DEF CON 26 CAR HACKING VILLAGE - KEVIN2600 - Grand Theft Auto Digital Key Hacking

Summary

Kevin presents a security analysis of the Amikey digital car-key system, an aftermarket device that lets a phone lock, unlock, and start some older cars. The Amikey unit stays inside the vehicle. A phone communicates with it over Bluetooth Low Energy (BLE), and the unit sends commands to the car using its existing radio-frequency key system. The system also lets users share digital keys, with temporary or permanent access options.

Research and findings

• Hardware and radio: The presenter examines the device, identifies a TI CC2640 Bluetooth module and a separate RF module, and measures its car-key transmissions at about 433.9 MHz. He also finds an additional sensor whose purpose is unclear.
• BLE and app analysis: The device broadcasts a BLE MAC address, which could allow tracking. By inspecting the Android app and its Bluetooth traffic, he maps the communication and key-sharing functions.
• Plaintext communications: The app communicates with backend servers over HTTP, exposing information such as a user’s phone number and answers to account-recovery questions. The presentation also reports that shared-key data can be observed in traffic.
• Physical access: The device is easy to open and appears to lack tamper protection. The presenter demonstrates replacing its RF board with a car key’s RF board to send working commands. This attack requires access to the unit.
• Jamming: The car-side RF communication is one-way, with no confirmation that a lock command reached the vehicle. A jammer can therefore prevent a command from being received without giving the user a clear indication of failure. The presenter compares this to conventional key-fob jamming.
• Key sharing and revocation: The system allows sharing with up to 20 users. The presenter demonstrates that cancelling a shared key or letting its time limit expire may not disable it immediately: the owner’s phone must sync with the Amikey unit to update the status. If that sync cannot happen, a supposedly revoked or expired key may continue to work.
• Weak authentication: Reverse engineering reveals a proprietary protocol that, according to the presenter, relies on weak, predictable values and XOR operations rather than robust protection. He demonstrates scripting a login packet and issuing commands, and argues that the system’s security claims are not supported by its implementation.

Conclusion

The talk concludes that security through obscurity is inadequate and that the product should have been thoroughly tested before release. The presenter says he reported four CVEs and had not received a response from the company at the time of the talk.

Review and guide status

This is a technical security-research presentation involving hardware inspection, traffic analysis, reverse engineering, and attack demonstrations—not a consumer product review or setup guide. The demonstrated attacks have different prerequisites; some require physical access or the ability to observe or intercept communications.

Main speaker and source

• Kevin (Kevin2600) — automotive security researcher and consultant presenting his research on the Amikey digital car-key system.