Your locked i3 really isn't....

[I33t]

The demo clearly proves that when the car "thinks" the fob is too far from the car it will not start.

Not quite. The demo shows that unless the fob is inside the car, it will not start.

It's normal for the car to stay running once started even if the fob is removed. That's for safety reasons, you don't want a vehicle stopping if the battery in the fob dies etc.

 

[CaptBreadbeard]

Except... This car doesn't fit that description.

For clarification, my comments were about these systems in general, not specifically the i3. Some manufacturers appear to have put no effort into making their system secure. As your test shows, BMW has done some...although I doubt anyone has really locked down the system down if the TPMS and CANBUS hacks are any indication.

The complaints were not only about the possibility of starting the car, but merely gaining access to it. As your window test shows, BMW has taken steps to ensure the car only starts when the fob signal is inside. Likely, some sort of triangulation / multiple antenna scheme. However, it wouldn't be a very good fob if it didn't provide access from outside the car.

What would really be interesting, is to determine if BMW provided protection against first gaining access through the boosted signal, getting in the car with the repeater device and then starting it. At that point the repeated fob signal is in fact emanating from within the car and without additional protections, the car should start and continue to drive until shutoff (for safety).

At the end of the day, not much has changed. It's not like other cars aren't broken into and stolen all the time. In my experience, people drastically over estimate how much security they really have and always are shocked when a little bit of knowledge and skill easily overcomes their security. This is sensational because it looks like magic, a bent coat hanger seems less threatening even if the results are similar.

 

[I33t]

What would really be interesting, is to determine if BMW provided protection against first gaining access through the boosted signal, getting in the car with the repeater device and then starting it.

Agreed. Need a booster to test, have you got one?

 

[WoodlandHills]

What would really be interesting, is to determine if BMW provided protection against first gaining access through the boosted signal, getting in the car with the repeater device and then starting it.

Agreed. Need a booster to test, have you got one?

Given the worldwide coverage of this I would not be surprised if some "investigative" TV show was doing just that..... If it really does work then we can expect lots of copy-cat incidents to follow, and lots of sensational reporting. IMHO, it is such a technically intriguing concept that someone, somewhere, will either debunk the whole thing or prove it. Where are the MythBusters when you need them?

 

[jadnashuanh]

This could easily work with some configurations, but it is a big stretch to say that all vehicles have the same vulnerability. There are lots of things you could do to prevent this sort of thing from working, at least easily and cheaply.

 

[GodFollower]

Well, for unlocking the vehicles with the door handles(Passive Entry) this would in theory work. However, this would not allow you to start the vehicle. BMW uses peripheral antennas for transmitter function relay only, not for actual locking function communications.

To elaborate, when you come up to your car with a comfort access key the antenna in the door handle you are approaching(peripheral antenna) recognizes the key via the AM signal the OP was referring to(125kHz). This wakes the key and requests an ID response on a different frequency(315MHz), which is sent by the key to the regular keyless entry antenna(FBD). So, as long as the key is within range of the car(if you hit the button on the remote, does it work?), this "hack" should in theory work to unlock the vehicle.

However, Passive Go(Keyless Starting) works slightly differently. When a start command is initiated inside the vehicle by pushing the button, it uses the comfort access aerials inside the vehicle(separate from the peripheral antennas) to identify the key via low power transmissions. The interior antenna still tells the key(on the 125kHz band) to transmit an ID packet, but it also instructs it to includes immobilizer data and as such is transmitted at a much lower power by the key(still in the 315MHz range). This distinction allows the vehicle to know if the key is inside or outside the vehicle, useful for determining if the doors should be allowed to lock(accidental locking prevention). After all, why do we need to use a full strength signal if the key is supposed to be within 10 feet of the FBD prior to starting?

This means the key's responding signals would have to be amplified as well to implement this "hack" to start the car, which is much less probable. Is the thief going to slip an amplifier into your purse when you are not looking, so they can steal your car? They may as well just palm your key if they are going that route...