Hackers could wirelessly unlock practically every Volkswagen, excluding the latest models, built since 1995, researchers have claimed.
Wired reports that new research reveals that a vulnerability in the keyless entry system affects more than 100m cars built by VW, including Audis and Skodas.
The attack relies on a cheap and common piece of radio hardware which clones a victim’s key fob by intercepting its signals.
The University of Birmingham and Kasper & Oswald researchers say hackers need only a software defined radio and a laptop, or an Arduino board with a radio receiver that costs only $40 (£31), to perform the attack.
The hack is particularly problematic, according to researchers, because drivers aren’t warned when their car’s security has been compromised and it requires the interception of just a single button press.
But that doesn’t mean it’s easy to pull off.
The hackers used reverse engineering to extract from a component inside VW’s internal network a single cryptographic key value shared among millions of their cars.
By combining this number with the number from a driver’s key fob, hackers can gain access to the car.
It is believed that four cryptographic keys provide access to nearly all the 100m vehicles built by Volkswagen since 1995, excluding current models.
The researchers are opting not to publicly identify the vulnerable components for fear of encouraging hackers.
Only the most recent models, which use a new locking system with unique keys, are not affected by the attack.
It was revealed last year that VW had spent two years trying to suppress research by the University of Birmingham team, which showed that millions of their cars could be turned on and driven off without a key.
In a statement, VW said:
“Researchers from the Universities of Bochum and Birmingham set themselves the task of analysing security technologies such as the immobiliser and remote control to identify systematic weaknesses, regardless of practical applicability. Their academic work, now published, showed that the security systems of those vehicles that were up to 15 years old do not have the same security level as, for example, our present vehicles based on the MQB Modular Transverse Matrix (e.g. the current Golf, Tiguan, Touran, Passat, etc.). These current vehicle generations are not affected by the problem described.
“The responsible department at our company is in contact with the academics and a constructive exchange is taking place. We agreed that the authors would publish their mathematical-scientific findings, but without the sensitive content that could be used by accomplished criminals to break into vehicles. Rather, the findings obtained will serve to further improve security technology. Vehicle theft is not possible in this way.”