Keyless car security Kia Niro

gabitzul

It seems that Kia are particularily vulnerable, but I confess I don't fully understand the technicalities.

This has reminded me to purchase a second faraday pouch, for the spare keys of my Kia Soul EV. 

The ease and speed with which they are opened and stolen is astounding.

murfy92

gabitzul said:

It seems that Kia are particularily vulnerable, but I confess I don't fully understand the technicalities.

This has reminded me to purchase a second faraday pouch, for the spare keys of my Kia Soul EV. 

The ease and speed with which they are opened and stolen is astounding.

faraday pouches cannot be relied on. 

purchase a metal box and keep the keys in their overnight better-still install an aftermarket immobiliser.

murfy92

Goldenyears said:

I use Faraday pouches for my (not keyless) BMW 3-Series.  When key is secured in the pouch and start button pressed, the car responds "Security failed".  So if the signal leaks, but not enough to start' is it possible for a thief to start the car with their device when the leaked signal is at least 1000X  lower with key 10 metres away? 

they have devices to amplify the signal which will enable them to clone the key.

murfy92

By the way I'm hearing a lot of Kia Niro's are getting stolen in my local area. 

Avoid buying Kia keyless cars they are vulnerable. 

Kia must do more to make it harder for thieves, at the moment it's just too easy.

gabitzul

murfy92 said:

faraday pouches cannot be relied on. 
purchase a metal box and keep the keys in their overnight better-still install an aftermarket immobiliser.

Tried what I thought to be a good metal tea box, but the signal was still being received by the car, so lost faith in metal boxes. The faraday pouches I have seem to work, I sit next to the car and it can't be unlocked. Will test from time to time to make sure it stays this way.

I seem to remember - I think the Kia system does not enter standby like others, because it does not have a movement sensor, so it remains vulnerable. But more knowledgeable people can correct me.

[Deleted User]

gabitzul said:

murfy92 said:

faraday pouches cannot be relied on. 
purchase a metal box and keep the keys in their overnight better-still install an aftermarket immobiliser.

Tried what I thought to be a good metal tea box, but the signal was still being received by the car, so lost faith in metal boxes. The faraday pouches I have seem to work, I sit next to the car and it can't be unlocked. Will test from time to time to make sure it stays this way.

I seem to remember - I think the Kia system does not enter standby like others, because it does not have a movement sensor, so it remains vulnerable. But more knowledgeable people can correct me.

Even testing a faraday pouch might not mean it is good enough to be stop a thief using a relay device, the pouches don't totally block the RF signals, they just reduce their strength.

Just because your key won't open the car when inside the pouch doesn't mean that it isn't leaking the radio signal in and out of the pouch, it is just too weak and the key fob or car determines the key is too far away and doesn't unlock.

For example your keyless entry might unlock the car from 5ft away, that doesn't mean at 6ft the radio signal totally vanishes, it is still there but below a pre-set signal strength threshold and will be ignored.

Understanding how keyless entry works makes it easier to see how metal boxes and faraday pouches can be overcome.

1. Car constantly transmits a signal usually on a lower frequency and is reasonably strong to avoid dead spots.
2. When the key fob hears a signal from the car it is paired to, if it is above a certain signal strength, it responds with a code on a higher frequency, usually 433Mhz.
3. The car receives the signal and unlocks, however depending on the strength, it also can ignore it if it is too weak, even though it is the correct signal to unlock.

The car and key fob relies on those predetermined signal strengths to figure out how far away the key is and reliably lock / unlock the car at a set distance.

Along comes the car thief with their high powered relay device....

1. The LF signal from the car is picked up on a device and retransmitted, usually to a second device that can be positioned near the house and nearer to the keys.
 
2. These devices ignore the manufacturers limited signal strengths and will transmit at a much higher power - enough to penetrate your Amazon basics faraday pouch. 

3. The key responds with its radio signal, only a weak signal escapes the pouch, too little to unlock the car even if right next to it,  but the thieves relay device is sensitive enough to pick it up and retransmit at a much higher power, enough for the car to think the keyfob is near enough.

So just because your key won't unlock the car in the faraday pouch doesn't mean it is safe from thieves. Putting that key / pouch as far away from the perimeter of the house as possible will help, but a better solution is keys that enter standby when not moving so they won't respond at all.

UncleZen

I was looking at a honda civic with Keyless ignition (they only make 1 model Keyless, the rest use a key). When i queried, with the dealer, if the keyfob went quiet, he said no, get a faraday pouch if you're concerned. That's the advice from a main honda dealer. I walked away.

[Deleted User]

Metal boxes don't work. I used to design radio devices that use the same frequencies as car fobs, specifically built to work inside metal boxes from a considerable distance.

They are not the most effective way to attenuate the signal.

What you really need is an updated key fob that has a motion sensor in it. No motion means no opening or starting the car. Kia should be able to provide one by now. They should give it to you for free, all things considered.

TheProfessional

I do have a metal box which does block the signal but I just leave the key hanging in the hallway (no access by fishing through letterbox) as if they are going to break in to the house to get it I would rather they didn't wake me or the children up

murfy92

[Deleted User] said:

gabitzul said:

murfy92 said:

faraday pouches cannot be relied on. 
purchase a metal box and keep the keys in their overnight better-still install an aftermarket immobiliser.

Tried what I thought to be a good metal tea box, but the signal was still being received by the car, so lost faith in metal boxes. The faraday pouches I have seem to work, I sit next to the car and it can't be unlocked. Will test from time to time to make sure it stays this way.

I seem to remember - I think the Kia system does not enter standby like others, because it does not have a movement sensor, so it remains vulnerable. But more knowledgeable people can correct me.

Even testing a faraday pouch might not mean it is good enough to be stop a thief using a relay device, the pouches don't totally block the RF signals, they just reduce their strength.

Just because your key won't open the car when inside the pouch doesn't mean that it isn't leaking the radio signal in and out of the pouch, it is just too weak and the key fob or car determines the key is too far away and doesn't unlock.

For example your keyless entry might unlock the car from 5ft away, that doesn't mean at 6ft the radio signal totally vanishes, it is still there but below a pre-set signal strength threshold and will be ignored.

Understanding how keyless entry works makes it easier to see how metal boxes and faraday pouches can be overcome.

1. Car constantly transmits a signal usually on a lower frequency and is reasonably strong to avoid dead spots.
2. When the key fob hears a signal from the car it is paired to, if it is above a certain signal strength, it responds with a code on a higher frequency, usually 433Mhz.
3. The car receives the signal and unlocks, however depending on the strength, it also can ignore it if it is too weak, even though it is the correct signal to unlock.

The car and key fob relies on those predetermined signal strengths to figure out how far away the key is and reliably lock / unlock the car at a set distance.

Along comes the car thief with their high powered relay device....

1. The LF signal from the car is picked up on a device and retransmitted, usually to a second device that can be positioned near the house and nearer to the keys.
 
2. These devices ignore the manufacturers limited signal strengths and will transmit at a much higher power - enough to penetrate your Amazon basics faraday pouch. 

3. The key responds with its radio signal, only a weak signal escapes the pouch, too little to unlock the car even if right next to it,  but the thieves relay device is sensitive enough to pick it up and retransmit at a much higher power, enough for the car to think the keyfob is near enough.

So just because your key won't unlock the car in the faraday pouch doesn't mean it is safe from thieves. Putting that key / pouch as far away from the perimeter of the house as possible will help, but a better solution is keys that enter standby when not moving so they won't respond at all.

Brilliant explanation and advice. More and more people need to know this as a lot of people are relying on the pouches.