Are RFID ignition systems secure?

RFID Security: Hacking In­

The fact is, people steal cars equipped with RFID security. It's especially common in Europe, where RFID has been used in cars for longer than in the United States. To prove the weaknesses of the system, researchers at Johns Hopkins went about breaking in. What they found was startling.

If you equip a laptop computer with a microreader, a device that can capture radio signals, you can capture the transmissions sent out by an RFID immobilizer key. Positioned within a few feet of the RFID transponder -- say, sitting next to the car owner in a restaurant -- the laptop sends out signals that activate the chip. When the key begins broadcasting, the reader grabs the code, and the computer begins decrypting it. Within 20 minutes, you've got the code that'll tell the car to start. (Once you have a good database of codes stored in your laptop, the time gets much shorter.) Pair that code with a copy of the physical key or a hotwire job, and you're on your way. In the case of the passive ignition system, the process is similar, but you need only stand next to the car, not the person carrying the key.

In cars that have RFID entry and ignition, it's an all-in-one process. Break the codes, and you can not only unlock the doors, but also start the car and drive away. According to some security experts, this is the problem with the system. RFID is a really great addition to a car's physical security system, but on its own, it allows for complete access with just a single act of decryption. For a thief with good equipment, it's a snap.

This is where the RFID, insurance and car industries object to the portrayal of RFID systems as faulty. Sure, the Johns Hopkins researchers could break it. They have money and hardware. Car thieves would never take the time or spend the money to break an encrypted code.

But with the payoff of tens of thousands of dollars for a high-end car, thieves have decided to give it a whirl. And whereas locksmiths weren't allowed to copy RFID-equipped keys at first, annoyance on the part of car owners who lost their keys led to a loosening of the rule. Now, both locksmiths and regular consumers can buy kits that can capture and clone an RFID code. The result is that people are losing their RFID-secured cars, and insurance companies call the owners' claims fraudulent because RFID security is uncrackable. The owners must be lying.

There are a few possible solutions to this problem that don't involve scrapping RFID. The Johns Hopkins scientists propose several ways to better secure the system: First, RFID makers should switch from 40-bit to 128-bit encryption; owners should wrap their fob in tinfoil when not using them, to help block fraudulent signals from activating transmission; and most important, carmakers should use RFID technology as an additional security measure, not the sole one.

As with any other security system, the advice is simple: Layer up. Don't rely on any single protection method. Instead, use several different types of security in order to make it as complicated as possible to bypass.