Faraday Cages for Keyless Go Fob Security
#1
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
Faraday Cages for Keyless Go Fob Security
Lately, I have been experimenting with Faraday Cages. This is what retired guys with inquisitive minds do...
I thought I would start a separate thread on this topic so we can get and share ideas. The concept is to prevent car theives from stealing your Keyless Go Mercedes by using electronic sniffers to capture and relay your key fob signal to your parked/locked car.
First attempt was a small breed dog feeding bowl (aluminum) below, with a lid made of aluminum foil wrapped around a pickle jar lid. The wrapped lid sits down inside the sloped wall of the dog bowl, finding a place where it seals the lid to the bowl. This worked, but the aluminum foil looked flimsy (pretty obvious). But I learned to add a plastic cup within the outer aluminum surface, to insulate the key fob from the outer shell. This is important.
If you experiment with these, you will find that a good seal between parts is IMPERATIVE, because any tiny gap where the parts meet allows the signal to exit. Also, any metal part on the key ring touching the aluminum shell will use the shell as an external antenna...hence the insulating plastic cup.
For this reason, I doubt that the fold-over, Faraday pouches found on Amazon will work as the fold doesn’t seal perfectly. Try one and you will see...
My second experiment works perfectly. I shopped the kitchenware section of a resale store for a used aluminum cup with a sealing aluminum lid. I had to buy two items, one the cup, and a second jar (glass) with an aluminum lid. Altogether, I spent $1.60 for both items. Sit the glass jar aside for some other science project, LOL.
The aluminum lid from the glass jar nests into the cup perfectly (albeit upside-down), and the sealing edge of the lid is deep enough to seal both parts together without fail.
In use, I can lock the car, then place the key within the cup, install the lid, and sit it on the ground 2 feet from the car door. After repeated attempts, the car will NOT unlock when I insert my hand through the door handle.
Once satisfied that it worked, I then added some colorful padding within the cup to eliminate key rubbing on the hard aluminum interior and provide the necessary isolation. Finally, I super-glued a plastic bottle cap to the lid to provide a grip to pull the lid out of the cup.
The completed faraday cup sits on my dresser inside a walk-in closet, 75 feet from the car in the garage. It takes hardly any room at all. And even though I live in an area that hasn't seen any crime in decades, no one driving by can hijack the signal from the key and relay it to the car. Not that they can open the garage door to get at the car anyways.
I thought I would start a separate thread on this topic so we can get and share ideas. The concept is to prevent car theives from stealing your Keyless Go Mercedes by using electronic sniffers to capture and relay your key fob signal to your parked/locked car.
First attempt was a small breed dog feeding bowl (aluminum) below, with a lid made of aluminum foil wrapped around a pickle jar lid. The wrapped lid sits down inside the sloped wall of the dog bowl, finding a place where it seals the lid to the bowl. This worked, but the aluminum foil looked flimsy (pretty obvious). But I learned to add a plastic cup within the outer aluminum surface, to insulate the key fob from the outer shell. This is important.
If you experiment with these, you will find that a good seal between parts is IMPERATIVE, because any tiny gap where the parts meet allows the signal to exit. Also, any metal part on the key ring touching the aluminum shell will use the shell as an external antenna...hence the insulating plastic cup.
For this reason, I doubt that the fold-over, Faraday pouches found on Amazon will work as the fold doesn’t seal perfectly. Try one and you will see...
My second experiment works perfectly. I shopped the kitchenware section of a resale store for a used aluminum cup with a sealing aluminum lid. I had to buy two items, one the cup, and a second jar (glass) with an aluminum lid. Altogether, I spent $1.60 for both items. Sit the glass jar aside for some other science project, LOL.
The aluminum lid from the glass jar nests into the cup perfectly (albeit upside-down), and the sealing edge of the lid is deep enough to seal both parts together without fail.
In use, I can lock the car, then place the key within the cup, install the lid, and sit it on the ground 2 feet from the car door. After repeated attempts, the car will NOT unlock when I insert my hand through the door handle.
Once satisfied that it worked, I then added some colorful padding within the cup to eliminate key rubbing on the hard aluminum interior and provide the necessary isolation. Finally, I super-glued a plastic bottle cap to the lid to provide a grip to pull the lid out of the cup.
The completed faraday cup sits on my dresser inside a walk-in closet, 75 feet from the car in the garage. It takes hardly any room at all. And even though I live in an area that hasn't seen any crime in decades, no one driving by can hijack the signal from the key and relay it to the car. Not that they can open the garage door to get at the car anyways.
Last edited by DFWdude; 10-02-2019 at 10:59 PM.
The following 2 users liked this post by DFWdude:
diesel_dan (01-31-2020),
kajtek1 (10-02-2019)
#3
I always enjoy reading DFWdude's writing ups, very thoughtful indeed. I feel I need some education on how the key signal is "sniffed" by car thieves, would you please tell us how that happens! THANKS!~
The following users liked this post:
pierrejoliat (01-30-2020)
The following users liked this post:
Stuttgarten (10-04-2019)
#6
MBWorld Fanatic!
Joined: Jan 2009
Posts: 9,121
Likes: 1,753
From: V E G A S
1922 Ford Model T / no OBD
The following users liked this post:
up_too_late (10-04-2019)
#7
So how did you come by a sniffer to determine what is better?
I can see the high school kids doing this in a few years as pranks....
Kinda miss the old days when you actually put a key in an ignition switch and turned it...
.
I can see the high school kids doing this in a few years as pranks....
Kinda miss the old days when you actually put a key in an ignition switch and turned it...
.
Trending Topics
#9
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
Last edited by DFWdude; 08-04-2020 at 05:37 PM.
#10
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
Has anyone tried making a Faraday Box for their key(s) since this thread begain?
Here's another video clearly showing the risk with keyless go cars.
Be sure to post pictures to give others ideas...
Here's another video clearly showing the risk with keyless go cars.
Be sure to post pictures to give others ideas...
Last edited by DFWdude; 10-17-2019 at 08:09 PM.
#12
Myself, I don't worry about it. Car is out of sight in a locked garage. If somebody goes through the effort to snag it this way, let the insurance company deal with it.
#13
Before you decide on cages, cans, etc, you might want to run a test to see how far away the key needs to be to receive the signal from the door handle being touched. If the key doesn't receive the signal from the door,no return signal is sent back to the car, the doors stay locked. If the key doesn't respond at say 50 ft, if your key is 50 ft or more, you are safe. Mine doesn't respond more than 15 ft away, in open air, much less if restricted in any way. Of course, it's best if your car is in a locked garage so that thieves cannot even touch the door handles to start the process of stealing the signal and your car. .
#14
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
Yeah, while DFW Dude probably has the winning entry in theory, other approaches that aren't "perfect" will still work. Even the coffee can, without any lid, will reduce the transmitted signal by quite a lot. We see that all the time with radio comm transmitting antennas - all sorts of things can attenuate (reduce) the signal. You don't have to get it to absolute zero here -- just low enough that it is not easy to find
Before you decide on cages, cans, etc, you might want to run a test to see how far away the key needs to be to receive the signal from the door handle being touched. If the key doesn't receive the signal from the door,no return signal is sent back to the car, the doors stay locked. If the key doesn't respond at say 50 ft, if your key is 50 ft or more, you are safe. Mine doesn't respond more than 15 ft away, in open air, much less if restricted in any way. Of course, it's best if your car is in a locked garage so that thieves cannot even touch the door handles to start the process of stealing the signal and your car. .
You can take your keys in your coffee can -- with or without plastic lid -- to the garage (closer to the car) and it will not work. The car will perceive the key is present and unlock as always. To the good, you have a convenient and consistent place to store your keys, a good habit to develop. On the negative side, you don't have a Faraday Cage... It's just a coffee can, and a false sense of security.
Problem is, this is the concept of relay theft that thieves rely on... two guys, each equipped with a "sniffer." If guy #1 knows or suspects where you keep your fob, he just has to get near enough to receive any signal -- through the top of the coffee can -- that he subsequently relays to the second guy standing at the car. An uncapped coffee can is no better than leaving your keys out in the open. The relay equiment extends the range, and the effective range could be quite a distance. So in theory, no keyless go car is safe from a relay attack.
Someone outside my bedroom window will NOT sniff any signal, even if the key is only 10 ft distant, because it is sealed in its Faraday cage. I mention this only because people should not presume to think that an unsealed coffee can will work in a relay scenario where one of the thieves learns where you keep the key.
This has been a fun project. But I really don't lose sleep over it. I've moved on to 5 other projects since.
Last edited by DFWdude; 10-23-2019 at 07:53 AM.
The following users liked this post:
DFWdude (10-23-2019)
The following 2 users liked this post by DFWdude:
KEY08 (10-23-2019),
machinemanjr (02-06-2020)
The following users liked this post:
KEY08 (10-23-2019)
#19
I don't think anyone can get a code unless they are close by when the key fob is used. Not real sure but I don't think there is any kind of signal sent from a key fob unless it is actuated by someone.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
#20
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
I don't think anyone can get a code unless they are close by when the key fob is used. Not real sure but I don't think there is any kind of signal sent from a key fob unless it is actuated by someone.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
Last edited by DFWdude; 10-24-2019 at 08:15 PM.
#21
MBWorld Fanatic!
Joined: Feb 2014
Posts: 6,155
Likes: 1,507
From: MA
2008 E350 4Matic, 2011 E350 4matic
I don't think anyone can get a code unless they are close by when the key fob is used. Not real sure but I don't think there is any kind of signal sent from a key fob unless it is actuated by someone.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
So storing it in a can ??? I would think that people that do sniffing is more they know the code protocol's and use a random code generator deal to sniff out the proper code. And the only way to protect from that is to disconnect the antenna in the car or shut down the remote system in the car. I would like to know how the system works.
The following 2 users liked this post by cetialpha5:
DFWdude (10-24-2019),
pierrejoliat (01-30-2020)
#22
MBWorld Fanatic!
Joined: Jan 2009
Posts: 9,121
Likes: 1,753
From: V E G A S
1922 Ford Model T / no OBD
I am still learning the technology and what brainstorming it concluded is that keyless go sends a ping every few seconds no matter what. Somebody said you can turn it off by double click, but several member reported it false.
The range is +- 4 ft.
When I stand at driver door and my wife will try to open passenger door - it will not work, but when I am a step behind her- it will.
Than once engine is started and car in motion, it will run with no ping till you come to firm stop.
The range is +- 4 ft.
When I stand at driver door and my wife will try to open passenger door - it will not work, but when I am a step behind her- it will.
Than once engine is started and car in motion, it will run with no ping till you come to firm stop.
#23
Here is a graphic from an article in the Daily Mail on this issue that shows what cetialpha5 wrote about:
This is a excellent video from 2 different angles showing a Mercedes C-Class being stolen in 20 seconds by remotely cloning a Keyless entry fob:
I'm not quite the tinkerer that DFWdude is so I purchased a 2 pack of Faraday cages from Amazon ( ) 18 months ago. I just successfully retested them before writing this post. While holding both sets Keyless entry fobs in their Faraday bags I could not open (unlock) my car door. This type of theft is more of a UK problem but two homes in my metro DC residential neighborhood have reported their non-MB "keyless" entry type cars being stolen during the night in the past year. Even if you have a garage at home, if you drive your MB on road trips it might be in your best interest to have your keys stored in a Faraday bag.
- Longroof
This is a excellent video from 2 different angles showing a Mercedes C-Class being stolen in 20 seconds by remotely cloning a Keyless entry fob:
I'm not quite the tinkerer that DFWdude is so I purchased a 2 pack of Faraday cages from Amazon ( ) 18 months ago. I just successfully retested them before writing this post. While holding both sets Keyless entry fobs in their Faraday bags I could not open (unlock) my car door. This type of theft is more of a UK problem but two homes in my metro DC residential neighborhood have reported their non-MB "keyless" entry type cars being stolen during the night in the past year. Even if you have a garage at home, if you drive your MB on road trips it might be in your best interest to have your keys stored in a Faraday bag.
- Longroof
Last edited by Longroof; 10-25-2019 at 10:29 AM.
The following users liked this post:
DFWdude (10-25-2019)
#24
MBWorld Fanatic!
Joined: Jan 2009
Posts: 9,121
Likes: 1,753
From: V E G A S
1922 Ford Model T / no OBD
Yeah, I wonder when we start hearing about cars stolen while the owners sits at McDonald or Starbucks..
It takes 1 thief sitting next to him and other driving away.
It takes 1 thief sitting next to him and other driving away.
#25
Thread Starter
MBWorld Fanatic!
Joined: Apr 2006
Posts: 4,654
Likes: 1,760
From: Dallas-Ft.Worth,TX
2016 E350 Sport
I am still learning the technology and what brainstorming it concluded is that keyless go sends a ping every few seconds no matter what. Somebody said you can turn it off by double click, but several member reported it false.
The range is +- 4 ft.
When I stand at driver door and my wife will try to open passenger door - it will not work, but when I am a step behind her- it will.
Than once engine is started and car in motion, it will run with no ping till you come to firm stop.
The range is +- 4 ft.
When I stand at driver door and my wife will try to open passenger door - it will not work, but when I am a step behind her- it will.
Than once engine is started and car in motion, it will run with no ping till you come to firm stop.
1) The car is locked in the garage (overnight) so presumed to be completely powered down.
2) My secondary key fob was deactivated (quick 2-lock presses) several weeks before. (The primary key sits in its faraday cage.)
So…
I took this secondary key to the car and immediately inserted my fingers through both driver side door handles. The car would not unlock. I then placed the fob on the sunroof and left it there.
I returned to the car at 5, 10, 15 and 30 minute intervals, and with the key fob still sitting on the sunroof, the doors would not unlock. Just to verify that the key battery wasn’t dead, I then activated the key (press any button), and it unlocked the doors as normal.
Maybe a couple of you can duplicate this procedure and verify my results?
This satisfies me that if the car periodically pings for the key, a deactivated key fob cannot be awakened to establish a handshake. To me, this also means that a deactivated secondary key does not need faraday cage protection, and that Kajtek1’s scenario – watching your car stolen while eating at McDonald’s – can also be avoided by double-clicking the Lock button before entering the restaurant. So much for keyless-go when you're out in public...
Now, you might say that (always) double-clicking the Lock button is sufficient, and that a faraday cage is not needed. However, that generally defeats the purpose of keyless-go. Also, I don’t want to wear out the fob button with twice as many lock presses... or (more likely) increase battery drainage in doing so. (A bit silly, I admit, since I long ago wore the lock markings off my 18 year-old Mercedes C320 key, and the buttons still work as new.)
Such are the esoteric experiments of a blissfully retired person…
Last edited by DFWdude; 10-25-2019 at 11:04 AM.
The following users liked this post:
pierrejoliat (01-30-2020)