Keep your key fobs isolated, folks.... to prevent stolen Bronco

[Beachin 74]

I wonder when they are going to start blaming Ford like they did Kia.
I mean we can't blame thieves, can we?

Sponsored

 

[Ninjak]

They have been stealing dodges like this for a while. Before that it was the Evo's. My friend who had 20k worth of work on his Evo had it stolen from the Tri Rail station.

With vehicles becoming more advanced, thieves' tools also get more advanced. So this is the state of the world we are in though. But honestly, it is no different than someone opening your door, and hot-wiring the car back in the day. Now its done with chips and signals.

 

[ChrisB351]

Still not sure why more people don't use their garages for putting their car in.

I have a small single car garage. It has 2 motorcycles, tools, an engine, and various car parts filling it up. Even if it were completely empty it would be a struggle to fit the bronco inside.

 

[Mdozier]

Travel with a folded piece of Al foil. Double it around the fob and fold closed if I have to stay in a sketchy area overnight. Simple, easy and cheap insurance for “just in case”

 

[Tacanta14]

If someone wants it that bad they can have it. Thats what insurance is for. I leave mine in the driveway wide open with doors and top of for a good 3-4mo out of the year.

I hope your insurance company doesn't read your post!

 

[Tacanta14]

Remember when you see the green dot that it's not that I value my stuff over a human life , it is the fact that you value my stuff over your life.

And the red dot!

 

[CarGuy]

AMEN! And all you knucks who paid ADM better have GAP insurance

A better phrase for ADM is “disposable income/cash.”

 

[ChrisB351]

I hope your insurance company doesn't read your post!

Why? Nothing incriminating in my comment. Ive had this conversation with my agent about leaving it open like that. She drives a Gladiator and does the same thing. Thats where the comprehensive coverage comes in to effect.

 

[Phil Brown]

Remember when you see the green dot that it's not that I value my stuff over a human life , it is the fact that you value my stuff over your life.

And the red dot!

One of the last great things about living in southern Calif.......So close to that HUGE desert area

 

[Tacanta14]

Why? Nothing incriminating in my comment. Ive had this conversation with my agent about leaving it open like that. She drives a Gladiator and does the same thing. Thats where the comprehensive coverage comes in to effect.

Just kidding, Bro!

 

[Rwhite692]

Was discussing this vulnerability / exploit with a friend who works in IT security (he owns an F150, which has the same Intelligent Access system). We sent some recommendations off to Ford yesterday, via their "Idea place" web portal:

"The key (pun intended!) to reducing the efficacy of this exploit, is to:

1) Realize that the parking situations and resultant security needs of users, vary GREATLY, and users need the flexibility to prevent the vehicle's Intelligent Access system from broadcasting (trying to obtain authentication from a keyfob), IN CERTAIN SITUATIONS and at CERTAIN TIMES.

2) Make the system behavior across the installed base of vehicles a NON-CONSTANT. This will cause thieves to lose confidence in the usefulness of their exploit, because it will not ALWAYS WORK for them (assuming that they can make successful RF contact with the keyfob) as it does NOW.

This could be achieved by adding intelligent user settings in the vehicle menus, such that the user can:

1) Disable Intelligent Access during a user-selected time window (When the user must park the vehicle on the street overnight, for example)

2) Disable Intelligent Access via Geofencing (Allow the user to set up geographical areas where Intelligent Access is always disabled)

3) Any combination of both #1 and #2 above (i.e.: "Disable Intelligent Access whenever my vehicle is parked at the gym, after 6PM"

4) Add a user option for a screen-entered PIN code requirement (pop-up) to enable starting the vehicle under a set of user pre-defined conditions, for example: "If the vehicle is opened between 1:00 AM and 5:00 AM, and the vehicle is within 100 feet of my home, require the PIN, to start".

5) Disable Intelligent Access altogether, if desired by the user.

If Ford does implement even a few of these user configurable options, it will greatly reduce the use of these exploits, due to the loss of exploit predictability.

Please realize that these keyfob RF exploits are rapidly becoming more common as the needed equipment cost is decreasing, and knowledge of the exploit techniques is spreading rapidly."

 

[flip]

Most of these relay boxes use Bluetooth to communicate, so… think of the range of your typical wireless Bluetooth headphones.

But really there is no limit other than the speed of light. At some point you get too far away and the authentication request will time out while it waits for the waves to travel… so you probably can’t perform a relay attack from the moon.

But I built one in college for a wireless communication class that worked over 2 miles. That was for garage doors and not automobiles, but same principle.

PATS

The PATS function is controlled by the BCM , the ABS , the RTM , and the PCM .

When the START/STOP button is pressed, a voltage signal is sent to the BCM . When the BCM detects the START/STOP button is pressed, it begins the key initialization sequence by activating the PATS front antennas, PATS center antenna, PATS rear antennas, and keyless entry rear antenna. Each antenna transmits a low frequency signal with an approximate range of 1m (3ft). The passive key activates if it is within range of the antennas. The BCM is able to determine the passive key location (inside or outside the vehicle) based on the input from the antennas.

When the passive key activates, it sends the PATS identification code to the RTM via a ultra-high frequency signal. The RTM interprets the ultra-high frequency signal from the passive key and sends the information to the BCM over the LIN based circuit.

If a programmed passive key is detected inside the vehicle, the BCM transitions the ignition from off to on.

When the ignition transitions from off to on and the modules initialize, the PCM sends a target 1 challenge request to the ABS module. The ABS replies to a target 1 challenge request to the PCM . The BCM replies and if the correct identification is received, the PATS disables and allows the vehicle to start. If the PATS prevents the vehicle from starting, a DTC sets in one of the modules.

The PATS and the RKE system share operation of several components including the passive keys and the RTM .

If there is a concern with either of these components, the PATS and the RKE system are both affected.

In the event of a no start, place a programmed passive key in the backup starting location to allow the vehicle to start. The PATS center antenna activates the passive key when the START/STOP button is pressed in the event the batteries are depleted within the passive key.

NOTE: If available as a selection on the diagnostic scan tool, the passive start feature is a programmable parameter and can be enabled/disabled. If the feature is disabled, the features to passively enter and start the vehicle are inoperative. To start the vehicle, the passive key must be placed in the backup starting location.

The BCM controls the ignition modes and in conjunction with the PCM and the ABS module, controls the PATS . PATS does not disable a vehicle that is already running.

Backup Starting

NOTE: There are certain areas within the vehicle where the passive key may not be detected and the message center displays "No Key Detected". If the passive key is in the far outside edges of the interior (such as in a door map pocket or above a sun visor), it may not be detected. Move the passive key to a different location and try to turn the ignition on.

When the BCM does not detect a valid programmed passive key in the passenger compartment or cargo area, the "No Key Detected" message displays in the message center when the START/STOP button is pressed.

In the event of one of these failures, place a programmed passive key in the passive key backup starting location to allow the vehicle to start. When the START/STOP button is pressed, the PATS center antenna activates the passive key and the identification code is sent to the BCM . The passive key must be oriented correctly in the backup starting location.

For more information and to identify the backup starting location, refer to the Owner's Literature.

"No Key Detected" Message

NOTE: Some brands/types of mobile phone, laptop computer chargers and other radio frequency interference may cause interference that could lead to a PATS no-start if the passive key is within close proximity of the charger. If a concern is observed, move the passive key away from the charger and attempt to start the vehicle.

The "No Key Detected" message displays in the IPC message center when:

• When the ignition is off, the START/STOP button is pressed and a programmed passive key is not detected inside the vehicle. If a component failure (such as a depleted passive key battery or BCM failure) is causing the "No Key Detected" message to display, the backup starting method can be used.
• When the ignition is on, the driver exits the vehicle with the programmed passive key and closes the door.
• The BCM activates the PATS front antennas, PATS center antenna, PATS interior rear antennas and keyless entry rear antenna to search the inside of the vehicle for a passive key any time a door or the tailgate is opened and then closed with the vehicle running and the first times each drive cycle the vehicle speed exceeds 5 km/h (3 mph). The "No Key Detected" message displays in the message center and the horn chirps (when in park only) twice when the ignition is on and a passive key is no longer detected inside the vehicle.
• The "No Key Detected" message displays in the message center when: the START/STOP button is pressed with the ignition off and a valid programmed passive key is not detected inside the vehicle.
• The engine has been started or the ignition is in RUN and a passive key is no longer detected inside the vehicle.
• Key not in vehicle
• Doors electrically disconnected, but still installed.

The BCM activates all the PATS antennas to search the inside of the vehicle for a passive key every time a door or tailgate is opened and then closed. This strategy aids to prevent the passive key from being separated from an already running vehicle. If a passive key is no longer detected in the vehicle, the vehicle continues to run. If the START/STOP button is pressed to turn the vehicle off, the engine can be restarted without a passive key present inside the vehicle for approximately 20 seconds. During that time, Restart now or key is needed displays in the message center. After 20 seconds have elapsed, a passive key must be present to start the vehicle or transition the ignition out of on.

Automatic Engine Idle Shutdown

The automatic engine idle shutdown feature monitors the state of the vehicle to determine when the engine is powered with no user interaction for approximately 30 minutes. Approximately 30 seconds prior to the shutdown, a message displays in the message center to inform the operator a vehicle shutdown is imminent. This includes shutting down the engine and turning the ignition off. When the shutdown occurs, press the brake and START/STOP button to re-start the vehicle (a valid programmed passive key is required).

The conditions required to begin the automatic engine idle shutdown feature are:

• power pack enabled
  • engine running
• brake pedal not pressed
• accelerator pedal not pressed
• remote start not active
• transmission in P (park) or N (neutral)
• diagnostic scan tool not connected to the vehicle

Once these conditions are met, a time-out starts. When the time-out period ends and none of the listed conditions changed, the automatic engine idle shutdown event occurs.

PATS Parameter Identifications (PIDs)

In conjunction with Diagnostic Trouble Codes (DTCs), the PATS Parameter Identifications (PIDs) are a useful tool when diagnosing PATS concern

 

[broncobase1]

If someone wants it that bad they can have it. Thats what insurance is for. I leave mine in the driveway wide open with doors and top of for a good 3-4mo out of the year.

There are millions that want it that bad, and is the reason why insurance in Californa is crazy high. You pay one way or another.

 

[flip]

RKE

The RKE feature is controlled by the BCM . When a button is pressed, the Transmitter Identification Code (TIC) and RKE command is received by the RTM . The RTM interprets the information and sends a message to the BCM over a LIN circuit, and when the network is awake over the CAN . If the BCM detects a valid programmed key, it carries out the command by controlling the door locks, releasing the tailgate latch or activating the horn or turn signals as required.

The RKE system can be used to:

• unlock the driver door.
• unlock all doors and the tailgate.
• lock all doors and the tailgate.
• arm/disarm the perimeter alarm.
• activate/deactivate the panic alarm.
• remotely start the vehicle.
• configure the staged lock programming (2-stage unlock or global unlock).

The passive key have a normal operating range of 50 m (165 ft) in an open air, no obstruction environment.

The passive key and the BCM also utilize a rolling code to prevent the code from being captured by a code grabber. The system advances the counter in the RKE transmitter and the BCM every time a RKE transmitter button is pressed.

The message center displays Key Battery Low Replace Soon when the battery in the key needs to be replaced.

The RKE is part of vehicle load shed strategy. For additional information
Refer to: Battery Load Shed (414-01 Battery, Mounting and Cables, Description and Operation).

 

[broncobase1]

Something fishy about this video. We do not see the Bronco drive away.

Sponsored