# How are these car burglars hacking keyless remote locks? **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [June 9, 2013, 5:28am UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527 "2013-06-09T05:28:26Z")\ **Posts on this page:** 9\ **Page:** 3
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [August 7, 2013, 12:55am UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/41 "2013-08-07T00:55:34Z")
> [@DougSt](#): > > This happened to me just last night. > > About 8 months ago the same thing happened, the car was broken into and the work laptop and my Cell was stolen overnight with no damage to the car at all. Now I couldn’t be positive that I’d locked it but I was sure I had. I put it down to poor judgement and bad luck however the police did say that a few other cars had been broken into in the street just over in the same manner, no damage at all. The police believed that jammers were being used then. > > Since the last time I lock the car with the remote and make sure that it’s locked physically by checking all 4 doors and I don’t keep valuables in the car anymore. > > However this morning I unlocked the car and got in as usual to find the glove compartment down…Once I started the car the computer told me that the passenger door was open and the boot (trunk) as well. > > I’m going to get CCTV now to catch them in the act. What model was it? Do you know the models of the others that were broken into? ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [August 7, 2013, 12:56am UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/42 "2013-08-07T00:56:35Z")
> [@Clothahump](#): > > And it’s expensive as hell, too. I lost my keys a while back and had to get new fobs for both my car and SWMOS’s, as well as the house alarm. 630 clams for the cars and another 125 for the house. Grrrrrr…:mad: Maybe someone should sell key insurance for a couple bucks a year. ---
**Author:** ![JsonR](https://avatars.discourse-cdn.com/v4/letter/j/74df32/32.png) [@JsonR](https://boards.straightdope.com/u/JsonR)\ **Post date:** [September 1, 2013, 12:41pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/43 "2013-09-01T12:41:02Z")
I just purchased a Dodge Ram and with the purchase comes a year subscription to Uconnect. Uconnect is able to send an unlock request to my vehicle via a cell phone app or from a web browser. I believe Uconnect is powered by Sprint. I think this is going to be the weakness. Would like to know more about the security they use for this. ---
**Author:** ![JustinC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/justinc/32/8083_2.png) [@JustinC](https://boards.straightdope.com/u/JustinC)\ **Post date:** [September 1, 2013, 12:53pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/44 "2013-09-01T12:53:53Z")
You can hack into wifi signals, cell phone signals, CB signals etc. Could a savvy thief hack into a fob signal as the door’s being locked? ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [September 1, 2013, 2:18pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/45 "2013-09-01T14:18:38Z")
> [@JustinC](#): > > You can hack into wifi signals, cell phone signals, CB signals etc. Could a savvy thief hack into a fob signal as the door’s being locked? These systems use “rolling” codes. So that the code to unlock the door changes each time. Having the code from the previous time doesn’t (hopefully) help. But the people who write the firmware for these systems aren’t perfect, bugs happen, shortcuts are taken, etc. and on some systems, after recording a few codes, the “pattern” can be figured out and a legitimate code can be faked. Sometimes these systems are more like security theater than actual security. ---
**Author:** ![JFLuvly](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@JFLuvly](https://boards.straightdope.com/u/JFLuvly)\ **Post date:** [September 1, 2013, 8:09pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/46 "2013-09-01T20:09:23Z")
I read an article on making a gps using a nintendo ds and a salvaged on star receiver which I was reminded of while reading this thread. I know that on star can unlock your car doors for you so I wonder if , instead of hacking the key fob, are they hacking the on star or whatever system the manufacturer is using? To be honest I don’t know if other manufacturers have a similar system to on star. ---
**Author:** ![ControlNode](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@ControlNode](https://boards.straightdope.com/u/ControlNode)\ **Post date:** [July 29, 2014, 3:49pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/47 "2014-07-29T15:49:43Z")
I just saw this video (or one on the same topic) and have a guess on how. I think they are tricking convenience devices (like OnStar or such) by by using a “microcell” in a box that pretends to be the cell tower for the cellular based communications for the convenience device that also contains a fake online server/service provider that the convenience device expects to communicate with. When the microcell is close enough to the car the convenience device seeing the microcell as a stronger signal connects to the microcell . One for first tasks would be to update its network address it gets from the new microcell connection in the online service’s database, its now talking to a fake online service in the box with the microcell. Once the microcell box confirms the address update it likely follows that with a request to unlock. If all of the authentication of the user when calling the online service call center or using the remote app happens on the online services servers and the command sent to the car is just the command with no other validation when the command is received it would just unlock since it trust the online service that it thinks is the correct one. I think the convenience service designers figured thieves would be targeting the car so the authentication would be the key itself to start it rather than targeting what people are leaving in their cars. I know this thread is a little old. I agree that it is unlikely that cars with standard key fobs are the ones at risk here. I think it is related to the newer “always connected cars.” ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [July 31, 2014, 12:51pm UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/48 "2014-07-31T12:51:10Z")
In the original article, it says that the police are baffled and are looking to the public for help. If the break ins were only occurring with cars with Onstar (or similar) systems I’d think the police would have noticed that and would have mentioned it if they truly want help from the public. In any case, I would hope that Onstar type systems would be encrypted to prevent the type of attack you described. ---
**Author:** ![usedtobe](https://avatars.discourse-cdn.com/v4/letter/u/ec9cab/32.png) [@usedtobe](https://boards.straightdope.com/u/usedtobe)\ **Post date:** [August 1, 2014, 6:03am UTC](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527/49 "2014-08-01T06:03:57Z")
I’ll pass this along for the young-uns: The first “Remote Activated” garage door openers did not use radio transmitters - they used, essentially, tuning forks to produce a sound (too high for human ears) wave which the opener recognized. Burglars would get a clicker and drive down the street, clicking away and see if an interesting-looking door opened. In the late 80’s I lived in an apt complex which still used audio clickers to open the gate. This was Salinas, but even there, I’d expect a bit more sophistication. [Previous page](https://boards.straightdope.com/t/how-are-these-car-burglars-hacking-keyless-remote-locks/660527.md?page=2)