- New consumer security rating to inform consumers around potential keyless entry/start vulnerabilities
- Audi e-Tron, Jaguar XE, Land Rover Evoque and Mercedes B Class 2019 models rated ‘Superior’
- 2019 models of Ford Mondeo, Hyundai Nexo, Kia ProCeed, Lexus UX, Porsche Macan and Toyota Corolla rated ‘Poor’ due to keyless entry/start vulnerability
- Suzuki Jimny has been given ‘Unacceptable’ security rating, despite not having a keyless entry/start system
- Policing Minister Nick Hurd, National Police Chiefs’ Council Lead for vehicle crime Graham McNulty, and the Association of British Insurers (ABI) endorse
Thatcham Research has launched security ratings to help consumers understand the theft risk of new cars against a backdrop of rising vehicle thefts. The new ratings assess whether measures to specifically address the keyless entry/start vulnerability have been adopted.
Six of the 11 vehicles launched this year have been given a ‘Poor’ rating as the keyless entry/start system they have, as an option, has no security measures to prevent theft by criminals using the so-called ‘Relay Attack’ technique. Without this option, the overall security features were classified as ‘Good’.
Richard Billyeald, Chief Technical Officer at Thatcham Research, comments: “This initiative focuses on addressing keyless entry/start vulnerability. We’ve seen too many examples of cars being stolen in seconds from driveways. Now, any vehicle that is assessed against the new Thatcham Research Security Rating, and has a vulnerable keyless entry/start system, will automatically not achieve the best rating.
“Security has come a long way since vehicle crime peaked in the early 1990s. However, the layers of security added over the years count for nothing when they can be circumvented instantly by criminals using digital devices. The shame is that most of the cars rated ‘Poor’ would have achieved at least a ‘Good’ rating had their keyless entry/start systems not been susceptible to the Relay Attack.”
The 2019 model vehicles have a security rating of the following:
- Audi e-Tron – Superior
- Ford Mondeo – Poor
- Hyundai Nexo – Poor
- Jaguar XE – Superior
- Kia ProCeed – Poor
- Land Rover Evoque – Superior
- Lexus UX – Poor
- Mercedes B-Class – Superior
- Porsche Macan – Poor
- Suzuki Jimny** – Unacceptable
- Toyota Corolla Hybrid – Poor
**Suzuki Jimny does not have a keyless entry/start system as standard or an option
Billyeald continues: “We are really pleased to see that the latest Audi e-Tron, Jaguar XE, Land Rover Evoque and Mercedes B-Class were all awarded ‘Superior’. These carmakers have made significant strides in addressing keyless entry/start vulnerability, by either switching to a more secure wireless technology or introducing key fobs that go to sleep when idle. This demonstrates that there are solutions and fixes to the problem, which we expect other manufacturers to include on their future models.”
“Our guidance for worried drivers is first and foremost to understand if your vehicle has a keyless entry/start system or not, as it is often an optional extra. If it does, check whether there are solutions available with your key fob – can it be turned off overnight or does it go to sleep when not being used?”
“Faraday shielding pouches can be effective but test them first to make sure they do block the signal. Many are designed for credit cards so make sure they still close fully with a set of keys inside, to ensure maximum effectiveness.”
“Storing all sets of keys, spares included, away from household entry points is also important as it hampers the criminal’s ability to relay the signal.”
“And finally, it may in some cases be possible to turn the system off entirely, so it’s worth checking with your dealer.”
Swift and decisive action against vehicle theft:
Minister for Policing and the Fire Service, Nick Hurd said: “I am determined to take swift and decisive action against vehicle theft. In January I chaired the first meeting of the Vehicle Theft Taskforce, which brought together members of industry and the police to significantly strengthen our response to this crime. In addition to improving vehicle security standards, the Taskforce will work together to ensure that robust measures are in place to prevent criminals exploiting the salvage process, and to stop access to devices that may be used to commit this theft.”
“Having an updated understanding of vehicle security helps the public better understand the theft risk of new cars.
“I welcome the finding in Thatcham Research’s work that some manufacturers are addressing vulnerabilities that exist, and would encourage others to see what more they could do. Together we can reduce the risks to the public that their vehicles will be stolen.”
National Police Chiefs’ Council Lead for vehicle crime, Deputy Assistant Commissioner Graham McNulty comments: “Part of the reason for the recent increase in vehicle theft is the rapid development in technology. While this has dramatically improved the experience of drivers, it has also allowed criminals to exploit weaknesses in electronic security.
“The significant reductions in vehicle crime in the 1990s were achieved by police working with manufacturers to design out crime with innovations like immobilisers, alarms and central locking. This approach is as valid today as it was then and we have been working in partnership with the industry by sharing intelligence and equipment seized from criminals.
“Police chiefs fully support the New Vehicle Security Assessment (NVSA) and the newly announced consumer rating which gives buyers a better understanding of how secure their chosen vehicle is. It’s a positive step towards improving vehicle security and will help us cut the levels of crime as manufacturers continue to develop security measures, in what remains a highly competitive industry.”
Laurenz Gerger, the motor policy adviser at the Association of British Insurers, said: “Car thieves have been having a field day lately. Crime stats show vehicle thefts at their highest level for a decade. Insurers paid out a record £376 million for car theft in 2018, which was partly driven by the vulnerability of some cars to keyless relay theft. Making these assessments public should spur motor manufacturers to take swift action to tackle this high-tech vulnerability. Meantime, consumers deserve to know how secure their cars are, so they can take the necessary steps to reduce the likelihood that they become victims of crime.”
Current theft trends:
The rating is designed to reflect current theft trends, with the new release including the latest digital exploitations, while maintaining the existing mechanical aspects. “It will evolve over time and close loopholes as they appear,” adds Billyeald.
Thatcham Research has been conducting security assessments for insurers on all new and facelifted models launched into the UK since the early 1990s.
Thatcham Research technicians conduct a series of tests, ranging from timed ‘brute-force’ attacks on locks and access points to tests that identify digital vulnerabilities, namely whether the keyless entry/start system is susceptible to the Relay Attack or the On-Board Diagnostic (OBD) Port allows blank keys to be coded.
Cars that fail the keyless entry/start and OBD tests move down a category per failure. The rating applies whether the keyless entry/start system is optional or standard-fit.
The categories are Superior, Good, Basic, Poor and Unacceptable.
Setting the standard:
Cars at different price points have different levels of security. Thatcham Research is also sharing guidance to help drivers understand what they should expect:
Up to 20k – Expected to have fundamental security features, but not some of the extra layers found on higher-priced vehicles. Typically, a car within this value range would include a Thatcham Research certified immobiliser, perimeter alarm, double-locking to all doors, locking wheel bolts and attack-resistant mechanical security.
20-35k – Expected to have high standard security features, but not some of the extra layers found on higher-priced vehicles. Typically, a car within this value range should include the security from the Up to 20k range plus a Thatcham Research certified alarm system.
35k+ – The security should be to the very highest standard. Typically, a vehicle within this value range would include the security from the 20-35k range plus Thatcham Research certified alarm system with a tilt sensor and a Thatcham Research tracking system.
Commenting on the Suzuki Jimny’s ‘Unacceptable’ rating, Billyeald said, “This car falls well below expectation, scoring consistently poorly across all criteria, and missing some fundamental security features that consumers might rightly expect should be fitted.”
Ongoing rating:
Thatcham Research will continue to rate the security of all new vehicles launched in the UK, making the ratings available via its website and its Twitter feed.
