Can the VF passive entry system be hacked or is it safe?

[mwb235]

I was recently reading several online articles about how cars with passive entry/start systems (like some VF models) can potentially be hacked - i.e. unlocked and driven away without the keyfob.

These two 2015 articles discuss it in detail:
https://www.whichcar.com.au/news/keyless-entry-hacked
https://practicalmotoring.com.au/car-advice/why-your-keyless-car-is-vulnerable-to-attack/

And an overseas article from 2017:
https://www.tomsguide.com/us/keyless-entry-car-hack,news-25022.html

Yet this NRMA arcticle from 2016 is a bit more positive saying it’s not an issue in Australia:
https://thehub.nrma.com.au/drive/have-keyless-cars-become-target-thieves

So I was wondering are VF’s with passive entry/start safe?

 

[Forg]

Anything can be hacked, if someone spends long enough trying.
Keep your insurance up to date & don't worry about it … it's probably better they do this, than smash a window with a brick & destroy your ignition-lock & half the dashboard hotwiring it …

 

[stooge]

most wireless security systems can be tampered with or hacked but if you read the articles they explain the hack needs to get your keys signal and send it to the vehicle.
they explain this by saying you need one antenna near the key and one near the vehicle and then they receive the key data and send it to the vehicle so the vehicle thinks you are next to the car and allows the unlock.
one article also points out you could remove the battery from the key to prevent it so this points out a few things.

the first is it needs live pkes data from the key to be streamed so it looks like the data cannot be simulated or recorded and sent at a later date probably because of cryptography/rolling codes.
another point is it seems to work on the wireless signal powered by the battery so removing the battery prevents it which would point to the keyfob rfid chip is not a part of the hack because that is not normally battery powered.

you should be able to start the vf without a battery in the key because it will detect the rfid chip so the question will be does the vf start with only the pkes data and not the rfid chip being detected and if you stop sending the pkes data because the person with the key goes out of range will the vf shut down because the rfid is not found.

I don't think anyone at gm or holden would divulge that information so we can only speculate but like forg said "insurance" is the best way and yes you might never be able to get another vf again but at least it wouldn't be a total loss.

 

[mpower]

yes it can. have good insurance.

 

[lmoengnr]

most wireless security systems can be tampered with or hacked but if you read the articles they explain the hack needs to get your keys signal and send it to the vehicle.
they explain this by saying you need one antenna near the key and one near the vehicle and then they receive the key data and send it to the vehicle so the vehicle thinks you are next to the car and allows the unlock.
one article also points out you could remove the battery from the key to prevent it so this points out a few things.

the first is it needs live pkes data from the key to be streamed so it looks like the data cannot be simulated or recorded and sent at a later date probably because of cryptography/rolling codes.
another point is it seems to work on the wireless signal powered by the battery so removing the battery prevents it which would point to the keyfob rfid chip is not a part of the hack because that is not normally battery powered.

you should be able to start the vf without a battery in the key because it will detect the rfid chip so the question will be does the vf start with only the pkes data and not the rfid chip being detected and if you stop sending the pkes data because the person with the key goes out of range will the vf shut down because the rfid is not found.

I don't think anyone at gm or holden would divulge that information so we can only speculate but like forg said "insurance" is the best way and yes you might never be able to get another vf again but at least it wouldn't be a total loss.

If a VF owner was really paranoid, removing the key battery is the best way of disabling the signal.
Another way is storing the key in a metal box(a Faraday shield) to disable the signal.
Something like a lolly tin.

 

[Skylarking]

Google is a great source in finding about these PKES hacks so using some trivial search terms will start you down the rabbit hole.

Sadly this circa 2011 hack seems not to have been mitigated against by vehicle manufacturers and the hack has only gotten cheaper (tens of dollars for the hardware) and better (works with the key some 1000 yards from the vehicle). One brief article describes the issue (which impacts Chevy Captiva) here or for the technically inclined here. These methods have also been improved so they trick your key into providing multiple rolling codes for later use by the lowlife thieves.

Luckily some white hat hacker is providing a cheap solution in the form of open source software and hardware (project on github) that provides some defence against these mildly technically capable lowlife using these PKES vulnerabilities. The solution is not a “product” you an buy in a shop but it’s trivial in cost though you need some nouveau to build it, see here. Not sure whether such a device, being a non compliant frequency jammer, is legal to use so I haven’t looked into it but it’s an option that some may want to investigate.

So the answer to your question is a definitive yes, your vehicle is vulnerable... but this is old news from 2011 and 1000’s of commodores haven’t gone missing so I wouldn’t be stressed.

And it seems most vehicle thefts in Australia are low life’s breaking into your home to steal or demand keys and may include violence, so this is likely more likely to occur than a techie thief quietly pinching your pride and joy.

But until the manufacturers pull their finger out and fix this PKES security vulnerability, your best defence is good insurance so keep your premiums paid up (as has already been said)

Oh, and if you’re a tin foil hat kind of guy, and you place your keys on a side table by the door when you get home, you may be inclined to now place your keys in a small lidded tin as that should mitigate your car being pinched from your driveway using this PKES vulnerability.

[edited to add that I was ninjad by Imoengnr re lidded tin while slowly typing]

 

[mwb235]

Ok thanks for the replies folks. I’m not at all worried about it, rather I was just interested if it was an issue here. Of course if someone really wants the car they’ll take it. As long as I don’t get hurt in the process is more important.

 

[panhead]

I thought every new vehicle could be hacked just not by everyone.




.

 

[Gmac 2.0]

Like everything i say...I could be wrong. But, I do know that the signals shared between key, the door handle antenna and buttons are exclusive, as they don't work, say, left handle button to right handle antenna and the key fob only works within a metre of the door antenna of the corresponding side door button (or buttons rear doors sedan and wagon). Stay with me....If you place your key fob on the passenger door handle and press drivers door handle button the car doesn't open and vice versa. Nor if placed on the bonnet or boot. The signal strengths are very weak. So these hackers may need to be up close and personal to ping your fob to grab a "code?". Be vigilant.
Secondly, whilst lots of claims have been made, my understanding is that whilst they have been able to access vehicles this way to steal items, they haven't been able to start them (I'll stand corrected) as this still requires the chip in the key, as keyless access triggers the doors to open and acknowledges the presence of a key in or out of the vehicle but doesn't trigger the BCM on its own to allow it to start.
Having said all that, thousands of cars each year are still stolen so if they want it then they'll find a way...like a tow truck.....!

 

[Gmac 2.0]

On the subject of keyless access ...if you drive away without a key, because say it was in your partners pocket/purse when they got out and you turn the car off without said key, it will let you restart the car without the key present. It chimes a lot and you do have to press the starter button twice to turn it off, but it does restart again and that's also after opening and closing the door many times. I know, I tried. When it stopped (starting) I guess it had timed out, but, I could be wrong....
Our Beemer won't, but the Holden does. Try it. I was surprised