Marco: Vehicle Identification & Tracking via Passive Keyless Entry
Nick Ashworth presents 'Marco', a radar-like RF attack that probes Passive Keyless Entry (PKE) systems to identify and track specific vehicles across a city.
Summary
Beyond Relay Theft: Exploiting PKE for Surveillance
While research on Passive Keyless Entry (PKE) focuses on relay attacks for vehicle theft, the unencrypted challenge-response protocol introduces massive surveillance vulnerabilities.
Introducing the 'Marco' Vehicle Tracking Attack
Nick Ashworth presents 'Marco', an attack methodology that functions like cooperative radar by broadcasting low-frequency wakeup beacons.
Fingerprinting Unique Vehicle Cryptographic Responses
By measuring precise RF timing and response identifiers from a target vehicle's keyless transceivers, an attacker tracks specific cars without physical contact.
Mitigating RF Tracking and Privacy Leaks in Connected Cars
The author discusses protocol enhancements, randomized transponder MAC addresses, and cryptographic challenges to prevent vehicle stalking.
Related talks
Car Hacking Village·26 min
Yago Lizarribar
Reveals how unencrypted RF broadcasts from direct Tire Pressure Monitoring Systems (TPMS) enable vehicle tracking and custom message injection to spoof ECUs.
Main Stage·40 min
Cooper Quintin · Yomna Nasser
Shows how modifying an inexpensive consumer 4G LTE mobile hotspot allows researchers to capture raw network packets and detect IMSI catcher surveillance.
Main Stage·43 min
Erwin Karincic · Woody
Discloses cryptographic and firmware vulnerabilities in goTenna Pro mesh networking devices, allowing off-grid key extraction and message decryption.