Two dozen vehicles found to have wireless key-entry systems that are vulnerable to hacking
Munich-based ADAC (Allgemeine Deutsche Automobil-Club) performed the study on dozens of cars to test a radio "amplification attack" that extends the range of a driver's wireless key fobs to open cars and even start their ignitions.
The researchers claimed 24 different vehicles from 19 manufacturers are vulnerable. The vulnerability allows cars to be unlocked and started but leaves no trace of the hack.
All that is needed to unlock and start a vehicle is commercially available wireless technology and the "technical knowledge of electronics or apprentices from the electrical engineering undergraduate studies," the article in WirtschaftsWoche, a German business magazine, stated.
The researchers discovered that the radio connection between wireless key entry systems and the car can easily be extended over several hundred meters. This is regardless of whether the original key is, for example, at the owner's home or pocket.
Also, immobilizer and alarm systems can be overcome the same way.
"Every one we have examined since the beginning of 2016 cars with keyless technology has this vulnerability," Arnulf Thiemel, an expert on automotive electronics from the ADAC Technology Center in Landsberg am Lech, said in a published report. "According to our estimates, hundreds of thousands vehicles are affected."
If a car is stolen, it runs without a key as long as fuel is in the tank, or until the engine stalls or is turned off, the researchers said. Even refueling with the engine running is possible.
Owners of cars with keyless locking systems should exercise increased vigilance in the storage of the key, the researchers said.
Vehicles exposed to the wireless entry hack include the Audi A3, A4 and A6, BMW's 730d, Citroen's DS4 CrossBack, Ford's Galaxy and Eco-Sport, Honda's HR-V, Hyundai's Santa Fe CRDi, KIA's Optima, Lexus's RX 450h, Mazda's CX-5, MINI's Clubman, Mitsubishi's Outlander, Nissan's Qashqai and Leaf, Opel's Ampera, Range Rover's Evoque, Renault's Traffic, Ssangyong's Tivoli XDi, Subaru's Levorg, Toyota's RAV4, and Volkswagen's Golf GTD and Touran 5T.
The automakers have "a duty" to take quick action by offering appropriate retrofits for effected vehicles, the researchers said.