Toyota, Lexus owners warned about thefts that use 'relay attacks'

Security experts are warning owners of Toyota and Lexus vehicles not to rely on their automobile's anti-theft system following a rash of brazen thefts across the Ottawa region.

Since April, criminals have made off with more than 100 of the Japanese-brand vehicles from Petawawa to Casselman, Ont., many of them apparently destined for resale in Africa and the Middle East.

Toyota 4Runners, Highlanders, Tacoma pickup trucks and Lexus SUVs worth around $60,000 each are driven right out of their owners' driveways under cover of darkness, and the thieves never touch the keys. All are made by Toyota.

Julie Rollwagen was recently awakened by the distinct roar of her 2015 Lexus GX460's engine coming to life in her driveway in Barrhaven, south of Ottawa. Her bedside clock showed 4:24 a.m. ET.

The sound was a selling feature at the Lexus dealership, Rollwagen said. "They'll say, 'Oh, one of the cool features is that it roars when you start it.'"

But by the time she'd rolled out of bed, made her way to the garage and opened the door, her vehicle had roared off into the night with a thief at the wheel.

It's going around

Another Barrhaven resident, Ramzi Yonis, came downstairs one recent Sunday morning to find his 2017 4Runner gone from his driveway. At first he thought his wife, Maha Mankal, had made an unscheduled trip to the gym, but when he went inside she was there, and so were their two Toyota key fobs.

Yonis made his way to a car rental outlet in Nepean to arrange for a replacement vehicle, where he bumped into a neighbour who had also just lost a 4Runner to thieves.

"If it's not recovered and we have to purchase another car, for sure it won't be another Toyota SUV," Yonis declared.

A Barrhaven Facebook group is full of similar declarations from Toyota owners, warning each other to keep an eye out.

Thieves using $200 'amplifier'

Like many new cars, modern Toyotas are designed to respond to the radio signal from the key fob within a range of a metre or two.

Jeff Bates of Lockdown Security in Markham, Ont., says thieves are using a $200 device that boosts the strength of that signal, allowing them to unlock the vehicle and disarm its security system even though the fob is inside the house. Driving off with the luxury vehicle is as simple as pushing a button.

"What the thieves are using is an amplifier," said Bates, whose company has been doing a brisk business beefing up cars whose owners want to guard against the so-called "relay attacks."

Bates said in some cases, thieves will still break into a vehicle the old-fashioned way, then plug a computer into the car's diagnostic port and hack the security system to make it think the key is present.

Bound for resale overseas

That's probably what happened to Scott Dillon's 4Runner.

"The funny thing about the whole story is that my truck never spends any time outside except for the twice a year that I take the tires off it," he laughed.

Dillon's home security camera captured thieves capitalizing on that rare window of opportunity in mid-November. OPP later located the truck parked in a lot not far from his home. The door handle had been broken off.

Often, the vehicles are never found. Sometimes, they're found at the last minute.

Several weeks after thieves drove seven new trucks and SUVs off the lot of a Toyota dealer in Petawawa, Ont., police announced several had been recovered from shipping containers, likely bound for lucrative overseas resale markets.

Taking precautions

In an email, Toyota spokesperson David Shum said customers should take extra steps to safeguard their vehicles, including considering an after-market alarm system, steering wheel lock and diagnostic-port lock.

"If a garage is not accessible, park another less desirable vehicle in front of your vehicle," Shum suggested.

While some experts recommend wrapping the key fob in tinfoil or keeping it in a metal box, Toyota suggests buying a radio frequency shielding "faraday pouch" to prevent unwanted radio waves from reaching the device.

Shum also warned Toyota owners to never leave their key fobs near the front door of their home.

Online, some owners say they've resorted to leaving the fobs in the microwave or freezer. But like Yonis, others say they're not willing to risk another theft, and are looking for a new brand of vehicle.

"I loved that vehicle, but no way I'm buying another one," said Julie Kirkpatrick, whose 2016 Highlander disappeared from her driveway in Westboro two weeks ago.

"There's no way I'm putting a sacrificial lamb in my driveway again."