Clonable key fobs: Analyzing and breaking RKE protocols
Name
10207_2025_1063_ReferencePDF.pdf
Size
1.67 MB
Format
Adobe PDF
Checksum (MD5)
5d803ad3a8d79a0e98444bdb276aceab
Author(s)
Gesteira-Miñarro, Roberto
López, Gregorio
Palacios, Rafael
Date Issued
May 31, 2025
Journal
International Journal of Information Security
Publisher
Springer Berlin Heidelberg
Citation
Gesteira-Miñarro, R., López, G. & Palacios, R. Clonable key fobs: Analyzing and breaking RKE protocols. Int. J. Inf. Secur. 24, 150 (2025).
Version
Author's final manuscript
Abstract
The automotive industry has been a target for cyber criminals for decades. New regulations have come into force in the automotive industry and manufacturers must take cybersecurity into account. One of the most interesting vehicle systems is the Remote Keyless Entry (RKE) system, which allows users to lock and unlock their cars, among other actions, with a remote control integrated in the car key. If this system is compromised, a malicious user could gain access to a vehicle remaining unnoticed. This paper presents the identification and analysis of a vulnerability in an RKE protocol that can be exploited to gain access to the car at any time, thus cloning the key fob. The reverse-engineering methodology used to uncover the vulnerability is outlined, along with other tested vehicles to show its applicability. A relevant aspect of the research is the fact that only open-source tools and available commercial hardware are needed to perform the analysis. This black-box approach is equally valid to learn RKE protocol features, without the need to extract and analyze ECU firmware, which is considerably more expensive. As a result, a detailed analysis of eight protocols from different manufacturers is shown and they are compared from a cybersecurity point of view, with one of them being totally broken.
MIT Department
Sloan School of Management
Terms of Use
Article is made available in accordance with the publisher's policy and may be subject to US copyright law. Please refer to the publisher's site for terms of use.
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1007/s10207-025-01063-7
