Researchers find cryptographic keys shared by millions of Volkswagen vehicles can allow them to clone key fobs using cheap radio hardware
Andy Greenberg / Wired :
Context & Ripple Effects
This finding lands in a string of cheap-hardware attacks on car access systems that Wired has tracked since 2015: an [[a:831909|OwnStar man-in-the-middle attack that grabbed virtual keys from BMW, Mercedes, and Chrysler apps]], a radio amplification attack hitting 24 models from 19 manufacturers months earlier, and a brake hack through an insurance dongle. What makes the Volkswagen disclosure different is scale and architecture — the flaw comes from cryptographic keys shared across millions of vehicles rather than a single model's radio path.
The pattern did not stop at VW: four years later researchers found immobilizer encryption flaws in some Toyota, Hyundai, and Kia keys, and by 2024 even Tesla's ultra-wideband keyless system fell to a low-cost relay demonstration. The throughline is that vehicle entry security keeps being broken by hardware costing hundreds of dollars, not thousands.
First-order effects
- Owners of the affected Volkswagen models face a concrete theft risk from attackers who can clone a key fob with inexpensive radio equipment, and Volkswagen is pushed into disclosing which vehicles share the compromised keys and how it will remediate them.
Second-order effects
- Every manufacturer using shared or weakly diversified key cryptography — the same class of design later exposed at Toyota, Hyundai, and Kia — faces pressure to audit its immobilizer and remote-entry architectures before researchers or thieves do it for them.
Third-order effects
- If the pattern holds, the industry moves toward per-vehicle cryptographic diversity and relay-resistant key designs as standard, while coordinated-disclosure norms between security researchers and automakers harden into expected practice rather than exception.
The trend: Vehicle access security is shifting from shared, fleet-wide cryptographic secrets toward per-vehicle key diversification and relay-resistant designs as attack hardware gets cheaper.