Technology

None of this needs to happen. Frankly insurance companies need to be holding the car manufacturer's feet to the fire by not insuring cars that can be trivially stolen like this. If a Flipper Zero can steal a car that is 100% on the car manufacturer.

If a tiny yubikey can generate cryptographically unique keys so can a car key fob.

It would not be that difficult to design a key fob which pairs with the car wirelessly (just like Apple uses for AppleTV and Apple Watch).

Literally all you need is:

1. Car has private/public key pair (which can be reset by technicians, but requires physically opening up the car)
2. Sync keyfob to car -- keyfob generates unique key pair, keyfob shares public key with car.
3. When the keyfob communicates with the car, all signals to unlock or start are cryptographically signed, then the car sends a token to authenticate and confirm the instruction.

If anyone complains about battery life just make the fob rechargable instead of the annoying shitty battery change process. You can even make a charging port in the car (where they keyhole used to be, or in the wireless charging tray).

Plus this can be extended to phones with zero trust and no need for external infrastructure or violating user privacy.

The shitty website is riddled with redirect ads.

Here is the archive https://web.archive.org/web/20250909120542/https://www.carsandhorsepower.com/featured/flipper-zero-car-thieves-and-a-brewing-security-crisis-what-s-really-going-on

Tl;dr not a lot more on the article than the headline says.

Well, shit happens if you let people develop security protocols without experience. But the car industry saved money by this.

Can do with a 100 dollar flipper zero? Maybe I should get one of those instead of paying VW 400.00 to replace my broken fob.

owning a hammer is not a crime, bashing in a car window with it is.

also, it is currently illegal for car owners to put custom firmware in their cars & there is no open standard to allow 3rd party software. all stolen cars should be refunded by the manufacturer for forcing us to use their shitty soft/firmware.

The blame falls on the car companies (and the thieves ofc)

They are still using rolling code technology when public private key exchange exists from the 70s. The have stagnated from anti theft technology while being in the bleeding edge of DRM and data collecting.

they profit from rediculous keyfob prices when a 2$ microcontroller can do the job

they have locked down the car so its impossible to modify

they are not doing recalls to patch the vunorabilities

they have lobbied against security research and threatened researchers with litigation

Companies whose primary product isn't security are shit at security. What else is new?

all because people don't to burn a calorie twisting a metal key.

Sounds like poor design on the manufacturers part if a $20 microprocessor and radio can break into a car.

I feel like this is mostly fluff. 404media had a better report on this.