100 Million Volkswagen Group Vehicles Can Be Unlocked With a Cheap Hacking Device

Two decades’ worth of Volkswagen Group vehicles are vulnerable to a simple, cheap hack that can unlock their doors.

A research paper released this week (first reported by Wired) describes how multiple Volkswagen, Audi, Seat and Skoda models built since 1995 can be unlocked using a handmade radio that copies key fob signals.

In the paper, researchers from the University of Birmingham and German security firm Kasper & Oswald outline two ways of getting into an unwilling vehicle. Both methods employ cheap radio hardware to “clone” a driver’s key fob. After hacking the encryption used by Volkswagen on millions of keys, all they needed to do was use a radio to intercept the unique signal from an individual key.

Mix the two values, and bingo. An unlocked car.

“You only need to eavesdrop once,” says Birmingham researcher David Oswald. “From that point on you can make a clone of the original remote control that locks and unlocks a vehicle as many times as you want.”

The first method involves a software defined radio connected to a laptop, but there’s a problem with that route. The hacker must be within 300 feet of the vehicle to catch the signal. A better way is to build your own Arduino board with an attached radio receiver. The radio itself might set a hacker back $40, and the overall package is much smaller.

The hardest part of the operation is hacking the shared key values. Only four exist, spread out among the roughly 100 million Volkswagen Group vehicles with keyless entry systems, but once hacked, the information can then be shared.

The researchers don’t disclose the shared key values in their paper, and alerted Volkswagen to their findings.

“We were kind of shocked,” Timo Kasper at Kasper & Oswald told the BBC. “Millions of keys using the same secrets — from a cryptography point of view, that’s a catastrophe.”

The team claims to know of at least 10 other widespread hacking schemes affecting other automakers, but haven’t yet published their findings.

[Image: Volkswagen of America]