Remix.run Logo
hsbauauvhabzb 6 days ago

What practical use does this have? From my reading if I capture an unlock signal, the car will not unlock for the owner, so they’ll press their remote a few times.

If I capture a lock signal, presumably I can instead prevent it from locking. The only real world malicious action I can see is being viable is to block the car lock, meaning the car is still in an unlocked state, open the boot (which I’m guessing can be done from the car dash anyway) then locking it afterwards?

theChaparral 6 days ago | parent [-]

This attack lets you use all the functions of the key fob, and not just the action captured.

hsbauauvhabzb 6 days ago | parent [-]

It makes no suggestion that it’s possible to start a push-to-start car.

Someone looking to break into your car will probably use a brick, not a flipper zero.

fc417fc802 6 days ago | parent | next [-]

Bricks attract lots of attention in busy parking lots. An unlock chirp, removing some bags, and walking off will appear legitimate to bystanders.

protocolture 6 days ago | parent | prev [-]

Its flipper zero performing this

https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack...

Suggests that it can be used to start a car. Whether it was a fob start or push start isnt specified.

usmannk 6 days ago | parent | next [-]

which slide suggests this? i didnt find anything suggesting you could start a car with rollback

kube-system 6 days ago | parent | prev [-]

> Whether it was a fob start or push start isnt specified.

... It's literally in the title on the first slide.

It is only an attack on keyless entry. Keyless start systems all use a different short-range radio system.

An attack on keyless entry might let someone trigger a remote starter if supported, but this doesn't enable anyone to drive the vehicle, because you will need to authenticate with the keyless start system after entering the vehicle before you can put it in drive (and to keep the engine running for longer than the predetermined timeout).