ES300H TAKUMI - wheel arch CAN BUS theft

[LenT]

29 minutes ago, johdhm said:

and went to look it up in the manual.  Not under 'Opening and closing the doors'.  Go figure........

The Manuals do seem to be a touch idiosyncratic when it comes to indexing.  You also have to watch out for American spellings when using the Search facility!

[ColinBarber]

1 hour ago, johdhm said:

I was surprised to find that my UX (keyless entry) doesn't deadlock unless you touch the handle twice within 5 seconds.  I only discovered when I accidentally touched it twice, heard a second 'clunk', and went to look it up in the manual.  Not under 'Opening and closing the doors'.  Go figure........

All Lexus models are the same - deadlock is dangerous if you lock it when someone is in the car, hence why you need to double press to prevent you doing it accidentally. It only protects against someone smashing the window anyway - that isn't how vehicles are being stolen so offers no protection.

[Dippo]

it does seem strange that Lexus are advising their customers to buy locking boxes for their OBD ports. How many of their customers do they think are going to access the ports? They are there for Lexus, and they are the ones who should make sure they are are secure.

[shapiro]

3 hours ago, johdhm said:

Interesting there are 75 comments on the car security page.

I was surprised to find that my UX (keyless entry) doesn't deadlock unless you touch the handle twice within 5 seconds.  I only discovered when I accidentally touched it twice, heard a second 'clunk', and went to look it up in the manual.  Not under 'Opening and closing the doors'.  Go figure........

This won’t save you from a canbus attack.

Once they access the wheel arch, with a £10 widely available device, they can basically talk to the brains of your car and tell it do what they want… control all systems, locked, deadlocked, without key, it simply does not matter. The flaw in the system is that bad.

Hence the outrage on many of these forums. It’s recall worthy. Especially as the root cause, in my opinion, is negligent design that is inherently flawed. For the RX, at least they are passively offering some physical deterrents, which is a small step in the right direction albeit it too slow and passive, especially for a customers possession that could cost ££££.

And to my knowledge nothing exists for LCs or NXs…

[ColinBarber]

2 hours ago, Dippo said:

They are there for Lexus, and they are the ones who should make sure they are are secure.

When a new car is type approved for sale, vehicle regulations means the OBD port must be within 1m of the steering wheel with no requirement for a tool to access it (I.e. if it is covered up it must just be a pull away panel).

[mister_johnn]

Unfortunately the car didn't have a tracking system and not sure with what I'm going to replace it... I haven't slept all night thinking how can I get it back... Did a few posts on social media, looked around the area in case they left it on a side road, knocked on doors around the location where the car was parked and nobody had seen anything or had CCTV... After some research found this:

https://www.lexus.com.au/connectivity/lexus-connected-services-faq#:~:text=Stolen Vehicle Tracking (SVT) is,to either continue%2C or discontinue.

It seems that this service is offered free for 3 years in Australia (possible also in US) and to be able to track it using this system you only need the VIN and and police reference number... Why this isn't available in the UK? I'll try to contact Lexus to find out more...

I do hope that they can find it... I have a hidden dashcam in the rear view mirror which can record around 24 hours whilst the car is powered on... Unfortunately everything is stored locally...

[LenT]

18 hours ago, Mincey said:

You'd think they'd not copy and paste their replies, wouldn't you...?

Quite right, James.  It simply reinforces the impression that they are inundated with the same complaints - compounded by the lack of an effective response in the first place!

Of course it maybe the case that the individual(s) responding on behalf of Lexus simply don’t have any effective answers.  It may even be that the sudden rise of new Lexus models up the stolen vehicle theft chart is not that they are more vulnerable than other makes, but that they are more desirable as cars! 

No consolation to the victims, of course.  In such circumstances, buying a replacement Lexus seems to be a triumph of hope over experience - a description once applied to divorce!

[Guest]

1 hour ago, mister_johnn said:

Unfortunately the car didn't have a tracking system

I didn’t fit a tracker, mine was traced using the Lexus link app, did you have that?

[peniole]

Even if he didn't activate the sim/link app. Surely lexus can do that remotely in an emergency or theft especially if you have a police crime reference number.

[Seekerr]

7 hours ago, Derant said:

t fit a tracker, mine was traced using the Lexus link app, did you have that?

Could shout with this, hope it gets sorted.

[mister_johnn]

Just a quick update... I contacted Lexus and they suggested sending an email to privacy@tgb.toyota.co.uk explaining the situation, done... just received a reply saying that only the police can request this information in the UK... I'm assuming is because GDPR in UK (or Europe)... in Australia (maybe US), this service is included for free in the first 3 years of ownership, and if the vehicle is stolen they only need the VIN and crime reference number to send you the location of the vehicle... I've sent an update to the case to the police and I hope they will send that email to Toyota... I'm sure that if they track my car, then there's a big chance of finding more stolen cars... so fingers crossed...

[Guest]

Received a response from Lexus regarding my stolen ES

 

Thank you for contacting Lexus UK. 

We are sorry to read of the reason for your contact and appreciate that this must have been a very upsetting experience for you. We understand this situation is hugely frustrating and would like to extend our deepest sympathies that you have been affected by this behaviour of criminals, especially as this was your retirement gift.

Regrettably, we must report that there is very little vehicle manufacturers can physically do to prevent this criminal activity. This is despite our and other premium brands having some of the most sophisticated security systems. These criminals are unscrupulous and have and will continue to target premium vehicles of many different brands because of their innate value and desirability.

Sadly criminals do and will, find new ways to exploit and attack any existing design and we assure you that future designs keep this activity in mind.

Unfortunately, at the present moment we are unable to provide a solution to this but please be assured that this is being treated as an utmost priority within Lexus and your concerns and comments are being taken seriously.

In closing, we are very sorry to loose you as a Lexus customer and regret that we are unable to provide a more positive response on this occasion. 

Kind regards

[shapiro]

Good luck and keep us posted.

[Cs150]

2 hours ago, Derant said:

Received a response from Lexus regarding my stolen ES

Regrettably, we must report that there is very little vehicle manufacturers can physically do to prevent this criminal activity. This is despite our and other premium brands having some of the most sophisticated security

Encrypting the Canbus would be a good start so that the vehicles cannot be stolen with a £10 device....

[shapiro]

I think you respond saying, “good news, I’ve found you a solution. Encrypt the messages flowing across the canbus, and update any control modules it’s talking to. when can you book me in for a fix?” 

[NICO1972]

I am sorry to hear this. I had 2 attempted thefts on my ES300h (2019 premium edition) and luckily both attempts (mid Sept and mid Oct) failed because my car has metatrak plus immobiliser fitted in. but they damaged the bumper and the loom cable. So I only got the car back last week (5 weeks without it) Thursday from repair (adaptor was replaced and new bumper was fitted in) and immediately exchanged it with another car and this time, I bought AUDI A6 AVANT Black edition Quattro S Line 2018. I am super happy with this new car and I got Metatrak plus fitted in too. Lexus is in serious trouble in my opinion as these kind of thefts with loom cable will continue to happen (even to newer models that have encrypted canbus system to prevent successful theft) and owners will risk one losing their car or have it damaged. I also suspect that the value of the ES will depreciate much quicker in the near future when people will know how risky the cars are. There could be an issue with insurances from even refusing to insure Lexus cars if thefts continue to rise...

[NICO1972]

It is so frustrating and I feel for anyone who has had their ES stolen or almost stolen. Lexus really needs to work on a fast solution or they will be losing customers quickly... 

[mister_johnn]

Just wanted to add a quick update... Toyota has followed up with an email in which they confirm that the car has been fitted with an embedded SIM, therefore there is a possibility that the vehicle can be tracked... they are only waiting for the police to request the tracking... I've sent another email to update the police... quite a few days passed and chances of finding it are dropping fast, by now the car might have been shipped to another country or dismantled for parts... I know that if the car doesn't have any power, then it can't be tracked... but maybe the location where the car was taken might give them away... I know is a long shot, but I'm still hopeful...

[shapiro]

Fingers crossed. Do you actually want it back though? Notwithstanding the hope that the scumbags who stole it get what’s coming to them…

[NICO1972]

Sad to hear your story with stolen car. It breaks my heart that these scums are getting away with murder so to speak. I did not hear back from the Police about my attempted thefts even though I gave them the plate and make of their vehicle that thieves were caught driving away... I know that it could be a stolen vehicle but still,  there is a huge problem and it is getting worst and worst. We are paying the price collectively with increase insurance costs....

[Vadim]

Have my car stolen same way recently. The party did not hit the record by far and took whole 4 minutes from arrival to departure - all in front of a visible CCTV system.

 

After the insurance procedures were followed the car was registered as stolen, and any car check clearly shows that.

 

I was wondering where these cars go in such quantities with right side drive and “stolen” mark? It should be quite easy to spot the export flows in form of cars or parts. The UK market is not large enough to sell that as spares due to reliability of these cars and cheaply extended dealer warranty which forces to use dealer-supplied parts.

Oh, actually many parts are officially supplied as remanufactured (like hybrid batteries). Just a random thought…

Lexus never again unless they acknowledge the problem, apologise and see into a solution.

[PDM]

On 11/19/2023 at 3:35 PM, shapiro said:

I’ve just asked for some advice for the LC500. I’m guessing they too can be gone in second seconds.

 

Let’s see if they make the directors cut. 

Your comments are now live on that Lexus web page, with the usual informative reply from our favourite car maker!

[Vadim]

It appears that the wheel arch can bus method may work by attaching a booster for key fob signal to make computer see the key from where it is at owners property nearby.

 This video suggests there is a way to disable key fob signal broadcasting:

 

[NemesisUK]

The handbook shows how to disable the remote fob signal...

[PDM]

10 hours ago, Vadim said:

It appears that the wheel arch can bus method may work by attaching a booster for key fob signal to make computer see the key from where it is at owners property nearby.

 This video suggests there is a way to disable key fob signal broadcasting:

 

These are two theft methods. The key fob boosting I'd called a relay attack. The CANbus method doesn't require the key at all.