Marquardt: Interfering with
    nuisance car burglars

    Security at the speed of light for vehicles incorporating keyless technology

    Measuring just 2 x 2 mm in size, this tiny chip makes a one cent piece look like a manhole cover. When integrated into a car key featuring keyless technology, it becomes the Marquardt Intelligent Drive Authorization System (MIDAS). It could lead to thieves using radio extensions to break into vehicles needing to discover a new skillset.

    But Michael Brochno (name changed), a sports car enthusiast, unfortunately won’t be able to take advantage of this solution, since his bright-red premium-class coupé seems to have disappeared. What happened, you ask? Well, on a warm summer evening, he drove to meet his friends and parked his car a few meters from the entrance of the beer garden, where he spends some quality time in good company. Later, when he was ready to drive home, he returned to find that his car, just like his good mood, had vanished! Days later, Mr. Brochno was still in shock. “I couldn’t believe it to begin with,” Mr. Brochno said. “I started walking around the surrounding area, even though I knew exactly where I had parked my car.”
     

    Relay attack on keyless systems

    While the proud new car owner was inside enjoying time with his friends, chatting about his last vacation, thieves had hacked his car key’s radio signal. It only took seconds. The perpetrators didn’t attract attention to themselves because their tactic is as simple as it is effective. Mr. Brochno’s car key, containing automatic keyless locking technology, can constantly receive and send back signals. A nearby thief can pull the encoded data out of the unsuspecting owner’s pants pocket. He uses a homemade radio range extender to activate the key and amplify the radio signals, which he then transmits to an accomplice stationed at the vehicle they’ve set their sights on. The vehicle electronics mistakenly receive the signal from the perpetrator instead of the vehicle owner. Now, the door can be opened as normal when touched. From there, all the thieves have to do is get in the vehicle and drive away. In Mr. Brochno’s case, it wouldn’t have made a bit of difference if he was sitting inside or outside, since the radio extension method even works through building walls and closed doors. 

    We can already effectively fend-off all attacks on keyless systems today.

    Wolfgang Stehle Head of System Development Car Access and Driver Authorization Systems

    Existing keyless systems measure signal levels and use them to determine the distance from the transmitter. This level can be mirrored and played back again at an amplified strength. Even the strongest encryption between the vehicle and the key can’t prevent that.

    Bernd Baer Development Engineer

    Michael Brochno’s case is by no means an isolated incident. Investigations conducted by the General German Automobile Association (ADAC) on over 180 vehicle models prove that many cars with the “keyless” convenience locking system are much easier to steal than vehicles with a normal radio key. In one trial, all cars equipped with convenience locking systems could be opened and started in a matter of seconds. “Car manufacturers have a duty in this regard,” explained the Automobile Association. “A more expensive locking system shouldn’t be far easier to crack than standard remote control keys.”

    The solution comes from Marquardt

    A production-ready solution to the problem is already in the works at Marquardt, an automotive supplier based in Rietheim-Weilheim, southern Germany. The global player is considered a technology leader in the field of radio keys, control panels and battery management systems and has developed its new product, MIDAS, in collaboration with a Swiss start-up company and ETH Zurich. Development Engineer, Bernd Baer, who is responsible for the tamper-proof drive authorization system at Marquardt, explains the challenge. “Existing keyless systems measure signal levels and use them to determine the distance from the transmitter. This level can be mirrored and played back again at an amplified strength. Even the strongest encryption between the vehicle and the key can’t prevent that.”

    The MIDAS system offers an alternative solution. It no longer measures the radio signal level, but rather, measures propagation delay in the air. The system uses a characteristic of radio waves to do so. They propagate at the speed of light. “No attacker can transmit radio waves faster than the speed of light,” explains Wolfgang Stehle, Head of System Development Car Access and Driver Authorization Systems at the Marquardt group. “When you combine this with suitable encryption, it’s simply too fast to be artificially extended by a relay attack. This allows us to effectively fend-off all attacks on keyless systems!” Best of all, the secret weapon against car burglars is integrated in a chip, just two square millimeters in size, that can be conveniently fitted into the tiny installation space of a vehicle key. It requires so little energy that there’s no need for an additional power supply. MIDAS can’t be cracked – it is the world’s most secure system on the market against relay attacks.

    „A more expensive locking system shouldn’t be far easier to crack than standard remote control keys.“
    ADAC

    For those buying cars with a keyless system, hope remains that Marquardt’s innovative speed-of-light solution will soon become the standard. In any case, Michael Brochno will ask his car dealer about it, so his next visit to the beer garden won’t end with another unpleasant surprise.

    Contact

    Marquardt GmbH
    Schloss-Straße 16
    78604 Rietheim-Weilheim
    Germany