3 Smartkeys

Check the owner's manual, but I'm believe it is possible.

 

wait until you see what they cost.

 

It was possible in previous generations, though I don't recall the exact limit on number of programmed keys. I'd be very surprised if they reduced it.

 

They're expensive - probably why nobody has tried.

 

Yes. In the Repair Manual (available by subscription to techinfo.toyota.com), Toyota writes, “A maximum of 7 electrical key transmitter sub-assemblies can be registered (this includes any electrical key transmitter sub-assemblies registered when the vehicle was purchased).”

 

Anyone know how to DETECT the Gen4 SKS keys in one's home? I read about frequencies on the Gen2 Forum (see below), but see nothing here yet. (Replacement fob is $330! Ugh...)

FROM GEN2 FORUM ON THIS TOPIC: "The car transmits on 134.2 KHz. When the fob recognizes the car signal, it replys on 315 MHz. I don't know if the car transmission is encrypted and/or varying. It may not be, in which case you just record the car signal and replay it. The normal range of the car transmission is about 3 feet. I suspect that a long piece of single conductor wire strung from one of the door oscillators would have a longer range, perhaps enough to trigger the keyfob reply from maybe 10 or 20 feet away.
The keyfob signal is certainly encrypted and varying. If you press the same button multiple times, it sends a different sequence each time. But you don't care what the keyfob says, only that it is saying something. So if you can get the keyfob triggered, then you'll need a 315 MHz receiver with a signal strength indicator. A directional antenna would be a real plus. So you need a 315 MHz receiver with at least a signal level meter. Then an antenna extender from an oscillator on the car. Maybe use a 100 foot long single wire (or an ordinary extension cord), and take several loops of it around the oscillator at one end."

 

I typically detect my keys by reflected visible light, but if you prefer an active RF approach, as I posted in another thread, I believe the frequencies are the same as the previous generation. My sources for that posting were Toyota’s Repair Manual and New Car Features book and the attachments in the FCC OET database for the key (FCC ID HYQ14FBC) and Smart Key system (FCC ID NI4TMLF15-1).

 

I wish you had posted earlier. I had to resort to other means:

1. Set fire to house.
2. Wait.
3. Rent front end loader, conveyor, and industrial sifter.
4. Feed conveyor bucketfuls of ash and debris to dump into the sifter.

By the time I finished, I remembered they were still in the car.

 

I hope you didn't leave your wife in the house.

 

No, she ran out after step one. She was in some sort of mood -- asked what I thought I was doing. After I told her, she asked, "Have you lost your mind?!"

I replied, "No, I told you, my car keys."

She ran off saying something about visiting our lawyer friend to see a D-Force. Knowing Hollywood these days, it's probably some action movie reboot.

 

I've spoken to my top colleagues in radio, drone design, cellular, etc., and they say that sensing the presence of a lost fob simply cannot be done w/o very expensive equipment & lots of time (to try & match the changing signal, which helps avoid car thefts, I guess).
I think we'd almost all rather have risk of car theft than such expensive key replacement. All of us are more likely to lose a fob than to have our car stolen, in almost any U.S. neighborhood, on almost any make & model.

 

I agree that decoding keyfob output requires expensive equipment, but you just want to detect a signal. The receiver in the car can't be that expensive, but talking to it is a black art.

 

I would respectfully disagree.

Cost may have been a barrier years ago, when custom RF work often meant using test instruments from companies like Hewlett-Packard, Rohde & Schwarz, or Anritsu, but today, inexpensive software-defined radio (SDR) transceivers can easily be programmed to transmit and receive narrowband LF and VHF signals like those used by the Smart Key system. Whatever security Toyota’s system provides comes from its cryptography, not from the difficulty of intercepting or reproducing the signals exchanged between car and key.

As explained in the articles I linked in another post, criminals are already exploiting vulnerabilities in keyless entry systems, and sadly, the Prius is no exception.

 

Personally, I would be more interested in Toyota stepping up on security since Chris Valasek and Charlie Miller have made all of their CAN BUS car hacking material publicly available free on GitHub. Some of their hacks are dependent upon physical access to the vehicle, but I would rather be safe than sorry.

 

I imagine Toyota could make some improvements, but I wouldn’t be too concerned about the techniques described in the Valasek and Miller paper, which I linked in another posting. Their main contribution was reverse-engineering some of the communications protocols used by the Toyota Techstream diagnostic software and Calibration Update Wizard utility, but I believe everything they describe requires physical access to the DLC3 (OBD II) diagnostic connector or other CAN bus wiring inside the car or under the hood.

I don’t see anything inherently wrong with treating the diagnostic connector as a trusted interface; owners and independent workshops need privileged access to vehicle systems for diagnosis and repair, and at least in the United States, vehicles are required by law (42 U.S.C. § 7521(m)) to have a standardized interface for emissions-related diagnostics. If Toyota wanted to alter this interface to add security features, they would first have to get the EPA and CARB regulations changed or waived, which is unlikely to happen if the modified interface wouldn’t work with existing emissions inspection (smog check) equipment.

As I wrote previously, though, it’s a problem when people misuse the diagnostic connector by attaching poorly-secured devices, like the one used with Metromile insurance, that allow more remote access than intended. It’s also important for built-in gateway devices—such as Toyota’s telematics transceiver, with its own cellular data connection—to have good security, especially if they are connected to multiplex buses, as on the Prius Prime.