Researchers from the University of Birmingham and the German security firm, Kasper & Oswald, have shown that Volkswagen cars can be hacked with just a £30 ($40) RF module. The hack was presented at the USENIX Security Symposium in Austin, Texas. It affects millions of VW cars and could explain unsolved insurance cases of theft from allegedly locked cars.
The paper also discloses a second method for hacking other brands, but it is a more complex vulnerability to take advantage of. A few of the cars listed as vulnerable to one of either of the attacks included the Renault Clio (2011), Chevrolet Cruze Hatchback (2012), Ford Ka (2009, 2016), Nissan Micra (2006). VW group cars including Audi, Seat and Skoda are affected too.
In the key fob attack, the researchers showed that a hacker could spy on key fob"s signal using a cheap, homemade Arduino-based RF transceiver. The hacker could then clone the digital keys to unlock various VW Group vehicles.
In the process of arriving at their findings, the researchers had reverse-engineered the keyless entry system in affected models and in some cases this resulted in them gaining access to some master cryptographic keys. The researchers agreed with Volkswagen that they would not publish the value of the cryptographic keys which they"d uncovered.
Speaking to the BBC, security expert Ken Munro from Pen Test Partners, said some of the affected cars will still be in use in ten years time without any sort of patch because of how difficult a job it would be to fix all the affected cars. Volkswagen is currently producing 10 million cars a year.
Source: BBC News | Image of a hooded hacker courtesy Shutterstock