Graduate Cryptographers Unlock Code of 'Thiefproof' Car Key

[gristy]

Avi Rubin, staunch critic of electronic voting systems, is in the news again.


By JOHN SCHWARTZ
New York Times
Published: January 29, 2005

BALTIMORE - Matthew Green starts his 2005 Ford Escape with a duplicate key he had made at Lowe's. Nothing unusual about that, except that the automobile industry has spent millions of dollars to keep him from being able to do it.

Mr. Green, a graduate student at Johns Hopkins University, is part of a team that plans to announce on Jan. 29 that it has cracked the security behind "immobilizer" systems from Texas Instruments Inc. The systems reduce car theft, because vehicles will not start unless the system recognizes a tiny chip in the authorized key. They are used in millions of Fords, Toyotas and Nissans.

<snip>
The computer scientists are not doing R.&D. for the Mafia. Aviel D. Rubin, a professor of computer science who led the team, said his three graduate students did what security experts often do: showed the lack of robust security in important devices that people use every day.

"What we find time and time again is the security is overlooked and not done right," said Dr. Rubin, who has exposed flaws in electronic voting systems and wireless computer networks.

www.nytimes.com/2005/01/29/national/29key.html

[TroglodyteScholar]

1. Excellent story

Thanks for posting that....Makes you think.

[Ready4Change]

2. Anything made by man can be cracked by man.

There is no perfect security. At least, with those chips, a thief needs to crack 2 security layers. The first is the physical key pattern, like with all cars, and the second is the immobilizer chip.

[Occulus]

3. I'm reminded of- was it Sony?- and the black felt tip markers.

Imagine- they spend hundreds of thousands of dollars to develop a copy protection scheme for their new release music albums, only to have someone discover they can defeat it by drawing a blck circle around the outside rim of the CD and defeat the protection entirely with a $.69 marker from any corner store.

[w4rma]

4. That's fine. As long as folks are aware that *any* lock can be picked

and don't assume that these locks are any more than deterence. More deterence is always good, when it doesn't infringe on others' rights.

Although, one must note that it appears that these keys literally broadcast what type of car you are driving through their keys.

[makhno]

5. Typical

Security is usually given little consideration compared to cost and time to market.

But Mr. Sabetti, the Texas Instruments executive, said such precautions were unnecessary. "It's a solution to a problem that doesn't exist," he said.

This attitude is sadly typical. It is also increasingly dangerous given the rapid rise in the use of RFID and other wireless technologies.

[nothingshocksmeanymore]

6. HAHAHA and John Stossel just whored these things last night on

his show (it was a repeat I believe)