FRANKFURT--Tens of millions of vehicles sold by Volkswagen AG over the past 20 years, and some current models, are vulnerable to theft because keyless entry systems can be hacked using cheap technical devices, according to European researchers.
Computer security experts at the University of Birmingham have published a paper outlining how they were able to clone VW remote keyless entry controls by eavesdropping nearby when drivers press their key fobs to open or lock up their cars.
Vehicles vulnerable to this attack include most Audi, VW, Seat and Skoda models sold since 1995 and many of the approximately 100 million VW Group vehicles on the road since then, the researchers said. The flaw was found in car models as recent as the Audi Q3, model year 2016, they said.
"It is conceivable that all VW Group (except for some Audi) cars manufactured in the past and partially today rely on a 'constant-key' scheme and are thus vulnerable to the attacks," the paper said.
The only exception were cars built on VW's latest MQB production platform, which is used in its top selling model, the Golf VII, which the researchers found does not have the flaw. "There are still some VW car models being sold that are not on the latest platform and which remain vulnerable to attack," Flavio Garcia, co-author of the report and a senior lecturer in computer security at University of Birmingham, told Reuters.
A VW spokesman said that its current Golf, Tiguan, Touran and Passat models are not at risk from the attack. "This current vehicle generation is not afflicted by the problems described," VW spokesman Peter Weisheit said in a statement, without commenting on the risks to other models.
In their paper, the researchers did not identify the auto parts subcontractor that makes the affected keyless systems for VW and potentially other car makers. VW declined to comment on its supplier relationships.
Garcia and co-author David Oswald, also a lecturer at Birmingham University, are scheduled to present their paper at the Usenix security conference in Austin, Texas, on Friday. The disclosures come as Europe's largest automaker struggles to overcome its biggest-ever corporate scandal, after it admitted to manipulating diesel emissions tests in about 11 million vehicles globally.
Attackers can use cheap and widely available tools for grabbing radio signals, according to the three researchers from the University of Birmingham in central England and a fourth who is a security consultant with Kasper & Oswald GmbH in Germany. Cars from other manufacturers may share these flaws, including some model years of the Ford Galaxy, the researchers said.
"We are aware of this security gap and have incorporated this knowledge in the enhancements of existing and future systems. We no longer use the described system in any of our new cars," Ford Europe spokesman John Gardiner said.
The reports' authors said they had focused on mass-market models and did not analyse in detail VW's luxury brands including Porsche, Bentley, Lamborghini and Bugatti. They first disclosed their findings to VW Group in November and met the company and the subcontractor involved in February and said VW had acknowledged the vulnerabilities.
The Wolfsburg-based automaker confirmed it has had a constructive exchange with the researchers and that the authors had agreed to withhold details in their report that savvy criminals could use to break into cars.
