Stop car hacking by keeping your key fob in a metal (coffee) can

A top global cybersecurity expert says the threat of car theft now is greater than ever and urges taking simple precautions to prevent car owners from becoming victims of tech-savvy criminals.

Thieves have perfected the art of stealing the code from that key fob sitting on a kitchen counter or hung on a hook by the door. And tools that make theft fast and easy can be purchased on the internet. Worse, the latest theft devices allow criminals to amplify a vehicle's radio signal so that thieves can better access and copy the key fob signal to steal a vehicle

"The problem is, this is not a story, it's reality," Moshe Shlisel, a veteran of the Israeli Air Force and now CEO of GuardKnox Cyber Technologies, told the Detroit Free Press by phone from his office in Ramla, Israel.

This whole situation revolves around "smart" key systems that use nonsecure commercial radio waves to signal when the key fob is near or inside the vehicle, he said. These key fobs allow car owners to unlock the door, start the engine or even open the trunk from far away. But that's not all.

"You may think of your car key as little more than a tool to start the car. But have you ever considered that it may also be the best tool to prevent your car from being stolen?" says AAA on its website.

Car thieves who steal all or valuable parts of cars are going beyond just disassembling steering columns or removing the catalytic converter anti-pollution devices made with precious (and costly) metals, according to AARP. Car owners now need to be proactive to prevent these cyberattacks:

Code grabbing, according to the AARP website, "means that thieves don’t have to track cars to the owner’s abode. Often, orders for high-end luxury cars are placed in advance, so thieves sit and wait until the right model drives into the parking lot and follow it to a spot. So, be aware of your surroundings and instead of hitting the remote lock button, lock your car before you walk away.​"

The cloning action is so easy to do, that it's commonly used by maintenance workers in gated communities to reset the remote control system for homeowners, Shlisel said.

Copying a key fob signal and stealing a car can happen in 20 to 30 seconds, according to the Master Locksmiths Association in Warwickshire, England.

The single most important tip is that car consumers should always store their key fob in a metal container or a metal wire bag often called a Faraday cage that prevents the key fob from communicating with hackers, Shlisel said. Anytime it's just sitting on a table or carried in a pants pocket, it can be hacked.

Now hacking has become even easier, not only with cheap tools that make it possible but also YouTube videos and tips all over the internet on how to use cloning devices to steal vehicles, Shlisel said, five years after he first outlined for the Detroit Free Press in great detail the threat that hackers present to car owners.

But cloning key fob signals is serious and preventable, he said.

"Just don't leave the key fob next to the door at home if you're parking nearby," Shlisel said. "Put the key fob as far away from you vehicle as often as you can. There's always communication between the key and the car itself."

Distance between the car and key fob helps prevent theft by people in the vicinity.

The mechanism that works between the key fob and the vehicle is based on pairing," Shlisel said. "You can connect it to your iPhone via Bluetooth, right? This is called pairing devices. If I’m taking your headset and separating that from your phone, and the phone is in one room and your headset is 10 meters away, there’s a possibility you’ll not be able to hear through the headset. That’s the first step on disconnecting the pairing."

Codes in the vehicles can be copied. Codes in the key fob can be copied. Tech researchers have worked to try and prevent this problem but it's expensive and already key fobs can cost up to $1,000 to replace, Shlisel said.

"People have tried to implement much more secure methods and failed," he said.

"When I'm pushing the "on" or "off" button for the car door to open or close ... you can clone the communications," Shlisel said.

For skiers and boaters, the worst thing to do is leave a key fob in the vehicle, he said.

And if nothing else, wrap the key fob in layers of aluminum foil to block the signal, Shlisel said.

In November, Ann Arbor police identified thefts that appeared to be tied to vulnerable key fobs.

Kevin Cox lives on Ann Arbor's north side. His wife called him after she left for work Thursday morning to tell him his truck was gone," according to a Nov. 17 news report on CBSDetroit. "Both sets of Cox's keys were in the house, and his truck was locked when it was stolen."

Police pointed out the use of devices that can transmit signals between the key fob and the vehicle, even working through walls.

"A neighbor shared ring footage with Cox, showing an SUV pulling into his cul-de-sac, then backing up, a man walking on the street, and, shortly after, his Ford F-150 driving away," CBS Detroit reported. "He said when he tried to access his Ford app, the thieves had turned off the location of the vehicle."

Police incidents of carhacking have been covered in Texas and Florida, too.

Car theft data released in October showed that the U.S. continues to experience "near record levels of vehicle theft," according to the National Insurance Crime Bureau, the insurance industry’s not-for-profit association dedicated to preventing and combating insurance crime. At the time, "nearly 500,000 vehicles were reported stolen nationwide in the first half of 2023, marking an increase of more than 2% compared to the first half of 2022."

Stolen Ford F-150s sold with clean titles in million-dollar ploy from Michigan to Arizona

10 trucks vanish from Dearborn lots in a single day as F-150, Raptor thefts escalate

Contact Phoebe Wall Howard: 313-618-1034 or [email protected]. Follow her on X @phoebesaid.