Attempted Theft of my RX450h 2020

[ColinBarber]

10 minutes ago, PDM said:

I'm not totally convinced that encryption can't be added in software for at least few critical commands (such as "correct key present"). To me the idea of trading in a 4RX for a 5RX sounds like a triumph of hope over experience!

A firmware update is highly unlikely because the system as a whole, and the multiple ECUs involved, aren't designed for signed communication and would likely require hardware replacements, not just software. Going full encryption will never happen on these old models - Toyota/Lexus isn't even using that on current models).

[Tickedon]

4 hours ago, my pride & joy said:

How does the 5th generation RX differ to the 4th, in terms of security?

My 4th generation was stolen last year and I replaced it with another 4th. On this latest one I have had fitted a ghost immobiliser, canbus plate and use a Milenco steering wheel lock - am I still screwed?

Yes. The 5th generation RX has a signed/encrypted communication for the key and start. It’s called “Toyota Security Key” and all their newly updated/introduced models have a version of this, which means they aren’t vulnerable to the issue with the 4th gen RX, older NX, and current ES models (amongst others!). 

4 hours ago, ColinBarber said:

A firmware update is highly unlikely because the system as a whole, and the multiple ECUs involved, aren't designed for signed communication and would likely require hardware replacements, not just software. Going full encryption will never happen on these old models - Toyota/Lexus isn't even using that on current models).

Jaguar Land Rover managed it on older models going back to 2016 that had similar flaws. Experts have also said encryption for the key elects here (doors /engine start) wouldn’t add significant overhead. Toyota are the world’s largest car manufacturer - they absolutely could fix this if they chose to. 

[Rob62]

I am not sure that I will live long enough for a software update from Lexus. I am therefore having a Ghost II installed tomorrow.

It will not stop the scumbags from damaging the car but at least I know they will not be driving it away. I hope!

[ColinBarber]

9 hours ago, Tickedon said:

Jaguar Land Rover managed it on older models going back to 2016 that had similar flaws.

No they haven't. For older vehicles they are installing trackers and immobilisers and newer ones have updated firmware in the main body ECU to detect hacks - that isn't anything like implementing encryption across the entire CAN bus.

[Spock66]

3 hours ago, ColinBarber said:

No they haven't. For older vehicles they are installing trackers and immobilisers and newer ones have updated firmware in the main body ECU to detect hacks - that isn't anything like implementing encryption across the entire CAN bus.

And no doubt Lexus could do something similar if they could be bothered....

[Andy B]

I had this post appear on my Twitter feed today regarding the recovery of a stolen RX. If you enlarge the photo you will see the telltale sign of the wheel arch molding having been removed. 

Looks like a tracker was the saviour on this occasion. 

[DaveyBoy]

Nice that 2 people were collared. It's the best outcome. 

The car might still end up scrapped. I watched a you tube channel where the gangs strip cars in a day. Engine, seats, interior the lot out and boxed up ready to ship. Amazing. It's because they don't need to worry too much about breaking things. They often cut cheap parts to get the expensive ones out. Typically BMW cars though. First I've heard of lexus being striped.

[Rob62]

The one show tonight (13/3) had a special on stealing Lexuses!

Apparently they spoke to Lexus and Lexus confirmed that they will be releasing a software update for cars registered before 2021 that should stop the CAN bus issue.

I have already contacted my Lexus dealer and will update if I have anything further.

Has anyone heard anything?

[my pride & joy]

8 minutes ago, Rob62 said:

The one show tonight (13/3) had a special on stealing Lexuses!

Apparently they spoke to Lexus and Lexus confirmed that they will be releasing a software update for cars registered before 2021 that should stop the CAN bus issue.

I have already contacted my Lexus dealer and will update if I have anything further.

Has anyone heard anything?

Thanks - will check it out on catch up 👍🏻

[Tickedon]

There’s a thread here about the show and statement from Lexus: 

 

[DaveyBoy]

Wow. Swapping out components. That'll cost. The existing canbus parts will be removed and new parts fitted. Could be a newly developed canbus bridge processor or a hybrid of the new platform components or anything really. 

 

This will have taken time to develop and put a distribution system in place. Probably piggy back of the new platform for key distribution, if encrypted units are being used. 

 

They talk of a countermeasure. So this could be anything really. Nice to be vague, best to keep it that way.

I'll eat my words....... 

[Sybaris]

I think the key is to keep pressuring Lexus CS like we did to get them to develop the plates.

[Sybaris]

... and don't let them fob us off with c**p excuses.  Keep challenging them.

[Sybaris]

Just saw this online.  Its an epidemic and not just Lexus.