ES300H TAKUMI - wheel arch CAN BUS theft

[Huwge]

40 minutes ago, wendle said:

I have had a Ghost fitted from new, 2017, i haven't had any problems, if it will stop the latest way's cars are now stolen i don't know, something you would have to look into.

 

It doesn't stop the damage being caused though, that's a benefit of a visible deterrent..to hopefully send them on to someone else's car

[Mincey]

Quick tip for anyone using a Stoplock, Make sure that your steering wheel is straight. I park on the driveway with my wheels at full lock because I'm lazy and don't straighten them. I put the lock on last night and the yellow sticky out bit was resting near the gear lever. I turned the car on before taking the lock out. Imagine my panic as the wheel came out from its resting position and the yellow sticky out bit met the gear lever. The wheel continued to move, pushing the rest of the sticky out bit onto the horn. "Oh dear" I said as I tried frantically to unlock the device whilst the horn blared...

[Mincey]

On 4/19/2023 at 5:13 PM, 08ISF said:

I bypassed Customer Services and went straight to their CEO. If you get a BS reply from Customer Services, write to Chris Hayes at Lexus UK Head Office. It worked for me!

I've just emailed chris.hayes at lexus.co.uk and will report back with any updates.

[beyond the blue]

23 hours ago, Mincey said:

Quick tip for anyone using a Stoplock, Make sure that your steering wheel is straight. I park on the driveway with my wheels at full lock because I'm lazy and don't straighten them. I put the lock on last night and the yellow sticky out bit was resting near the gear lever. I turned the car on before taking the lock out. Imagine my panic as the wheel came out from its resting position and the yellow sticky out bit met the gear lever. The wheel continued to move, pushing the rest of the sticky out bit onto the horn. "Oh dear" I said as I tried frantically to unlock the device whilst the horn blared...

Was that the "Oh dear" that begins with "F"?

[Slucky]

Sorry to hear about the theft. I have an ES too and looking to build a CAN bus fix. 

The below article gives a very good understanding of how CAN injection works. 

https://kentindell.github.io/2023/04/03/can-injection/#:~:text=The way CAN Injection works,Key validated%2C unlock immobilizer”.

[Mincey]

14 hours ago, beyond the blue said:

Was that the "Oh dear" that begins with "F"?

That exact one!

[Julncamp54]

Thank you for that link .

fascinating . A very detailed analysis of the car systems. Very complicated to understand though .

[Slucky]

1 hour ago, Julncamp54 said:

Thank you for that link .

fascinating . A very detailed analysis of the car systems. Very complicated to understand though .

It looks complicated, but the overall structure is quite simple compared with the large amounts of wires in the old days.

The Controller Area Network (CAN bus) is the nervous system, enabling communication.

The 'electronic control units' (ECUs) are like parts of the body, interconnected via the CAN bus. Information sensed by one part can be shared with another.
The CAN bus system enables each ECU to communicate with all other ECUs - without complex dedicated wiring.
An ECU can broadcast information (e.g. sensor data) via the CAN bus, consisting of two wires, CAN low (L) and CAN high (H). The broadcasted data is accepted by all other ECUs on the CAN network - and each ECU can then check the data and decide whether to receive or ignore it.

Looking at the device in the article. It seems the way these thefts are taking place is by accessing the CAN H wire and using a P-Channel FET device to send the signals necessary to confuse the system and gain access into the vehicle.

In software similar to SQL injection attacks, networking Denial of Service (overloading a network node by rapid requests) and this CAN bus attack has elements of both.

[Cs150]

Outcomes in summary from the detailed article were. The systems were not designed explicitly with security in mind and not secure by default. Manufacturer not willing to engage in a proactive way at this time for resolution.

[peniole]

On 4/19/2023 at 5:54 PM, e-yes said:

Which email address should we be sending this email to Peniole ?

Thanks,

--E

Sorry E, been off a few days. I emailed my contact at our local Lexus dealer in Preston, he further raised it himself with head office. If you have a trusted contact at yours I'd do that, otherwise as others have done above straight to head office.

[avenue4555]

My mum's ES was stolen last week.  Thieves took about ten minutes, ripped the bumper off, played with some gizmo, the car unlocked and off they went.  Just a few weeks prior she had contacted Lexus concerned after some media reports but they assured her it was the RX and NX that were being targeted and not to worry with the ES.

She has now written to the CEO.  At the very least they should inform customers of a vulnerability coupled with a seismic increase in thefts, so that owners can take steps like buying the immobilizer, better tracking (thieves have disabled the WiFi so it still thinks it's parked outside her house) or even just hiding an Airtag somewhere.

[peniole]

9 hours ago, avenue4555 said:

My mum's ES was stolen last week.  Thieves took about ten minutes, ripped the bumper off, played with some gizmo, the car unlocked and off they went.  Just a few weeks prior she had contacted Lexus concerned after some media reports but they assured her it was the RX and NX that were being targeted and not to worry with the ES.

She has now written to the CEO.  At the very least they should inform customers of a vulnerability coupled with a seismic increase in thefts, so that owners can take steps like buying the immobilizer, better tracking (thieves have disabled the WiFi so it still thinks it's parked outside her house) or even just hiding an Airtag somewhere.

Sorry to hear that. Where was it taken from?

[Mincey]

10 hours ago, avenue4555 said:

My mum's ES was stolen last week.  Thieves took about ten minutes, ripped the bumper off, played with some gizmo, the car unlocked and off they went.  Just a few weeks prior she had contacted Lexus concerned after some media reports but they assured her it was the RX and NX that were being targeted and not to worry with the ES.

 

"Firstly I must thank you for your email and prudent request for advice in this situation with a view to protect your investment. The Lexus ES model is not one that we have seen any volume of being targeted - however we cannot say with certainty that it may not be attacked, as regrettably we cannot assume to know the motivations or indeed limits of the technology being used by current organised criminals."

That's two or three stolen here now isn't it? I've not heard anything yet from the CEO. I'll revert to snail mail if nothing has arrived by the end of the week.

[HotSpur-Lexus]

This is a serious worry. 

How much of a problem is this, i.e. are you guaranteed to lose your Lexus as a result, I mean are they all going missing or is it small numbers - not sure if that is the right question, but worried as I have a new to me (2021) ES coming this week and all of a sudden read issues like this - spoke to a car security company and they say its not just Lexus but all cars, and Range Rover's are worse, but I get paranoid and wonder if you have to be unlucky for it to go or is it just a matter of time? My neighbour has a Range Rover and it has been safe for several years, and the amount of RR-Sport's you see on the road to me indicates its a small number so in comparison it makes me feel a bit better - but not sure how to feel?

[avenue4555]

1 hour ago, peniole said:

Sorry to hear that. Where was it taken from?

Thanks, she is in North-West London.

12 minutes ago, Mincey said:

"Firstly I must thank you for your email and prudent request for advice in this situation with a view to protect your investment. The Lexus ES model is not one that we have seen any volume of being targeted - however we cannot say with certainty that it may not be attacked, as regrettably we cannot assume to know the motivations or indeed limits of the technology being used by current organised criminals."

That's two or three stolen here now isn't it? I've not heard anything yet from the CEO. I'll revert to snail mail if nothing has arrived by the end of the week.

That is the sort of reply we are expecting.  If we hear anything, I will post it here.  

She is not sure what to do now about replacing the car.  It looks like Lexus (if she opts for it again!) still have a waiting period of a several months for the ES, so she will be without a car potentially for a while.

[HotSpur-Lexus]

15 minutes ago, avenue4555 said:

Thanks, she is in North-West London.

That is the sort of reply we are expecting.  If we hear anything, I will post it here.  

She is not sure what to do now about replacing the car.  It looks like Lexus (if she opts for it again!) still have a waiting period of a several months for the ES, so she will be without a car potentially for a while.

 

Would she not consider a used one or ex-demo model?

[essexguy]

Sadly with the upsurge in Lexus cars being stolen, i have decided its just not worth the worry or grief of owning one. 

I will be Part exchanging my 7 week old ES for something less desirable to thieves.

Its a shame that Lexus dont seem to be taking that much interest in the problem. 

Lets hope not too many people are  put off buying their cars over this .

[Slucky]

4 hours ago, HotSpur-Lexus said:

This is a serious worry. 

How much of a problem is this, i.e. are you guaranteed to lose your Lexus as a result, I mean are they all going missing or is it small numbers - not sure if that is the right question, but worried as I have a new to me (2021) ES coming this week and all of a sudden read issues like this - spoke to a car security company and they say its not just Lexus but all cars, and Range Rover's are worse, but I get paranoid and wonder if you have to be unlucky for it to go or is it just a matter of time? My neighbour has a Range Rover and it has been safe for several years, and the amount of RR-Sport's you see on the road to me indicates its a small number so in comparison it makes me feel a bit better - but not sure how to feel?

On the dark web, apparently website lists the models of cars ‘supported’ by the theft device: Lexus models including the ES, LC, LS, NX, RX and Toyota models including the GR Supra, Prius, Highlander, Land Cruiser - and RAV4.

The prices are up to €5000 for one one these devices. There are products targeting many car models, including from Jeep, Maserati, Honda, Renault, Jaguar, Fiat, Peugeot, Nissan, Ford, BMW, Volkswagen, Chrysler, Cadillac, GMC - and Toyota.

So not only Lexus, so best to use a wheel lock or any deterrent to make it harder for these criminals.

I use a Stop lock pro and a Wheel clamp till I fix a solution on the CAN Bus theft.

 

[Cs150]

1 hour ago, essexguy said:

Sadly with the upsurge in Lexus cars being stolen, i have decided its just not worth the worry or grief of owning one. 

I will be Part exchanging my 7 week old ES for something less desirable to thieves.

Its a shame that Lexus dont seem to be taking that much interest in the problem. 

Lets hope not too many people are  put off buying their cars over this .

A shame but understandable, Lexus reputation is taking a serious downturn and it has taken them decades to get to where it was. Reputations are easy to lose but very hard to build up. Cannot help think if it is Lexus UK rather than the global Lexus brand that is the problem. It seems as if the UK element of the business simply has poor management and people not fit to hold the positions in my interaction with them.

[Dippo]

This has been known about in Japan for some time - this article is dated September 2021:

https://japantoday.com/category/crime/japanese-police-struggling-with-growing-number-of-'can-invaders'-used-to-steal-luxury-cars

[Slucky]

I will also be using similar one of these to attach it o the inside door handle to add more security, since once the CAN bus is compromised, all alarms would be turned off.

https://www.amazon.co.uk/Wireless-Door-Handle-Alarm-Intruder/dp/B01BNLDBCI/ref=sr_1_12_sspa?keywords=door+alarm+sensor&qid=1682349786&sprefix=door+%2Caps%2C90&sr=8-12-spons&sp_csd=d2lkZ2V0TmFtZT1zcF9tdGY&psc=1

 

[GMB]

 

I was concerned about the theft of fine cars like mine especially because if they took my Wartburg it would never be found in the smokescreen that it leaves behind it. No-one has attempted to steal it. In fact no-one even looks at it. I don't understand when it is such a desirable dream car. 

 

It sounds like it had a King Prawn Madras the night before.

 

[beyond the blue]

2 hours ago, GMB said:

Wartburg??? Sounds more like a Warthog.

I was concerned about the theft of fine cars like mine especially because if they took my Wartburg it would never be found in the smokescreen that it leaves behind it. No-one has attempted to steal it. In fact no-one even looks at it. I don't understand when it is such a desirable dream car. 

 

It sounds like it had a King Prawn Madras the night before.

 

[Cs150]

Those that have emailed Chris Hayes has anyone got a response? My message had no acknowledgement of receipt and simply radio silence. Not a great way to deal with people that have invested significant sums in an asset made by the company. More "premium" service shown by the maker. Anyone had any form of response?

[Mincey]

3 minutes ago, Cs150 said:

Those that have emailed Chris Hayes has anyone got a response? My message had no acknowledgement of receipt and simply radio silence. Not a great way to deal with people that have invested significant sums in an asset made by the company. More "premium" service shown by the maker. Anyone had any form of response?

No nothing here either. I will write to him via snail mail at the weekend.