Keyless car theft still a concern as new models receive “Poor” rating

Four new cars have been given ‘Poor’ security ratings after they were found to be vulnerable to relay attack in a series of security tests carried out by Thatcham Research.

Thatcham, which assesses cars’ crash-test performance in conjunction with Euro NCAP, last year branched out into making security assessments of vehicles’ keyless entry and go systems in the wake of rising car theft figures.

This latest round of assessments found four cars - the Mazda CX-30, MG HS, Subaru Forester and Vauxhall Corsa - receive ‘Poor’ gradings after Thatcham was able to open and start the vehicles without using a key. 

The Tesla Model 3 and Hyundai i10, meanwhile, were judged to offer ‘Basic’ protection. Although testers were not able to start them without the key, their low scores relate to a number of other security systems, including the fitment and effectiveness of immobilisers, alarms, double-locking systems and wheel security.

Relay theft attacks see thieves clone signals emitted by key cards and fobs which can permanently transmit unlocking codes on models with ‘keyless entry’ functions. The crooks use cheap, easily available equipment to amplify these signals, opening and starting the cars, which are tricked into thinking the key is present.

Richard Billyeald, chief technical officer for Thatcham said “keyless vulnerability continues to be a concern to car owners”, although he cautioned that “it is not the only factor behind recent increases in vehicle theft.”

Nonetheless, he criticised the makers of vulnerable cars, saying: “Our assessment found that the rated Hyundai, MG and Tesla models are missing some commonly accepted security measures. These measures were introduced to improve core car security and represent the minimum today’s drivers should expect, whatever the vehicle price point.”

He added that Thatcham had been “working closely with Tesla” on Model 3 security, and said the car’s ability to receive over-the-air updates was “a huge advantage.”

It wasn’t all bad news for car makers, though: the BMW X6  and 2 Series Gran Coupe, Land Rover Discovery Sport, MINI Electric, Porsche Taycan, Skoda Superb and Toyota Supra were all judged to offer ‘Superior’ security systems, and all shrugged off relay attacks.

Manufacturers have been coming under increasing pressure to solve vulnerabilities related to keyless systems. Some firms - like Jaguar Land Rover - use sophisticated ‘ultra-wideband’ technology, which is immune to relay attacks. Meanwhile, Kia offers signal-blocking Faraday pouches with new cars fitted with keyless entry, and Ford developed a ‘sleeping’ motion-sensor key that switches off keyless signals if the key doesn’t move for 40 seconds or more. Billyeald called motion-sensor keys “a good short-term fix”, but warned such systems are “not the ultimate solution to the keyless vulnerability, which should be designed-out of new vehicles completely in the future.”

Billyeald offered the following advice to car buyers: “Drivers should go into the dealership with their eyes open to keyless security and if they do intend to specify the system, ask if a fix has been introduced. Your dealer is there to help with any queries or concerns and will know about system fitment and which type of fob is available.”

Auto Express contacted manufacturers whose cars received a ‘Poor’ security rating. Mazda said: “The Mazda CX-30 is fitted with a Thatcham Category 1 Alarm and immobiliser that complies with the very latest published guidelines

“The Mazda CX-30 key can easily be deactivated by the driver when leaving the vehicle if added security is needed. Mazda continues to work in close partnership with Thatcham, SMMT and the Police to ensure engineering solutions are put in place to combat new theft trends.”

Vauxhall said it takes “very seriously”, adding: “Working closely with the policing authorities, we study the subject of relay attacks with the same attention we give to all tools that facilitate the theft of a vehicle.  The use of this device needs exceptional circumstances with very specific and favourable conditions. In the unlikely event a thief were successful in entering or starting the vehicle, without possession of the key, when the engine was stopped it couldn’t be restarted.  These limiting factors reduce the risk of large scale use of this tool by thieves.”

Are you worried about your car being stolen through keyless entry? Let us know in the comments below...