5th Gen SR5 Stolen

[CmdrCody]

Just found out my couple of houses down neighbor had his 2010 5th gen SR5 stolen last week from in front of his house. Unfortunately, my info is still 2nd hand.

I'm a bit concerned because apparently (yet to be confirmed) he has all his keys. He thought it was possible he left it unlocked, but has no idea how they stole it.

I thought this was the whole purpose of the ridiculously expensive key with a chip in it, such that the engine immobilizer would at least keep it in the driveway! So does this mean it is easily defeat-able?

When I have the direct story, I'll update the post.

 

[Batang.Gapo]

Just found out my couple of houses down neighbor had his 2010 5th gen SR5 stolen last week from in front of his house. Unfortunately, my info is still 2nd hand.

I'm a bit concerned because apparently (yet to be confirmed) he has all his keys. He thought it was possible he left it unlocked, but has no idea how they stole it.

I thought this was the whole purpose of the ridiculously expensive key with a chip in it, such that the engine immobilizer would at least keep it in the driveway! So does this mean it is easily defeat-able?

When I have the direct story, I'll update the post.

That's scary. We all know that these people are always ahead in tools/equipment in order to accomplish their goal.

 

[brockeverly]

Nothing will keep your vehicle that safe. Worst case, there is always a flatbed, that trumps all security systems. If a thief wants it bad enough, they will get it.

 

[MarkWalker]

That sucks. Hope he had good insurance, and they take care of him.

Please do let us know what you find out.

 

[Casper421]

Nothing will keep your vehicle that safe. Worst case, there is always a flatbed, that trumps all security systems. If a thief wants it bad enough, they will get it.

I hate to say it but :iagree:

 

[NHinAK]

Does the key transmit the immobilizer code when the lock/unlock button is used? Yes, it does. That's why my key fob only works with my vehicle. So, that would leave it open for interception and exploitation by a second party. Get the code, get the truck. All the chip in the key is doing is relaying a code, when requested. This code is relayed to the vehicle immobilizer wirelessly when the key is within range (think: inside the vehicle) or when the fob is used. Think of it as a wireless handshake.

 

[philsey]

He up to date on his payments? .... just sayin'

 

[Foques]

Does the key transmit the immobilizer code when the lock/unlock button is used? Yes, it does. That's why my key fob only works with my vehicle. So, that would leave it open for interception and exploitation by a second party. Get the code, get the truck. All the chip in the key is doing is relaying a code, when requested. This code is relayed to the vehicle immobilizer wirelessly when the key is within range (think: inside the vehicle) or when the fob is used. Think of it as a wireless handshake.

are you sure it is wireless? I know that we could not start my car when my key was inside, next to the ignition.. when I would touch the ignition metal with the key, however, the car would turn over no problem.. just sayin..

He up to date on his payments? .... just sayin'

I was thinking the same.

While yes, granted, there isn't a recourse that will keep your car safe, and thief will get the car should he really want; I just can't think of any good reason of someone going through a hassle of stealing a stock sr5.. the way I see it, it is just so not worth it, and the encryption breaking is a ***** on the new models..

 

[Johnny Utah]

Does the key transmit the immobilizer code when the lock/unlock button is used? Yes, it does. That's why my key fob only works with my vehicle. So, that would leave it open for interception and exploitation by a second party. Get the code, get the truck. All the chip in the key is doing is relaying a code, when requested. This code is relayed to the vehicle immobilizer wirelessly when the key is within range (think: inside the vehicle) or when the fob is used. Think of it as a wireless handshake.

man in the middle attack

I've successfully mitigated that attack by not having the key fobs. I only have the regular key. lol

 

[terra4r]

are you sure it is wireless? I know that we could not start my car when my key was inside, next to the ignition.. when I would touch the ignition metal with the key, however, the car would turn over no problem.. just sayin..

This. The code isnt send wireless when you press unlock or whatever, it has to be real close to the ignition...Think RFID.

The guy probably wanted to save face and say it was stolen, but sounds like repo. I dont see the 4runner being a target.. want a SUV? steal an escillade, it'll be easier.

 

[Uneek]

Nothing will keep your vehicle that safe. Worst case, there is always a flatbed, that trumps all security systems. If a thief wants it bad enough, they will get it.

:iagree: An ex-car thief was interviewed, he pretty much said, no theft deterrent system will stop him from taking your car. If it's a car he wanted, he'll wait for your return and take it a gun point. Is your life worth more than the car?

 

[NHinAK]

This. The code isnt send wireless when you press unlock or whatever, it has to be real close to the ignition...Think RFID.

The guy probably wanted to save face and say it was stolen, but sounds like repo. I dont see the 4runner being a target.. want a SUV? steal an escillade, it'll be easier.

How is the lock/unlock code authenticated and is it the same as the ignition immobilizer code? All keys are different and all fobs are matched to a specific vehicle. There's a code transmitted wirelessly when the lock/unlock button on the fob is used regardless if the ignition uses RFID....

 

[homeyclaus]

man in the middle attack

I've successfully mitigated that attack by not having the key fobs. I only have the regular key. lol

are you sure it is wireless? I know that we could not start my car when my key was inside, next to the ignition.. when I would touch the ignition metal with the key, however, the car would turn over no problem.. just sayin..


I was thinking the same.

While yes, granted, there isn't a recourse that will keep your car safe, and thief will get the car should he really want; I just can't think of any good reason of someone going through a hassle of stealing a stock sr5.. the way I see it, it is just so not worth it, and the encryption breaking is a ***** on the new models..

I think you're giving automakers too much credit. Most of the rfid-type or other near-field chatter isn't really encypted, it's security by obscurity. Remember that there are bluetooth hacks floating around for several model years of Prius (along with custom roms, like the battery software mod), and you could create all sorts of trouble. OnStar is probably no safer.

There are bluetooth sniffers available for Android phones and some older Palm models, and some of the newer phones now have multi-protocol RFID readers, so it's a matter of time before sniffers are commonly available for that - until then it costs $40 for the parts from Active Electronics or elsewhere.

 

[K O]

I think you're giving automakers too much credit.

I think you're giving borrowers too much credit. Most likely the car was repo'd - non-payment, bankruptcy, pending ugly divorce, etc.

 

[Foques]

um.. Encryption used on 4r key IS a pain.. we tried to pull it.. I had no issues doing so with my G35, my pop's Suby.. but I couldn't do that with my 4r. So, no, I do not give them too much credit.
Yes, it is not a 128bit encryption, but still..

Lock/Unlock is not related to the immobilizer code. It just turns off the alarm. so yea, you stole the signal, and unlocked my door, enjoy pulling the code.


i mentioned this to a buddy of mine (he still works as tow truck driver, and does repo), and he told me a story how a guy asked to be hit in the face, so he had a good explanation as to why the car is gone..

 

[homeyclaus]

I think you're giving borrowers too much credit. Most likely the car was repo'd - non-payment, bankruptcy, pending ugly divorce, etc.

I never stated a reason why I thought the vehicle disappeared. I merely stated that history proves there is little reason to have faith in the security of automotive technology, or any technology for that matter.

Once you have the car, the codes are in the ECU, and you can either code new keys into the ECU, or if they really did this right, need to put in a new one. The procedure is in the FSM.

 

[Foques]

Only one problem with that logic. Only 2 ECU scanners that I know of that can read Toyota ECUs are either toyota or aegis.
If one has an ability to obtain such scanner (and the key port), they will not be stealing a 4runner.. just not cost effective.

Though, I would love to know the real story behind the disappearing act.

 

[harper7]

The majority of stolen vehicles go straight to a chop shop anyways so they don't care if the key is chipped or not.If the parts are in demand ,the odds go up that your vehicle might get stolen.

My X father-in-law and my old neighbor are repo men and they could snatch a vehicle in under a minute.I rode shot gun with them a couple of times and it definitely was a adrenalin rush with some of the stories they have.Same goes for professional car thieves! If they want it bad enough it will be gone in 60 seconds from the street or mall.

I have Lojack on my truck and had it in my Beemer and other vehicles that I loved.It doesn't prevent thieves from stealing it.The only advantage it has is much higher recovery rates and lower theft damages if it's recovered and it at least gives the police a fighting chance to get it back.I'm fortunate to have my baby garage kept at home and at work it is gated with cameras and guards.

 

[terra4r]

How is the lock/unlock code authenticated and is it the same as the ignition immobilizer code? All keys are different and all fobs are matched to a specific vehicle. There's a code transmitted wirelessly when the lock/unlock button on the fob is used regardless if the ignition uses RFID....

Correct as I stated, sorry if it wasn't clear... I was in a rush. The immobilizer code is different than the key-less signal to lock/unlock, as below. I realize this is 2nd hand info, but its nice to know!

um.. Encryption used on 4r key IS a pain.. we tried to pull it.. I had no issues doing so with my G35, my pop's Suby.. but I couldn't do that with my 4r. So, no, I do not give them too much credit. Yes, it is not a 128bit encryption, but still..

Lock/Unlock is not related to the immobilizer code. It just turns off the alarm. so yea, you stole the signal, and unlocked my door, enjoy pulling the code.

 

[scanny]

Only one problem with that logic. Only 2 ECU scanners that I know of that can read Toyota ECUs are either toyota or aegis.
If one has an ability to obtain such scanner (and the key port), they will not be stealing a 4runner.. just not cost effective.

Though, I would love to know the real story behind the disappearing act.

Just out of curiosity I ran a Google search and looks like there are plenty of ways to bypass imobilizers. For instance I found site IMMO BYPASS DEVICES

Idon't know of course if it works but if this stuff is public available then what is available for professional thieves.