Sunday, 23 November 2014 15:28

Stolen Vehicle Report

Written by

I thought it would be good to follow up on the vehicle security, since there has been quite a bit of news recently on car thefts, in particular a piece on Watchdog on the BBC showing how easy it is to steal vehicles especially on some of the latest models.

  1. ABS Anti Braking System Module ECU.
  2. TCM Traction Control Module ECU.
  3. KVM Keyless Vehicle Module ECU.
  4. Low Frequency Transmitter (125kHz/134kHz) Doors, Boot/Trunk and Internal.
  5. Smart/Proximity Key.
  6. RF Radio Frequency Receiver Module ECU (315MHz/433MHz).
  7. Engine Start/Stop button.
  8. Security System Module ECU.
  9. ECM Engine Control Module ECU.
  10. Instrument Cluster Module.
  11. Steering Control Module ECU.

Well I have to say I already knew this from being involved in key programming devices for over 12 years, and I have to say to the Vehicle Manufacturers “I told you so” in 2006 when I met with Ford, VW, Audi and Thatcham to explain what is happening and is there some way that the vehicle manufacturers could work with the aftermarket in some way to offer a key programming service to registered professionals, so the equipment being developed was not available to anyone. They never responded with any follow up or offer, just used the meeting to see how we did things and I suppose upgrade their software.

Well here we are in 2014 and you can steal a high value vehicle in lest than 30 seconds, so how has that become possible ?

The early systems as I have explain use a transponder in the key plus a mechanical blade to start the vehicle. When the key is inserted into the ignition the transponder is activated and the signal is sent to the vehicle which enables starting.

This system has developed over the years, and the new vehicles and systems offer a Proximity/Smart key system on many of the later vehicles. This system enables the vehicle to be opened and started without inserting a key or switching on the ignition.

The way this works is, there are a number of transmitters located around the vehicle, front doors, rear doors, rear bumper which send a signal out. When this signal reaches the Proximity/Smart key the transponder wakes up and sends a signal back to the vehicle with the correct code.

Once the vehicle has received this code, it enables the vehicle door locks to operate when you pull the door handle or press the proximity button on the door handle. The door then opens.

Once you enter the vehicle with the proximity/smart key, there are at least 1 or 2 internal transmitters that again send a signal to the key, and if the key responds with the correct code then pressing the start button will enable the vehicle to start.

That’s it, simple.

So programming a new key into a vehicle using a security pin code is quite easy as there is no mechanical key cutting. All that is required is access to the OBD port to program a new proximity/smart key and press the start button. Access to the OBD port is never easier as most are now located above the pedals or close to the door frame, so smash the window, lean inside the car and connect to the OBD port and program a key. As soon as that key is programmed the doors open, press the start button and the car is gone…

The systems that have been implemented by the manufacturers all use pin codes or security algorithms and the old saying “If man made it, man can break it” and that is certainly the case as these devices are now coming out of China that program these vehicles for less than £100.

So your car that you paid between £30K and £100K that has the latest security smart/proximity key system fitted, will is not quite as secure as they told you it is.

The AA are working on a device that stops this type of theft, and I believe there are a couple of other devices that offer some protection on certain models. So interesting times ahead.


As I have touched on the Proximity/Smart key systems, I though perhaps it would be best to explain in more detail on how these systems work. I have chosen a system that is fitted to Range Rover and Jaguar models to show how complex these systems have become.


The Proximity Smart Key systems, all work in a similar way. The system compromises a number of components, some are linked to other systems to enhance the security of the whole vehicle.


The Smart/Proximity key receives low frequency signals on 125kHz or 134kHz frequency transmitted from the proximity transmitters located in the vehicle doors or rear bumper.

The key has a transponder, which when you operate the vehicle door by either pulling the handle or pressing the button (This varies on vehicles and models) the transponder is energised through a 125kHz or 134kHz signal. The key then responds to the vehicle on a higher RF frequency 433MHz or 315MHz sending a security message to the vehicle system.

If the vehicle and the key communicate with the correct security messages, then the vehicle will open the door. A second communication is then instigated when you enter the vehicle and the key comes into range of the internal proximity transmitters, normally located in the centre console, this then allows the starting of the vehicle using the start/stop button.

There are a number of sensors transmitting the 125KHz/134KHz signal around the vehicle, normally in the doors, boot/trunk, external bumper, centre console, rear seats, glove box area etc, depending on the make and model.

The door and bumper transmitters control the opening of the doors, the internal transmitters control the starting of the vehicle. On some models there is an additional transmitter in the vehicle boot/trunk which gives additional protection against locking your smart key in the boot, which can easily be done on some older models and systems.


I thought I would also just give you a heads up on a web site and app that I have developed for Remote Keyless Entry programming and information. The web site is called :

There is also an APP in the Apple IOS store and the Google Play store that allow you to install all the information on the device so no internet connection is required. They are both free to download and use.

The app shows a picture of the remote control that is used on the vehicle and the programming instructions on how to program a new remote into the vehicle, or if it is just synchronization then it will show this. Other information that is being added, number of remotes that can be programmed, the battery type and other tips and hints.

Read 4635 timesLast modified on Sunday, 23 November 2014 15:52
Greg Chambers

Greg Chambers is 45 years old and married with two children.
He has been in the Automotive sector since leaving school, when he joined Lucas Automotive as an apprentice.
Following his apprenticeship he joined Lucas Engine Management Systems as an electronics engineer, and subsequently moved to Lucas Aftermarket as a Test Equipment development Project Manager.
In 1995 he moved into Lucas Test Equipment as the Laser 2000 Diagnostic Software Manager.
In 2000 he left TRW Automotive as it was known by then, to set up Advanced Diagnostics Ltd, a company that specialised in equipment for programming and copying transponder keys on cars and trucks, along with Advanced Keys Ltd which supplied keys, transponders and remote controls.
In 2011 he decided to exit from the AD company and relocate to Devon, setting up The Diagnostic Box.


Latest from Greg Chambers

More in this category:« Key Security Systems
Login to post comments

MOT News