Attacking Keyless Entry Systems
Keyless entry is convenient and a rich attack surface. From garage remotes to passive car entry, these systems trade physical keys for radio, and radio can be captured, replayed, and relayed. Here is how the main attacks work, what defends against each, and what it means for anyone building access control on RF.
The Families of Attack
Keyless entry exists because nobody likes fumbling for a key, and that convenience is built on radio, which anyone nearby can reach with equipment far cheaper than it used to be. The attacks divide into a few clear families, and each maps to a defense:
| Attack | How it works | What defends it |
|---|---|---|
| Fixed-code replay | Capture one press, retransmit it later | Rolling codes that never reuse a value |
| Rolling-code weakness | Shared manufacturer key or a loose resync window | Per-device keys, tight windows, a sound cipher |
| Jam-and-replay (RollJam) | Jam the receiver, capture an unused valid code | Jam detection, expiring codes, challenge-response |
| Relay (passive entry) | Two radios extend the car-to-fob conversation | Ultra-wideband distance bounding, motion sensors |
| Fob key extraction | Read or side-channel the fob key, then clone it | Key in a secure element, per-device keys |
Knowing which family applies to a system tells you both how it will be attacked and what it needs to resist, and the same principles cover car fobs, garage remotes, and RF building access. The rest of this walks each family in turn.
Fixed-Code Replay, the Easy Case
The simplest systems send the same code every time, which makes them trivial to defeat by replay. Capture one press with a software-defined radio, transmit it back later, and the receiver opens, no understanding of the code’s meaning required.
# capture a fixed-code remote, then replay it
rtl_433 -f 433.92M -A # identify/decode common remotes
hackrf_transfer -r capture.iq -f 433920000 -s 2000000 # record the press
hackrf_transfer -t capture.iq -f 433920000 -s 2000000 # replay it later If the replay opens the device, the system has no real protection, because the code is a static credential anyone in range can copy. Testing for this is a thirty-second check, and a system that fails it should be considered unlocked for anyone with a sub-hundred-dollar radio.
Rolling Codes, and the Jam-and-Replay Trick
Better systems use rolling codes: each press sends a different code derived from a shared secret and a counter, so a captured code is valid only once and a replayed old code is rejected. KeeLoq and similar schemes defeat the basic replay, but they are not automatically safe, their security lives in the key management and implementation, and a shared manufacturer key or a too-generous resync window undoes the concept.
A subtler attack, RollJam, defeats naive rolling codes by jamming: the attacker jams the receiver while recording the user’s press, so the code is captured but never accepted, then captures a second press, lets it through, and keeps the first still-valid code to replay later. It works because the first code was never consumed, so its counter remains valid. The defenses are jam detection, tight windows that expire unused codes, and bidirectional challenge-response.
Relay Attacks on Passive Entry
Passive keyless entry, where the car unlocks as the fob approaches with no button pressed, is vulnerable to relay attacks. The car emits a low-power signal the fob answers when close; attackers use two relay devices to extend that conversation, one near the car and one near the fob inside the house, fooling the car into thinking the fob is present.
The relay breaks no crypto; it simply carries the legitimate signals over a longer distance than the system assumes. This has been used in real car thefts, and it is effective precisely because the security model assumed a proximity the relay defeats. The fob’s distance, not its secret, was the control, and distance is forgeable.
Defending Passive Entry
The defense against relay is to measure something the relay cannot fake, usually time. Ultra-wideband ranging measures the actual distance to the fob by timing the signal precisely, so a relayed signal that traveled farther fails the distance check even though the crypto is valid, which is why newer vehicles adopt it. Simpler mitigations help too, motion sensors that disable a still fob and an option to require a button press, but time-of-flight distance bounding is the real fix because it attacks the relay’s only trick, the extra distance, directly.
The Fob Is an Embedded Device Too
Beyond the radio protocol, the fob is an embedded device with firmware and a secret key, and it can be attacked physically. Extracting the key by reading its chip or via side-channel analysis can let an attacker clone it, so the fob needs its key in hardware that does not give it up easily, ideally a secure element, with per-device keys so cloning one fob does not threaten others. The radio attacks get the attention, but the fob’s own key storage is part of the attack surface.
Testing a Keyless System
Assessing one runs through the families in order: capture and replay to test for fixed codes, capture several presses to see if codes roll, attempt jam-and-replay against the rolling code, test whether a relay extends the range on passive entry, and examine the fob’s key storage. Each test maps to a known defense, so the results point straight at the gaps, and the tooling, an SDR, a couple of relay devices, standard RF software, is exactly why these systems are attacked in the real world.
What It Means for Builders
Anyone building RF access control should pick the protection level deliberately against the consequence of unauthorized entry: fixed codes only for trivial uses, rolling codes with sound key management for most consumer gear, distance bounding for passive entry, and hardware-protected per-device keys in the fob. The recurring lesson is that the radio is not a trust boundary you can lean on, because anyone in range, or able to relay range, is on the other side of it. Authentication has to be real, the keys protected, and proximity measured, not assumed.
Where This Fits
Testing keyless entry and RF access control across the full range of replay, rolling-code, and relay attacks is part of the wireless work in a product security assessment. If you build keyless access and want it tested the way a thief with an SDR would, that is the kind of work we do at Berkner Tech.
