Sometimes, you’ve got to park your car somewhere sketchy.
Maybe you’re travelling abroad for some vacation, on a work trip, or to check out a new city for a long weekend. You might be leaving your car in an airport, hotel, or condo parking lot for an extended period. In any case, you might be wondering about the best ways to make sure your car and its contents are as you left them when you return.
Sure, you’ll follow the usual steps: locking doors, parking in a well-lit area, and maybe even installing an anti-theft device or alarm. That used to be enough, but today’s car thieves are employing more high-tech and creative ways than ever to gain access to vehicles. When it comes time to protect your car or truck from being broken into or stolen, you can do better.
Below, I’ll share the three steps I take when parking my car for extended periods away.
Not only do these help ensure your car won’t be an attractive target for a break in, they can also help prevent electronic attacks and theft, which are on the rise. Each of the tips below takes less than 90 seconds, costs you nothing, and could save you thousands.
Tip 1: Leave a Visibly Empty Interior
The night before leaving for a trip, I remove everything from my car that doesn’t need to be there.
Garbage, accessories, cables, books, bags, loose change, any other items in my glovebox or centre console? All gone.
Other than a booster pack (in case my battery dies while I’m away) and my ownership and registration, nothing is allowed inside the car that isn’t coming with me on my trip. The few items I need to leave behind go into the spare tire well or beneath the floor of the trunk or cargo area, where they can’t be seen from outside.
When I get to where I’m parking, I first unload my luggage and bags, leaving the car’s interior completely and totally empty. Then, I open my glovebox and centre console, displaying their emptiness for all to see.
If I’m driving an SUV, crossover, or hatchback, I also make sure the cargo area cover is retracted to create a clear view of my totally empty cargo hold.
“Nothing to steal in here!” says my car’s interior to anyone taking a casual peek while I’m gone.
Often, vehicle break-ins are crimes of opportunity, and proudly displaying a totally empty interior can make it more likely that a would-be car thief will move to another vehicle.
Be careful, though. The centre console or glovebox in your car may have a built-in light that turns on when it’s opened. Leaving this light on for several days or weeks could drain your battery. If your centre console or glovebox has a built-in light, look for a switch to turn it off. If there isn’t one, just remove the bulb. Check your owner’s manual for instructions. This usually takes about 10 seconds.
Tip 2: Disable Your Engine
Your vehicle may have an advanced anti-theft system and engine immobilizer built into its electronics. Though these are designed to prevent unauthorized people from starting your car’s engine, both can be hacked or bypassed by skilled criminals.
Starting your engine requires the orchestrated efforts of various components, including the fuel pump. The fuel pump in your car relies on electricity to do its job, and the electricity that feeds it must first travel through a relay and/or fuse.
Using your owner’s manual or a web search, track down the location of your car’s fuel pump relay, and instructions on how to remove it. Usually, it’s located in a sealed compartment beneath your dashboard or under your hood.
Most drivers can track down and remove their fuel pump relay in a minute or less. The relay is a small block-shaped module, about half the size of a container of Tic-Tacs. You can pluck the relay from its receptacle and put it in one of your bags, or hide it in your car’s spare tire well for when you return.
With no fuel pump relay, your car’s fuel pump can’t receive electricity. This means your engine can’t receive gasoline and will not start or run, even if hotwired or hacked.
Reinstallation upon your return takes about 30 seconds, just be sure not to forget where you kept the relay while you were gone.
WARNING
When returning to your vehicle, don’t forget to reinstall the fuel pump relay before trying to restart the engine. If you accidentally try to start your engine before you reinstall the fuel pump relay, you could get a Check Engine Light, trouble codes, or have trouble restarting your engine, even after the relay is installed. When you return to your car, make 200 per cent sure you remember to pop that relay back in before firing up the engine.
Tip 3: Mind Your Key Fob
Your remote smart key communicates with your car to validate you – unlocking the doors and providing access to the locks and ignition. This process is intended to work at very close range, perhaps a foot or two from your vehicle. That’s why your smart key won’t unlock the car unless you’re pretty much standing right next to it. Your smart key can also transmit lock and unlock signals to your vehicle when you press its buttons.
Lately, an increasing number of car thieves are using special equipment to intercept, manipulate, and replicate the communication signals between your keys and your car, using them to their advantage.
Different vehicles use different types of signals, and car thieves use different means of exploiting them. Broadly, these are known as “relay attacks.”
Roger Spears is a cybersecurity expert and senior manager of cybersecurity consulting services for Schneider Downs.
“This type of attack does not take a long time to execute,” Spears explains. “The threat actor must be in position to record the signal when the victim presses their key fob. From the demonstrations I’ve seen, once recorded, the signal can be played back quickly.”
Perhaps you lock your car using the remote and walk off with your luggage. As you do, a nearby thief may walk near you while concealing a device in their coat or backpack that’s used to capture the signal from your remote. This captured signal can be manipulated and played back later, allowing access to your vehicle while you’re away.
According to Spears, your car’s built-in protection against this type of attack may be insufficient.
“Auto manufacturers have tried to use a rolling code to prevent previous key fob presses/signals from being used in relay attacks,” explains Spears. “The rolling code is a counter within the vehicle and within the key fob. With each key fob button press, the counter increases. To account for accidental key fob button presses out of range of the vehicle, the rolling code resets the next time the key fob is pressed and the vehicle has a lower counter value than the key fob. There are recent demonstrations that would indicate the rolling code does not work as intended on all models of vehicle. There are demonstrations that show a recorded key fob signal effectively used 100 days after its recording.”
In this type of attack, a signal is recorded for future playback.
“The key fob signal can be recorded at any time,” explains Spears. “If you locked your car using the manual push-button locks located inside your vehicle without pressing the key fob buttons, it might prevent this type of attack in a high-risk setting.”
Another type of attack intercepts the authentication signals sent between your remote and your vehicle, even when you don’t press a button on the remote. Normally, your vehicle and smart key authenticate each other at very close range, perhaps a foot or two. This allows drivers to operate their door locks and ignition without handling their smart key.
Using two thieves and the right equipment, this signal can be picked up and transmitted over a distance, with the intention of tricking your car into thinking your smart key is nearby when it’s not.
One thief positions themselves near your smart key, perhaps walking alongside you in a parking lot. They’re carrying a concealed device that reads the signal from your smart key and transmits it to an accomplice in position near your vehicle. The accomplice has another electronic device that picks up the signal from your far-away smart key, and transmits it to your car. Now, the signal can be used to unlock your doors and even start the engine.
So, as a final step after displaying my car’s totally empty interior to deter break-ins and pulling my car’s fuel pump relay to disable the engine, I also pull the batteries out of my car’s remote and put them in my pocket or bag – preventing it from sending off any signals that can be recorded as I walk away.
