internalblue

Regarding firmware patching, look at InternalBlue [1]. I guess they did it for one IC, but obviously can't do it at will for just any IC and instead hand wave "it can be done". Overall I don't think it's impossible: Someone stated it would be unidirectional, and the bitrate was not given (read: could even be minutes per bit for all we know). But yeah, I'm sceptical, too. A gateway would have made more sense to me, because it does not require firmware-level cooperation with chip set manufacturers and you can reuse existing space networks. Especially since they're not aiming to add the feature into future ICs (which could have driven sales across the whole industry), but backport it instead, competing with the manufacturers and voiding existing FCC et al. certification. [1] https://github.com/seemoo-lab/internalblue

I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significantly for BLE? So either they establish normal connections between relays and victims (meaning two keys, one between each relay and each victim), and then forward data coming out of the Link Layer between the attacker devices - or they need to sniff the whole spectrum in case there is just one key between car and fob. Last time I checked, sniffing the full spectrum of BT required three SDRs, meaning six in total; making this attack rather expensive to pull off (no problem for professional thieves though, I guess). OTOH if they can use any BT stack (or manipulate it with e.g. InternalBlue[1]), potential carjackers just need two Android Phones and good WiFi :( [1] InternalBlue: https:

Given [1] I really hope they do. [1] https://github.com/seemoo-lab/internalblue