Thieves steal cars by accessing wiring in the front bumper

Mr._Dan

Raising awareness of another car theft issue. Thieves can buy devices (that look like innocent Bluetooth speakers) that enable them to steal cars in a minute or so. They break the clips holding the front bumper to access the car's wiring. They can attach a device to the wiring to send signals that override the car's security and unlocks the doors, then jump in and drive off. Multiple car models are affected. Unlike the key relay attack, storing your keys in an RFID pouch or metal box doesn't matter, it is using a newfound weakness in the car's wiring design. There is a video on Youtube of it happening, search "Toyota RAV4 2021 - stolen in less than two minutes" on Youtube. The CANIS Automotive Labs website has more detail for those with an interest in vehicle electronics.

Next time you visit your dealer ask them what they are doing about this problem. It could be fixed by a software update from the manufacturer. In the meantime, it looks like I need to be digging out my old steering lock again!

Dan

fred990

Yes heard recently of cars with cruise control/AEB radars being prised open then giving instant access to the canbus systems. 
Gone in minutes. 
Think I'd be parking tight nose in!

CliveOfIndia

Another benefit of driving old bangers with none of this fancy electronic gubbins

binao

fred990 said:

Yes heard recently of cars with cruise control/AEB radars being prised open then giving instant access to the canbus systems. 
Gone in minutes. 
Think I'd be parking tight nose in!

@fred990

O learned one, What is AEB and a canbus system?

Thanks

Grumpy_chap

binao said:

What is AEB and a canbus system?

AEB = Autonomous Emergency Braking.  More commonly camera controlled (mounted behind the rear view mirror) than radar controlled.  Radar is more common for Adaptive Cruise Control.

CanBUS = Controller Area Network - computer communications system that allows components to interact without a host computer.  I don't know but suspect automotive systems would use ModBUS (Modicon - the developing company) which does require a PLC / ECU unit to facilitate the communication between components.

facade

In The Not Very Olden Days (a few years ago) thieves stealing certain cars whose make began with "F" used to have to go to the trouble of popping the drivers side window and reaching in to plug into the OBD socket to steal the car.

(No-one will ever admit anything, but the most likely explanation is that the manufacturers database was hacked, or downloaded by a malicious employee and sold, so that readily available software could look up the VIN number and generate the correct codes to access the security system, open the doors and start the car)

Eventually, after many years and thousands of stolen cars the mystery manufacturer took the simple step of ensuring the alarm actually went off when they reach in. More obvious things like the car's software having a 5 minute waiting period in between access and enabling the ignition has still eluded them I fear.

This still left the thief sitting on shards of window glass, which is a bit uncomfortable even if it is safety glass.

It was a godsend to the thieves allowing them to stand outside someone's house with a relay box and access their keyless transponders and steal the car without having to risk being caught breaking into the car or sitting inside it, only having to get in when they know it is away in seconds.

Finally, after many many thousands of stolen cars whose make begins with "R" ending up in containers shipped overseas manufacturers took the simple step of putting the keyless transponder to sleep when it is in your biscuit tin, so it won't respond to the relay box.

So the thieves realised that they can simply tap into the cars wiring instead.

CANBUS

Modern cars did away with ultra-reliable switches and wires that went directly to things like the lights and wipers in favour of the canbus system.

Everything on the car has connection to power, and all the switches and bulbs now have "failomatic (tm)" interfaces attached, so your light switch now sends a coded signal along like a ring mains- the canbus,  to the headlight which then turns on (or sometimes expensively doesn't). 

Basically a way of making something cheap and reliable anything but. There are "advantages" like the lights can stay on to annoy other road users whilst you get out, come on by themselves in the dark, flash messages in morse code etc, with the advantage for the manufacturer that they can charge ££££ extra to enable these "premium" features. 

Now if you can tap into the canbus, you can pretend to be the security system and tell the rest of the car that everything is wonderful and we are going to go for a drive, so we need to open the doors and start up.

All you need us a suitable interface (available through the usual channels) and a canbus wire to connect it to. It turns out that the radar/lidar modules fitted in the bumper of some premium cars have canbus access and can be quickly pulled out to get to the wires.

Thieves like to work outside the car, then if one of those "Police" (that you never ever see anymore) or a large enough and sufficiently well armed vigilante group* turn up they can jump back into their (stolen) golf and escape rather than getting trapped inside.

If you have a decent steering wheel lock and a particularly common car like a Rangerover sport there is every chance the thieves will move onto next door's Rangerover instead.

Nothing will stop determined thieves stealing your particular car to order, they will just come back with the tools to open your brand of lock another night.

(*If you ring these "Police" and tell them you car is being stolen they just warn you not to confront the thieves as they have backup and are usually armed, and if you are lucky they send a car round in a few days, or just give you a crime number for the insurance)

fred990

binao said:

fred990 said:

Yes heard recently of cars with cruise control/AEB radars being prised open then giving instant access to the canbus systems. 
Gone in minutes. 
Think I'd be parking tight nose in!

@fred990

O learned one, What is AEB and a canbus system?

Thanks

Canbus is the controller/module communication system on VAG cars.

The AEB radar aerial in the bumper area is what I was referring to, easy to open/ access (without preventative modification). Obviously the camera part would involve smashing the windscreen! Not sure that would make a for a quick getaway...

GC must be referring to some sort of Doppler camera (!) that does braking?

HillStreetBlues

My car doesn't even have electric windows, so think it's safe from that