Keyless Entry & Faraday Bags

[Jim Koepke]

Anyone with a keyless entry on their vehicles use a Faraday bag to prevent thieves from doing what is called a "relay entry?"

Is this only for those who are paranoid or in high car theft areas?

For an explanation, a Faraday bag blocks radio signals from electronic devices.

"Relay entry" is usually done by two people. One picks up a signal from an electronic key fob or keyless entry unit and transmits it to another person near the vehicle being stolen. My knowledge on this is from reading an older article and there may now be ways for someone to copy a key by being close and stealing the car without an accomplice.

jtk

[Mike Henderson]

Keyless entry works by having the fob and the vehicle each generate a pseudo-random number. It's not really random because both use the same generator and the same seed number so they will both generate the same sequence of numbers that appear random.

When the vehicle receives a number it looks at a set of numbers that are some length long to see if the number received matches any of them. It has to look at the sequence because it could have missed a click from the fob, or you might have pressed the fob button while away from the car. This will advance the fob sequence but not the vehicle sequence.

The way someone can hack this system is to receive the button press from the fob but send a scrambler signal to the vehicle so it can't receive it. You then press the button again and this advances the sequence on the fob. Again, they block the signal to the vehicle but then send the first number received, which opens the vehicle (since the vehicle didn't receive any of the numbers, the first number is good). Later, they can send the second number to the vehicle and that will open the doors.

But this takes a lot of equipment and the person doing this has to be pretty close to the vehicle. This technique has been known for a while but people don't worry about it very much.

Mike

[I'm not familiar with the "relay technique" but I assume it works by having a probe signal from the vehicle cause the fob to transmit a pseudo-random number, as described above (rather than pushing a button). That way, you can just walk up to the car and it will open up automatically, with no action on your part. In that situation, a device can send a probe signal to your fob, which will respond with the next number in the sequence. That number can be relayed to another person who uses it to open the car.]

[Jim Koepke]

Thanks for the explanation Mike.

My vehicle has a small button on the door that will unlock and open only the driver or passenger door without a button being pressed on the fob.

The article at > https://www.locksmiths.co.uk/faq/keyless-car-theft/ < implied a fob sitting near a window or wall could be bootlegged and used to open a car a distance away from the fob by an accomplice.

Two Faraday bags were ordered today. Have to wait for their arrival to see if this blocks the "keyless/buttonless entry" system.

jtk

[Mike Henderson]

Thanks for the explanation Mike.

My vehicle has a small button on the door that will unlock and open only the driver or passenger door without a button being pressed on the fob.

The article at > https://www.locksmiths.co.uk/faq/keyless-car-theft/ < implied a fob sitting near a window or wall could be bootlegged and used to open a car a distance away from the fob by an accomplice.

Two Faraday bags were ordered today. Have to wait for their arrival to see if this blocks the "keyless/buttonless entry" system.

jtk

I suspect that the way the system works when you press a button on the vehicle is that pushing the button causes the car to send a probe signal to the fob, which responds with a pseudo-random number. If the probe signal includes a pseudo-random number that the fob has to verify against it's list of numbers, the system would seem to be safe. A person who tried to get the fob to respond with its number would not be able to send a valid number to the fob to begin with. But I haven't looked into how those systems work. Usually, when they are designed they have some pretty good engineers designing them.

If the probe signal from the vehicle does not include a pseudo-random number, someone could do the relay theft.

Mike

[Jim Koepke]

The Faraday bags arrived today.

Placed a fob inside of one. Walked over to my vehicle and could still unlock it by pressing the unlock button.

The lock/unlock buttons would also work when pressed through the bag.

It seems they, at least the ones purchased on Amazon, may just be a waste of money.

jtk

[Jim Allen]

Back when I was using Faraday cages they had to be grounded, how would you ground a Faraday bag?

[Lee DeRaud]

FWIW, the $5 bag I bought (I think from Amazon) when I got the Honda works fine. I have it because, on vacation, GF carries the spare fob in her purse and the car won't let her leave her purse in the car (even the trunk) because it can "see" the fob inside the car.

In Honda's system (for 2013-2017 anyway), the fob is constantly transmitting at a very low level, so the car can "see" it when you're close enough to grab the door handle...the range in that mode is only about 8 feet with a good battery. The downside of this system is that the fob battery needs replacement more often, although the car will tell you when it's starting to fade. (It also appears to have some sort of RFID capability, because it will start the car with a dead fob if held within 4-6 inches from the 'start' button.) It shifts into a much higher-power mode when you actually push one of the buttons, although if you use the buttons constantly to lock/unlock, the battery life goes down to a year or so.

And as mentioned before, it really works hard to keep you from locking the fob inside the car, but normally there's no reason to ever take the fob out of your pocket anyway.