Remote locking - drivers beware

On the BBC web site.

Looks like M4 at the moment but soon to come to a car park near you.

http://www.bbc.co.uk/news/uk-england-berkshire-38195281

My PA had the NIT unit from her VW Tiguan stolen with no obvious sign of break in. The police said that Tiguans are particularly susceptible to this so assume it applies to most V A G products. I think VW has sorted out the problem out in newer cars now.

This has been around for a very long time. There are some officially sanctioned installations of kit which will prevent some cars working properly. Used to have loads of trouble with a Range Rover at a particular Sainsbury's carpark. The car always locked, but often was reluctant to unlock, and even worse, wouldn't start. It turned out to be interference from a police radio transmitter, preventing the immobiliser from working correctly.

A jammer for the remote fobs is extremely cheap and easy to make. Not a lot can be done to get around that, since we all like the convenience of the remote locking.

On a similar point, I don't trust the remotes on electric garage doors. By nature, they are not generally secondary locked inside, or what is the point of being electric?
When we go away on holiday or the weekend, I have always turned off the electric to the garage door opener as a precaution.
I now have a better solution, a wemo wifi socket.
Now, automatically, the electric is isolated overnight to the garage door opener.
During the day, using IFTTT app that works with wemo, the power is also automatically isolated whenever I leave the geofence area of the house, and when I re-enter the geofence area of the house the wemo switch is turned back on.
If the Mrs needs to open the garage door when I am away, she can override the switch by pressing a button on the front of it.
This might seem a bit OTT, but the wemo switch was less than 40 quid (http://www.belkin.com/uk/p/P-F7C027/), the wemo app is free to switch it on and off by my phone, and the IFTTT app is also free (https://ifttt.com/discover)
You can also buy the wemo maker (http://www.belkin.com/uk/F7C043-/p/P-F7C043/) with this you can operate your garage door using you phone, and get notification when it is open by using a magnetic switch.

The concept is certainly a step in the right direction - cutting the power to the garage door opener is a great idea, and I love the automatic Geofencing.

Belkin's WeMo isn't that secure though I'm afraid. They can be used to gain remote access to Android phones, and are being widely used to host the Mirai botnet worm. Ensure you've got the very latest firmware updates on your kit Mike!!

As I type this, there are 900k people offline in Germany, a load in the East of UK, and several million in USA with internet down due to Mirai hosted on home automation kit, much of it running the Belkin system.

drewf said:

The concept is certainly a step in the right direction - cutting the power to the garage door opener is a great idea, and I love the automatic Geofencing.

Belkin's WeMo isn't that secure though I'm afraid. They can be used to gain remote access to Android phones, and are being widely used to host the Mirai botnet worm. Ensure you've got the very latest firmware updates on your kit Mike!!

As I type this, there are 900k people offline in Germany, a load in the East of UK, and several million in USA with internet down due to Mirai hosted on home automation kit, much of it running the Belkin system.

Click to expand...

Only got the one switch!
It did actually do a firmware update as soon as it was 'online', only a few weeks ago.
IFTTT is very powerful, and I use a few apps not associated with wemo.
One for example is just a software button on my android phone, so when 'pushed' sends me an email of my exact position on google maps. Its amazing how useful that can be at times!

mjheathcote said:

I now have a better solution, a wemo wifi socket.

Click to expand...

Neat.

Years of driving Italian stuff with dodgy electrics has me conditioned-reflexed to physically check the door after I've blipped the key fob; I never trust it until then.

Actually the QP's central locking is quite quiet, on a busy street or car park I simply can't hear it locking. Another reason I like to verify it before walking off.

So from what I gather, you park your car. Press the lock button on the remote, but a masked villain in a hooped jersey and a bag of swag has jammed your signal to the car. You do not think about checking if it is locked, or if the lights flicker to acknowledge the car has received the signal and then Mr Lightfingers has a rummage around in your glovebox.

So to simply overcome the issue and the Daily Mail blaming homosexuals and the Supreme Court is to check your car is locked!

Does the jammer stop the alarm from activating as well, in which case wouldn't you notice the lack of the beep on Maserati alarms? I tend to look back at my cars as I'm locking it just to check the indicator flash in any event.

Really not news.

Drew what's the Z-wave stuff like for security? I've got a Vera controlled and a stack of Fibaro modules as well as some remote sockets and sensors.

C

CatmanV2 said:

Really not news.

Drew what's the Z-wave stuff like for security? I've got a Vera controlled and a stack of Fibaro modules as well as some remote sockets and sensors.

C

Click to expand...

Generally it's pretty good - they support encryption by default, but individual bits of kit can be vulnerable if they haven't been correctly implemented (by the manufacturer). USA is full of Z-wave gear, and I'm aware of a demonstration at recent Black Hat showing serious flaws. One was a replay attack, where they record the radio commands and simply play them back again to the device. This used to be a huge problem with cars before they moved onto key-hopping tech rather than using just one encryption key for every press of the button. It shouldn't be possible with any modern kit.

Another issue was the devices reconnecting to the host controller after they've been initially set up. Turned out they weren't bothered about exactly WHICH controller they reconnected to, so the perfectly reasonable AES128 encryption was irrelevant, since the device simply accepted the new network key from its new master! Bit of a snag if it's the front door lock...

As usual, it's flaws in the implementation of specific devices, rather than the protocol itself.

Cool, ta. I'd love a lock, but conscious the insco won't be to keen on paying out as yet. Dearly love the other tricks with geo fencing and scenes that I've set up

C

Experienced the jamming this morning in a stupidmarket car park. Took my daughter's Ibiza for a little run out to keep it turned over while she's away, and couldn't lock it. The remote wouldn't do anything at all, so I locked it with the key, and had to unlock it with a key when I came back out too. Worked just fine back at home.

Had exactly the same thing to the Beemer earlier in the week.

I had camera equipment stolen from a locked Focus hire car in Marbella, the security at the shopping arcade said jamming was known to go on there. Insurance didn't pay out because there was no physical damage to the car. So beware, look at the small print on the your insurance policy. Even the ombudsman backed them up. I lost £1800! If you do get something nicked, break a quarter light or something before reporting it.