these guys are on the street waiting for the signals? :island14: Only thing I can think of. Yeah, can’t imagine key fobs are sending out signals otherwise? Or they are getting these the way they steal chip card information, being in close proximity to your wallet. Dunno, but it’s pretty f-d up.

[Vince Clortho]

I do have a question about how this happens, though. How ae they getting the signal from the FOB if standing outside. Does the FOB constantly put one out whether buttons are pressed or not? Seems like they'd have to get really, REALLY close to pick it up to get the signal used to open the door when the fob is within a very short proximity of the car.

In a relay attack, hackers position one radio device near the car and another near the real key. These radio devices essentially extend the signal to trick the car into believing the key is nearby, allowing the car to be unlocked and started.

https://vicone.com/blog/from-key-fob-to-uwb-how-hackers-hijack-vehicle-entry-systems

The internet seems to think it can easily be done. I don't really know, one would think the manufacturers have a way to block it.

[Wathen1955]

Here in the US, almost every citizen has guns. Here is an example of what happens:

https://www.youtube.com/watch?v=iYbV_GTY5k4

[Humanoid 3.0]

In a relay attack, hackers position one radio device near the car and another near the real key. These radio devices essentially extend the signal to trick the car into believing the key is nearby, allowing the car to be unlocked and started.

https://vicone.com/blog/from-key-fob-to-uwb-how-hackers-hijack-vehicle-entry-systems

The internet seems to think it can easily be done. I don't really know, one would think the manufacturers have a way to block it.

Interesting. They bring the car to the fob. It would seem they can get entry and start the car, but once they are away from the FOB the car will probably say no key detected, so they have to get to where they are going to without shutting down the car and i guess hack a new FOB maybe based on VIN, etc.

[Humanoid 3.0]

Here in the US, almost every citizen has guns. Here is an example of what happens:

https://www.youtube.com/watch?v=iYbV_GTY5k4

I believe in NJ you would have to wait for them to breach the door and go inside

[04 commemorative]

I can wait :seasix:

[dvarapala]

Still, to this day, there are no verified instances of either a C6 or C7 theft by fob cloning.

Typical mainstream media reporters who don't understand the technology and use incorrect terminology. They said the fobs were cloned but what they described is a relay attack.

[Murray]

Is this news?

Up here in Canuckistan we've been keeping our fobs in faraday cases for years now.

*in eastern Canada

[Humanoid 3.0]

Typical mainstream media reporters who don't understand the technology and use incorrect terminology. They said the fobs were cloned but what they described is a relay attack.

well to be fair, they reported this as a relay attack

https://youtu.be/TbbWG7PDR3w?si=ms_eq8SQQxLIAbTq

[owc6]

Typical mainstream media reporters who don't understand the technology and use incorrect terminology. They said the fobs were cloned but what they described is a relay attack.

I should have included relay in my first sentence.

There is plenty of discussion (on all three places I mentioned) as to why our fobs aren't subject to this.

In a nutshell, the fob never transmits unless a button on the fob or car is touched. The fob never queries the car on its own, and the car sends only a weak signal out that extends only a few feet, and the fob sends back a very week signal that has to be within a couple of feet of the car for it to unlock. The only time the fob sends a strong signal is when a button on the fob is pushed.

The fob then needs to be inside the car to start.

I suppose in theory, you could open the car if the fob was stored on an outside wall with either B pillar within two feet of the fob or a series of relays, but then you still couldn't start the car. You would then have to have a series of relays every couple of feet (or an amplifier) and the final transmitter would have to inside the car to start.

Sound like a lot of trouble and expense for a thief when a tow truck could snatch the car in an instant for practically nothing extra (thieves already have one or access to one for their line of work).

I'm sure I've forgotten some other detail, but that's the gist of it.

[MY03C5Z]

Typical mainstream media reporters who don't understand the technology and use incorrect terminology. They said the fobs were cloned but what they described is a relay attack.



They call all handguns ‘Glocks’ and all rifles ‘AR-15’s’. You can’t expect them to get electronic technology correct. lol.

[gs568]

If it’s anything like the Lexus system, then there should be a setting that disables the constant radio signal. By doing so, you lose the ability to walk up to your car and open the door without touching the remote. In my case, I use the buttons on the remote to unlock and lock the car. And I have to put the remote up to the start button so the car will start.

Better than having someone steal your car.

[dvarapala]

I should have included relay in my first sentence.

There is plenty of discussion (on all three places I mentioned) as to why our fobs aren't subject to this.

In a nutshell, the fob never transmits unless a button on the fob or car is touched. The fob never queries the car on its own, and the car sends only a weak signal out that extends only a few feet, and the fob sends back a very week signal that has to be within a couple of feet of the car for it to unlock. The only time the fob sends a strong signal is when a button on the fob is pushed.

The fob then needs to be inside the car to start.


I owned a 2005 for 10 years and I understand how the fobs work.

The relay attack involves 2 people: 1 stands near the car, the other stands near where the fob is hanging on the peg hook in the hallway inside the house. Each thief carries a small device that relays the RF signals bi-directionally between the two units, bridging the gap between the fob and the car; as far as the car can tell, the thief standing next to the car has a legitimate fob in his hand. The relay devices take the weak signal from the fob and re-encode it using a much stringer RF signal with a much longer range - more than enough to cover the distance between the house and the C6 parked in the driveway.

To start this process, all the thief has to do is touch the door handle, and the RCDLR module inside the car will transmit the challenge message which will be relayed to the fob, and the fob's response relayed back. The solenoid will activate and the door will open. The thief gets inside and presses the start button; again the messages are relayed between the car and the real fob; the RCDLR sees a legitimate fob inside the car and so the car starts. The second thief then hops into the passenger seat and they drive off.

The C6 will continue to run until the thieves shut it off in their chop shop, where then can then take whatever steps are necessary to pair one of their own fobs with the RCDLR inside the car or simply replacing the RCDLR module entirely.

[dvarapala]

The internet seems to think it can easily be done. I don't really know, one would think the manufacturers have a way to block it.

The way you block it is to keep you fob inside of a Faraday bag or cage to block any RF signals from getting to or from your fob. :yesnod:

[Steve_R]

I owned a 2005 for 10 years and I understand how the fobs work.

The relay attack involves 2 people: 1 stands near the car, the other stands near where the fob is hanging on the peg hook in the hallway inside the house. Each thief carries a small device that relays the RF signals bi-directionally between the two units, bridging the gap between the fob and the car; as far as the car can tell, the thief standing next to the car has a legitimate fob in his hand. The relay devices take the weak signal from the fob and re-encode it using a much stringer RF signal with a much longer range - more than enough to cover the distance between the house and the C6 parked in the driveway.

To start this process, all the thief has to do is touch the door handle, and the RCDLR module inside the car will transmit the challenge message which will be relayed to the fob, and the fob's response relayed back. The solenoid will activate and the door will open. The thief gets inside and presses the start button; again the messages are relayed between the car and the real fob; the RCDLR sees a legitimate fob inside the car and so the car starts. The second thief then hops into the passenger seat and they drive off.

The C6 will continue to run until the thieves shut it off in their chop shop, where then can then take whatever steps are necessary to pair one of their own fobs with the RCDLR inside the car or simply replacing the RCDLR module entirely.


If a thief is inside the house standing near the fob, why not just take the fob? :shrug:

[dvarapala]

If it’s anything like the Lexus system, then there should be a setting that disables the constant radio signal. By doing so, you lose the ability to walk up to your car and open the door without touching the remote.

On my IS-F, the fob does transmit periodically (the courtesy lights on the car illuminate as you approach) but I still have to physically touch the door handle before the car will actually unlock. I suspect that turning off the continuous transmissions would make your Lexus operate like a C6, i.e. when you touch the door handle the car will still transmit a challenge message to your fob and your fob will still respond. If that is indeed the case then even with that setting disabled the car is still vulnerable to a relay attack.

[dvarapala]

If a thief is inside the house standing near the fob, why not just take the fob? :shrug:

The thief is not inside the house, he's standing at the front door within a few feet of where the fob is hanging - close enough to capture the weak signals coming from it.

This video provides a good view of how the attack works. Notice the second thief walking around the perimeter of the house, trying to guess where the fob is being stored. Meanwhile his partner presses the button on the door handle to trigger transmissions from the car to the fob.

4bqQfldMnwM

BTW, this protector device looks like it would be very effective. It appears to remove battery power from the device until you tap it twice, at which time it allows the fob to operate long enough for you to get inside the car and start it. Very clever. :yesnod:

I wonder if the engineer that came up with this design was "licensed"?

[Wathen1955]

I have a 2024 Honda Pilot Elite. I have 2 FOB's for the car. One is inside the house, as you enter from the garage, I have it hanging on a hook. That one is a spare, so I probably should simply move it away from the car further. My other key is the one I use all the time. It's inside my master bedroom, about 300 feet away from the car. Is this a problem?

It would be nice if there was a way to turn off the FOB when not in use.

[owc6]

I owned a 2005 for 10 years and I understand how the fobs work.

The relay attack involves 2 people: 1 stands near the car, the other stands near where the fob is hanging on the peg hook in the hallway inside the house. Each thief carries a small device that relays the RF signals bi-directionally between the two units, bridging the gap between the fob and the car; as far as the car can tell, the thief standing next to the car has a legitimate fob in his hand. The relay devices take the weak signal from the fob and re-encode it using a much stringer RF signal with a much longer range - more than enough to cover the distance between the house and the C6 parked in the driveway.

To start this process, all the thief has to do is touch the door handle, and the RCDLR module inside the car will transmit the challenge message which will be relayed to the fob, and the fob's response relayed back. The solenoid will activate and the door will open. The thief gets inside and presses the start button; again the messages are relayed between the car and the real fob; the RCDLR sees a legitimate fob inside the car and so the car starts. The second thief then hops into the passenger seat and they drive off.

The C6 will continue to run until the thieves shut it off in their chop shop, where then can then take whatever steps are necessary to pair one of their own fobs with the RCDLR inside the car or simply replacing the RCDLR module entirely.

Again, theoretical. No proof this has ever happened. Don't forget the rolling codes, which makes the fob cloning thing darn near impossible.

Fun mental exercise, however.

BTW, (if by chance you drive off w/o a fob on board), it will give you one chance to restart the car in ~5 minutes.

It will not give you a second chance to do so.

This part makes no difference to the chop shop.

[Torqaholic]

Is this news?

Up here in Canuckistan we've been keeping our fobs in faraday cases for years now.

I was going to say it smells like Canadians :rofl: Why PA though? Did Florida get wise to them and they ran out of gas on the way home?

[jw38]

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.

Are most of those dudes high on melanin?

[FLEXjs]

Are most of those dudes high on melanin?

In almost all cases, yes.

[6spdC6]

In almost all cases, yes.

As bad as it is for you guys, here in the US we have many more of those people. They most certainly live up to the old stereotypes-:mad:!

[BRUIZER]

This is why there are so many home invasions here now. If they can't get a signal they just kick in your front door and demand the key fobs. Usually 4-5 dudes break in with hammers. It's lawlessness here. And we cannot defend ourselves. If you shoot one of these ****ers, they'll charge you with manslaughter.



No. Like i said, we've been keeping our fobs in faraday cases for years.

The SRT, they re-programmed the car.

The Z06, I have no idea, I think they might have used a tow truck or something. They didn't start it.


Instead of purchasing newer vehicles, I would be spending the $$ on a place outside the city, with no neighbors.
With nobody around to hear or witness a criminals cries for mercy, it's a LOT easier to inact justice, while burying evidence of you defending your property and/or life. A hammer isn't going to stop a few po'd guard dogs.

[Humanoid 3.0]

I have a 2024 Honda Pilot Elite. I have 2 FOB's for the car. One is inside the house, as you enter from the garage, I have it hanging on a hook. That one is a spare, so I probably should simply move it away from the car further. My other key is the one I use all the time. It's inside my master bedroom, about 300 feet away from the car. Is this a problem?

It would be nice if there was a way to turn off the FOB when not in use.

Maybe put the spare in one of those metal key boxes. It is not the distance to the car that is the issue with the relay attack, but the distance from the outside perimeter of your home, especially windows, to the FOB.

[Force-1]

Maybe put the spare in one of those metal key boxes. It is not the distance to the car that is the issue with the relay attack, but the distance from the outside perimeter of your home, especially windows, to the FOB.

I keep a spare fob to my Audi Q7 in a lockable hitch box. It's wrapped in tin foil so it doesn't transmit.

[dvarapala]

Again, theoretical. No proof this has ever happened.

Absence of proof is not proof of absence.

Don't forget the rolling codes, which makes the fob cloning thing darn near impossible.

I was not discussing cloning. I was discussing a relay attack.

In watching a few of the videos on this topic, I noticed that many people are making the unstated assumption that the key fob must be transmitting continuously in order for a relay attack to work. That is not the case - all a thief has to do is touch the door handle to trigger the car to transmit, which you see the first thief doing repeatedly in the video I posted.

[Humanoid 3.0]

Absence of proof is not proof of absence.

. ...