SBD report urges rethink on car security

16 Sep 09

Independent technical consultancy SBD has issued a detailed report highlighting the overriding need for new anti-theft strategies in the next generation of cars. Brian Sims reports.

By Brian Sims

Despite a downward trend across the last decade, SBD is predicting that vehicle crime will increase unless the major car manufacturers “adopt an active approach to evolve vehicle security systems”. The global nature of the automotive industry, the ready availability of technical information and the creep of organised crime are all being blamed.

SBD’s report exposes the methods criminals are now choosing to overcome security systems and devices. The stealing of car keys and acts of fraud are still rife, of course, but now the thieves are developing sophisticated electronic methods to achieve their goals. Worryingly, the report suggests that almost every vehicle security system on the market today can be bypassed.

Speaking about the report – entitled ‘Vehicle Crime in the 21st Century and the Impact of Electronic Theft Methods’ – SBD’s managing director David Bell commented: “Many manufacturers use similar ‘off-the-shelf’ systems. That being the case, tools to overcome these products can be made common knowledge in an instant thanks to the Internet. Vehicle manufacturers and suppliers need to develop new, robust security strategies that take into account the globalisation of vehicle crime.”

In recent times, vehicle crime has evolved from small independent groups operating on a local or national level to where we are today, with highly organised criminal gangs reaping significant financial rewards on a global scale.

Since vehicle theft across Europe peaked in 1993, manufacturers have increasingly fitted electronic immobilisers and many other security features as a direct response to the introduction of legislation, insurers’ demands for enhanced security and the demonstrable requirement to maintain brand image.

While the initial motivation for improved security came from Europe, many manufacturers have subsequently introduced some of the same security measures in other markets. This has indeed had a positive effect in reducing theft in those markets. However, it has also had the effect of standardising many security solutions, leading to a wider range of cars around the world being fitted with similar protection devices – and more thieves having more cars to study in order to find the weaknesses.

Professional thieves – and in particular those with international connections – have caught up with immobiliser technology and developed equipment that overrides it. This equipment is often designed to conduct an electronic attack on a given vehicle’s systems, and can be pretty sophisticated in nature.

Current and future trends

While the overall level of car theft in many developed countries has fallen since 1999, the level of ‘professional’ theft has increased. Vehicle theft is a lucrative activity for criminal groups, and one that’s estimated to generate revenues in excess of £20 billion in the USA and Europe alone.

Theft patterns have changed significantly since the initial immobiliser systems were launched and cars became more secure. Thieves have been forced into finding new ways of stealing cars and, as always, have adapted to suit. Stealing the keys, carjacking, fraud and the development of electronic ways of overcoming security systems are now in vogue.

While the theft of the original key is still a common method of stealing vehicles in a number of markets, it’s the development of electronic theft methods that SBD believes will pose the biggest threat to vehicle security in the years to come.

Once the thief has access to – or is able to replicate – electronic security codes, they can then override all of the vehicle’s security systems (including the door locks, the alarm system, the electronic steering lock and immobiliser) without any risk such as would be associated with trying to first obtain the keys.

Since the collapse of the former Soviet Union, many individuals from the old Eastern Bloc with specialist skills have found themselves either unemployed or desperately short of income. Organised crime groups have been quick to offer these people freelance employment, asking them to develop devices and techniques that will overpower vehicle security systems.

In Russia alone, research shows that 80% of luxury car thefts – ie the theft of high value imported vehicles – are carried out using electronic high-tech methods.

Influence of the Internet

The Internet provides the perfect medium for thieves not only to share information on security weaknesses, but also for them to obtain technical data on a range of security systems and purchase a wide variety of specialist equipment that can help to override vehicle security systems.

On top of that, the World Wide Web has acted as the market for a wealth of normally restricted electronic components and parts (such as keys, transponders, microchips, microprocessors and control ECUs).

While many of these parts are copies, genuine parts can also be purchased through popular auction sites such as e-Bay or small specialist supply companies. There are also many web sites offering a variety of legal re-programming services for immobilisers, audio PIN decoding and mileage adjustment services.

There are also changes in legislation that need to be borne in mind. In the very near future, vehicle manufacturers will be forced to change their approach to the accessibility of information on vehicle security. The recent legislation introduced Stateside (ie the California Senate Bill 1542) and the pending European emissions legislation (Euro V) due in 2010 will force manufacturers to rethink their policies, and to put processes in place that will allow independent service operators the same level of access to security information as their approved dealerships.

According to SBD, these two pieces of legislation will afford wider access to security system information, which will inevitably lead to easier methods of theft and the development of increased numbers of override devices as well as aftermarket software that’s capable of bypassing security systems.

Effect of the global economic recession

Historically, the effects of financial hardship and, in particular, unemployment tend to take their time before the full impact is felt by society. Previous recessions have witnessed rises in depression and anxiety, leading to increases in both domestic violence and drug and alcohol abuse.

In truth, this type of behavioural change can often force normally law-abiding people down the path of criminality, and persuade career criminals to enhance their activities.

These conditions are often viewed by criminal gangs as an ideal opportunity for making money. During times like these the so-called ‘black market economy’ tends to burgeon. Many countries experience and increase in rates of criminality, particularly theft, which is partially to keep up with the demand for low cost goods and items.

What can vehicle manufacturers do?

The current trend for the global sharing of ‘off-the-shelf’ technology across vehicle models, markets and even across different vehicle manufacturers has made life so much easier for anyone wanting to develop a new method of overcoming a given vehicle’s security systems.

However, there are steps that vehicle manufacturers can take to improve their processes and make it much more difficult for thieves to bypass security solutions.

Robust system design

Consider the range of threats highlighted by the SBD report and ensure that each is considered at the design stage. Also make sure that the system specification aims to avoid weaknesses. Conduct attack testing using the latest known tools and methods for evaluating new systems.

Protect components from easy access and replacement

Apart from the theft of keys, which is a very difficult issue for vehicle manufacturers to address, the replacement of components continues to be a popular method of stealing a vehicle. By rendering component replacement difficult in the extreme, thieves can be discouraged from trying such an attack.

Robust service procedures and PIN coding

A secure process to prevent unauthorised access to keys and key programming procedures should be implemented globally, and based on industry Best Practice.

Do not rely on dealership staff

Sales staff cannot be expected to be able to detect forged documentation (both from the country of origin or foreign documentation) and act as the only level of protection against professional thieves trying to obtain keys and components.

Do not rely on simple CAN messages

Vehicle manufacturers should assume that thieves have full access to technical documentation and that they are adept at using portable diagnostic equipment to monitor and transmit messages on the CAN bus. They should ensure that it’s not possible to overcome security protocols using simple ‘capture and replay’ or basic message manipulation techniques.

Introduce regular software changes

The more frequently the software of the security system changes – even if those changes are small – the more difficult it is for thieves to develop attack tools and keep them current. Making software slightly different in different countries also prevents global tools and techniques from being developed by the criminals.

Speaking about the SBD report, DS Mark Tidy from the ACPO Vehicle Crime Intelligence Service (AVCIS) explained: “We welcome this report. Although vehicle crime has generally seen a decrease, the AVCIS is well aware of the need to stay one step ahead of organised crime groups that profit from the theft of – and from – vehicles.”

The AVCIS is currently the UK lead in tackling vehicle-enabled crime and works closely with the Home Office, all 43 UK Police Forces, SOCA, the insurance industry and Thatcham in an effort to further reduce this area of criminality and keep the public safe.