Here's an excerpt from an Ars Technica story on car theft techniques:I read it differently. If the key is close enough to talk to the car, then even if the key is stationary, and sleeping, it still might be talking to the car but at a lower message rate. In fact the car has to exchange info with the fob to know the key is indeed in sleep mode. If I was still working and had access to an Agilent spectrum analyzer I’d do a test for that, record messages between the fob and the car to see what they are actually doing.
“Now that people know how a relay attack works… car owners keep their keys in a metal box (blocking the radio message from the car) and some car makers now supply keys that go to sleep if motionless for a few minutes (and so won’t receive the radio message from the car),” Tindell wrote in a recent post. “Faced with this defeat but being unwilling to give up a lucrative activity, thieves moved to a new way around the security: bypassing the entire smart key system. They do this with a new attack: CAN Injection.”
The rest of the article is on the "CAN Injection" method, but cars from the last few years have implemented countermeasures that make it less likely to succeed. Regardless it would be cool to capture the communication and be certain what 'sleep' means for the fob and car.



