Gone in 90 seconds: how thieves hack into and steal keyless-entry cars

WHEN DANIEL Witte paid nearly £70,000 for his dream car he wasn’t taking any chances with security. The Sunday Times reader from the West Midlands fitted the Audi RS 4 Avant with a top-rated alarm and parked it on his drive, monitored by two clearly visible CCTV cameras.

If anyone broke into the car, the wailing alarm and sophisticated immobiliser should have ensured that it was impossible to drive away. And if, despite that, someone managed to start the engine, a tracking device would monitor the car’s position, enabling police to recover it.

Thanks to modern vehicle security, a number of insurers have claimed that some of today’s cars are virtually theft-proof. They are wrong.

Witte, a property developer, was woken in the middle of the night in June by a phone call from a security company telling him the tracking device on his car indicated that it was being driven away from his home at speed. Bleary-eyed, Witte looked out of the window to discover the Audi was missing. Where it had stood were just a few fragments of glass.

What might have been a puzzle that baffled TV’s greatest detectives was rapidly solved, thanks to the footage from Witte’s CCTV cameras.

It appears to show crooks breaking a window and then plugging a device ­­—  assumed to be a piece of equipment available online that is used to silence alarms and program blank key fobs — into the dashboard. Just 90 seconds after the four masked and hooded thieves broke the window they drove away the Audi, which had more than £10,000 worth of factory options fitted.

The footage raises disturbing questions about car security. “I was in bed and didn’t hear anything,” says Witte, 40, whose two children, aged eight months and three years, were also in the house. “Five minutes later I got a call from the company that had fitted a tracker to the car, but the gang obviously found it because they removed it within 12 minutes. I haven’t seen the car since.”

Despite having viewed the footage, Audi refuses to admit that there is a problem, stating that the evidence is “inconclusive”.

However, it is understood that even a staff member at Witte’s Audi dealership has had an Audi RS 4 stolen, apparently using the same method. The dealership declined to comment and referred Driving to Audi’s press office.

Security experts and police sources also tell of alarming increases in thefts of vehicles with keyless entry systems. With such systems the key fob communicates wirelessly with the car. In some vehicles the driver has only to press a start button to drive off as long as the fob is in the car. In others, the fob has to be placed in a slot on the dashboard.

To comply with European regulations requiring independent mechanics and locksmiths, rather than just main dealerships, to be able to replace lost key fobs, many car makers include a feature that allows new fobs to be programmed from data held inside the car’s electronics. The data is protected by security software but some hackers appear to have cracked the codes and developed devices that thieves can use to access the data and program blank fobs.

Security experts and police sources also tell of alarming increases in thefts of vehicles with keyless entry systems.

Adrian Davenport, a former police officer who now works for the vehicle security firm Tracker, which fits systems that enable police to trace stolen cars (Witte’s Audi was protected by a different company), says the problem is getting more serious. “It is very apparent from the vehicles that have been stolen and reported to us that Audi thefts have increased substantially,” says Davenport. “Police forces I have been speaking to are all talking about a rise in Audis being stolen.”

A police source said hundreds of Audis have been stolen this year in the Midlands alone, while other areas, including Liverpool, are thought to have a similar problem.

West Midlands police say Audi thefts have quadrupled in a year: 12 have been stolen in the past six weeks, compared with three during the same period in 2012. The force has set up a crack team to tackle keyless thefts.

The technique that thieves are using is well known to police and regular readers of The Sunday Times. We reported extensively on the problem last year after dozens of readers got in touch to report stolen BMWs, even though the owner remained in possession of the vehicle’s key fobs.

It emerged that a device similar to that believed to have been used in the Audi thefts was being used to program blank keys for BMWs. Following our articles, BMW released a software update, which, according to police, has reduced the number of thefts.

Police warn that all new cars with keyless entry are vulnerable to the technique, as long as hackers can crack the security codes. “If they can hack into the Pentagon computer, then they can hack into cars,” says Simon Ashton, the industry liaison officer at the Metropolitan police stolen vehicles unit. “There is not a vehicle out there that can’t be reprogrammed. This is likely to be a constant battle in the future. With every new car or software update, it will be a matter of time until the hackers find a weakness. This is how car theft will be from now on.”

Equipment for programming Audi, BMW and other keys, aimed at professional mechanics, is readily available online, often from sites outside Britain. Davenport says other manufacturers are likely to be affected too. “There used to be a time when the Range Rover Sport was the preferred choice for car thieves, then it was BMWs and now it is Audis,” he says.

Audi says its cars, including the RS 4, regularly get top security ratings. “The security performance of Audi vehicles is always of paramount importance to the brand, and we take any potential threat to this exceptionally seriously,” said Audi.

“We have a dedicated technical team committed to closely monitoring thefts to ensure that our countermeasures are as robust and pertinent as possible. This video evidence has been included in our investigations in collaboration with the police, the results of which have so far proved inconclusive.”

Witte does not share the company’s opinion. “Audi has a problem,” he says. “I have owned six or seven Audis now, but I replaced the RS 4 with a Golf and I would be reluctant to buy another Audi until they come out and say there is a problem and they have fixed it.

“I’m really upset about it because I had put down a deposit for it 2½ years before it was delivered. I’d had it for exactly three months when it was taken and it was very special. It handled like no other car I have driven but it was too easy to steal.”