Thieves outwit high-tech advances

Automobile antitheft systems have gotten smart -- but so have networks of criminals.

February 8th, 2006

LA Times

By Ralph Vartabedian, Times Staff Writer

The recent thefts in Southern California of several Lexus LS 400s, known among security experts for their antitheft systems that tie into the car's central computer system, have created new concerns about the evolving expertise of organized crime rings to defeat the auto industry's most clever engineering.

In the past, the theft of a few vehicles might not have seemed like such a big deal. But the ability of thieves to defeat top-tier automotive technology is another sign of the sophistication of criminal networks. Increasingly, car theft is more like computer hacking than like breaking and entering a home or business protected by physical locks and keys.

For every step taken by engineers to increase the difficulty of stealing a car, criminal networks have responded with schemes to defeat physical and electronic systems.

"It is a cat-and-mouse game between the bad guys on the street and the engineers in the lab," said Kim Hazelbaker, senior vice president of the Highway Loss Data Institute, a Washington, D.C. insurance group.

Though theft rates have been cut in half, insured losses remain unchanged from a decade ago as professional thieves target higher-value vehicles.

Just like any automotive technology, antitheft systems differ widely in both their design and effectiveness, said Forrest Folck, who operates Motor Vehicle Forensic Services in San Diego.

The LS 400s that were stolen are among models that use a smart key to tie into the car's electronic control module, or ECM, the central brain for the engine, transmission and related systems. Unless the smart key sends the proper code to the ECM transponder, the ECM disables the electronic fuel-injection system.

Here's how a criminal ring has defeated it: First, they force the locks on the door and steering column with a custom-made tool, using a socket wrench coupled to a specially machined blank key that fits any Lexus lock and can deform the wafers and tumblers.

Once inside the car, the hood is popped, the steering wheel lock is broken and the ignition electronics can be engaged. Normally, however, the ECM transponder would recognize that the key is not providing the proper security code.

But a second team member goes straight for the ECM, unscrewing the 6-by-8-inch box under the hood and unplugging the 50-pin connector. It is replaced with an altered ECM with a disabled transponder that does not shut down the fuel-injection system, Folck said.

Ken Zion, a collision and theft expert from Auto Collision Consultants, said he inspected two of the Lexus LS 400s and was impressed with how little damage was caused during the thefts.

"This was very ingenious," Zion said. "They can do the entire ECM swap in under five minutes."

The Lexus vehicles were recovered by an inter-agency auto theft task force, one of 16 in the state funded with a portion of vehicle taxes in an attempt to keep a lid on the theft problem.

Southern California is close to the Mexican border and next to the nation's largest port complex, both destinations of choice for thieves who want to export luxury cars to foreign markets, according to Hazelbaker.

In 2004, there were 2.3 theft claims nationwide for every 1,000 insured vehicles. By contrast, Los Angeles has 2.8 theft claims per 1,000 and the claims average $10,240, about 30% above the national average, he said.

Mark Stowell, a theft expert with the National Insurance Crime Bureau who works with the Orange County Auto Theft Task Force, said police recover 86% of stolen vehicles. While some are undamaged, many are stripped, crashed or burned.

Every generation of antitheft technology is good for a while but eventually gets figured out by criminal networks, a cycle Hazelbaker has seen play out before.

"A new technology is good for two or three years before you see the theft statistics creep back up," he said. "By five or six years, if the manufacturer hasn't changed the technology, you see the numbers back to where they were before."

The evolution began with locking steering columns back in the 1970s. They were effective until thieves defeated them with brute force. Now, even teenage thieves know how to defeat a locking steering column.

Among the most sophisticated antitheft systems is the Bosch controller area network system, used on BMW, Mercedes-Benz and other brands, Folck said.

But thieves have increasingly found ways to defeat this system as well, using laptop computers that plug into the OBD II connector under the steering wheel to reprogram the vehicle's software. Who is smart enough to write pirate software to steal cars? Electrical engineers who are familiar with basic computer design, Folck said.

Less sophisticated antitheft systems are widely used, including the General Motors "Pass Key" system. Folck said Pass Key systems are defeated using a simple magnetic tool. Consequently, the Cadillac Escalade has ranked as the most frequently stolen vehicle in the nation.

Folck said homemade antitheft systems that cut off power to a key mechanical system often cause thieves more trouble than a factory device because they are so unpredictable in design. But even if a homemade or factory electronic system does work perfectly, it will not necessarily protect a vehicle.

Some theft teams use casters to elevate a car off its wheels and then roll it onto a flatbed tow truck.

back to News Room