BMW Thefts Without Keys

X5Sport · Post by **X5Sport** » Sun Jul 08, 2012 11:51 am

8 July 2012 UPDATE

I have just got back from an 'Olympic Torch Event' at my Dealer in Bedford and the Sales guys says that the key issue has now been fixed. Concerned Owners now need to make contact with their local Dealership and arrange for the Service Team to carry out whatever mods have been agreed between BMW & Thatcham done to their car(s). No recall apparently! No indication of what is modified - but then I would expect them to keep quiet about that.

Interestingly, one of the workshop techies was saying that they do not programme the keys anyway as that is done by BMW directly though whether in the UK, or Germany wasn't clear. When an Owner orders a key it arrives pre-programmed to the car. Presumably it's not the key that's the issue, it's the pairing of the key and car where the hole is.

Bedfordshire Police have been working closely with the Dealer because there has been a sharp rise of the level of not only thefts by the method we're concerned about, but also in parts such as mirrors, bumpers, and steering wheels of all things! Luton seems to be the local hub of the criminal groups and any town in reasonable striking distance has seen a sudden increase in thefts....and not limited to BMW, but Merc, Audi, Jaguar too.

dirtymonkey29 · Post by **dirtymonkey29** » Sun Jul 08, 2012 1:23 pm

Luton is a toilet

squeaky2 · Post by **squeaky2** » Tue Jul 31, 2012 8:11 am

Its not just BMW's now......Mk7 Ford Transits seem to be going walkabouts at a higher rate than BM's

Had mine stolen a few weeks ago, was coincidentally found the next morning with no damage to it at all.......all locks intact etc.

At least its easier to fit aftermarket alarms and locks on it though

jason@bwchiptune · Post by **jason@bwchiptune** » Thu Aug 02, 2012 1:15 am

Any BMW with a push start button is at risk
With the cas system it is so easy to read the key info over the obd socket
I told people on the forums about this years ago
We have been making replacement keys from 1994 for BMW cars
In the with the old system(EWS) the chip had to be removed to read the key code data
On the puts start cars just plug into the obd or can high and low wires and read off the full key data need to make a key to start the car
Even better is you just wake the car up and the modules like the cas unit have instant power so you can read it without having to turn on the ignition

mogsyman · Post by **mogsyman** » Thu Aug 02, 2012 8:17 am

[quote="X5Sport"]
8 July 2012 UPDATE

I have just got back from an 'Olympic Torch Event' at my Dealer in Bedford and the Sales guys says that the key issue has now been fixed. Concerned Owners now need to make contact with their local Dealership and arrange for the Service Team to carry out whatever mods have been agreed between BMW & Thatcham done to their car(s). No recall apparently! No indication of what is modified - but then I would expect them to keep quiet about that.

Interestingly, one of the workshop techies was saying that they do not programme the keys anyway as that is done by BMW directly though whether in the UK, or Germany wasn't clear. When an Owner orders a key it arrives pre-programmed to the car. Presumably it's not the key that's the issue, it's the pairing of the key and car where the hole is.

Bedfordshire Police have been working closely with the Dealer because there has been a sharp rise of the level of not only thefts by the method we're concerned about, but also in parts such as mirrors, bumpers, and steering wheels of all things! Luton seems to be the local hub of the criminal groups and any town in reasonable striking distance has seen a sudden increase in thefts....and not limited to BMW, but Merc, Audi, Jaguar too.
[/quote]

Are all BMW dealers aware of the 'fix'?

X5Sport · Post by **X5Sport** » Thu Aug 02, 2012 11:38 am

Having talked to the Service Team a couple of days ago about it, my Dealer knew sweet FA about a fix. I'm not impressed but don't know who to ask next. The guy I spoke to didn't even know there was an issue and two people from parts told him about it!! Not exactly inspiring..

snipez999 · Post by **snipez999** » Thu Aug 02, 2012 1:34 pm

I'm booked in on Monday for a service light (rear pads) and advisory (brake fluid before December so may as well do them both now). Asked the service guy to also hook me up for the 'advisory on OBD/CA" and he knew nowt. Will have a word when I drop her off Monday and see for sure then.

snipez999 · Post by **snipez999** » Mon Aug 06, 2012 2:25 pm

OK spoke to service manager today. Apparently it relates to pre 2010 cars only, if you can believe that. It shall remain a mystery as yet unsolved then.

X5Sport · Post by **X5Sport** » Thu Aug 09, 2012 5:34 pm

Oh.....Right.......clear as mud then! As usual. :blink:

So does that mean pre-2010 cars were the only ones being nicked (they weren't), or the post-2010 ones are still at risk (likely).....or? And is that calendar year or model year?

Come on BMW get your act together! >:( >:(

I'll have another word in my Dealership next time I'm passing.

Turks · Post by **Turks** » Fri Sep 21, 2012 3:49 am

Only now has this made the press... I wonder if the additional pressure will make BMW change their stance?

Cloned Key Fobs

Turks.

X5Sport · Post by **X5Sport** » Fri Sep 21, 2012 12:59 pm

It made the Press months ago, and BMW stated they would have a 'fix' by the end of August - which they almost made. Mine, along with many others E70/71 on here have now been modified.

BMW don't have to change their stance because they are legally correct - and have fixed it anyway on post-Sept 2011 builds (how has not been announced). They may be morally wrong (IMHO) as they didn't do enough for the 'real world', only enough for the standard required. And there is no way they should have kept on using the same system virtually unchanged from 2004. That really was asking for trouble. They both could and should have moved with the times. Corporate Deniability?

The question that I have yet to see anyone ask though, is why didn't the EU foresee this kind of problem when they mandated the OBDII standard having to be open in a way to allow non-franchised garages to work on cars? Similarly, why did Thatcham (I suspect I know the answer to this one - vested interests) not also move with the times and toughen up the tests to take things into account as tech moved forward and thieves abilities with it.

Let's face it a modern car is not much more than a computer controlled engine & systems wrapped in a metal & glass box and rolling on four wheels. Microsoft issue patches once a month, and almost every other IT company has some form of very regular patching schedule. Perhaps it's time cars were done on a more regular basis than every two years (time based servicing).

Perhaps we'll even need a WiFi dongle to connect our cars to the web to get the latest patches ......assuming none of us have Cat5/6 cables long enough to reach. But then we'll need anti-virus too, and proper firewalls in case someone hijacks the BMW download site, and if your ISP goes tits-up at the critical moment your car becomes an expensive brick (although less nick-able as a result).

Richard

jaynana · Post by **jaynana** » Wed Sep 26, 2012 8:12 pm

[quote="pvr"]
With Tracker now though, your insurance premium goes UP. I have trackers, but it was cheaper to not declare them than to do declare. Madness.
[/quote]

what's the issue with Tracker btw? is it good or bad? i have a Tracker Horizon.

i just paid the premium for the remainder of the car staying with me.. ie lifetime cover. needed for insurance from past but to be honest this time around i didn't check the insurance premium by removing the tracker!! bit too late now.

j

graemeX5 · Post by **graemeX5** » Wed Sep 26, 2012 9:08 pm

I have just read the below on pistonheads forum bit of a concern.

Hi,
There appears to be a lot of conflicting views about what is happening here.
I posted on another forum what a few of 'think' is happening and believe me I have met the guys that design and sell these 'rogue' tools.

It will not be solved by a software fix for any period of time (in our opinion anyway).

I'm posting a link as I just couldn't type it out again.
Apologies if that breaks a rule. If so then could someone copy/paste. It's next to impossible on iPhone!

Kind Regards,
E.
http://www.bmw-driver.net/forum/showpost.php?p=502...

Details on the link

For those that are interested there is a load of cr*p being said about this issue.

OBD standards in Europe are being blamed - this is NOT true. (and it's EOBD standards. The US version is OBDII)

There are lots of news articles suggesting that it's a 'brute force' hack of 'rolling codes' of the CAS system. This is NOT true.

The 'software fix' from BMW is very unlikely to work for long (see below).

---

The way this equipment works (the 'clone type' tools) can only be understood by understanding how the CAS works.

When you insert the key the CAS reads a code from the key. If this code is correct then the CAS authorises the Engine (DME/DDE) to start and releases the steering lock.
NOTE the the information travels from the KEY>CAS.

What this tool does is READ the stored key data from the CAS via the OBD port. This is not a software flaw but a hardware flaw allowing the EPROM of the CAS to be read by that method.
There is NO NEED for this function to be available for ANY DEALER or AFTERMARKET equipment for the legit motor trade.

Older models and indeed a lot of current models do not allow this. The CAS (or 'immobiliser control unit') must be physically accessed and the data read directly from it and in some cases directly from the chip or chips inside.

It's not 'encryption' that is wrong, it's that this data can be accessed through the standard diagnostic port.

For example, the latest Mercedes models require that you remove the 'EZS' (ignition switch) and read the data from it before 'flashing' a 'new' key. They don't allow access to this information through the DLC (Data Link Connector).

The software 'fix' from BMW will most likely just change the parameters of when the CAS is 'awake' (allowing communication) with a diagnostic tool. However even this is a problem as its possible to 'wake' the CAS by just joining two wires.
It's possible that BMW will also change the strategy of the DWA to improve security but this would be easily bypassed also.

I honestly believe that the only cure or fix for this is the change out of the CAS control unit itself with a revised model/unit that does not allow reading of the CAS chips through the DLC.

This would cost BMW an absolute fortune on all 'starter button' vehicles and I can never see it being done. Their bottom line is worth too much to them.

Kind Regards,
E.

X5Sport · Post by **X5Sport** » Fri Sep 28, 2012 10:24 pm

And they probably made the necessary hardware changes late last year to close the hole. As said this is a software fix and software can be hacked......it will only be a matter of time, but we'll see.

sramsay · Post by **sramsay** » Mon Jul 21, 2014 10:29 am

I just saw an article in the Daily Mail saying that X5's were amongst the top targets for theft in London by exploiting the security systems.

Does anyone know if the security fix BMW applied 2 years ago, has now been exploited or are they just trotting out old news?

XSeries-forum

XSeries-forum