If you own a Volkswagen, you are very likely at risk of a remote cloning attack, according to new research.
After reverse-engineering the keyless entry systems of many VW models from the early 2000s through 2016, a team of researchers believe that the vast majority of the 100 million VW Group vehicles sold during that time are vulnerable to a key cloning attack that leaves the ignition and keyless entry system exposed to tampering.
The attack can be carried out using inexpensive, off-the-shelf battery-powered radios that are capable of intercepting and recording the rolling codes used by keyless entry systems. The same device can then imitate the car key.
One of the tools developed for the attack was an Arduino-based RF transceiver that costs about $40.
Researchers from the University of Birmingham in England, and German security firm Kasper & Oswald will present their research this week at the Usenix security conference in Austin, Texas.
Researchers note that Volkswagen Group used only a few global master keys for RKE systems in vehicles sold over the past two decades.
“With knowledge of these keys, an adversary can eavesdrop on a single signal from the target remote. They can then decrypt that signal, obtain the current UID and counter value, to create a clone of the original remote that locks or unlocks every door on the target vehicle.”
Researchers discovered the master keys by reverse engineering them in the firmware of electronic control units (ECUs). The attack exploits weaknesses in the encryption key distribution method.
The researchers informed the VW group about the vulnerabilities and reached an agreement with the company not to disclose the cryptographic keys and numbers of the vulnerable ECUs.
