Honda Ridgeline Owners Club Forums banner

Key fob (smart key) repeater hacking

23K views 34 replies 23 participants last post by  zroger73  
#1 · (Edited)
It is my first time of having the smart key since I got my G2, I started to do some research on how secure key fob is. It is not too difficult to find articles talk about this on Internet and this is quite alarming. Basically if you are at home you have your key fob on 2nd floor, the hackers/high tech car theft can come near your house using a $20 repeater from eBay to amplify the signal of your key fob. It tricks your car's computer thinks that you are physically around the vehicle. They can then open the door as well as start the engine, once the engine starts it no longer needs the key fob around.

If I got the information correctly, this is how I understand key fob works - basically it keeps sending a pulse at around 315 MHz in a certain interval 24/7. Unlike the old style remote control, the signal is transmitted only if you press the button. This is the problem. See this article.

https://www.wired.com/2016/03/study-finds-24-car-models-open-unlocking-ignition-hack/

There are couple of ways I found on Internet to protect this, I tried both of them and they BOTH worked - putting the key fob in a metal box as well as wrapping with aluminum foil. If you don't want your G2 stolen from your driveway, I recommend these. I am not sure if Honda Ridgeline/Pliot has the special immunity to these relay/repeater hack, but I would wrap my key fob at home as precaution. This is not new, I just want to share with G2 community who are new to smart key like me. Hope this helps and raise the awareness on these high tech gadgets.
 

Attachments

#3 · (Edited)
If I got the information correctly, this is how I understand key fob works - basically it keeps sending a pulse at around 315 MHz at a certain interval 24/7. Unlike the old style remote control, the signal is transmitted only if you press the button. This is the problem. See this article.


There are couple of ways I found on Internet to defeat this, I tried both of them and they BOTH worked - putting the key fob in a metal box as well as wrapped with aluminum foil. If you don't want your G2 stolen from your driveway, I recommend these.
good info! I had not thought about this at all.
AND, a side benefit, It just became harder to make fun of me for wearing my tin foil hat! who's laughing now!

edit. they still make sucrets?
 
#5 ·
For clarification...

It's your car that is sending out a pulse from time to time, not the fob. The fob is coin-cell powered, so energy is limited. Once the fob recognizes the "are you there?" pulse from the car, it responds with a handshake signal.

As such, this repeater method does work, but with some minor caveats... it needs to be close enough to the fob to hear its handshake response. The fob has a significantly weaker signal compared to the car, but it's feasible if someone tosses their keys next to the door to their apartment. The thief must know which apartment so they can get reasonably close (say, within 50'). This would generally make it a two-person job, with one person near the car and another near the apartment door.
 
#6 ·
For clarification

As such, this repeater method does work, but with some minor caveats... it needs to be close enough to the fob to hear its handshake response. The fob has a significantly weaker signal compared to the car, but it's feasible if someone tosses their keys next to the door to their apartment........
Wouldn't the repeater only have to be as close to the key fob as the longest range the key fob has to open doors/start engine?
 
#7 ·
I'm not worried, no radio signal is getting in or out of my house.

Turns out the builder who built it used standard fiberglass insulation plus 1" foil backed rigid foam over the framework and under the cement board and brick work. Great insulating properties, our electric and gas bills are super low, but our entire house is like a faraday cage. Cellular reception indoors is poor as is FM radio reception. Also my WiFi signal outside the house is non existent, standing next to my house there is very poor WiFi signal, whereas I get a strong WiFi signal from my neighbors home over 400ft away.
 
#8 ·
I'm not worried..... at.......my house.
Live in the middle of heavily forested 20 acres with big dogs who sound very threatening; therefore, I share your sentiment. In 1986, however, I purchased a very nice Toyota 4 Runner, which was the equal in its day to the desirability and scarcity of the RTL-E. Three months after buying the Toyota I went to a movie. When I emerged from the theater there was only a small pile of glass where I had parked the 4Runner. Took a cab home-lasting impression that I don't want reinforced. My fear is stopping at Panera's for a delightful lunch and having to hail another cab because my RTL-E is gone. I guess I could vary the experience by texting Uber.
Because of my prior experience I will have the window glass of the RTL-E etched with my driver's license number. Inconspicuous, and apparently deters the discerning thief.
 
#12 ·
2017 Honda Ridgeline Black Edition... walked up the driveway and pushed a relay amplifier I suppose, cleaned out the cab, never even set off an alarm. Had to install steel safe in house and carry a faraday pouch for the fob all the time now. Pah... new tech! I'd rather it wasn't keyless, or had much better security.
 
#13 ·
I just keep the key fob in the same pocket as my cellphone! No way to open the Ridgeline. :grin:
 
#14 ·
Maybe this read will keep my wife from locking her purse in the RL and thinking it's safe there. I guess i'll have to come up with a booby trap system for my RL..
 
#15 ·
My insurance agent just today sent an email containing an article listing the Most Stolen Vehicles in 2016. Nobody wanted G1 Ridgelines it seems. :grin:

1. Honda Accord (50427)
2. Honda Civic
3. Ford Pick-Up (Full Size) (32721)
4. Chevrolet Pick-Up (Full Size) (31238)
5. Toyota Camry
6. Nissan Altima
7. Dodge Pick-Up (Full Size) (12128)
8. Toyota Corolla
9. Chevrolet Impala
10. Jeep Cherokee/Grand Cherokee (9245)
 
#16 ·
I have a box that looks like an Altoids tin with a little foam pad in it to keep it from rattling around. Works like a charm. I can hold the fob 2" from the truck inside this box and it won't be detected.

The box was a promotional thing from Misumi. Originally held a USB stick.
 

Attachments

#18 ·
I'm not worried. I also don't worry about big trucks, crossing the street, buses or walking bare foot.
If it's that easy to take the autos I bet the insurance companies will be all over the manufactures to fix the problem. If someone wants it that bad I'm sure the truck will never be seen again. I have insurance to protect me and my loss. Again, knowing the insurance companies HATE to pay out; if it's that easy the insurance companies will get it fixed.
 
#23 ·
Cocktail shaker for keys: Keyless entry might be hackable

I bought a cocktail shaker for my KEYS. 'Not as weird as it sounds. (But is still seems a little goofy, but as an old sound man I get that wireless signals can be played with)

My intent was to shield my keyless entry fob from hijacking by thieves with tech gadgets that boost the signal of FOB that might be sitting on your entry table. They boost the fob signal to fool your car that you're standing next to it with your actual FOB.

My spouse had her car rummaged. 2016 Subie Outback. She swore it was locked.

Several cars have been tossed in our 'hood. Also seeing a lot of comments on "Next Door" all across Long Beach, California. Folks swear they locked their rides too. There's no jimmy marks or weatherstripping out of place (one of my neighbors did have a small drill into the door handle of their older model Chevy truck while another newer ride was clean.)

The initial net research was spotty and finds a little foil-hat like. But keywording "keyless entry hack" showed one can hijack a car's key fob tech and get in, and even drive the car away.

My decision was based on daily convenience/ergonomics. Coming home and dumping keys in shaker seemed easier than snapping and unsnapping the lil' fob pouches you can buy that'd be on the fob all the time.

The shaker was cheaper than most pouches. Other prepper-related faraday enclosures were pricey. I tested the shaker and it works well. We tried a couple tin boxes we had and they failed.

Hit Youtube and seach on cocktail shaker faraday.

Wired Mag: https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal-car/

New York Times: https://www.nytimes.com/2015/04/16/style/keeping-your-car-safe-from-electronic-thieves.html
 

Attachments

#24 ·
Re: Cocktail shaker for keys: Keyless entry might be hackable

I put my spare key in a metal box because we were going on a trip and I wanted to have an extra.

Packed in my luggage antd when we were leaving I couldn't lock the trunk. The metal container was not hiding the key from the truck.

Maybe an ammo can or one of those lead envelopes for protecting film would work better.
 
#25 ·
Re: Cocktail shaker for keys: Keyless entry might be hackable

I put my spare key in a metal box because we were going on a trip and I wanted to have an extra.

Packed in my luggage and when we were leaving I couldn't lock the trunk. The metal container was not hiding the key from the truck.

Maybe an ammo can or one of those lead envelopes for protecting film would work better.
We tried a couple boxes we had laying around that didn't work. Then, I came across the cocktail shaker on Youtube. Its seal is enough, and it might be the material. One "screen" box worked, but working is dependant on the tightness or the screen mesh.

For luggage, the several FOB pouches sold on Amazon might be a better, more right-sized solution.
https://www.amazon.com/FobGuard-Faraday-Protect-Keyless-Protection/dp/B010VK9ZLI/ref=sr_1_2?ie=UTF8&qid=1508356828&sr=8-2&keywords=keyless+entry+pouch

My want was to keep my lanyard key chair loose for convenience sake during the day, but to have something relatively compact, yet easy to dump my clump of keys into at night. Our driveway runs along the side of the house, so the FOB's close enough to be compromised if laying out.

The shaker's easy open/easy close. My wife would prefer something less booze-related laying out, but it's efficient and cheap.
 
#26 ·
I just had my 17 ridgline Touring stolen 2 weeks ago not sure if the used a Relay attack or if a body shop cloned my key.


What happens is you start a vehicle in a relay attack, can you drive away with the vehicle with out the fob?

I have a faraday pouch coming in fri so that my keys go in the pouch when I am not driving, to mitigate a relay attack.

Jim
 
#28 ·
I am curious, has anyone tried this because it seems like something you would find on a tin foil site. I can be standing 10 feet from the truck and my daughter grabs the handle and it will not unlock. In other words the signal for the passive locking system has a very limited range. To be able to pick up and amplify the signal you would have to pick up the signal. It would look kind of odd walking around someone's house trying to get the amplifier close enough to the fob for it to work.

Personally I have my truck in the garage with the door down so good luck stealing it there. At my office I have an interior office you couldn't catch that signal anywhere outside. I can still remotely start but that is a completely different signal.
people leave their keys on the counter or in their jackets near the front/side.rear doors. They use a signal amplifier and copy the code, then take that and use it to start the truck. crazy stuff...
 
#29 ·
I know this is an older post but I have seen video where Toyota can shut off the fob by pushing the lock button then also pushing the unlock a set number of times. it was mentioned in comments that the method works on Subaru. I tried my 17 RLE but no luck. Is it possible to do with Honda? Thanks all.
 
#31 ·
I'd rather have a key/fob that uses a rechargeable lithium cell (via USB C) that only lasts a few months that is more intelligent. Have an accelerometer that disables it if it's been still for more than X minutes. Have it switch to a RX only while driving in case it is still enough to disable. Plenty of ways to get around security concerns with 'em.


It's also a fob. Not a FOB. It's not an abbreviation or acronym. It's a thing. Like a key isn't a KEY. It's just a key.
 
#32 ·
Honda refers to it a "smart entry remote transmitter". Mazda refers to it simply as a "transmitter". Ford calls it a "remote control". GM calls it a "remote keyless entry transmitter". I couldn't find the word "fob" in the owner's manuals for a 2021 Ridgeline, 2020 CX-5, 2021 F-150, or 1999 Regal. :)