Car Theft Prevention for High-End Cars: Relay Attacks, CAN Injection and the Countermeasures That Work

Why Car Theft Prevention Matters on the Costa del Sol

Car theft prevention used to mean a steering lock and a loud siren. On a modern keyless car, neither matters much. The high-end cars stolen around Marbella today usually leave with no broken glass and no alarm, because the thief has convinced the car's own electronics that a valid key is present.

How Modern Cars Are Actually Stolen

Five techniques account for almost every keyless theft of a high-end car, and organised groups usually chain two or three of them. None requires breaking the car's cryptography in real time; each exploits a design assumption.

1. Relay attacks on passive keyless entry

A passive keyless entry and start (PKES) system works as a challenge and response. Antennas in the door handles and cabin transmit a low-frequency field, typically around 125 kHz, with a deliberately short range of one to two metres. The key wakes, computes a cryptographic answer and replies on UHF, usually 433 or 868 MHz in Europe.

The car verifies that the answer is correct. It does not verify how far away the key is. A relay attack places one device near the house, where the key sits on a hall table, and a second device beside the car. The two devices extend the low-frequency field across the gap, so the genuine key answers a car that is 20 metres away. The cryptography is never broken; it is simply carried further than the engineers intended.

2. CAN injection through the headlight or wheel arch

CAN injection was first documented on Toyota models, but the technique applies to any car that trusts unauthenticated CAN messages. Automotive security researcher Ken Tindell documented it in 2023 after a Toyota RAV4 belonging to his colleague Ian Tabor was stolen

The thief pulls back the front bumper or wheel-arch liner and connects to the CAN wiring behind the headlight. The device impersonates the smart-key ECU and sends a "key validated" message, which the gateway forwards to the powertrain bus, where the engine ECU accepts it and releases the immobiliser. A second burst tells the door ECU to unlock.

The device wins the bus in an unusual way. CAN is a wired-AND network in which a dominant bit overrides a recessive one; the modified transceiver holds the bus recessive, so the genuine ECUs cannot transmit and drop into error recovery while the spoofed frames get through. Tindell estimated the parts at about $10, packaged inside a dummy Bluetooth speaker and sold for several thousand. The theft takes minutes, and its only fingerprint is a storm of communication fault codes in modules that have not actually failed.

3. OBD key programming and module swaps

Once inside the cabin, by relay, by a jammed lock command or by a broken quarter-light, the thief connects to the OBD-II diagnostic port. Key-programming equipment then adds a blank key to the immobiliser's list of authorised keys, using the same diagnostic routines a dealer uses. Where the port is protected, some groups replace the immobiliser, body control module or engine ECU with a pre-matched set. The group dismantled in Marbella in 2024 reprogrammed control units and coded blank keys in exactly this way.

4. Radio jamming and rolling-code capture

A jammer floods the 433 or 868 MHz band while the owner presses lock in a car park. The car never receives the command, stays open, and the owner walks away believing it is secure. The same tactic, on GNSS and mobile bands, blinds a tracker after the theft.

A more refined variant jams the key's rolling-code transmission while recording it, then replays the unused code later. Rolling codes defeat simple replay, but not an attacker who prevents the code from ever reaching the car.

5. Cloning keys through weak transponder cryptography

The immobiliser transponder in many keys still runs a proprietary cipher designed in the 1990s. Hitag2, Megamos Crypto and Texas Instruments' DST40 and DST80 have all been broken publicly. In 2020, researchers at KU Leuven and the University of Birmingham showed that DST80 keys on Toyota, Kia, Hyundai and early Tesla Model S fobs could be cloned in seconds after brief proximity to the key, because the secret was derived from public data such as the serial number. Affected Toyotas included the Land Cruiser, Hilux and RAV4 from roughly 2008 to 2016.

What Factory Security Does, and Where It Stops

A factory immobiliser stops the opportunist completely. It was never designed for an organised group with diagnostic equipment, time in a quiet garage and physical access to the wiring loom,even car security development is a daily task for car developers.

The transponder immobiliser

The immobiliser control unit, often integrated into the body control module or keyless ECU, runs a challenge and response with the transponder in the key. If the answer is correct, it authorises the engine ECU through a paired secret exchanged over the vehicle network. Two weaknesses follow from this design. The final authorisation is a message on the CAN bus, which CAN injection can fake. And the list of authorised keys is editable through the same diagnostic routines a dealer uses, which OBD key programming exploits.

Ultra-wideband keys

Ultra-wideband (UWB) keys measure distance by time of flight. The car and key exchange pulses a few nanoseconds wide, and every metre of distance adds about 3.3 nanoseconds each way. A relay adds processing delay and cable or radio distance, so it cannot make a remote key appear close. This is the only technical fix for relay theft, and it is the basis of the CCC Digital Key 3.0 standard used by phone-as-key systems.

Jaguar Land Rover developed UWB protection in 2018 and later invested more than £10 million in body control module updates for 2018–2022 Range Rover and Range Rover Sport models; UK thefts of those models fell by more than 40%. The lesson is in the second half: UWB stops relay attacks, but it took separate module software to stop thieves who started the car by other means.

Motion-sensing sleep fobs

Many current fobs contain an accelerometer and stop answering after a period without movement. This defeats the classic overnight relay attack on a key left on a hall table. It does not protect a key in a jacket pocket in a restaurant, a hotel lobby or a beach club car park, where it is still moving.

Authenticated CAN messages and UNECE R155

The permanent answer to CAN injection is message authentication: each safety-relevant frame carries a truncated message authentication code (MAC) and a freshness counter, computed with keys held in a hardware security module. AUTOSAR's SecOC specification defines one such scheme. A spoofed "key validated" frame without a valid MAC is simply ignored.

UNECE Regulation R155 has required a certified cybersecurity management system for all new vehicles registered in the EU since 1 July 2024. R155 regulates the manufacturer's process; it does not prescribe authentication on every CAN frame. More importantly, almost every high-end car on the Costa del Sol today was built before it applied. For those cars, the gap has to be closed after the factory.

A Layered Car Theft Prevention Strategy

No single product stops all five attacks. Effective protection breaks the theft chain at several points, so a thief who defeats one layer still faces a car that will not start, cannot be driven far or cannot be hidden.

Four of the five attack techniques converge on the start stage, so that is where a second, hidden layer pays off most.

Layer	Countermeasure	Stops	Limitation
Key	Faraday storage away from doors and windows; keyless entry disabled where the car's coding allows; UWB key where the manufacturer offers it	Relay attacks	No effect on CAN injection or OBD programming
Lock	Confirm locking visually (mirrors folding, indicators flashing) before walking away	Lock jamming	Depends on habit
Diagnostic port	Locked or relocated OBD-II port, with the original location left looking standard	OBD key programming	A module swap bypasses it
Start	CAN-bus pandora immobiliser, disarmed by a PIN sequence on the car's own buttons; no fob, no LED, no radio signature	Relay, CAN injection, OBD programming, cloned keys	Only as good as its installation
Start	Secondary hard-wired start inhibit on a circuit chosen per car	Module swaps and generic bypass tools	Must be engineered per platform to avoid fault codes
Physical	Steering-wheel lock, wheel clamp, garage bollard	Quick drive-away	Deters and buys time; does not prevent
Recovery	Tracker with GNSS, LTE and an independent backup channel, jamming detection and a driver ID tag	Blinding of single-channel trackers	Recovers the car; does not prevent the theft
Counter-surveillance	Sweep for planted GPS trackers	A specific car being followed and stolen to order	Needs repeating
Forensics	Diagnostic audit of the key list and fault-code history	Extra keys left coded; early signs of CAN tampering	Detects; does not block

Why the start layer matters most

Relay, CAN injection, OBD programming and cloned keys all end at the same point: the car believes a valid key is present. A pandora immobiliser adds a second, independent condition the thief cannot see. It sits on the CAN bus, waits for a PIN sequence entered on existing controls such as the steering-wheel buttons or window switches, and blocks engine start until it receives it.

There is no fob to relay and no LED or radio transmission to detect. Because each installation is placed differently, a gang cannot develop a standard removal routine for it.

The tracker has to survive a jammer

A tracker that reports only over GNSS and mobile data can be blinded by a jammer carried in the thieves' own car. For a high-value vehicle, specify four things: an independent backup channel, a backup battery that survives the main supply being cut, jamming detection that raises an alert rather than going silent, and a driver ID tag so the system alarms whenever the car moves without its owner present.

The key audit: the check almost nobody does

Through diagnostics we read how many keys the immobiliser has authorised. A car sold with two keys but showing three coded is a warning: the third may belong to a previous owner, a careless workshop or someone who plans to return. We disable unknown keys and include this check in every pre-purchase inspection.

The same scan shows fault-code history. A cluster of lost-communication codes around the front lighting module, with no failed parts, is the signature of an attempted CAN injection. Ian Tabor's RAV4 was tampered with twice before it was finally stolen.

A safety rule: never stop a running engine

Every start inhibit we fit acts only before the engine starts. A system that cuts fuel or ignition while the car is moving creates a far greater risk than the theft it is meant to prevent, and we do not install one.

Platform Notes: McLaren, Porsche, Land Rover, Toyota and German Brands

Every car needs the same layers, but the weak point, and therefore the first measure, differs by make and model year.

Platform	Main exposure	First measures
McLaren (720S, 765LT, Artura, GT)	Keyless entry and start; high value makes them targets for theft to order and for lifting onto trailers	Tracker with driver tag; pandora immobiliser routed with the car's architecture in mind; key-list audit with McLaren's MDS diagnostic system
Porsche (911, Cayenne, Macan, Taycan)	Relay attacks on cars with the Entry & Drive keyless option	Faraday storage; Porsche Vehicle Tracking System or an equivalent tracker with driver recognition; pandora immobiliser
Range Rover, Range Rover Sport, Defender	Relay attacks on earlier keys; keyless start by other routes on 2018–2022 cars without updated software	Confirm JLR's security software updates are installed; UWB key; OBD protection; pandora immobiliser
Toyota Land Cruiser, Lexus	CAN injection through the headlight harness; DST80 key cloning on roughly 2008–2016 Toyota models	pandora immobiliser as a priority; investigate any disturbed bumper or wheel-arch liner; tracker
BMW, Audi, Volkswagen Group	Relay attacks on Comfort Access and Advanced Key; OBD key programming on earlier generations; Megamos Crypto transponders in older keys	OBD protection; key-list audit; pandora immobiliser

Model year matters as much as the badge. A diagnostic check of your exact car tells us which keys are coded, which software level it runs and which attacks it is exposed to.

Frequently Asked Questions About Car Theft Prevention

Does a Faraday pouch stop keyless car theft?

It stops relay attacks on the key inside it. It does nothing against CAN injection, OBD key programming or cloned keys, because those attacks do not need your key at all.

Can a car with an ultra-wideband key still be stolen?

Yes. UWB defeats relay attacks by measuring the key's real distance, but it does not stop CAN injection, OBD key programming or module swaps. A UWB key should be combined with a start-layer immobiliser and OBD protection.

What is a pandora immobiliser?

A pandora immobiliser connects to the car's CAN bus and blocks engine start until the driver enters a PIN sequence on existing controls, such as the steering-wheel buttons. It has no fob, no LED and no radio signal, so thieves cannot detect it with a scanner.

How do I know if someone has tried to steal my car?

Warning signs include a disturbed front bumper, headlight or wheel-arch liner; sudden warnings for lights, cameras or driver aids; lost-communication fault codes with no failed parts; an unfamiliar GPS tracker on the car; or more keys coded to the immobiliser than you own. A diagnostic scan confirms or rules out each of these.

Is a GPS tracker enough on its own?

No. A tracker helps recover a stolen car; it does not prevent the theft. Choose one with an independent backup channel, its own battery, jamming detection and a driver ID tag, and pair it with a start-layer immobiliser.