BMW Thefts Without Keys

squeaky2 · Post by **squeaky2** » Fri Jun 15, 2012 12:00 pm

[quote="pvr"]
Are cars without comfort access ok then?
[/quote]

From the stuff ive read there is as i read it a possiblity that vehicles with comfort access are safer. It seems the way that the majority of this is working is that people are either blocking the remote locking so the car doesnt lock or are grabbing the frequency of the locking and unlocking it once youve left.

I think to do it with the comfort access is a little more complicated and suspicious, the way ive read it is that someone has to get close enough to the car to be able to grab the coding signal from the car and then have to get close enough to you to transmit and receive the coding signal from the key.......what with all of this being short range it seems to me to be a bit safer.

Then again i could be wrong

sramsay · Post by **sramsay** » Fri Jun 15, 2012 4:41 pm

I have comfort access but almost always lock/unlock by touching the door handle. Is this any safer or the same?

X5Sport · Post by **X5Sport** » Fri Jun 15, 2012 5:14 pm

[quote="squeaky2"]
[quote="pvr"]
Are cars without comfort access ok then?
[/quote]
It seems the way that the majority of this is working is that people are either blocking the remote locking so the car doesnt lock or are grabbing the frequency of the locking and unlocking it once youve left.
[/quote]
The radio frequency is common to all the keys for a particular manufacturer of key fob systems and it's also in a shared frequency band used by all kinds of other services. There just aren't enough radio channels for every car manufacturer and key combo - so the bit the thieves need is the code (which should change with every press, hence called a rolling code) data burst sent between the target key and target car.

But, because there is a chance that the buttons get pushed whilst the key is in your pocket, the car has a set of valid codes which it will accept, including the last codes used for each key. It also knows what the next few codes will be so when the button is pushed it knows what to accept. It's why you can still use your spare and often unused second key months later, or let your kids play with the key buttons, and it still unlocks the car. Grab the code, and bingo!

The only thing about the Comfort Access System that might make it harder for thieves if it's transmitter power level is lower so that it doesn't open the car from 100yds away - like some keys seem to do! Not having seen the spec for the BMW CAS key I don't know what its Tx power level is. If it is lower then as you say, the thieves need to be that much nearer to pick it up. And of course if it is a CAS equipped car, then they just break the window.

This is why I think it is so important that the car manufacturers 'harden' their key programming security processes - they can't practically harden the radio part - and harden the in car side to make it all but impossible for anyone to be able to program a blank key and add it to your car except actually at the Dealership and with the car connected to a secure server, or some other secure access system only Dealers have.

It takes under a minute to set up a new key once they have access to the OBDII port! That's where the hole is with BMW at present. Anyone with the right kit can be in your car and have a key done and the car away so fast it's just incredible that no one at BMW (or the other affected car manufacturers) thought of it and saw the problem coming.

No wonder they 'aren't pleased' as they must be seriously embarrassed by the recent spate of thefts - with instructions on YouTube! Note this is the legit hardware in use, but you buy it on eBay!

pvr · Post by **pvr** » Sat Jun 16, 2012 9:35 am

With Tracker now though, your insurance premium goes UP. I have trackers, but it was cheaper to not declare them than to do declare. Madness.

graemeX5 · Post by **graemeX5** » Sun Jun 17, 2012 8:00 am

I must admit there appears to be a gap in the BMW security that someone is exploiting still not 100% sure which model of keys as several commented on.

Although I did read a lot of people had pressed their remote button twice and so they had deactivated the interior sensors in error which doesn't help. It seems they programme a new key to car via the obd port which is on the drivers side and sometimes they break that window.

One chap made the point about you are buying a car you're not buying a security system and he has never relied on the manufacturers systems alone, which is a fair point. So it looks like if you want to keep your car add further security measures to the cars to deter the thieves. One person posted up a link for the trunk monkey a definite solution I liked not sure if Halfords do them -lol

You'll have to copy & paste link

http://m.youtube.com/watch?v=Ee3L9BQQ4Gs

ianmaney · Post by **ianmaney** » Sun Jun 17, 2012 8:47 am

That's it, I need a Trunk Monkey !

sramsay · Post by **sramsay** » Sun Jun 17, 2012 3:16 pm

Brilliant!

M3SD · Post by **M3SD** » Sat Jun 23, 2012 11:34 pm

Had my 2009 M3 Cabrio stolen from Birmingham on Sunday. Same MO - smash the glass, plug in the OBD device, mate a blank key to the car, disable the alarm and immobiliser and drive away. Luckily my car was found apparently abandoned few hours later.
Was shocked to read how quickly and easily it could be done thanks to the flaws and weaknesses in BMW’s system. According to police reports, 30-40 BMWs are being stolen a month in the Midlands region alone!!!!

Spoke to BMW Customer Services. They are fully aware of the problem but don’t have an answer. BMW dealers in the Midlands know about the thefts but can’t provide a permanent or robust solution either.

Read some of the posts here and they talk about owners contacting BBC Watchdog, BMW, motoring press etc and unsurprisingly they haven’t received a reply. I think we should take another approach - BMW have a Facebook page and Twitter account which are public. Why not do as I did, send messages/posts to those accounts as well? Or maybe set up a #BMWthefts on Twitter to get the word out there? I was lucky to get my car back, as I know the majority of vehicles will never be found.

Question – Zim Zimma….who got da keys to my Bimma?
Answer – Apparently every crook in the Midlands!

X5Sport · Post by **X5Sport** » Sun Jun 24, 2012 10:49 am

Glad you got your car back, and hopefully not too badly abused! >:(

Assuming it would be a 'stolen to order' theft then it should have been treated with a bit more care.

Auto Express have at least picked it up and published it, but apart from local press in some areas, they do seem to be the only ones.

Good idea about Facebook & Twitter as there was an article on the BBC Click Programne on Saturday about Companies taking more notice of Social Media and what opinions are being expressed and how much 'damage' can be done. However BMW GB or even BMW GmbH may not be interested!

At least they are now acknowledging there is a problem - until very recently it was being hotly denied - and a 'fix' is being worked on at the moment. It doesn't help those of us with potentially 'at risk' cars, which is why I now have a Stoplock wheel cover fitted. You can program as many keys as you like, but can't drive away. A wheel clamp is another option. None of this would be necessary if course if these companies had done any thought about the risks associated with allowing keys to be programmed on the car with almost no security in place. That in my view is an unforgivable oversight.

Richard

M3SD · Post by **M3SD** » Sun Jun 24, 2012 11:11 am

In terms of damage/loss: smashed driver's side window, nicked my IPod, sunglasses and Navigation DVD - obviously angry but could have been worse and at least no one was hurt....

As an engineer and security consultant I am shocked that BMW or Thatcham didnt consider this weakness and flaw. Sadly we are picking up the cost of these failings....

X5Sport · Post by **X5Sport** » Sun Jun 24, 2012 11:22 am

Unfortunately it shows that the Security Test Standards for cars may fall somewhat short in assessing how cars get stolen now. And yes, this theft method is blindingly obvious! As with so many things these days, once a flaw is found then the internet allows it to be widely circulated and then exploited. Thatcham are supposed to be working with BMW on a fix - so ay be both are severaly embarrassed as they rightly should be >:(

My Dealer will continue to be pressed into putting a solution in place. Of course if there is a maximum number of keys (was 4 on the E53 I think), then they could always let me have two more spares free........

pvr · Post by **pvr** » Mon Jun 25, 2012 3:28 pm

Perhaps the interim solution is exactly that - program the maximum number of keys that is allowed or set the computer at the dealer to not allow any more keys to be cut?

dirtymonkey29 · Post by **dirtymonkey29** » Mon Jun 25, 2012 5:18 pm

I would assume that if the software exists to create new keys then the software will probably have the ability to also delete keys too which would make owning the maximum number of keys also useless.

pvr · Post by **pvr** » Mon Jun 25, 2012 6:22 pm

But in the case of smash and grap from a broken window, would you be able to update the software that quickly via the OBD port?

X5Sport · Post by **X5Sport** » Mon Jun 25, 2012 6:26 pm

EDIT: Reply to DM29....Pass. I believe that the module in the E53 generation of car could only hold four keys and it was not erasable. If the data is held in a ROM (Read Only Memory) then once written it cannot be erased. If you lost too many keys then you needed a new module in the car, and those were several hundred pounds each. The question is of course.....are they still using that type of system? Probably not.

XSeries-forum

XSeries-forum