Why you might want to wrap your car key fob in foil

USA Today

DETROIT – Given that the best way to store your car keys at night is by putting them in a coffee can, what’s an ex-FBI agent’s advice to protect cars from theft during the day?

Wrap car fobs in aluminum foil.

“Although it’s not ideal, it is the most inexpensive way,” said Holly Hubert, a cybersecurity expert who retired in 2017 from the FBI in Buffalo, New York. “The cyber threat is so dynamic and ever changing, it’s hard for consumers to keep up.”  

Now, as CEO of GlobalSecurityIQ, she suggests clients go online and spend a few dollars and buy what’s called a Faraday bag to shield the fob signal from potential theft. Imagine a traditional sandwich bag made of foil instead of plastic.

Thing is, the car is always waiting for the fob signal. Thieves can buy legitimate devices that amplify the fob signal sitting unprotected in a purse, a pocket, on a counter at home or even just copy the code to access the vehicle.

Copying code from key fobs isn’t difficult. And this is something the auto industry and insurance companies are monitoring closely.

The cheap (or homemade) metal protection covers, named for the scientist who figured out how to block an electromagnetic field, can prevent thieves from having access to vehicles with a wireless fob. Currently, thieves can capture fob signals from outside a home, office or hotel room.

“You know it works if you can’t unlock a car door when the fob is inside,” said Moshe Shlisel, CEO of GuardKnox Cyber Technologies and a veteran of the Israeli Air Force who helped develop cyber protection for fighter jets and missile defense systems.

“The credit card holders don’t work because they’re essentially a net rather than a wall.”

He visited Detroit recently to meet with automakers. He’s already working with Daimler on Mercedes-Benz vehicles and the Volkswagen Group on Porsche, Audi and Volkswagen products – to protect them from hackers. Other clients and potential clients have asked to remain confidential.

Shlisel showed a new video of his company’s engineers taking control of a semi-truck through the use of a cellphone. Numerous videos have been posted online to illustrate that vulnerability is an industrywide problem.

Canned key fob

He held up his fob and said, “This should be something we don’t need to wrap with foil. It’s 2018. Car companies need to find a way so no one can replicate the messages and the communication between the key and the vehicle.”

At home, Shlisel puts his key fob in a can with foil around it to add another layer. In his pocket, he carries the fob for his 2017 Ford F-150 in a little pouch that is made of fabric on the outside and foil inside.

Cybersecurity experts say privately that anyone who knows anything about the ease of auto and personal data hacking practices safe fob storage.

Clifford Neuman, director of the University of Southern California Center for Computer Systems Security in Los Angeles, pointed to the millions of consumers who now carry their credit cards in a protective pocket designed to work as a Faraday cage.

“We’re talking about electronic burglary tools or car theft tools,” he said. “You go up to a house with a car parked in front of it, detect a fob 10 feet away in a bedroom and it allows the car to be unlocked. As these devices become more available, this scenario becomes more and more likely.”

Neuman added, “Cars used to be hot-wired. That used to be common, but was an accepted risk. This will become a new technique used by criminals.  How much you are concerned, and what you do about it, is a matter of risk management.”

People who store their fobs in Faraday cages aren’t paranoid, experts say.

Jay Beckerman doesn’t want to wrap his key fob in aluminum foil before leaving home, but he says he is learning that maybe it’s a good idea.

After reading an article in May about cybersecurity experts not going to bed before stashing their car “keys” in metal coffee cans to prevent theft, the retired journalist from Phoenixville, Pennsylvania, wrote to say, “I can’t carry my keys in a metal can during the day. What do I do?”

He went on, “I bought a Samsonite RFID pouch from Staples, put my fob wholly in the pouch, stood about 10 feet from my car, a 2004 Audi A6, and pressed the buttons from the outside. But the lock and unlock buttons worked, lights went on and off. Same with a 2013 A4. Not the desired outcome to foil a miscreant snooper. Though they might fit in a purse, Altoid cans probably aren’t deep enough and wouldn’t work in a pants pocket. Band-Aids don’t come in small cans anymore.”

Shlisel said at the time, “The best thing you can do is keep your key in a small tin can wrapped with aluminum foil. But in a purse or pocket, just aluminum foil will do the job.”

This is the reality of a wireless, connected world where car doors lock with a click and a chirp, where children in the back seat stream videos and companies can update software technology remotely.

While auto industry engineers know a lot about traditional safety, quality, compliance and reliability challenges, cyber is an “adaptive adversary,” said Faye Francy, executive director of the nonprofit Automotive Information Sharing and Analysis Center, which specializes in cybersecurity strategies. “Automakers are starting to implement security features in every stage of design and manufacturing. This includes the key fob.”

https://www.usatoday.com/story/money/nation-now/2018/07/08/wrap-car-key-fob-foil/762338002/