21
Car keyless entry system attack Yingtao Zeng,Qing Yang,Jun Li UnicornTeam,Qihoo360

Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

  • Upload
    others

  • View
    16

  • Download
    1

Embed Size (px)

Citation preview

Page 1: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Car keyless entry system attack

Yingtao Zeng,Qing Yang,Jun LiUnicornTeam,Qihoo360

Page 2: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Passive Keyless Entry System

Image source:http://www.nxp.com/documents/leaflet/75017275.pdf

Page 3: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Normal Authentication Flow

Page 4: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Choose the Suitable Antenna

Page 5: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

The 125Khz Carrier Signal

Page 6: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Decode The Data

Page 7: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

The Relay Attack Scenario

Page 8: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

The Relay Attack Scenario

Noticetherearetimingconstraintsenforced!!!

Page 9: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Page 10: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Blue:CC1101Red:EM4095White:AS3933

Page 11: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

CH1 CH1CH2CH2

125Khz

125Khz315Mhz

315Mhz

315Mhz

Page 12: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

DEMO

Page 13: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

DEMO

Page 14: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

DEMO

Page 15: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

COST

• BQ241701.3• CC11011.3*6• EM40950.6• as39330.95• 125KhzAnt 0.95

• 125Khz3DAnt 2.2• atmega3280p0.75*2• 2.5dbAnt 0.41*6• PCBbord 0.7*2• ~20EUR

Page 16: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

ANT2.5DBi~320M

RANGE1

Page 17: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

RANGE2

Page 18: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Real world Attack scenarios

CarisparkedinParkinglot/Roadside/etc

Ownner isinHome/Shoppingmall/Starbuck/etc

Oncethecarisstarted,ifthecarisbeingdrivenoutoftherelayrange,thecarwillonlywarningyouthatthekeyfob cannotbedetected,butitwon’tstoptheengine,sothethief(ie .us;))candriveutill outofgas.

Page 19: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Reference• http://ams.com/eng/Products/Wireless-Connectivity/Wireless-Sensor-Connectivity/AS3933• http://cache.nxp.com/documents/leaflet/75017275.pdf?fsrch=1&sr=1&pageNum=1• http://www.nxp.com/documents/leaflet/75017275.pdf• http://www.ti.com/lit/ds/swrs061i/swrs061i.pdf• https://eprint.iacr.org/2010/332.pdf

Page 20: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

PossibleCountermeasures?Putthekeyfob insideafaradaycage/bagRemove the batteryStricter timing constraintsFor manufactures:take relative positionbetween the car and keyfob into consideration

Page 21: Car keyless entry system attack - Home - Hack In The Box ... · CH2 CH1 CH2 CH1 125Khz 125Khz 315 Mhz 315 Mhz 315 Mhz. DEMO. DEMO. DEMO. COST • BQ24170 1.3 • CC1101 1.3 *6 •

Q&A