I hacked into my own car

You can buy my books here:

You can support me on Patreon and get access to the exclusive Discord:

just like these amazing people:

Glenn Watson
Peter Turner
Joël van der Loo
Matthew Cocke
Mark Brouwer
Deneb

[The_Real_David_Davidson]

My car has a physicalized version of this where the code is actually imprinted as a series of bumps and divots on a small metal authenticator. Once inserted into a port in my car's door the authenticator is read by a series of gravity driven checkpoints (which are each validated in sequence). Once each checkpoint is in the required position the entire locking mechanism rotates, unlocking the door.

This system is 100% secure against the attack vector used in this video.

[alexevans]

"I'm in my car!" said Steve, standing outside his car.

[avramlevitter]

I've never seen someone so ecstatic to discover that his car is really easy to break into.

[Aitch-Two-Oh]

That trick works if the fob is out of range the car, otherwise it will obviously lock/unlock and then advance the code to the next one so your recording is useless.

However... 😁. Record the fob and simultaneously jam the signal. The car stays silent. When the 'victim' presses again record and jam a second time, then immediately replay the first code, and the car will respond. Victim shrugs, and you have the next valid code.

It's called a rolljam attack.

[cbiscione]

I did a circuit like 30 years ago that was able to open any car paired with a single and specific remote radio-based key. I just opened the remote key and noticed it had a chip with twelve terminals. One was ground and the other was energy. The rest of the terminals were solded to same number of metal tracks. Some of those tracks were cut, interrupted and then i deducted this was kind of coding.
As my friend had a spare remote, i modified it, by cutting all the tracks and soldering cables to the pins that ended in my protoboard with the circular-binary number generator. The circuit worked by generating a number, creating the apropriate signals to the encoder chip and after this, sending the signal simulating a open button press in a cyclic sequence. On a test in a very crowded parking lot in Centro Ciudad Comercial Tamanaco mall (Caracas), it was able to generate a correct signal to deactivate and open two cars’ alarms this morning and the consequential beeping.
Just for fun. After all the sequence ran, i had to modify the arrangement to send the close and arm signal to the two open cars and leave the site. Fun ol’days. 😅

[grahamwaldo]

Very smart to blur out your key. The number of people who don’t know to do that is concerning.

[IrishFinalExit]

this has made be paranoid about the wireless keys. I'm glad my car still has a key and manual locks.

[GiannisBak]

This rolling codes thing made my car key open my garage door for a couple of weeks

[macromancer]

If you think your car keys secure your car, watch a tow truck driver use a plastic wedge and a metal rod to open your door in a heartbeat.

[growingheart]

The double parked car in the diagram really speaks to me!
Great video! ❤

[forgottenfamily]

BTW: beware leaving your car keys near your door at home. Someone could scan your car key's RFID signature which can be used to access your car. These aren't massively long range so getting it further away mostly addresses this

[SLAutoRepair]

And now your rolling code doesn’t match. Some cars whole security system have to be reprogrammed/reset due to this nonsense.

[jamesirwin]

This is why future cars will have biometrics included. Face, fingerprints and voice.

[veroxid]

Keep in mind that the tech used to unlock the car is the same tech used to "secure" a keyless ignition.
Even modern cars are vulnerable to brute-force attacks.


If you can avoid it, dodge keyless ignitions like your life depends on it, otherwise you may walk out to your car with it not there.

[Lord.Kiltridge]

The more complicated something is, the greater the chances of failure.

[leepope]

Your evil, hacker, hacking in-a-dark-room smile is outrageous 😂

[WizardAngst]

Hi Steve, "automotive manufacturers" that invented this was one fella working for GM in Australia of all places. He showed it to his boss who told him it was work product and GM owned it now, then they outsourced it's development to one of their R&D firms. How do I know? The fella was my dad's friend, they both worked in R&D at GM. Was invented around 92. What I'm saying is source: trust me bro.

[BrandonLongwell]

I recently bought an '05 Mini and I got to learn all about this because the keyfob didn't work!
My problem turned out to be a bad connection on the receiver, but the programming and communication were fun to learn about.

[lephtovermeet]

The batteries on my fob died so I had to read the ones and zeros out loud.

[fuzzywzhe]

Aren't they all challenge and response now? Basically this method essentially has the fob contact the car, the car responds with a challenge, and the fob has to transform the response from the car into another response, by encrypting it with a particular key, or a cryptographic hash. This is impervious to replay attacks, and doesn't require a long list of one time use codes. It can be implemented with ECC or RKS (use ECC instead), or even just SHA256. The disadvantage of using computational power on a key fob, is you need some amount of processing power on the fob which in 1990, might be quite a challenge, but today? You can't do ECC quickly on a PIC chip, but you can do it on a PIC chip. It's just about 512 computations and mostly a lookup table. You have to implement modulo division and support computations on numbers that are over 1/2KB in length.