At least two dozen cars are vulnerable to being remotely unlocked and started with simple equipment that costs about $225, according to research from German automobile club ADAC.
The hack involves cars with keyless-entry systems, which send a radio signal from the car to the key when the owner is a short distance away that opens the car door. Once inside, the owner usually just has to hit a button to start the car.
Researchers figured out how to extend that short distance from a couple feet to nearly 300 feet with an "amplifier attack" — meaning the key sitting on your counter could be used by a thief to easily open your car in the driveway.
"The radio connection between keys and car can easily be extended over several hundred meters," the researchers wrote. "Regardless of whether the original key is, for example, at home or in the pocket of the owner."
Related story
It kind of works like a WiFi extender for your home internet connection, which maximizes the distance the radio signal can go. And since this hack doesn't replicate, but rather, extends the real signal from your car key, it easily bypasses car alarms because the car believes it's being accessed by the owner.
As The Telegraph notes, this type of threat has been around since at least 2011, when Swiss researchers demonstrated it. But five years later, car manufacturers haven't done much to fix the problem.
ADAC says it successfully broke into 24 different cars, including European cars like the Audi A3, A4, and A6, BMW 730d, and Opel Ampera. It also found models like the Ford Galaxy, Kia Optima, and Toyota Rav4 were susceptible, among many others.
Unfortunately, there's not much practical advice out there on how to protect against this type of attack. Perhaps manufacturers could make a change to cars to turn off the engine if the key goes out of range, but right now most engines will continue to run as long as there is gas in the tank.
The Telegraph says to place car keys inside a protective Faraday cage at home that blocks outgoing radio signals. There are also signal-blocking bags you can buy, or if all else fails, you can throw your key in the freezer.
Here's a video from ADAC showing how it works:
