How did my UX get stolen?

Krissy · August 16, 2022

Hi!
Hoping someone clever can help me figure out this conundrum.
Last night someone stole my UX 250h. We heard a loud thud of something solid breaking (not glass) and went to the window when we saw a man wearing a covid mask swiftly start walking away from the car.
Checked the car was ok and still locked and went to sleep.

Woke up in the morning to find the car gone and notifications on My Lexus app saying Hybrid System Malfunction, Sonar System Malfunction, One or more doors unlocked.
Long story short, the location was still tracking so I immediately went there and took the car back. It’s now at the garage to be re-secured but I cannot figure out how they did it.
Both keys were protected in Faraday pouches.
There was some minor damage to the left side front wheel well and guard was sticking out. The plastic panel under multimedia was ripped off. The left indicator was making a double speed noise. That’s about it - no broken windows or doors!

Please share if you know what happened so I can try to keep my car safe when I get it back.

Thank you!

Krissy

NemesisUK · August 16, 2022

Did you report the theft to the Police and inform your insurers?

How far did the 'thief' take it before abandoning it, presumably waiting to see if it had a tracker fitted?

The garage (Lexus dealership?) are to re-secure it. How? Presumably they must know something to be able to do that. Have they not said what they are doing and at what cost to you?

Krissy · August 16, 2022

Yes and yes.
They took it 5 mins down the road. Waiting on the garage to confirm all these details and to be fair they will probably answer all my questions in due course - I’m just being impatient!

Spock66 · August 16, 2022

1 hour ago, Krissy said:

Please share if you know what happened so I can try to keep my car safe when I get it back.

Can't help with how it was done, but I would suggest a high visibility quality steering lock.

Dealkent · August 16, 2022

1 hour ago, Krissy said:

Hi!
Hoping someone clever can help me figure out this conundrum.
Last night someone stole my UX 250h. We heard a loud thud of something solid breaking (not glass) and went to the window when we saw a man wearing a covid mask swiftly start walking away from the car.
Checked the car was ok and still locked and went to sleep.

Woke up in the morning to find the car gone and notifications on My Lexus app saying Hybrid System Malfunction, Sonar System Malfunction, One or more doors unlocked.
Long story short, the location was still tracking so I immediately went there and took the car back. It’s now at the garage to be re-secured but I cannot figure out how they did it.
Both keys were protected in Faraday pouches.
There was some minor damage to the left side front wheel well and guard was sticking out. The plastic panel under multimedia was ripped off. The left indicator was making a double speed noise. That’s about it - no broken windows or doors!

Please share if you know what happened so I can try to keep my car safe when I get it back.

Thank you!

Krissy

Very worrying, I keep our keys in the protective pouch , looks like they can get round that now?

Herbie · August 16, 2022

2 hours ago, Krissy said:

Both keys were protected in Faraday pouches.

Faraday pouches tend to fail after a few months even though there is no visible indication of failure. Test them at least weekly by keeping the fob in the pouch and walk to the car to see if the interior lights come on.

Wrapping the fob in a bit of kitchen foil works well.

Illogan · August 16, 2022

3 minutes ago, Herbie said:

Faraday pouches tend to fail after a few months even though there is no visible indication of failure. Test them at least weekly by keeping the fob in the pouch and walk to the car to see if the interior lights come on.

Wrapping the fob in a bit of kitchen foil works well.

And, when homw, I just keep our keys in a metal biscuit tin!

rayaans · August 16, 2022

They seem to go for the passenger side wheel well a lot. Chances are the ECU is probably located near there

NemesisUK · August 16, 2022

50 minutes ago, rayaans said:

They seem to go for the passenger side wheel well a lot. Chances are the ECU is probably located near there

Or the alarm siren module?

ColinBarber · August 16, 2022

12 hours ago, Illogan said:

And, when homw, I just keep our keys in a metal biscuit tin!

Unfortunately this isn't anything to do with a relay attack with the keys. It is a CAN bus attack - they get to the wiring in the wheel arch and disable alarm/open doors etc. Most modern Toyotas seem to be susceptible - UX, RX, RAV4 etc.

A steering wheel lock is probably going to be the most effective deterrent. Something like a ghost immobiliser would stop them taking the vehicle but they could still do damage before discovering it is immobilised.

ALAW · August 17, 2022

5 hours ago, ColinBarber said:

Unfortunately this isn't anything to do with a relay attack with the keys. It is a CAN bus attack - they get to the wiring in the wheel arch and disabled alarm/open doors etc. Most modern Toyotas seem to be susceptible - UX, RX, RAV4 etc.

A steering wheel lock is probably going to be the most effective deterrent. Something like a ghost immobiliser would stop them taking the vehicle but they could still do damage before discovering it is immobilised.

Would putting the key fob in standby mode and placing it in a fully working Faraday wallet stop the vehicle been stolen.

ColinBarber · August 17, 2022

5 hours ago, ALAW said:

Would putting the key fob in standby mode and placing it in a fully working faraday wallet stop the vehicle been stolen.

No, not with the method used to steal OP’s vehicle.

Looking after your keys will prevent a relay attack theft so it should be done, although using just one of the methods you describe will work, there is no additional security gained by doing both together.

LenT · August 17, 2022

15 minutes ago, ColinBarber said:

No, not with the method used to steal OP’s vehicle.

Looking after your keys will prevent a relay attack theft so it should be done, although using just one of the methods you describe will work, there is no additional security gained by doing both together.

As an additional thought, I’ve fitted Eufy solar powered security cameras and a video doorbell at the front - and indeed at the back - of the house.

Apart from being occasionally entertaining - eg when our cat chased a fox out of the garden - and supplying evidence of an attempted con by an Appliance Direct employee - they do at least let chummy know their actions have not gone unnoticed.

It’s also often the case that the individuals concerned will have visited your drive on previous occasions to check on the model. So such visits may also have been recorded and may provide additional evidence.

PCM · August 17, 2022

14 hours ago, Spock66 said:

Can't help with how it was done, but I would suggest a high visibility quality steering lock.

I do like the idea of such things, ( Steering Locks ) but worry about reviews of some where they have jammed locked or damaged the steering wheel etc.

For those with a driveway and gate-post or similar, driveway alarms are good. e.g.,

(HOSMART 1/2 Mile Long Range Rechargable Wireless Driveway Motion Alarm System Outdoor Weatherproof Motion Sensor & Detector)

and CCTV where practical.

Harrier Man · August 18, 2022

WOW, read an article on CAN Bus attacks, very worrying. However, wondering how they got into the car in the first place to connect into the Bus given that Kristina reported that there were no broken windows or doors. Was this a wireless attack that didn't involve a relay attack with the keys (which were in a Faraday pouch)?

dutchie01 · August 18, 2022

I once read an interview with a car thief about this topic and he said the only time he walked away was when the licence plate number is etched in all the windows. This means he has to replace all windows before selling the car on which is too costly/cumbersome.

If they are in it for the parts though....

NemesisUK · August 18, 2022

2 hours ago, Harrier Man said:

WOW, read an article on CAN Bus attacks, very worrying. However, wondering how they got into the car in the first place to connect into the Bus given that Kristina reported that there were no broken windows or doors. Was this a wireless attack that didn't involve a relay attack with the keys (which were in a Faraday pouch)?

On 8/16/2022 at 7:14 PM, ColinBarber said:

Unfortunately this isn't anything to do with a relay attack with the keys. It is a CAN bus attack - they get to the wiring in the wheel arch and disable alarm/open doors etc. Most modern Toyotas seem to be susceptible - UX, RX, RAV4 etc.

A steering wheel lock is probably going to be the most effective deterrent. Something like a ghost immobiliser would stop them taking the vehicle but they could still do damage before discovering it is immobilised.

J Henderson · August 18, 2022

On 8/17/2022 at 6:53 AM, LenT said:

video doorbell

It seems thieves can also signal block these to prevent them recording.

Someone on a local FB group reported that a gang of thieves had attempted to steal their car, and that their Ring doorbell had been blocked and hadn't recorded any footage of the event. 🤔

LenT · August 18, 2022

1 hour ago, J Henderson said:

It seems thieves can also signal block these to prevent them recording.

Someone on a local FB group reported that a gang of thieves had attempted to steal their car, and that their Ring doorbell had been blocked and hadn't recorded any footage of the event. 🤔

I’ll see if I can get Eufy to comment on this!

PCM · August 19, 2022

12 hours ago, J Henderson said:

It seems thieves can also signal block these to prevent them recording.

Someone on a local FB group reported that a gang of thieves had attempted to steal their car, and that their Ring doorbell had been blocked and hadn't recorded any footage of the event. 🤔

I assume it's a comment referring to 'blocking' wi-fi?

https://www.cnet.com/home/security/can-burglars-jam-your-wireless-security-system/

J Henderson · August 19, 2022

I'm guessing so as that's how those doorbells work, right? (WiFi).

LenT · August 19, 2022

On 8/18/2022 at 5:44 PM, dutchie01 said:

I once read an interview with a car thief about this topic and he said the only time he walked away was when the licence plate number is etched in all the windows. This means he has to replace all windows before selling the car on which is too costly/cumbersome.

Many years ago (!) I was in a BMW dealership in Leicester taking delivery of a new convertible. The sales guy was taking me round the car for the handover.

As part of their customer service, he explained, they had etched the reg number into all the glass - free of charge.

“An excellent idea,” I said. “But shouldn’t that number be the same as the one on the number plates?” I remarked.

I left him to sort it out.

ColinBarber · August 19, 2022

On 8/18/2022 at 8:52 PM, J Henderson said:

It seems thieves can also signal block these to prevent them recording.

Someone on a local FB group reported that a gang of thieves had attempted to steal their car, and that their Ring doorbell had been blocked and hadn't recorded any footage of the event. 🤔

Ring doorbell Elite with wired Ethernet connection would solve that, but 99% of them out there are 2.4 GHz wifi only models which are easy to block. Some of the newer models have 5 GHz wifi too but could still be blocked.

Hillie · August 19, 2022

Wireless (Wi-Fi, BLE, Zigbee, Cellular) or other can all be blocked with the right frequency jammer. Wired Ethernet or other wired connection is harder to defeat, but IMO, they could just as easily have used a piece of electrical tape and covered the lens or whole device, removing it when they left.

I have an interest in this topic as various local social media groups (NextDoor, Facebook, etc) close to me are reporting an up-tick in late night suspicious activity, posting cctv pictures of attempted relay attacks in this area. No reports yet of CAN Bus attacks but in the last few years there have been a multitude of catalytic converter thefts as well. (and Toyota was most targeted). With the current economic situation worsening and rising costs affecting everyone, I am also certain that the sticky fingered within our society will be even more active in coming months.

Although my NX is not due to be deliverred till end of year, I am installing some Reolink 8MP camera's high up on my house wall that over look my garage and drive way now. These cameras will be the hardwired with PoE and have some over lapping coverage for redundancy. When discussing the camera installation locations and area of coverage with my neighbour out of courtessy and respect for their privacy, they actually asked me to increase the coverage and eliminate the recording masks to also partially cover their drive. It turns out they are also concerned for the same reasons.

I am also looking at a hardwired Door Bell/Camera with fish eye lens if I can find a way to route the cable relatively easily.

Overkill maybe, piece of mind most certainly.

Herbie · August 19, 2022

59 minutes ago, Hillie said:

I am installing some Reolink 8MP camera's high up on my house

They don't want to be too high - you need to get the little scrote's faces.

The two photos below were just captured from my system a few minutes ago. I've had to reduce the file sizes but they're from Hik-Vision Color-Vu 4MP PoE cameras: