Volkswagen just could not seem to catch a break. As the automobile manufacturer continues to deal with the fallout of its emissions cheating scandal, security researchers have unveiled that about 100 million of the company's vehicles are vulnerable to a wireless key hack.
The news comes from the Usenix security conference held in Austin, Texas, where Flavio Garcia, a researcher from the University of Birmingham, exposed a method that exploits wireless key systems to remotely unlock Volkswagen vehicles.
In the paper that Garcia and his team released on the matter, it was revealed that practically all vehicles released by Volkswagen since 1995 are vulnerable to the hack. With the method possible to be carried out remotely without leaving any physical traces, the vulnerability presents a severe security threat to owners of Volkswagen vehicles.
The researchers, through reverse engineering on one component of Volkswagen's internal network, were able to acquire a single cryptographic key value that is shared among the vehicles of the automobile manufacturer. They then used radio hardware to intercept another value that is unique to the target Volkswagen vehicle and is included in the signal for every time that a driver presses the button on the key fob.
Through the combination of the two supposedly secret values, the researchers can clone the Volkswagen vehicle's key fob and gain access to it. The hack will not be able to start the car, but with the attacker inside, the vehicle can be placed on neutral so that it can be rolled onto a waiting flatbed to steal it. Attackers could also clean out all the valuables left behind in the vehicle.
According to David Oswald, one of the researchers on the team, hackers would only need to eavesdrop on the keyless entry signal once. Afterwards, they can clone the original remote control to unlock and lock a vehicle as many times as they wish.
The attack is not particularly simple to carry out, as radio eavesdropping requires the attacker to be within 300 feet of the target vehicle. The shared key is also not universal, as the value is different for various models and production years of Volkswagen vehicles.
The components from which the researchers extracted the keys were not revealed for protection against car hackers, but the team warned that if hackers would reverse engineer the keys themselves, millions upon millions of Volkswagen vehicles will be made vulnerable. The four most commonly used keys are found in 100 million Volkswagen vehicles that were sold over the past 20 years.
Worried Volkswagen car owners could not do anything to stop such an attack once it gets out, save for looking around to check if there are any suspicious figures nearby that might be trying to sniff out the key fob signal. The safest option would be to drop the use of the wireless key entry system altogether, and instead resort to using the mechanical lock of the vehicle.
In June, Volkswagen agreed to a $14.7 billion settlement over the diesel emissions cheating scandal, with 11 million Volkswagen vehicle owners eligible for cash compensation. It is unclear what Volkswagen will do in relation to the wireless key hack vulnerability, but the company has been made aware of the problem.
