Preventing Relay Attacks on Keyless Cars with Faraday Protection

Modern convenience often introduces hidden security vectors. One prominent example is the keyless entry and keyless start system found in contemporary automobiles. Commonly called "smart keys" or "proximity keys," these systems allow you to unlock your vehicle door by touching the handle and start the engine by pressing a dashboard button. You do not need to retrieve the physical key fob from your pocket or bag.

While highly convenient, this proximity technology exposes your vehicle to a cyber-physical exploit known as a Relay Attack (or signal amplification attack). Using inexpensive, specialized radio transceivers, thieves can bypass your vehicle's encryption and drive off with your car in under sixty seconds, without triggering alarms or breaking windows.

This guide details the physics of proximity key communications, explains the exact mechanics of a relay exploit, and provides practical instructions to implement Faraday protection to shield your vehicle from signal interception.

Technical Evolution of Vehicle Theft

To understand why relay attacks dominate modern vehicle crime, examine the history of automotive security.

1. The Mechanical Era (Pre-1990s)

In early automobiles, security relied entirely on mechanical cuts in a brass key. If a thief wanted to steal a car, they forced the door lock cylinder open and physically bridged the electrical ignition wires under the steering column. This action, known as hotwiring, required zero computer knowledge.

2. The Transponder Era (1990s-2000s)

To prevent hotwiring, manufacturers introduced transponders. They placed a tiny RFID chip inside the plastic head of the physical key. When you turned the key in the ignition, an electromagnetic coil around the keyhole read the chip serial number. If the chip was absent or incorrect, the engine control unit (ECU) refused to enable fuel delivery. This measure successfully eliminated simple hotwiring.

3. The OBD-II Exploitation Era (2010s)

As vehicles became rolling local area networks, thieves shifted to digital ports. They smashed a side window, plugged an expensive diagnostic programmer tool into the OBD-II port under the dashboard, and forced the car's computer to register a blank key fob on the spot.

4. The Proximity Relay Era (Present)

Today, thieves do not even need to touch your vehicle physically to gain access. They exploit the continuous, automatic radio broadcast loops of your keyless entry systems. Proximity relay allows them to drive off without any physical damage or sound, bypassing both mechanical and electronic barriers.

Physics of Attenuation and Skin Depth in Faraday Cages

The effectiveness of a Faraday cage is not absolute. It depends on the frequency of the target signal, the conductivity of the material, and the thickness of the shielding.

1. Electromagnetic Attenuation

When a radio wave hits a metal barrier, it does not stop instantly at the outer surface. It penetrates the material slightly, losing energy exponentially as it travels. This reduction in signal strength is called attenuation, measured in decibels (dB). To block a smart key signal, your cage must attenuate both the 125 kHz low-frequency challenge and the 433 MHz high-frequency response by at least 50 dB to 80 dB, rendering the signal too weak for the transceivers to decode.

2. Skin Depth calculations

The distance a radio wave travels into a conductor before its intensity drops to approximately 37% of its surface value is called skin depth.

Skin depth decreases as the signal frequency increases.
High-frequency signals (like 433 MHz) have very shallow skin depth. They are easily blocked by thin foils or mesh.
Low-frequency signals (like 125 kHz) have much deeper skin depth. They can pass through thin, cheap metal foils easily.

This is why thin kitchen aluminum foil often fails to stop a relay attack. The low-frequency 125 kHz wake-up signal passes directly through the thin foil, stimulates the key, and allows the attack to succeed. A reliable Faraday pouch must utilize highly conductive copper and nickel weave patterns of sufficient thickness and density to block both frequency extremes.

Physics of Keyless Proximity Communications

To understand how thieves exploit smart keys, you must first examine the two-way radio protocol that enables proximity sensing.

Your keyless vehicle and your smart key fob communicate using low-power, short-range radio frequency (RF) signals. This process relies on a continuous loop of challenges and responses:

The Wake-Up Call (Low Frequency): The vehicle possesses several low-frequency (LF) antennas mounted inside the door handles, trunk, and dashboard. These antennas continuously broadcast a short-range, omnidirectional signal at 125 kHz or 134 kHz. This signal has an active range of approximately one to one and a half meters around the car.
The Proximity Trigger: When you approach the vehicle and touch the door handle sensor, the car transmits a "wake-up" challenge packet on the LF frequency.
The Cryptographic Response (Ultra-High Frequency): If your key fob is within range, its internal battery powers its microprocessor to receive the LF challenge. The key fob calculates a cryptographic signature using a pre-shared secret key and transmits this authorization response back to the car using an ultra-high frequency (UHF) band, typically 315 MHz (in North America) or 433 MHz (in Europe and Asia).
Access Granted: The vehicle's onboard receiver decodes the UHF response. If the signature matches, the door locks disengage. A similar handshake occurs when you press the "Start" button inside the cabin.

This protocol assumes that if the key fob receives the LF wake-up signal, the physical key must sit within one meter of the vehicle. Attackers exploit this assumption of physical proximity by virtually extending the radio cable.

The Mechanics of a Relay Attack

A relay attack does not crack your vehicle's cryptographic keys or brute-force its passwords. Instead, it acts as a virtual extension cord, relaying the radio signals over hundreds of meters to trick the car into believing the key sits right next to the door handle.

This attack requires two participants, whom we will call Thief A and Thief B, operating in close coordination:

[Key Fob inside House] <──(LF Signal)──> [Thief A (Transceiver)] <───(Long Range Link)───> [Thief B (Transceiver)] <──(LF/UHF)──> [Car outside]

Step 1: The Wake-Up Forwarding

Thief B stands next to your vehicle parked on your driveway or in a parking lot. They touch the door handle to trigger the car's wake-up routine. The car transmits the 125 kHz LF signal. Thief B holds a handheld transceiver device that captures this LF signal and converts it into a high-power long-range radio signal (often on a 2.4 GHz or sub-GHz band). This device transmits the signal back toward your house.

Step 2: The Key Stimulation

Thief A walks close to your home's exterior walls, doors, or windows carrying a receiving transceiver. If your key fob is resting on a table near the front door or in a key hook, Thief A's device receives the forwarded signal from Thief B and rebroadcasts it at 125 kHz.

To the key fob, this signal looks exactly like the car sitting directly next to it. The key fob wakes up and transmits its cryptographic UHF authorization response (315 MHz or 433 MHz).

Step 3: The Authorization Forwarding

Thief A's device captures the UHF response, converts it into the long-range protocol, and sends it back to Thief B standing near the vehicle.

Step 4: Ignition and Departure

Thief B's device rebroadcasts the key fob's UHF signature. The vehicle's receiver decodes the signal, verifies the cryptographic authorization, and unlocks the door. Thief B sits in the driver's seat, presses the engine start button, and the engine starts.

Once the engine runs, the car does not shut down if the key disappears. It displays a dashboard warning ("Key Not Found"), but the engine continues running until the thief turns it off or runs out of fuel. This allows them to drive the vehicle directly to a secure warehouse, chop shop, or shipping container.

The Physics of a Faraday Cage

The most effective protection against a relay attack relies on a principle of physics discovered by Michael Faraday in 1836: The Faraday Cage.

A Faraday cage is an enclosure formed by conductive material or a mesh of such material. When an electromagnetic wave (like a radio signal) hits the conductive enclosure:

The electrical charges within the conductive material redistribute themselves immediately.
This redistribution generates an internal electric field that cancels out the external electromagnetic field's effect inside the cage.
The external signal cannot penetrate the interior of the enclosure, and any internal signal cannot escape.

By placing your keyless key fob inside a small, portable Faraday cage when you are not using it, you block all incoming 125 kHz wake-up signals and prevent any outgoing 433 MHz responses. Thief A's transceiver can stand directly next to your front door, but they will receive only silence from your key fob.

Practical Protocols to Protect Your Vehicle

Implement these defensive layers to secure your proximity keys and prevent relay exploitation.

1. Utilize a Verified Faraday Pouch

A Faraday pouch is a small, flexible sleeve lined with multiple layers of conductive metallic fabrics (typically copper, nickel, or silver mesh).

How to use it: Every time you exit your vehicle, place the key fob inside the metallic lining of the pouch and seal the Velcro flap completely. Do not leave the key fob partially exposed; even a millimeter gap can allow high-frequency signals to escape or enter.
Verification test: Stand next to your vehicle with your key fob sealed inside the Faraday pouch. Try to touch the door handle or press the unlock buttons through the fabric. If the car doors remain locked, the pouch works successfully. Perform this test once a month, as the conductive metallic lining can degrade, crack, or tear over time with everyday use.

2. Implement Home Container Shielding

Do not leave your car keys hanging on a hook near the front door, entryway, or windows. These locations are easily reached by Thief A's signal amplifiers from the outside.

Store keys in a metal box: Place all spare and primary key fobs inside a dedicated metallic tin, a heavy cast-iron key box, or a safe lined with conductive materials.
Distance matters: Keep your keys stored deep inside the interior of your house, at least five meters away from exterior walls and windows. This distance reduces the physical strength of any signal attempting to reach the fob.

3. Manually Disable the Key Fob Transmitter

Some vehicle manufacturers include a feature that allows you to turn off the radio transmitter inside the key fob manually.

For Toyota / Lexus fobs: Hold down the Lock button, and simultaneously press the Unlock button twice. The indicator LED on the fob will flash four times. This indicates the fob has entered sleep mode and turned off its receiver. To wake the key up, simply press any button on the controller.
For other brands: Consult your vehicle's official manual or contact your dealership to ask if your key fob supports a manual sleep mode or possesses a built-in motion sensor that turns off the transmitter after remaining stationary for more than two minutes.

4. Enable Software PIN-to-Drive

If you own a modern electric or software-defined vehicle (such as a Tesla), use the built-in system security controls.

PIN-to-Drive: Go to Settings > Safety & Security > PIN to Drive. Configure a secure four-digit PIN code.
How it works: Even if an attacker executes a successful relay attack to unlock your car, they cannot start the electric motors or drive away without entering the PIN code on the central touchscreen display. This software layer completely neutralizes the threat of physical theft via radio interception.

5. Install Physical Security Layers

If your vehicle does not support software locks, supplement your security with physical visible deterrents:

Steering Wheel Lock: Use a heavy, physical steering wheel lock bar (such as "The Club"). A thief with transceiver tools will avoid your vehicle if they see they must spend minutes grinding through steel to steer the car.
OBD-II Port Lock: Thieves often connect devices to the diagnostic OBD-II port under your steering wheel to program a blank key fob on the spot. Install a physical locked cover over your OBD-II port to block this connection.

Comparison: Defensive Methods against Signal Hijacking

Evaluate the trade-offs of different keyless security solutions:

Method	Security Effectiveness	Convenience Level	Cost	Primary Weakness
Faraday Pouch	High	Moderate	Low	Material degrades over time with use.
Home Tin Storage	High	High (at home)	None	Does not protect you when parked in public lots.
Manual Key Sleep	High	Moderate	None	Not supported by all manufacturers.
PIN-to-Drive	Absolute	Moderate	None	Only available on specific connected vehicles.
Steering Wheel Lock	High (Physical)	Low	Moderate	Requires manual installation every trip.

A Self-Audit for Keyless Vehicle Safety

Run this physical security check twice a year to verify your posture:

Check Faraday pouch integrity: Place your key fob inside the pouch, seal it, and walk to your car. If the door unlocks when you touch the handle, discard the pouch and replace it.
Review key storage locations: Verify that no family member leaves smart keys on the entryway table, kitchen counter, or near garage doors. Move them to a shielded interior location.
Verify spare keys: Remember to secure your spare key fobs. An unsecured spare key resting inside a drawer near the garage wall is just as vulnerable to amplification as your primary key.
Test manual button patterns: Attempt the sleep button combinations on your key fobs to check if your model supports battery-saving sleep states.

Frequently Asked Questions

Can a relay attack happen while I am driving?

No. Once the car is started and moving, the relay attack is no longer relevant. The vehicle's operating system only performs the key proximity check to authorize the initial door unlock and engine start. It will not shut off the engine mid-drive if the key signal disappears, to prevent dangerous highway power loss.

Will a metal kitchen container work as a Faraday cage?

Sometimes. A simple aluminum foil or metal cookie tin can reduce signal strength, but it is not always a perfect Faraday shield. Many tins have gaps in the lid seal or utilize metals that are too thin to block high-frequency signals. Always place your key inside the container and test it next to your vehicle to confirm total block before relying on it.

How do thieves find where my keys are inside my house?

Thieves do not need to know the exact drawer where your keys sit. Thief A walks slowly along your exterior walls, garage doors, and front porch, holding a highly sensitive directional antenna. The antenna emits a high-power wake-up signal that can penetrate standard brick, wood, and glass walls up to several meters, stimulating any key fob resting in the vicinity.

Do keyless attacks affect older cars with traditional key turn ignition?

No. Older vehicles that require you to physically insert a metal key blade into a keyhole and turn it to start the engine are immune to relay attacks. Those vehicles rely on physical mechanical cuts to engage the lock and ignition, although they may still utilize simple transponders for immobilizers that only operate inside the ignition cylinder.

Is eSIM or phone-as-a-key technology vulnerable to relay attacks?

Phone-as-a-key systems that utilize Bluetooth Low Energy (BLE) and Ultra-Wideband (UWB) technology are much harder to relay. UWB measures the exact "Time-of-Flight" of the radio signal to calculate physical distance. Because signal relaying introduces microsecond delays, the vehicle detects the delay and refuses to unlock, realizing the key is not physically adjacent.

Sources and References

Editorial Note: This article serves educational purposes. Radio protocols, frequencies, and physical configurations change with vehicle model years and manufacturers. Refer to your vehicle manufacturer's official documentation to learn about specific anti-theft settings and key fob modes. Keep your physical security layers active when parking in unfamiliar public areas.