[ChrisSnow]

That is incorrect. BMW's reference to UWB technology is for Digital Key Plus on a compatible phone:

The keys do use UWB. If you look up the fccid for the key and the spectrum they applied for you will see.

UWB also works over a much longer range than you think. Practical range is tens of metres.

 

[Paladin1]

Nowhere does BMW mention the use of UWB technology for their key fobs. Nowhere. Their engineering specs exclusively refer to RFID technology, which is supported by the fact that the keys "time out" (unnecessary with UWB), and the distance over which they operate. Unless you have seen conflicting documentation.

https://www.bmw.com/en/innovation/bmw-digital-key-plus-ultra-wideband.html

 

[jcolinzheng]

Paladin1, I wouldn't think UWB keyfob is something that BMW necessarily wants to brag about at this point, because it makes their other models look bad/unsafe.

The page you linked could be intended to explain how Digital Key Plus works (i.e. using UWB). I don't think that's an evidence that keyfob does not use UWB.

Testing by ADAC explicitly lists NO for "Illegales Öffnen möglich" (can illegally open the car) and "Illegaler Motorstart möglich" (can illegally start the car), contrasting other BMW models. The comment column cites UWB. Looking at all the other car models they tested, I would find it very surprising if they tested using Digital Key Plus only (and without mentioning that).

https://assets.adac.de/image/upload/v1645525388/ADAC-eV/KOR/Text/PDF/Keyless_Liste_500_Autos_rjqzty.pdf

Their engineering specs exclusively refer to RFID technology

Link?

 

[jcolinzheng]

keys "time out" (unnecessary with UWB), and the distance over which they operate.

It is possible that key fobs time out to save battery. Max UWB distance is easily tens of meters (google "uwb range"). The fact that Digital Key Plus has a different max distance than the key fob may be due to different power used for UWB between phone and key fob, and/or that the car artificially places different distance limits between phone and key fob.

 

[ajcham]

UWB transmission - like NFC but slightly further - is very short range (think scanning your smart watch or phone on a pay terminal).

This is incorrect. UWB technology can be used at 10s of metres, and provides centimetre-level positioning accuracy. In the case of my Pixel 6 Pro and the Digital Key Plus, the car unlocks when I move within 1-2 metres of the car, and locks when I move more than 3-4 metres away.

 

[jcolinzheng]

p.s. I have used Digital Key Plus with Pixel 7 Pro, and think it's a big step backwards in convenience for me. Doing any of the following from more than 20 feet away becomes difficult or impossible: locking/unlocking the car, opening the trunk, rolling up/down all the windows.

 

[ajcham]

So I've just looked up the FCC results for the keyfob, and it does use UWB. So I'm happy to stand corrected on that .

The FCC ID of my keyfob is IYZBK1 (opened it up and checked), and looking through the various documents on there for the keyfob provides the answers:

 

[Paladin1]

So I've just looked up the FCC results for the keyfob, and it does use UWB. So I'm happy to stand corrected on that .

The FCC ID of my keyfob is IYZBK1 (opened it up and checked), and looking through the various documents on there for the keyfob provides the answers:
View attachment 5195

Sounds like the vehicle has a UWB module (which it would need for DK+) but the "passive entry" key itself uses bidirectional RFID, at least that's what I read. But regardless of whatever proprietary mechanism BMW uses, it sounds like they have thought of and addressed security which should somewhat reduce concerns about key hacking.

 

[ChrisSnow]

Sounds like the vehicle has a UWB module (which it would need for DK+) but the "passive entry" key itself uses bidirectional RFID, at least that's what I read. But regardless of whatever proprietary mechanism BMW uses, it sounds like they have thought of and addressed security which should somewhat reduce concerns about key hacking.

No, that's not how FCC certification works, if they applied for the radio grant it has to have the radio included.
It has a 433mhz and UWB radio in the key.

 

[ajcham]

Yeah, it's got both 433MHz and the higher frequency UWB.

 

[darylp310]

Good to hear that BMW has improved FOB security in the past couple of years! So who wants to go to London and leave your iX "honey-pot" outside with the FOB nearby and see if these clever thieves can get into your car with a remote relay attack?

 

[Paladin1]

No, that's not how FCC certification works, if they applied for the radio grant it has to have the radio included.
It has a 433mhz and UWB radio in the key.
View attachment 5196
View attachment 5197

Good job tracking down - frequencies nailed it! No wonder these things cost so much to replace - that should resolve the concerns with relay attacks from unsophisticated hackers. There's still the flatbed method though...sleep tight all....

 

[jcolinzheng]

Good job tracking down - frequencies nailed it! No wonder these things cost so much to replace - that should resolve the concerns with relay attacks from unsophisticated hackers. There's still the flatbed method though...sleep tight all....

I'm not sure flatbed is realistic - a parked car should alarm like crazy when this type of motion is sensed

 

[electric_journey]

Good to hear that BMW has improved FOB security in the past couple of years! So who wants to go to London and leave your iX "honey-pot" outside with the FOB nearby and see if these clever thieves can get into your car with a remote relay attack?

@darylp310 I'm not sure the iX is that desirable to thieves here. Partly because it's an EV with limited range (most models sold here are the iX40) and because it's quite a distinctive looking car, so it's something that stands out on the road, which criminals may not want if they want to blend in with a stolen car.

 

[Croddlebopper]

Am I out of step here? I thought the key relay had been fixed by a simple motion detector.

if the key is not moved or carried then it goes into Sleep mode and cannot be woken by external communication pokes?

does that sound familiar??