High tech auto crime: Relay theft and signal jammers

Stolen bike parts on their way from a chop shop, intercepted by police

While the average thief might not hold a degree in electronic engineering, the equipment they’re now using is some of the most advanced seen in automotive security. Major manufacturers are playing catch-up, hampered by the budgetary and legislative constraints that the world’s criminals don’t need to concern themselves with, but understand the tech being used, and you can be far better equipped to prevent your bike – or car – being stolen…

A typical car theft in a public place can involve criminals using very common household devices to jam the signal from your remote (this can also work on your bike’s alarm fob, if it’s not self-arming). The owner leaves the car either assuming it’s locked, or if they notice, then intending to get it fixed when they get home.

Either way, the crook has access to the vehicle to programme a new key in as little as 13 seconds. The thieves then either start the car and drive it off, or take it later. If you have details of your home address in the car – be it paperwork or in your sat-nav, they can take it whenever suits them, unlocking it with their newly programmed key.

Programming a new key using OBD

CAN bus compatible devices are freely available for programming blank keys to a huge range of cars… sellers even explain their use on YouTube

The equipment to programme keys is freely available online, and a quick look at eBay even sees some of the items using paid promotion to keep them first in the listings.

Another, more sinister theft involves what’s known as a keyless ‘relay theft’. And again, the kit can be easily bought online.

Relay theft was first seen by the International Association of Auto Theft Investigators as early as 2006; criminals stealing keyless ignition cars from apartment blocks didn’t know which room the keys were in, so worked out how to pick up the signal from the fob through walls and transmit it to the car. They could then start the car, and of course it would run until it was switched off, at which point they’d be at a location that they could either reprogramme the immobilisation, or strip the car and sell it for parts in a chop shop.

In 2010, the first unexplained thefts of cars occurred in the UK, and by 2012 relay thefts were confirmed. It typically involves two criminals – one holding a device next to the vehicle, the other moving a scanner across the walls, windows and doors of your home until the unit ‘finds’ your key, amplifies the signal, then sends it to the box being held next to the car.

Relay theft of a Mercedes

This car was stolen using a relay theft in Solihull. West Midlands police caught the crooks and seized the equipment used

Where are the cars and bikes going?

While export is one market for stolen vehicles (and you can fit a lightly-stripped bike into a 50 gallon oil drum quite easily), chop shops run across the UK at an industrial scale, with teams operating very successful businesses through the most popular online stores and auction sites.

The criminals will often specialise, be it in motorcycles, or specific car brands, and it’s not just the new vehicles they’re interested in – cars are often high-end brands that are out of warranty – the point when more people will be looking for cheaper spares. Of course, new and old vehicles get damaged bodywork, and the crooks will take advantage of the general public’s hunger for a bargain. Anything is game.

Keyless ignition isn’t as common on bikes, and a motorcycle’s vulnerability lies more in its portability (police officers have reported that a drug-fuelled crook has been able to pick up a Fireblade and throw it into the back of a van on his own), so for advice on how to secure a motorcycle, please click here.

How to defeat a jammer

It’s important to always check your car doors are locked or your bike alarm (if fitted) is armed – if your fob won’t work, it could be as simple as a weak battery. It’s actually possible to ‘boost’ the signal a little by holding it to your head and of course, simply getting closer; make sure you change the batteries that day, or consult your dealer if it’s a self-charging key.

However, if you believe someone may be attempting to jam your device, you can hold the fob under your chin, with your head down. Then move around the vehicle – as close to it a possible – while facing it. Keep pressing the button until it locks – at this point your body will be shielding the vehicle and fob from the jammer, which will also give you an indication that the person doing it is likely to be to your rear. Do not attempt to confront them.

If you suspect your key fob’s signal is being jammed, walk around the vehicle as close as possible while facing it. With the keys tucked under your chin, keep pressing the button until the car locks

How to keep your bike or car safe from a keyless attack

• Never leave your keys on or near your parked bike (or car), regardless of if it has keyless ignition.

• Always keep any keys out of sight and away from windows or letterboxes.

• If your vehicle has keyless ignition, try to keep the keys as far from any exterior walls or windows as possible. The most expensive relay equipment has a long reach, but the DIY kit seized from a recent attack showed officers that the ‘budget’ equipment – for now at least – is less powerful.

Relay theft devices are freely available for sale online

• Urban myths state that keeping your keyless ignition fob in the fridge or a biscuit tin will prevent it being scanned. This isn’t true – not all refrigerators are fully metal-clad, and some tins can even boost a signal. Keep your keys in a quality RFID pouch, but be aware that the cheaper versions can wear with use, and that one recently tested by the Tracking and Aftermarket Security System Association (TASSA) stopped preventing a relay attack after a short period of use. Unfortunately, an owner wouldn’t be aware that the RFID-resistant coating had failed until they realised their vehicle was gone.

A quality product like the £15 pouch from Trade Vehicle Locks (TVL) – available here – has been tested by TASSA and an independent accreditation house to last a minimum of 20,000 key insertion/removals – approximately 14 years if you use it twice a day.

Silver foil does work, but people have also used the oven, until this was forgotten and it was turned on…

If using an RFID key pouch, ensure you spend a little extra on a quality one

• If a thief can’t access your vehicle using a relay attack, it does not mean they’ll then break into your home; this is very unlikely and there are plenty more cars and bikes available to steal.

Entry into the home is a more serious offence and carries much more risk for the criminal, but sadly it is a possibility, however remote. We’d recommend that while keeping your keys out of easy reach of an opportunist thief is important, they should be left accessible. Do not take them to bed with you.

Ultimately, your vehicle is insured, and if a criminal is willing to enter your home, the best advice is simply to allow them to take what they need and leave as soon as possible.

• It can take seconds for a keyless ignition fob to be generated by a crook – your OBD (On Board Diagnostics) port is always within 30cm of your steering wheel, and they’re increasingly appearing on bikes.

It’s been known for a valet cleaning service to process a key while the customer has a coffee. So impressed with how immaculate their car looks, the owner gladly signs up to the offered loyalty card scheme, registering their postcode at the same time. The crooks are now free to come to the address whenever they like with their own fresh keys.

• Don’t leave paperwork in your car with your address on (and ensure it’s not displayed in your sat-nav).

• Even if you don’t have keyless ignition, if those with criminal intent have your key, they can very quickly clone it.

• Check if the keyless ignition option can be disabled on your vehicle – some allow it, so check your manual or ask your dealer.

• Use additional hard security – with bikes, you should use a heavy-duty chain where possible, secured to an immovable object like a ground anchor. You can read BikeSocial’s in-depth tests of chains and locks here and garage security here. If you’re securing a car, use a device like Disklok or even use one of your bike’s U-locks if you have a spare, to tie the wheel to the door handle or another solid point in the car.

• Consider a tracker. If your bike or car is taken, a quality tracking device could alert you immediately, and is very likely to see the return of your vehicle, not to mention potentially lead to the conviction of the criminals. Read BikeSocial’s tests of trackers here.

Code grabbers can pick up your key’s signal while being used, though rolling codes have helped reduce this form of attack

What’s being done to beat the thieves?

OBD ports are a legal requirement on cars and now bikes, and manufacturers (and the police) have to work within the law, which means publishing details of the technology and how it works. But crooks don’t worry about such niceties as legal process, and a cheap device can very quickly programme a new key through an OBD port, so manufacturers are working to lock down the ports when the vehicles are locked.

Organised groups of thieves will not hesitate to spend $36,000 on relay equipment from Lebanon – freely available online – or $8,000 on (for example) a Range Rover key programmer; thieves don’t have the resource and budget constraints of our stretched police forces. A few vehicle manufacturers though have ‘invested’ in the kit, and some of the latest keyless ignition systems are evolving to be able to beat a relay attack.

The IAATI and vehicle manufacturers (not to mention Bennetts) notify companies like eBay when products that enable theft are listed for sale, but those that are removed are replaced by hundreds more. And many of the programmers and dongles that enable theft can be bought for as little as a few dollars from China.

The only chance of stopping these devices getting into the UK is with something that many people are against; European legislation. From programmers to scanners to relay equipment, none of this electronic kit is CE-approved, and as such shouldn’t be seen on the shores of any country that conforms to European standards (as the UK will continue to after Brexit). The problem though will be how many of these packages can be checked by our stretched port authorities.

Contrary to popular culture, the police are working hard to combat this crime – albeit with reduced resource – and there’s a lot more at their disposal than can be publicised. Social media would have you believe that the police don’t care, and that they can’t do anything, but officers around the country meet regularly with experts from across the globe to tackle vehicle cyber crime, and the Met police has already publicly shown that it WILL chase scooter suspects not wearing helmets, and it WILL perform a ‘controlled takedown’ where necessary.

But the best way to help prevent yourself from becoming a victim of crime is to use common sense, and to make sure that your vehicle – be it car or bike – is securely locked.

Met police controlled takedown

Despite claims in the media and online, the police will take dangerous scooter criminals down…