LBX Encrypted CANBUS

[UX250HTAK]

I presume that the new LBX is on an encrypted CANBUS platform, like the new NX and RX. Does anyone know if this has been confirmed?

[SH20]

I don't know is the answer but if Lexus hasn't taken note of the abysmal security issues the ES has suffered from for example and failed to secure the LBX with an encrypted CANBUS platform then they do not deserve to sell a single one. 

[rayaans]

On 12/4/2023 at 1:53 PM, UX250HTAK said:

I presume that the new LBX is on an encrypted CANBUS platform, like the new NX and RX. Does anyone know if this has been confirmed?

It most likely is as all new Lexus models will be. 

Will have to wait until UK launch go confirm though 

[Don C]

The detailed spec has been released.   If the fuse box is in the same place as the Yaris Cross you wouldn’t reach it from under the headlight.  
 

 

231220-LBX-Press-Pack.pdf

[ColinBarber]

9 hours ago, Don C said:

If the fuse box is in the same place as the Yaris Cross you wouldn’t reach it from under the headlight.  

A CAN bus attack doesn't need access to a fuse box, just access to the bus wiring which is present at the headlights. If they have strengthened the CAN bus security by using encryption, authentication or proper firewalling then it should be ok. No way to know from the press information though. 

[Don C]

On 12/21/2023 at 9:29 AM, ColinBarber said:

A CAN bus attack doesn't need access to a fuse box, just access to the bus wiring which is present at the headlights. If they have strengthened the CAN bus security by using encryption, authentication or proper firewalling then it should be ok. No way to know from the press information though. 

The spec of the new 300h say “Ultra Wide Band Security” whatever that means!

[Tickedon]

45 minutes ago, Don C said:

The spec of the new 300h say “Ultra Wide Band Security” whatever that means!

It means a relay attack where thieves “scan” for your keys and relay back to the car doesn’t work. UWB uses very specific timing, and a relay can be detected - meaning the car (in theory) won’t unlock if the key isn’t actually within the right distance of the car. 

[ColinBarber]

1 hour ago, Don C said:

The spec of the new 300h say “Ultra Wide Band Security” whatever that means!

As above from Tickedon, UWB is a wireless technology that is used in this instance for the vehicle to more accurately determine how near a key fob is to the vehicle using Time of Flight calculations - therefore if your key is 'relayed' from your home to the vehicle it will know and won't unlock. It also potentially allows a UWB capable phone to be used as a key fob.

I'm 99% sure the LBX will use authentication on the CAN bus, the same as the Yaris Cross, and therefore isn't susceptible to the common attack we see on the ES and RX but Toyota haven't officially confirmed this.

[Biffo]

I have asked Lexus customer relations about CANBUS thefts/security on the LBX, got  a message back that they have requested information from an internal team, and they will get back in touch as soon as they have a reply.

[AWC]

14 hours ago, ColinBarber said:

As above from Tickedon, UWB is a wireless technology that is used in this instance for the vehicle to more accurately determine how near a key fob is to the vehicle using Time of Flight calculations - therefore if your key is 'relayed' from your home to the vehicle it will know and won't unlock. It also potentially allows a UWB capable phone to be used as a key fob.

I'm 99% sure the LBX will use authentication on the CAN bus, the same as the Yaris Cross, and therefore isn't susceptible to the common attack we see on the ES and RX but Toyota haven't officially confirmed this.

So would this mean we do not need to use a Faraday pouch?

[ColinBarber]

20 minutes ago, AWC said:

So would this mean we do not need to use a Faraday pouch?

Correct.

[AWC]

11 minutes ago, ColinBarber said:

Correct.

That's a big boon for me because I hate using them!

[Biffo]

On 1/19/2024 at 9:38 AM, Biffo said:

I have asked Lexus customer relations about CANBUS thefts/security on the LBX, got  a message back that they have requested information from an internal team, and they will get back in touch as soon as they have a reply.

Reply from Lexus Customer Relations received states:-

We have requested information from an internal department who have advised that the LBX has been counter measured against CanBus theft. Most Lexus vehicles have the latest electrical platform that prevents CanBus theft. 

Other security measures that the LBX features includes: 
Alarm/anti-theft (with siren and two sensors)
Engine immobiliser
Two motion door lock
VIN Etching
Locking wheel nuts (Thatcham approved)

 

[Juicedrinker]

On 12/20/2023 at 8:50 PM, SH20 said:

I don't know is the answer but if Lexus hasn't taken note of the abysmal security issues the ES has suffered from for example and failed to secure the LBX with an encrypted CANBUS platform then they do not deserve to sell a single one. 

Couldn't agree more with you on this.  I'm on my third Lexus BUT will not be getting a fourth if they do not sort out their appalling attitude to resolving their security weaknesses

[Don C]

Off you trot to BMW where everything is super and perfect.  Good job you’re on a high income, you’ll need it 👍

[Tickedon]

2 hours ago, Don C said:

Off you trot to BMW where everything is super and perfect.  Good job you’re on a high income, you’ll need it 👍

Given Lexus (as a percentage of their cars) are the number 1 stolen car brand in the UK in 2023, overtaking JLR, I don’t think it’s unreasonable for anyone to suggest Lexus ought to take some action.

JLR are spending £15m retrofitting upgrades to their Land Rovers and other cars… dating back to cars from 2016! They are owning the issue, and are even subsidising insurance costs given that some of their cars essentially became uninsurable (plenty reports in these forums of very high prices or insurers refusing to renew and drop cover for Lexus models).

Whereas Lexus have introduced a protection plate, that doesn’t actually solve the issue, and is only available on one of the vulnerable models. 

https://www.dailymail.co.uk/news/article-13060215/Britain-stolen-cars-Interactive-graphic-targeted-thieves-list-Lexus-RX-Range-Rover.html#

[Don C]

2 hours ago, Tickedon said:

Given Lexus (as a percentage of their cars) are the number 1 stolen car brand in the UK in 2023, overtaking JLR, I don’t think it’s unreasonable for anyone to suggest Lexus ought to take some action.

JLR are spending £15m retrofitting upgrades to their Land Rovers and other cars… dating back to cars from 2016! They are owning the issue, and are even subsidising insurance costs given that some of their cars essentially became uninsurable (plenty reports in these forums of very high prices or insurers refusing to renew and drop cover for Lexus models).

Whereas Lexus have introduced a protection plate, that doesn’t actually solve the issue, and is only available on one of the vulnerable models. 

https://www.dailymail.co.uk/news/article-13060215/Britain-stolen-cars-Interactive-graphic-targeted-thieves-list-Lexus-RX-Range-Rover.html#

They’ve done it.  Are you ignoring the post above?   As for anything JLR, it might as well be stolen because it’ll be at the dealer more than in your possession.