+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: IoT, Embedded Systems, Electronics, Gadgets, and DIY (https://hackforums.net/forumdisplay.php?fid=193)
+---- Thread: Relay attack passive keyless cars (/showthread.php?tid=5910283)
Pages: Pages
1
2
Relay attack passive keyless cars - yyyyyyyyyy - Nov 21, 2018
Hi,
I am interested in finding out how to build, or how to get, the equipment to relay attack a car with passive keyless entry/start system. Does anyone know where to find information on this?
/Mike
RE: Relay attack passive keyless cars - jBloq - Nov 21, 2018
A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.
ps: you have a long journey ahead
RE: Relay attack passive keyless cars - Nechifor - Dec 16, 2018
Send me a pm, i have some info about that.
RE: Relay attack passive keyless cars - FriendZone - Dec 18, 2018
(Nov 21, 2018 01:55 AM)jBloq Wrote: A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.
ps: you have a long journey ahead
He should also use the first captured signal to open the car for the owner after the first attempt capturing the second one and using it before a third generated signal.
Basically he needs something able to jam the signal and capture it, the car won’t open, use it as soon the target car owner use a second signal to open the car, jam and capture it again, and simultaneously use the previous capture signal to open the car for the owner.
RE: Relay attack passive keyless cars - -Aspect- - Dec 19, 2018
https://www.youtube.com/watch?v=M2JY1_Xmokg&t
Just checking in.
I published this video a few days ago
It's possible, and it's cheap.
Although, rolling keys take a bit more effort, as jamming is necessary.
RE: Relay attack passive keyless cars - Nechifor - Jan 24, 2019
That's not what he's looking for. That's a device like Samy's RollJam, but he's looking for a passive keyless entry/ start device like those guys using in the Youtube "Relay attack Solihull" video
RE: Relay attack passive keyless cars - leoneldahma - Sep 4, 2019
Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz
RE: Relay attack passive keyless cars - cyberkun - Sep 4, 2019
(Nov 21, 2018 12:03 AM)yyyyyyyyyy Wrote: Hi,
I am interested in finding out how to build, or how to get, the equipment to relay attack a car with passive keyless entry/start system. Does anyone know where to find information on this?
/Mike
Hi Mike.depending on your location you just buy them online.If you are good with electronics and coding, only the will you be able to reverse engineer or build similar devices from plans , books and other info available. most of the parts are easily available but the programming of the chips and the pcb design will be tricky.
You have to relay 2 different frequency spectrums,if you want to go for maximum attack range LF (NFC for the wake up signal and the key challenge) and HF(UHF) to actually unlock and lock the vehicles( also works on some motor bikes) . but by taking that route you will have to tweak the signal runtime, by using the righ frequency and the right chips for fast processing..you only have few ms for the whole process to succeed.if you need more info hit me up.
(Nov 21, 2018 01:55 AM)jBloq Wrote: A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.
ps: you have a long journey ahead
A few? 99% of all PKES use radio waves and less than 1% uses biometrics as a "key". capturing the system is not working on keyless systems for several reasons.
The wake up signal between keyfob and BCM are time restricted and can not be replayed...thats why it's called a relay attack .your advice is useless for what the OP is asking.
(Dec 18, 2018 02:34 AM)FriendZone Wrote: He should also use the first captured signal to open the car for the owner after the first attempt capturing the second one and using it before a third generated signal.
Basically he needs something able to jam the signal and capture it, the car won’t open, use it as soon the target car owner use a second signal to open the car, jam and capture it again, and simultaneously use the previous capture signal to open the car for the owner.
Same as above...completely wrong attack...
(Dec 19, 2018 10:12 PM)-Aspect- Wrote: Unlock Cars with a Raspberry Pi And SDR - Replay attack - YouTube
Just checking in.
I published this video a few days ago
[video=youtube]Unlock Cars with a Raspberry Pi And SDR - Replay attack - YouTube[/video]
It's possible, and it's cheap.
Although, rolling keys take a bit more effort, as jamming is necessary.
still the wrong attack but nice video though
(Sep 4, 2019 02:06 PM)leoneldahma Wrote: Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz
Yes, but just boosting the signals is not enough as i wrote previously. In most cases the frequencies used are according to international standards or the asigned/available frequency spectrum plus all unmodified keyless vehicles use 125 / 130 kHz (Audi: 20 kHz) in the LF spectrum and with small deviations Europe: 433 MHz/868 MHz and Japan and the USA: 315 MHz in the HF spectrum.
RE: Relay attack passive keyless cars - Jinxter - Sep 7, 2019
(Sep 4, 2019 11:38 PM)cyberkun Wrote: Hi Mike.depending on your location you just buy them online.If you are good with electronics and coding, only the will you be able to reverse engineer or build similar devices from plans , books and other info available. most of the parts are easily available but the programming of the chips and the pcb design will be tricky.
You have to relay 2 different frequency spectrums,if you want to go for maximum attack range LF (NFC for the wake up signal and the key challenge) and HF(UHF) to actually unlock and lock the vehicles( also works on some motor bikes) . but by taking that route you will have to tweak the signal runtime, by using the righ frequency and the right chips for fast processing..you only have few ms for the whole process to succeed.if you need more info hit me up.
A few? 99% of all PKES use radio waves and less than 1% uses biometrics as a "key". capturing the system is not working on keyless systems for several reasons.
The wake up signal between keyfob and BCM are time restricted and can not be replayed...thats why it's called a relay attack .your advice is useless for what the OP is asking.
Same as above...completely wrong attack...
still the wrong attack but nice video though
Yes, but just boosting the signals is not enough as i wrote previously. In most cases the frequencies used are according to international standards or the asigned/available frequency spectrum plus all unmodified keyless vehicles use 125 / 130 kHz (Audi: 20 kHz) in the LF spectrum and with small deviations Europe: 433 MHz/868 MHz and Japan and the USA: 315 MHz in the HF spectrum.
Listen to this man, great advice right there.
(Sep 4, 2019 02:06 PM)leoneldahma Wrote: Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz
Boosting can work over a limited range but it is the 125khz signal that needs to be 'boosted' or relayed and without relaying the 433Mhz signal back you are limited to it's normal range.
This is what's happening in many of the videos or news articles you see, the 433Mhz remote in the house is in range of the car already.
RE: Relay attack passive keyless cars - gasvo99 - Oct 7, 2019
hi,
i want to make a keyless go amplifier.
It may be for short distances for testing purposes.
Anyone have any interesting information? what is best to use what works?
Thanks
RE: Relay attack passive keyless cars - cyrusdavirus - Oct 31, 2023
@cyberkun please contact me as soon as possible
RE: Relay attack passive keyless cars - bisla002J - Nov 4, 2023
A guy literally uploaded a video on the same topic on youtube
RE: Relay attack passive keyless cars - BigEzA - Jan 9, 2024
Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.
Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.
RE: Relay attack passive keyless cars - SIM-5186353 - Jan 10, 2024
(Jan 9, 2024 09:11 PM)BigEzA Wrote: Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.
Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.
Try buying a rtl sdr and a hackrf, for roll jam attacks. The clone hackrf it's pretty good, and it's better if you buy the portapack.
RE: Relay attack passive keyless cars - BigEzA - Jan 13, 2024
I’m looking to copy the fob and send the signal