CAN bus security on keyless mirage

[redline81]

Hi everyone,
As happy owner of a 2021 Mirage with keyless system and hearing now more and more horror stories about very quick thefts of 6-figures worth keyless cars manifactured by Toyota and Stellantis groups, I would like to start a discussions with people here who owns a keyless Mirage.
This is the issue I'm talking about:

https://kentindell.github.io/2023/04/03/can-injection/

I believe it's not hard at all to find a way to intercept a CAN-enabled wire in our car (front bumper side is easy to pull) I haven't found any references about system updates for Mitsubishi cars.

Any thoughts, any ideas on how to mitigate this?

[inuvik]

Hi everyone,
As happy owner of a 2021 Mirage with keyless system and hearing now more and more horror stories about very quick thefts of 6-figures worth keyless cars manifactured by Toyota and Stellantis groups, I would like to start a discussions with people here who owns a keyless Mirage.
This is the issue I'm talking about:

https://kentindell.github.io/2023/04/03/can-injection/

I believe it's not hard at all to find a way to intercept a CAN-enabled wire in our car (front bumper side is easy to pull) I haven't found any references about system updates for Mitsubishi cars.

Any thoughts, any ideas on how to mitigate this?

Simply owning a Mirage is the best anti-theft device you can have. Who wants to steal one? My son had my Mirage in LA for years parking on side streets and left it unlocked so thieves wouldn't smash the windows to search the car. How many times did he have someone rummage through the car? ZERO. Who wants to hoon a 78HP car with a CVT? Nobody.

[Fummins]

Thankfully I don't think most thieves target cheap econo cars. I assume the ones going through that much effort to learn how to steal are targeting sought-after vehicles for export to zero ****'s give kinda places like Nigeria. I guess a Mirage could be a popular 3rd world car there.

If you're still really worried about it, you could put a kill switch on the start circuit to the small wire on the starter solenoid. Or pull a relay out or....

[mirthmobile]

The built in anti-theft aspect of these cars was a selling point.

[mohammad]

I believe it's not hard at all to find a way to intercept a CAN-enabled wire in our car (front bumper side is easy to pull) I haven't found any references about system updates for Mitsubishi cars.

what CAN enabled wires did you have in mind? other than the ABS system I am unaware of any can enabled computers under the hood.

[redline81]

The built in anti-theft aspect of these cars was a selling point.

That's exactly the point, thanks.

Keyless systems were initially sold as more secure than physical keys. They are, if you focus on the keyless system itself (rolling keys, car-remote mutual authentication, etc). They aren't if you consider that CAN bus standard in most of keyless cars is basically the same as 10 years ago. Keyless system just drops a message on the bus saying "hey, key is validated, turn on the engine". You can understand how stupid this is if you look that CAN runs all over the electrical car equipment and it's a common bus for all the devices connected.

[redline81]

what CAN enabled wires did you have in mind? other than the ABS system I am unaware of any can enabled computers under the hood.

LED Headlights, for example. They are targeted on Toyotas. Front bumper is very easy to pull with hands, not sure if you can reach the socket from there.

[Mark]

That's exactly the point, thanks.

Keyless systems were initially sold as more secure than physical keys. They are, if you focus on the keyless system itself (rolling keys, car-remote mutual authentication, etc). They aren't if you consider that CAN bus standard in most of keyless cars is basically the same as 10 years ago. Keyless system just drops a message on the bus saying "hey, key is validated, turn on the engine". You can understand how stupid this is if you look that CAN runs all over the electrical car equipment and it's a common bus for all the devices connected.

A keyless remote is constantly sending out a signal that can be intercepted by thieves. Your car & fob are constantly communicating with one another, and thieves know this!

You could be sitting at a restaurant, & someone sitting near you can send/transmit your signal to a partner out by your car. They use what is called a "keyless go repeater". Your car could be stolen within minutes.
Example below -

https://www.youtube.com/watch?v=pNtXb6G53mg

Saying a keyless fob is more secure is a myth.

I would pay extra for a car that uses a physical key with a chip to program.

[redline81]

A keyless remote is constantly sending out a signal that can be intercepted by thieves. Your car & fob are constantly communicating with one another, and thieves know this!

You could be sitting at a restaurant, & someone sitting near you can send/transmit your signal to a partner out by your car. They use what is called a "keyless go repeater". Your car could be stolen within minutes.
Example below -

https://www.youtube.com/watch?v=pNtXb6G53mg

Saying a keyless fob is more secure is a myth.

I would pay extra for a car that uses a physical key with a chip to program.

Relay attack. Some car manifacturers already solved this by adding a little gyro on the remote, if you are not moving for a couple of minutes then the remote goes into sleep state and stop answering to car signals, if any. For our Mirage and other cheap cars, there are special key sleeves around (you can find them by googling keyless signal blocker), with a conductive tissue inside to replicate some sort of faraday cage effect. I got one and it works pretty well.

[Fummins]

This reminds me, I should consider installing a kill switch in my minivan. I'm pretty sure it doesn't have an immobilizer.

As for the Mirage, unless you're in a third-world country where beggars can't be choosers, I don't think there should be too much fear-mongering about Mirages being targeted. Most thieves would steal something more desirable,re-floggable overseas, and/or more fun. Like a bicycle.

I don't worry much about theft where I live but I'm sure if I left the keys in the ignition of my car for long enough it would eventually drive off after a week or month.