key this car —

After burglaries, mystery car unlocking device has police stumped

Southern California cops can't figure out how keyless entry device works.

It's February, about an hour after midnight, and three men in oversized clothing and hats walk silently down a deserted residential street in Long Beach, California. Each one goes up to a car in the area, takes out a small electronic device, and pulls on the passenger side car handle. The first man tries a car in the street. It doesn't open, and he walks on. The other two men try an Acura SUV and an Acura sedan in one home's driveway. Both of the cars unlock, their overhead lamps going on. The two men rummage through the cars, taking what they find. They shut the car doors and walk off.

Video of this scene was recorded by a surveillance camera placed in the driveway where the two Acuras were parked. The Long Beach Police (LBPD) department says that eight vehicles in total were “accessed and burglarized” in the same neighborhood that night. But despite having footage of the crime, the LBPD was not able to determine how the electronic devices worked or who the suspects were.

Auto burglary technology grants keyless access.

In April, the Long Beach Police posted the surveillance video on YouTube, desperate to figure out just how the electronic device used by the three suspects works. Ars spoke to a Long Beach Police spokeswoman who confirmed that after another two months, the department still hasn't come to a conclusive answer.

The Today Show's Jeff Rossen also interviewed an Illinois man who has similar footage of a thief breaking into his Honda Accord using an electronic device, also from the passenger side of the vehicle.

"We are stumped and we don't know what this technology is,” Long Beach Deputy Police Chief David Hendricks told The Today Show on Thursday. The department said it has contacted auto makers and car alarm manufacturers to no avail.

While keyless entry systems have been available for cars in rudimentary forms since the late '80s, modern transmitter codes are generally encrypted, and most transmitters rely on a “rolling code” that changes in a planned sequence to prevent would-be thieves from standing near the car as the owner opens it and listening in on the UHF signal that the transmitter sends to the car. The Register noted that last year saw a spike in BMW break-ins due to the sale of a $30 on-board diagnostics bypass tool that allows hackers to reprogram blank keys for use on specific cars, but the US attacks appear to be different.

One interesting theory, however, was put forth on the LBPD's YouTube channel two months ago. “One has to wonder if they were using signal repeaters to join the car to the key—which was presumably inside the house some distance away,” one commenter wrote. “Usually both the key fob and the car must be close together but with a repeater to boost the strength in both directions, the distance could be extended significantly. This type of hack was described more than two years ago by a Professor from ETH Zurich(? Iirc).”

Ars believes the commenter is referring to an academic paper explaining how to increase the signal strength of a car's passive keyless entry system.

The Long Beach police media relations team responded by saying that it would forward the idea to the detective on the case, but it seems a resolution is still outstanding. A signal repeater would explain why the device might not work on cars in the street (which could be too far away for a signal boost) but might work on cars parked closer to the house. It does not explain the consistent passenger-side entry, however.

Channel Ars Technica