Car Theft. Vulnerable Keyless Entry Codes.

This was forwarded in an email to me and I thought it was interesting.

"Snopes Approved

I locked my car --- as I walked away I heard my car door unlock I went
back and locked my car again three times. I looked around and there were
two guys sitting in a car in the fire lane next to the store. When I
looked straight at them they did not unlock my car again.

How to lock your car safely

While traveling my son stopped at a roadside park. He came out to his car
less than 4-5 minutes later and found someone had gotten into his car, and
stolen his cell phone, laptop computer, GPS navigator briefcase.....you
name it ... called the police and since there were no signs of his car
being broken int o- the police told him that there is a device that
robbers are using now to clone your security code when you lock your doors
on your car using your key-chain locking device.. They sit a distance away
and watch for their next victim. They know you are going inside of the
store, restaurant, or bathroom and have a few minutes to steal and run.
The police officer said ...to be sure to manually lock your car door-by
hitting the lock button inside the car, that way if there is someone
sitting in a parking lot watching for their next victim it will not be
you. When you hit the lock button on your car upon exiting...it does not
send the security code, but if you walk away and
use the door lock on your key chain- it sends the code through the
airwaves where it can be stolen, something totally new to us...and real
... be aware of this and please pa s s this note on..look how many times
we all lock our doors with our keys...just to be sure we remembered to
lock them....and bingo someone have our code...and whatever was in the
car...can be gone.

Keep safe everyone!"

Here is a brief version of what Snopes has to say.

"Origins: Automobile remote keyless entry systems (RKE) were introduced in the 1980s. They've proved to be a big hit, making it easier for the grocery-laden to unlock their cars and sparing many of the terminally forgetful from finding they've left their keys in the ignitions of their now-locked cars or their purses in the seats of same.

The earliest RKE systems were quite vulnerable to the sort of attack described in the warning e-mails quoted above. Their RF transmitters (usually built into key fobs) sent unique identifying codes that could be picked off by 'code grabbers' devices that recorded the codes sent out when drivers pushed buttons on their remote key fobs to lock or unlock their cars.

...automakers shifted from RKEs with fixed codes to systems employing rolling random codes. These codes change every time a given RKE system is used to lock or unlock car doors and thus renders 'code grabbers' ineffective. That form of more robust system became the industry standard for remote keyless entry system in the mid-1990s, so automobiles newer than that are not vulnerable to being quickly and easily opened by criminals armed with code grabbers.

...theoretically possible...with the right technology...

'Theoretical attack requires detailed knowledge of the system implementation and a combination of data, specialized skills, equipment and access to various components of data, specialized skills, equipment and access to various components of a system which is seldom feasible. These theoretical attacks are not unique to the Keeloq system and could be applied to virtually any security system.'

None of the police agencies we spoke with had ever heard of an instance of an automobile break-in theft being accomplished through the method described above."