Simple Arduino hack unlocks 100 million Volkswagens

Attention drivers of Volkswagens: if your vehicle was built in 1995 or later, know that you’re at risk for being hacked, along with 100 million other motorists. The hack comes from researchers at the University of Birmingham and German engineering firm Kasper & Oswald, and involves using radio hardware to intercept a signal from a wireless key fob. The signals can be used to create a clone of your key that allows the vehicle to be unlocked. 

100 million Volkswagens are at risk of being hacked. Image source: Volkswagen.

The worst part? The hack is simple, being that it could be done with an Arduino board with a radio receiver, costing a grand total of $40. The researchers discovered this method after reverse-engineering a specific Volkswagen component. As reported by Wired, they were able to extract a “single cryptographic key value shared among millions of Volkswagen vehicles.” Intercepting a single key press is all it took to show the team what they needed to clone the key. As for a thief looking to break into your car, they’d need to be within 300 feet of your vehicle to open it.

In an email statement Volkswagen expressed their concern over the hack. “Volkswagen takes the security of our customers and their vehicles very seriously,” the company said. “Volkswagen is in contact with the academics mentioned and a constructive exchange is taking place. We agreed that the authors would publish their mathematical-scientific findings, but without the sensitive content that could be used by accomplished criminals to break into vehicles. The findings obtained will serve to further improve the security technology.” 

Turns out that all you need to hack a Volkswagen is a $40 Arduino board with a radio receiver. Image source: Wired.

After this security flaw, the researchers are set to test another hack, which can affect millions of vehicles. This next experiment covers multiple automakers, including Alfa Romeo, Fiat, Ford, Mitsubishi, and Nissan. However, this hack is predicted to be trickier, since it involves capturing multiple remote button presses, but it could still be used to gain access to a large number of vehicles, which is an obvious concern.

Do note that these hacks only allow access to the inside of the vehicles, and cannot be used to steal the car. Of course, getting inside could allow thieves to put the car in neutral and roll it onto a flatbed before speeding off with it.

You can view the original report on the Volkswagen hack here.