Relay station attack. Two attackers use relay stations, carried in their briefcases, to make a long-distance connection between the owner's transponder with the car's transceiver.
In digital security, a relay attack (also known as the two-thief attack) is a type of hacking technique related to man-in-the-middle and replay attacks. In a classic man-in-the-middle attack, an attacker intercepts and manipulates communications between two parties initiated by one of the parties. In a classic relay attack, communication with both parties is initiated by the attacker who then merely relays messages between the two parties without manipulating them or even necessarily reading them.
Example attack
Peggy works in a high-security building that she accesses using a smart card in her purse. When she approaches the door of the building, the building detects the presence of a smart card and initiates an exchange of messages that constitute a zero-knowledge password proof that the card is Peggy's. The building then allows Peggy to enter.
Mallory wants to break into the building.
Mallory approaches the building with a device that simulates a smart card, and the building responds by initiating the exchange of messages.
Mallory forwards the message to her accomplice Evelyn who is tailing Peggy as she runs errands in another part of town.
Evelyn relays the message to Peggy's smart card, listens for the answer, and forwards the answer to Mallory, who relays it to the building. Continuing in this way, Mallory and Evelyn relay messages between the building and Peggy's smart card until the building is satisfied that it is communicating with Peggy's smart card.
The building opens and Mallory enters.
Countermeasures
Passive keyless entry and start (PKES) systems used in automobiles are a documented target for relay attacks. Because the attack relays the legitimate exchange without altering it, it succeeds irrespective of the strength of the cryptography involved; researchers who demonstrated the technique against ten vehicles from eight manufacturers reported that their relays were "completely independent of the modulation, protocol, or presence of strong authentication and encryption".
Ultra-wideband (UWB) ranging has been deployed as a countermeasure. Because UWB establishes proximity by measuring signal time-of-flight rather than radio reachability alone, the propagation delay introduced by a relay causes the key to be measured as distant. In testing of 698 vehicles published by the German automobile club ADAC in 2024, 629 could be unlocked and started using relay equipment; the vehicles that resisted were those equipped with UWB. UWB ranging also underlies the Car Connectivity Consortium's Digital Key 3.0 specification.
