Paper 2024/1816 Original: eprint.iacr.org/2024/1816 ↗

Attacking Automotive RKE Security: How Smart are your ‘Smart’ Keys?

Abstract

Remote Keyless Entry (RKE) systems are ubiqui- tous in modern day automobiles, providing convenience for vehicle owners - occasionally at the cost of security. Most automobile companies have proprietary implementations of RKE; these are sometimes built on insecure algorithms and authentication mechanisms. This paper presents a compre- hensive study conducted on the RKE systems of multiple cars from four automobile manufacturers not previously explored. Specifically, we analyze the design, implementation, and security levels of 7 different cars manufactured by Honda, Maruti-Suzuki, Toyota, and Mahindra. We also do a deep dive into the RKE system of a particular Honda model. We evaluate the susceptibility of these systems to known vulnerabilities (such as RollJam and RollBack at- tacks). This is accomplished using a novel tool – ‘Puck- py’, that helps analyze RKE protocols. Our tool automates several aspects of the protocol analysis process, reducing time and logistical constraints in RKE research; we provide standardized protocols to execute various attacks using our Puck-Py tool. We find that, despite having a long period of time to fix security issues, several popular automobiles remain susceptible to attacks, including the basic RollJam attack.