Lexus UK statement on vehicle theft - RX continued

[GSLV6]

I was told this morning (cannot state who, but it's a reliable source) that all dealers are being contact within the next two weeks to start rolling out the long overdue canbus fix.  As many of us suspected, whilst they cannot (not permitted) give out exact details until then, it will include a Ghost Tracker and some form of additional immobiliser.  Who, exactly, pays for the tracker subscription hasn't been announced yet. 

It is finally happening folks so hopefully insurance premiums next year will become more realistic...

[Derfo]

There is hope!

 

[PDM]

1 hour ago, GSLV6 said:

I was told this morning (cannot state who, but it's a reliable source) that all dealers are being contact within the next two weeks to start rolling out the long overdue canbus fix.  As many of us suspected, whilst they cannot (not permitted) give out exact details until then, it will include a Ghost Tracker and some form of additional immobiliser.  Who, exactly, pays for the tracker subscription hasn't been announced yet. 

It is finally happening folks so hopefully insurance premiums next year will become more realistic...

I was rather hoping it would be a fix to the CAN injection issue directly, and hence stop thieves opening the doors.  An immobilizer will not stop them unlocking the car using CAN injection, will it?

[RONNIE W HODGEKINSON]

46 minutes ago, PDM said:

I was rather hoping it would be a fix to the CAN injection issue directly, and hence stop thieves opening the doors.  An immobilizer will not stop them unlocking the car using CAN injection, will it?

Paul.. Even Fitting This plate To Protect The Headlight Wiring from being Accessed The Car is Still Suseptable in other Places To Carry out the same Procedure to Gain Access to the Car..The Empirical Problem is down to the software which prevents access Whenever the cars Wiring is Breached..That's what lexus Ought to be Focusing On..!!!!

[PDM]

2 minutes ago, RONNIE W HODGEKINSON said:

Paul.. Even Fitting This plate To Protect The Headlight Wiring from being Accessed The Car is Still Suseptable in other Places To Carry out the same Procedure to Gain Access to the Car..The Empirical Problem is down to the software which prevents access Whenever the cars Wiring is Breached..That's what lexus Ought to be Focusing On..!!!!

Totally agreed, Ronnie.

[RONNIE W HODGEKINSON]

4 hours ago, Derfo said:

There is hope!

 

Actually.. There is NO HOPE as long as Lexus are not Focusing on the Current Software Which Prevents These Canbus Attacks and Thefts..In My Opinion Until They get this Update And Quickly All lexus Cars are Vulnerable.. My Opinion Only Of Course.!!!!

[Spock66]

Until we get some hard facts this is all just speculation on what if anything Lexus plan to do.

[GSLV6]

It's a bit more than mere speculation.  It's rock solid confirmation from someone at Lexus.  There's no way any manufacturer these days will move away from canbus, it's in everything these days.  Software fixes as I understand it, are not possible with the current ECU as they don't employ a separate security systems ecu, meaning that any software fix can (eventually with the right software hack) be hacked via the canbus system.  The only solution, other than a complete redesign and implementation of a dual canbus with separate security ECU linked to start up, doors etc, is apparently to introduce a means of immobilisation separate to the main canbus, which makes perfect sense and will (hopefully) prevent theft.  In effect, it's not hackable unless some form is access is possible via the OBD port but even then, the proprietary software should be designed and coded to avoid hack attacks.  I don't see what else they can really do.  That, the steel plates, a tracker and separate immobiliser are more than most vulnerable makes are provided with.  Let's wait and see.  For now, sensible steps include a steering wheel lock and to disable your wireless access so the key is needed.  It takes seconds to do using the buttons on your key fob which are pressed in a certain order (see you tube for details).

[Sybaris]

Run canbus cables and protect connectors in steel armoured conduit.  Make it so that it would take hours to get to the cables.  They could rewrite software too.  They just need some clever developers.  Or we should point out to thieves to go after the cars on the deserted forecourts of dealerships, that will get them moving.

[Masiv44]

I had mine done four weeks ago, and was told that they had done a related software update. 

[PDM]

9 hours ago, GSLV6 said:

It's a bit more than mere speculation.  It's rock solid confirmation from someone at Lexus.  There's no way any manufacturer these days will move away from canbus, it's in everything these days.  Software fixes as I understand it, are not possible with the current ECU as they don't employ a separate security systems ecu, meaning that any software fix can (eventually with the right software hack) be hacked via the canbus system.  The only solution, other than a complete redesign and implementation of a dual canbus with separate security ECU linked to start up, doors etc, is apparently to introduce a means of immobilisation separate to the main canbus, which makes perfect sense and will (hopefully) prevent theft.  In effect, it's not hackable unless some form is access is possible via the OBD port but even then, the proprietary software should be designed and coded to avoid hack attacks.  I don't see what else they can really do.  That, the steel plates, a tracker and separate immobiliser are more than most vulnerable makes are provided with.  Let's wait and see.  For now, sensible steps include a steering wheel lock and to disable your wireless access so the key is needed.  It takes seconds to do using the buttons on your key fob which are pressed in a certain order (see you tube for details).

So this will not stop them opening the doors with the CAN injection?  

[eightk]

Rewriting the canbus system is next to impossible from the little I understand.

Steel canbus plates are a pathetic solution that could be got around in seconds with a bit of practice... or they'll just find another access point.

If they are proposing a proper Thatcham fob-type immobiliser that isolates an ecu, fuel pump, brake pedal light or similar that's what I've got on my LC (plus an S5 Scorpion tracker amongst other things), and it's what I've been suggesting all along, provided installations cover a range of circuits and locations - it'd be pointless every Lexus having the same immobiliser relay in exactly the same place!

They could still get into my car via canbus, but finding which circuit has been immobilised would take many minutes if not hours to locate and rewire.

And it's taken, what, 4 months to come up with this 30 year old 'solution'?!

They'd better not be suggesting we pay for it.

[GSLV6]

9 hours ago, Masiv44 said:

I had mine done four weeks ago, and was told that they had done a related software update. 

I was informed yesterday that UK dealers wouldn't be getting the software or trackers for another two weeks so they may be doing a roll out distribution by area?

[GSLV6]

7 minutes ago, eightk said:

Rewriting the canbus system is next to impossible from the little I understand.

Steel canbus plates are a pathetic solution that could be got around in seconds with a bit of practice... or they'll just find another access point.

If they are proposing a proper Thatcham fob-type immobiliser that isolates an ecu, fuel pump, brake pedal light or similar that's what I've got on my LC (plus an S5 Scorpion tracker amongst other things), and it's what I've been suggesting all along, provided installations cover a range of circuits and locations - it'd be pointless every Lexus having the same immobiliser relay in exactly the same place!

They could still get into my car via canbus, but finding which circuit has been immobilised would take many minutes if not hours to locate and rewire.

And it's taken, what, 4 months to come up with this 30 year old 'solution'?!

They'd better not be suggesting we pay for it.

I believe that the solution is a combination of what you have done with some software updates.  I understand that it's a Ghost tracker/immobiliser they're using.

 

If they dare charge....we all have it in our interests to shout very loudly and involve the press.

[eightk]

Ghost themselves only do a canbus system immobiliser, so the tracker side will be something like one of these.

Ghost is cheap, easy to fit and doesn't need much soldering or messing with the car's wiring like a relay inserted into a loom does.

Downside : it's potentially not infallible - how accurate that post is I dunno, but my guess is a Ghost isn't hack-proof. I know installers are given a couple of locations to fit the thumbdrive sized Ghost unit - if found eg under the drivers door sill trim like on the Audi I had - it can be ripped out in seconds.

Mine's a Scorpion S5 tracker with an immobiliser upgrade that physically cuts a circuit like the Cat 2 immobilisers from decades ago. More work, but harder to get around. Keep it old school 😎

[Brian R]

52 minutes ago, eightk said:

Mine's a Scorpion S5 tracker with an immobiliser upgrade that physically cuts a circuit like the Cat 2 immobilisers from decades ago. More work, but harder to get around. Keep it old school 😎

Similar to what I was thinking and wondering whether I could fit a kill switch to the fuel pump or to be more precise my son could fit. Having said that, mine goes in for its service on July 12th which in theory is just beyond when the Lexus solution is supposed to be available.

[GSLV6]

Whatever they come up with, no system is infallible, but a combination layered system using plates, immobiliser, tracker and decent steering lock will make it an unattractive enough proposition not to bother with, unlike Landrovers/Rangerovers/Kias/Hyundais/Porche cars all of whom don't seem to have addressed their vulnerabilities yet.  Theives would have to be tooled up to deal with all of those things making it a lot longer than a 40 second getaway, and a noisy affair at that.  Chances of being caught are probably too great for them to bother. Statistically, even a decent steering lock would put off most of them.  They'l always take the easier option as it's low risk.

[Pinkfish]

Many have fitted mechanical immobilisers - because the Lexus security system is not fit for purpose.  This will put off many thieves, and mean the number of thefts will decrease, which will slowly feed through to our insurance premiums. Sadly, this will not help the folk who have to renew in the next few months - all of which will take huge hits. 

Lexus has done too little to late - they did not even bother to warn us about the vulnerabilities.  

[Pinkfish]

2 hours ago, GSLV6 said:

I believe that the solution is a combination of what you have done with some software updates.  I understand that it's a Ghost tracker/immobiliser they're using.

 

If they dare charge....we all have it in our interests to shout very loudly and involve the press.

We will

 

On 6/26/2024 at 12:51 PM, omegatt said:

Thanks Paul and your probably right,  the attractions of the brand are mostly still intact, though the customer focused approach does seem to have slipped of late.  

 

[FredD]

On 6/27/2024 at 8:15 PM, Pinkfish said:

Despite all this I still think the brand is great and I would not consider buying any other make + their dealership is the best one based on my experience (I brought my RX yesterday to my dealer to have the plates fitted and a service) and they have been superb (as usual). When I compare their dealership with Porsche or BMW (my neighbours complain about those all the time), Lexus has  got it right.

 

 

 

[GSLV6]

It can't come soon enough...I disturbed would be thieves just last night poking around the car on my driveway at 2:20am with a torch.  They'd parked up, engine running,in a panel van.  They scarpered as soon as they saw me.  As I live at the end of a cul de sac, it wasn't opportunistic.

[RONNIE W HODGEKINSON]

On 6/27/2024 at 5:39 PM, eightk said:

Ghost themselves only do a canbus system immobiliser, so the tracker side will be something like one of these.

Ghost is cheap, easy to fit and doesn't need much soldering or messing with the car's wiring like a relay inserted into a loom does.

Downside : it's potentially not infallible - how accurate that post is I dunno, but my guess is a Ghost isn't hack-proof. I know installers are given a couple of locations to fit the thumbdrive sized Ghost unit - if found eg under the drivers door sill trim like on the Audi I had - it can be ripped out in seconds.

Mine's a Scorpion S5 tracker with an immobiliser upgrade that physically cuts a circuit like the Cat 2 immobilisers from decades ago. More work, but harder to get around. Keep it old school 😎

YES..!!

[Pinkfish]

2 hours ago, GSLV6 said:

It can't come soon enough...I disturbed would be thieves just last night poking around the car on my driveway at 2:20am with a torch.  They'd parked up, engine running,in a panel van.  They scarpered as soon as they saw me.  As I live at the end of a cul de sac, it wasn't opportunistic.

I agree, the quicker the flaw is put right the better we all sleep at night. I would also see Lexus subsidise our insurance and other related costs until they have fixed this security flaw.

Concerning the flaw - Lexus security is not industry wide. The flaw mean would be thieves can access and steal a Lexus in under 30 seconds. This PP design. 

[Paul Mingay]

Good news at least for now ,thx for the info 👍

[GSLV6]

Still no update, despite the "we should hear in two weeks time" message I received three weeks ago 🙄

To rub salt in, the would be thieves I noticed have dented the mid point of my nearside rear door top chrome trim.  "No problem" I mused, "...it's probably a £20 strip of chrome taking minutes to replace...".  Lexus quoted me £253 to replace it, including an hour's labour at £195!  They're slowly but surely alienating any loyal customers remaining in the UK.  I've seen this sort of arrogance in pricing at premium levels before and it never works out well for those doing it.  When will they learn?  I'd rather not be paying for swish dealerships, fancy coffee, VIP days and the Christmas bubbly thanks all the same Lexus.  I'd rather walk into a wooden hut with instant decaf and some stools if it meant customers got car care needs at reasonable real world pricing.  To coin a few lyrics "It don't impress me much"!

Now, had they addressed the canbus scandal sooner and more effectively, I'd not have minded as much but this is the last straw for me, and the last Lexus I'll buy.