Almost every vehicle Volkswagen has sold since 1995 is vulnerable to a couple of simple hacks that could allow thieves to unlock their doors wirelessly. The bug was discovered by a team of researchers led by Flavio Garcia at the University of Birmingham, who reverse-engineered an undisclosed Volkswagen component of the keyless entry security system to extract a cryptographic key value that is common to many of the company's vehicles.
Armed with this information – which isn't being publicly shared, of course – a hacker can then intercept the unique ID emitted by the car's key fob using an Aduino-based RF transceiver that can be made for about $40. The attacker would need to be fairly close to the target vehicle but the process is pretty straightforward to do undetected.
The device the researchers made using an Arduino control board and radio receiver
One scary possibility suggested by the researchers, is that hackers could leave an eavesdropping device in a parking lot, harvesting the unique ID emitted by each of the cars.
The researchers note that Volkswagen relied on only a few cryptographic global master keys for the Remote Keyless Entry systems in vehicles sold during the past two decades, including makes like Audi, Skoda and many more.
This isn't the first Volkswagen vulnerability that the researchers have found. Back in 2013 they discovered a way to start Volkswagen cars' ignitions, but they were hit with a lawsuit that delayed the publication of their research for two years.