Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars

Vulnerabilities in Automotive Rolling Codes

Samy Kamkar investigates the cryptographic architectures governing wireless keyless entry systems for modern automobiles and garage doors. While early systems utilized static radio codes vulnerable to simple replay attacks, modern vehicles rely on rolling codes (such as Keeloq) where each transmission uses a pseudo-random code that expires upon use.

Architecture and Mechanics of the RollJam Attack

Kamkar introduces RollJam, a low-cost, pocket-sized hardware device built using inexpensive radio transceivers and microcontrollers. RollJam intercepts wireless key fob signals by executing a simultaneous jamming and sniffing attack: when the car owner presses the unlock button, RollJam jams the receiver with noise while recording the valid rolling code.

Stealing Unused Rolling Codes in Real Time

When the victim presses the key fob a second time assuming the first press failed, RollJam repeats the process: it jams and records the second code while instantly replaying the first recorded code. The vehicle unlocks normally, leaving the driver unsuspecting, while the attacker retains a valid, unspent rolling code capable of unlocking the car or garage later.

Industry Countermeasures and Cryptographic Upgrades

The presentation demonstrates the attack against multiple automotive manufacturers and garage door brands. Kamkar urges automotive engineers to implement time-based code expiration, dual-frequency validation, and challenge-response cryptographic protocols to protect vehicular access control against synchronized RF manipulation.

(AI summary — Gemini 3.8 Flash)