Europol: 31 Arrested for Using Malware to Steal Keyless Cars

French authorities have dismantled a car theft ring that employed malware to steal keyless cars.

With the support of Europol, Eurojust, as well as Spanish and Latvian police, French authorities dismantled a car theft ring that “used a fraudulent software to steal vehicles without using the physical key fob.”

The action, carried out on 10 October in the three countries, resulted in the arrest of 31 suspects. Police raided 22 locations and seized more than 1 million euros in criminal assets.

The investigation was initiated by the French Gendarmerie’s Cybercrime Centre (C3N), with Europol supporting the case since March “with extensive analysis and the dissemination of intelligence packages to all the countries affected by this crime.”

Two meetings were held at Europol’s headquarters to jointly decide on the final phase of the investigation. A Europol mobile office was also deployed to France to assist French authorities on action day.

“The criminals targeted vehicles with keyless entry and start systems, exploiting the technology to get into the car and drive away,” according to the press release.

The Europol stops short of mentioning the car brands, saying only that the perps targeted keyless vehicles from two French car manufacturers.

The report says thieves used an “automotive diagnostic solution” coupled with specialized software (i.e. malware) to replace the vehicles’ original software. With the doors open, thieves could start the car without using the actual key fob.

Europol’s announcement also falls short of describing the malware behind the attacks.

Among those arrested are the malware developers, resellers, and some of the suspected car thieves themselves.

Widely used in recent years, remote keyless systems (RKS) perform all the functions of a standard car key without physical contact. Pressing a button on the remote key in close proximity of the car can lock or unlock the doors, as well as enable remote keyless ignition (RKI) to start the engine.

Keyless ignition is not regarded as a particularly secure technology, with some insurers refusing to cover damage or theft unless there are additional mechanical locks in place.