Stealing @ Speed of Light - Anatomy of a Relay Attack tool

The talk opens with how passive keyless entry and start works. The car sends a low-frequency challenge when its owner is nearby, and the key fob answers over UHF with a response computed from a shared secret. The speaker frames the weakness: the system treats proximity as proof of authorization, and a relay can extend the radio link so the fob responds to a car it cannot physically reach.

The researchers bought an inexpensive relay kit from an online automotive-test vendor and operated it against a 2017 Suzuki model, demonstrating unlock and engine start with the key roughly ten meters away. Using a spectrum analyzer and software-defined radios, they located the tool's internal link near 915 MHz and recorded both the original LF and UHF traffic. Comparing the captures, they concluded the device demodulates the on-off keyed LF signal and retransmits the bits using FSK, reproducing the original frames exactly.

To close, the speaker outlines defenses. Detection approaches include watching turn-on transients, carrier frequency offset and peak measurements, or the relay hardware's own link. Mitigations include UWB or RSSI-based proximity binding, frequency hopping, sleeping the fob when it is still, and Faraday pouches. The takeaway is that a cheap, widely available tool can defeat the trust assumption built into modern vehicles.