Blog: How Tos

Practical security advice for keyless cars

consultant-placeholder10 Ken Munro 02 Sep 2015


There’s been plenty written about the four high profile car hacks that were presented or released around BlackHat and DefCon this summer.

However, little advice has been put out in the press for Joe Public.

Should you be concerned? What can you do about it?

Well, as an owner of a keyless entry car, I’m concerned and I’m doing something about it.

#1 keep your keyless entry car keys well away from your car

I know it sounds blindingly obvious, but a spate of attacks appear to have happened in the US that exploit this. A radio signal amplifier has been used by the thief to amplify the signal from your keyless entry keys, making the car think the keys are next to it, rather than in the nearby house.

The car then unlocks when the door handle is pulled. It starts, and off the thief drives.

So: if your car is parked close to your house, don’t leave the keys near the front door. Keep them well away from the car, so this ‘amplification’ attack is harder

#2 consider putting your keyless entry keys in a RF shielded box or pouch

Keyless entry is so easy. Keys in pocket or bag, car opens for you.

Make this attack so much harder by stopping the radio signals getting from your keys. It’s a pain having to take them out of the pouch, but it could stop your car being stolen.

If at home, keep the keys in a small metal box, ideally one that’s shielded from radio waves. Lead, copper or silver can work well!

#3 if your car hasn’t been for a service recently (say the last 3 months or so) speak to your dealer

Unless your car can update its software by itself (Tesla, some BMWs and a few other brands) then it may need a software update to fix security flaws. This may require a trip to the dealer, so speak to them.

Here’s a list of cars affected by the Megamos hack:


#4 even if you don’t have a keyless entry car, don’t leave valuable stuff in it

The attacks work against non-keyless entry cars too. It’s just that it can be a harder to start the engine, requiring different techniques and maybe some old-school hot-wiring of the ignition.

The car can be unlocked, so don’t leave anything in it. Again, this is really obvious, as smashing a window works almost as well for a thief.

Check with your dealer for a software update too.

The above isn’t the end of it, there are other issues to be aware of, but that’s what I’m doing personally about these hacks.