LC500h theft on FB

[BrettMRC]

I wouldn't want it back if it was mine.  😞

Lexus still haven't replied to my enquiry.

[eightk]

What we need is a steel plate like they’re supposedly thinking about making for the RX. And landmines in the wheel arches. I’m sure South Africa has something we can fit…

[Brian R]

Well done Essex police! I suppose a new front bumper isn't the end of the world and before it's fitted, an ideal opportunity to safeguard against another canbus attack.

Great shame this is happening, and really any manufacturer who leaves this access point vulnerable really ought to be sorting this out with some measure of urgency.

[Linas.P]

It is real shame Lexus has not done anything about it yet. This 100% justifies call EVERY SINGLE CAR and retrofitting something that prevents this, I just can't see how it could be passed onto the owners as "acceptable security" of the car.

And don't blame Lexus for making this mistake, but I blame them for not acting as they should in such circumstances... they made mistake they need to solve it. 

I know in UK there is not such thing as "class action lawsuit", but they certainly should face consequences for doing nothing about it. 

And I know argument could be made "why didn't you said the same when they had all keyless entry debacle"... well that is different. First of all, it was inherent flaw with the technology, those attacks didn't damage anything in the car, nor key. In short it was not like they left a security flaw in the design simply that design itself turned out to be vulnerable. Secondly, there was prevention - one could simply disable keyless entry in the car, or put the key in the pouch. Still not ideal, but there were workarounds.

In this case it is 100% security flaw, because there is no reasonable explanation why headlight wiring should have access to can-bus in such a way that it could unlock the car and start the engine. I do understand why that wiring exists, and why it is connected to the can-bus (that is because lights nowadays are so smart that they require dedicated ECU to control), but basic security design should ensure that headlight ECU should not be able to instruct other ECUs to unlock the car, disable immobiliser and start the car, this just shouldn't be possible. And on top of that - no communication line should be easily accessible for outside of the car - good example is Immobiliser in older Lexus models, to access it you need to remove entire dash and ventilation vents, so nobody is accessing that on the driveway in 3 minutes. Following that example, what I am saying is that any such security critical system must be placed in the car in such way that it would require significant time and effort to access them. So in short - Lexus is deficient in two ways here, physical security for access is inadequate and signals are not encrypted, nor security rights properly provisioned for auxiliary functions like headlight control (I guess that makes three ways, but can-bus protocols is by default unencrypted). I guess fundamental mistake here is to allow headlight ECU to be on the same can-bus as the rest of the systems, multiple better designs are available and in fact were used in the past - there are other networks types that could be used on the car, or the car can even have multiple separate can-bus... one high-speed can for critical parts and secondary low-speed can for things like headlights, seat-memory, windows etc. 

[Arth_Vader]

Ive bought a Stoplock Pro Elite.  £50  Nice and big and yellow so the bastards know in advance they will have to work a bit harder if they want it.  

Good deterrent I think - they’d have to get the Stoplock off first before doing the canbus thingy as when they start it it’s pretty noisy 🙂

[eightk]

After Lexus sent the reply I posted above I emailed back with links to the stolen LC, the canbus method on that experts blog etc.

They've replied -

"Thank you kindly for your detailed reply, which is greatly appreciated. I have shared the information from your email with the relevant internal teams in relation to your comments and suggestions of information seen online.

Whilst I do not have any other comments outside of my prior email to share on this, I would like to express my sincere gratitude for your email in the meantime."

Reading between the lines that sounds hopeful. I have a Stoplock Pro now too ☹️

[Linas.P]

Sadly it sounds to me like it is going to go into junk box on Lexus corporate. It is not like they are not aware of the problem - because this affect most new Lexus and Toyota cars, even broader industry, I think these sort of attacks started on Range Rovers, later BMWs and Audi. By now I think BMW/Audi got on top of it so this type off attack is moving to other brands.

What I am saying - if they wanted to fix it, they could... but clearly there is no sufficient risk from alike of class action suits to justify rolling out recall and fixing it. They just decided damage done by theft is lower than damage created by recall, so they clearly need looming risk of $10 billion class action suit before they move the finger. Currently, they are just playing on owners ignorance, because let's face it - 95% of owners will not blame them for the theft and won't realise that part of the reason of popularity of this method is negligent security design from the maker.

I think it is as well a "watershed" moment for them - because issue is so widespread they can't just do few models. If they now admit that say LC and RX, NX are vulnerable and they will be calling them back, then next on the list will be ES... and if ES is on the list then why Toyota Avalon isn't?! In short this would open the gates for owners of all other cars with that vulnerability to start raising the issue as well. I don't believe Toyota is worried about fixing few 100k Lexus, they are afraid that if they admit it is their fault then they will be responsible for fixing tens of millions of Toyotas.

Just good example that "corporate mindset" does not change. This is like exploding Pinto gas tanks - Ford decided it will cost them less money to pay compensation to the families of people who died, than fixing the cars. Toyota doing exactly the same thing and the only difference that this is not fuel tank and likely won't kill anyone, so they just calculated the risks and decided doing nothing is most "cost efficient" way. 

[BrettMRC]

I finally got this reply yesterday:

Quote

 

Dear Mr BrettMRC

Thank you for your email regarding your Lexus LC 500 Black Inspiration.

I am sorry for our delay in response to your email, which expresses genuine concern for the security of your vehicle. We are sorry to hear of your concerns and appreciate the reason for your contact. 

I must confirm that we do not have any internal information on any Lexus LC thefts using the CANBUS attacks you mention or any other method. 

We are certainly aware of the growing trend of vehicle theft across the industry and understand your cause for concern.

Lexus have been developing a prototype protective plate that can be installed into the Lexus RX to help prevent against this new type of attack on vehicles.

At this moment in time, we do not have any dedicated development towards the LC directly in alignment with the protective plate you mention for the RX. We are certainly conscious of the concern around our other models, and can assure you that we are considering different options for our other models.

Once there is further information to share, we will provide this to the Lexus Network. In the meantime, if you have any questions at all, we would be happy to discuss them with you in further detail. 

Please be assured that your concerns and comments are being taken seriously and we are sorry that we are unable to provide a more positive response. 

Kind regards

 

 

This combined with some issues I was having trying to actually get from my house to the main road without a tractor/pickup truck/moron contractor interface lead me to sell the car back to Lexus on monday.

I'll replace it with something smaller, cheaper and easier to live with - not to mention harder to steal.

I cannot believe how apathetic Toyota/Lexus are with these issues.

[BrettMRC]

Another reply:

 

Quote

 

Good afternoon,

Thank you for your reply and for your update.

It is a great pity that you have had to sell your car.  There is always a risk with such an attractive and desirable product that someone wants it, without having to pay for the privilege.

As per my previous reply, we have only just started to see feedback relating to the LC and so it is something which is on our radar.  The most effective method of protecting your car from this type of theft method is a ghost immobiliser, which is not a product we manufacture.  However, we will look to see if any other deterrents can be used as well but this could take some time as this issue appears to be concentrated within London and the M25.  

I really hope that you can look at Lexus again in the future and thank you for bringing this to our attention.

Kind regards

 

 

[Toyota Owner]

It seems Ghost immobiliser is the default answer for Toyota / Lexus customer service & social media enquires 🤔

It shows what faith Lexus UK have in the official Lexus retrofit 2nd immobiliser system 🤣

[Brian R]

8 hours ago, BrettMRC said:

I finally got this reply yesterday:

 

This combined with some issues I was having trying to actually get from my house to the main road without a tractor/pickup truck/moron contractor interface lead me to sell the car back to Lexus on monday.

I'll replace it with something smaller, cheaper and easier to live with - not to mention harder to steal.

I cannot believe how apathetic Toyota/Lexus are with these issues.

Hello Brett

As I recall you've not had the LC for any length of time and I sincerely hope the decision to sell was not based on the "thievability" of the car? It does seem as if navigating the car to the main road was the primary reason, is that correct?

[BrettMRC]

2 hours ago, Brian R said:

Hello Brett

As I recall you've not had the LC for any length of time and I sincerely hope the decision to sell was not based on the "thievability" of the car? It does seem as if navigating the car to the main road was the primary reason, is that correct?

The primary issue is getting safely too and from the adopted roads, driving became incredibly stressful every time due to width etc.

Idiots ripping it to pieces to steal it wasn't an encouraging thought either.

I had it 13 months from new, it's on thr Hedge End approved used section now, a stunning car if anyone is after a black Inspiration.

[rayaans]

On 6/29/2023 at 5:41 PM, eightk said:

Received the above five minutes ago. I have posted on an RX450 theft thread a few times too.. what’s being said on there is something like a Ghost won’t stop canbus theft.
I’m therefore looking at Cat 2 immobilisers - visible flashy led on the dash plus a touch key to get the car started. My tracker has a relay to stop the car starting already but there’s no visible signs it’s been fitted - an extra dash led from the cat 2 should achieve that visibility. Bastards 😂

How would a cat 2 immobiliser stop it if a ghost doesn't? 

As far as I am aware, most security companies have said that ghost would stop the canbus theft as the car would switch off if the engine is started regardless of the method used 

[Toyota Owner]

27 minutes ago, rayaans said:

How would a cat 2 immobiliser stop it if a ghost doesn't? 

As far as I am aware, most security companies have said that ghost would stop the canbus theft as the car would switch off if the engine is started regardless of the method used 

Other immobiliser options available as well

Well I did have a link to a video to show how it works so people could have another option other then Ghost - must upset a forum mod 🤐 I wont bother trying to be helpful in future. 

Im off, nuke my account I wont be back. 

[Brian R]

9 hours ago, BrettMRC said:

The primary issue is getting safely too and from the adopted roads, driving became incredibly stressful every time due to width etc.

Idiots ripping it to pieces to steal it wasn't an encouraging thought either.

I had it 13 months from new, it's on thr Hedge End approved used section now, a stunning car if anyone is after a black Inspiration.

Ah, I now better understand the circumstances. Thanks for the update and as you say someone now has a chance to pick up a very rare car.

[rayaans]

11 hours ago, Toyota Owner said:

Other immobiliser options available as well

Well I did have a link to a video to show how it works so people could have another option other then Ghost - must upset a forum mod 🤐 I wont bother trying to be helpful in future. 

Im off, nuke my account I wont be back. 

Its more likely cos you have a small post count and newish member it might be suspected as advertising 

[BrettMRC]

Was that an actual flounce? 🤪🤣

[eightk]

12 hours ago, rayaans said:

How would a cat 2 immobiliser stop it if a ghost doesn't? 

As far as I am aware, most security companies have said that ghost would stop the canbus theft as the car would switch off if the engine is started regardless of the method used 

I’m only going off what’s been discussed on the RX section. I’ve asked Autowatch - ghost suppliers - if ghost stops canbus attack and they haven’t responded. 
A cat 2 has two physical cuts with relays fitted in the fuel pump, starter, engine coil (remember those?!). You’d need to physically find them and rewire them to start up and drive away.

[eightk]

4 minutes ago, BrettMRC said:

Was that an actual flounce? 🤪🤣

If anyone’s flouncing it’s you with your narrow roads excuse 🤣

[BrettMRC]

Just now, eightk said:

If anyone’s flouncing it’s you with your narrow roads excuse 🤣

Can't argue with that! 🤐🤣

[DavidCM]

Brett-I don't know if you've decided on a replacement yet,butLexus Cheltenham had a new,pre registered RCF V8 a couple of weeks ago.Ehen I spoke to them they seemed v.keen to do a deal..

[BrettMRC]

I may have accidentally purchased a manual supra already... 🤪

[DavidCM]

Good choice.

[Brian R]

1 hour ago, BrettMRC said:

I may have accidentally purchased a manual supra already... 🤪

One of the cars I would seriously consider, albeit I think I warm more to the latest Z4 which of course is basically the same car. I just feel the Supra didn't quite translate from the early mug shots I had on my office calendar. However, given it's a Toyota, I would imagine the reliability will be better than the BMW.

It'll be interesting to hear what you make of it.

[Ruffle]

6 hours ago, BrettMRC said:

I may have accidentally purchased a manual supra already... 🤪

Nice.  Let's hope Toyota have breathed their magic and improved the reliability (SWMBO had a couple of Z4's which delighted in throwing every warning light imaginable at the drop of a hat).