Carmakers introduce sleeping fobs to frustrate keyless thieves

Six new cars have been assessed by independent automotive research centre Thatcham Research in its latest Consumer Security Rating release, and all have achieved the top 'superior' rating.

The Audi A6 Allroad, BMW 1 Series, BMW 8 Series and BMW X6, along with the Ford Puma and Volkswagen Passat gained 'Superior' ratings for all-round security and the presence of a Relay Attack fix.

Richard Billyeald, chief technical officer, Thatcham Research said: "The models rated from Audi, BMW, Ford and Volkswagen not only have strong all-round security but have also made motion sensor enabled fobs available as standard when buyers opt for keyless entry and start. It's positive news for consumers that carmakers, in increasing measure, are making this fix available."

"The motion sensor fob is a good short-term option," said Billyeald, "but the goal for carmakers must be to design out the vulnerability entirely. Until then, a fundamental security flaw remains."

Motion sensors inside the fob detect when it has been stationary for a period and trigger a sleep mode. This means the fob will no longer respond to attempts to relay its signal. Full functionality is restored when the owner moves the key.

"We advise consumers to check how long it takes before the sleep mode on their keyless fob is engaged," said Billyeald. "Some fobs go to sleep in one or two minutes, others in 15 or even as long as 30 minutes.

"We urge manufacturers to bring keyless technology to market in secure form and remove from drivers the onus to provide additional security. Closer collaboration on the design and implementation of new technologies is the key to identifying vulnerabilities before they entrench in the vehicle parc," Billyeald said.

This is the third set of Consumer Security Ratings launched in 2019. Security engineers from Thatcham Research conduct a Relay Attack test on the vehicle's keyless entry and start system, while confirming that other security features meet minimum insurer requirements, including certified immobiliser, alarm and double locking systems.

To date, 24 vehicles have been assessed, with nine downrated to 'poor' having failed Relay Attack testing. 'Superior' ratings for all-round security and for having a fix to the keyless vulnerability in place have been awarded to 14 cars. Only one car, the Suzuki Jimny, has been downrated as a result of all-round security failings, despite not having a keyless entry and start system.