While teenagers with USB cords are causing mayhem across America in stolen Kias, a more sinister sort of car theft is going on across the northern border. Vehicles stolen from the Canadian provinces of Ontario and Quebec are reportedly being shipped overseas through the Port of Montreal to fund organized crime. How bad is the situation? According to federal documents obtained by the CBC, government-issued Toyota Highlanders used by the Canadian Minister of Justice have been stolen three times in the past three years.
In 2022, some 105,673 vehicles were stolen across Canada, the highest number in twelve years. Clearly, this is a more organized sort of crime than joyriding. The immobilizers that have been mandatory in Canadian vehicles since 2007 may thwart the common car thief, but not the networks that exist to scout, steal, pack, ship, export, and resell vehicles all across the world. Compared to drug or weapons trafficking, the payout to criminals for stolen cars is high, the risk relatively low, and everyone pays for it through rising insurance rates and psychological fears.
So how are these vehicles getting stolen, and how are they getting out of the country? In most modern vehicles with immobilizers and proximity keys, there are a few ways thieves can make off without disturbing a vehicle’s owner. Relay attacks used to be the norm, and are still commonly used today. The term refers to relaying the signals used by the car and its keyfob. It’s a two-person operation: using radio gear, a thief close to the target vehicle relays the vehicle’s signal to their partner, who is stationed close to the vehicle owner’s home at a location the key fob is likely to be – the front door, for example. The second thief transmits the relayed signal to the fob, which responds as if it were close to the target car. The fob’s signal is relayed back to the thief stationed by the vehicle, at which point the car “thinks” the key is present and makes itself available for operation. The thieves can now simply pull the door handle, unlock the car, hop in, press the start button, and make their getaway.
However, relay attacks don’t work so well if the key is in a faraday cage, or if the key isn’t near a home’s exterior aperture. That’s when CAN injections come into play. Using devices that can be bought off the dark web, thieves simulate a vehicle’s key receiver simply by tapping into an easily-accessible Controller Area Network line, like some modern cars have on their headlights. As automotive security expert Dr. Ken Tindell explained in a blog:
When first powered on, the CAN Injector does nothing: it’s listening for a particular CAN message to know that the car is ready. When it receives this CAN message it does two things: it starts sending a burst of CAN messages (at about 20 times per second) and it activates that extra circuit connected to its CAN transceiver. The burst of CAN messages contains a ‘smart key is valid’ signal, and the gateway will relay this to the engine management ECU on the other bus. Normally, this would cause confusion on the control CAN bus: CAN messages from the real smart key controller would clash with the imposter messages from the CAN Injector, and this could prevent the gateway from forwarding the injected message. This is where that extra circuit comes in: it changes the way a CAN bus operates so that other ECUs on that bus cannot talk. The gateway can still listen to messages, and can of course still send messages on to the powertrain CAN bus. The burst repeats 20 times a second because the setup is fragile, and sometimes the gateway is not listening because its CAN hardware is resetting itself (because it thinks that being unable to talk is an indication of a fault – which in a way it is).
Once the engine management computer gets the message, the vehicle can be started and driven away. It takes but minutes for thieves to rip out a headlight, hook up the device, and get away, usually without owners ever being alerted.
There is a third method of car theft that some criminals have chosen to use, although it’s not particularly subtle. As CTV News reports, some car thieves have taken to forcefully breaking into homes to look for keys.
In one case this fall, two thieves clad in hoodies and masks kick down a door together in a home in Rosedale. They come face-to-face with the man who lives there, who screams at them to get out.
“I was lying in bed and heard a crash, and it jolted me, waking me up,” said the man, Richard, who asked not to use his last name. “I walked down the stairs, and two guys were in the house, running around the main floor, clearly looking for my keys.
“It was scary, man. Super scary,” he said.
Yeah, home invasions are scary. While the victim in this case managed to maintain life and limb, what if the car thieves who broke into his home were armed? Just something to think about. Speaking of violent crime, CBC News reports that the number of violent carjackings in Toronto last year stood at more than 300.
Once these stolen cars are stuffed in containers, they’re exported to far away lands. Last month, CTV News reported that a shipment of 251 stolen Canadian vehicles headed for the Middle East were intercepted on a container ship in Italy. Another thriving market for these stolen exports? Africa. In fact, CBC News found one Torontonian’s stolen Acura RDX in Ghana.
The call from Ghana woke Len Green at the Toronto home where his prized vehicle had been stolen a year earlier.
“I’m calling from CBC News,” said the journalist on the other end of the phone. “We’re doing an investigation into stolen vehicles, and I’m pretty sure I’m sitting in your vehicle … in West Africa.”
“Whoa,” he replied. “I can’t believe it … that’s crazy.”
That certainly is crazy, as are potential reasons why these stolen vehicles aren’t caught before they exit the country through facilities like the Port of Montreal. Part of the problem is that the people investigating border-related crimes in Canada are incredibly underqualified. As per a Canadian Border Services Agency audit published this year:
The analysis of training completion data indicated that no Investigator working in the Program as of had completed the full set of Investigator courses as outlined in the NTS, and only 48% of all investigators have completed the CBSA’s introductory in-class course, Foundations of Criminal Investigations (S4013-N). The completion rate for this course was as low as 14% for one region.
I believe the phrase we’re looking for here is a jaw-dropping lack of oversight. It’s astonishing that under-training this severe has been left unchecked for so long, and not exactly surprising that thieves may be using it to their advantage.
So, what’s currently being done to fight Canada’s big car theft problem? Well, following a national summit on auto theft, the Canadian federal government has announced $28 million in spending to tackle car theft. The Canadian government claims in a media release that “With this new funding, the Canada Border Services Agency (CBSA) will have more capacity to detect and search containers with stolen vehicles, as well as further enhance collaboration and information sharing with partners across Canada and internationally to identify and arrest those who are perpetrating these crimes.” In addition, new vehicle detection technologies are said to be on the table, although specific methods haven’t been specified beyond including “advanced analytical tools, such as artificial intelligence.”
In the meantime, there’s only so much owners of heavily targeted vehicles can do. Some have installed GPS trackers and hidden immobilizers, while others have resorted to tire boots and clamps. Deterrence goes a long way, but it certainly isn’t foolproof. If the 2022 list of most stolen vehicles in Canada by insurance crime association Equite suggests anything, it’s that Canadians should stay away from frequently-stolen vehicles like the Range Rover, the Honda CR-V, the Toyota Highlander, the Lexus RX, and all domestic half-ton pickup trucks. Stay safe out there.
(Photo credits: Toyota, Lexus, Honda, Ford, Equite Association)
Support our mission of championing car culture by becoming an Official Autopian Member.
-
Let’s See If We Can Identify This Fatal Hit-And-Run Car From These Headlight Fragments
-
Some Idiot Thought It Might Be Possible To Evade Police In A Reportedly-Stolen PT Cruiser
-
Kia Is Going To Put A Sticker On My Dad’s Car So A Teen With A USB Cable Hopefully Doesn’t Try To Steal It
-
Kia Actually Sent My Dad A ‘Club’-Style Steering Lock Because They Built A Car That Teens Could Steal With A USB Cable
-
Kias And Hyundais All Over The Country Are Getting Stolen By People With USB Cables
Got a hot tip? Send it to us here. Or check out the stories on our homepage.
I live just outside of Toronto.
My buddy’s wife got a new CRV, then a few months later she got sandwiched between 2 cars on the highway.
The insurance company wouldn’t replace it. Instead they decided to slowly piece it back together, and hand it back with a severely decreased value.
He leaves it parked on the driveway every night with all the doors unlocked, and nothing.
What gives?
Oh just of note… Teslas are some of the least-stolen vehicles because they have the best security
https://www.kron4.com/news/these-are-the-most-and-least-stolen-cars-as-of-2023/#:~:text=According%20to%20theft%20claims%2C%20the,stolen%20vehicles%20for%202020%2D2022.
“In the meantime, there’s only so much owners of heavily targeted vehicles can do. Some have installed GPS trackers and hidden immobilizers, while others have resorted to tire boots and clamps”
The CBC had this subject discussed on the Cross Country Checkup program they have every Sunday. The had a cop on the program and he mentioned what he did on his car is he bought a replacement OBDII port and had his mechanic disconnect the original OBDII port and wire up the replacement and have it installed in an unexpected location in the engine bay.
This means that when the thieves plug their tool into OEM OBDII port to program in their own key, nothing will happen because it will be disconnected.
And the other big thing to do is keep your car parked in the garage.
And one thing that got missed that I wanted to call in about… enable the ‘enter PIN to Drive’ security feature… which only Teslas have.
I was also thinking that people could also boot/clamp a wheel on their own vehicles.
https://www.ultimatesafety.com.au/cdn/shop/products/IMG_2164.jpeg?v=1430133032
And of course another approach is to get a car with a manual transmission.
I’m fine with tech that improves things, but an ‘improvement’ that allows my car to be stolen by someone talking dirty to my headlight is not an improvement.
Damn. Would these kinds of attacks work on my 2012 Prius v in the U.S.?
I absolutely love not having to reach into my pocket at all–door unlocks when my finger touches the handle with the remote in close range, and then push-button start (with key close enough).
I’ve never had a car without at least a fob. Manually unlocking seems like such a pain, from the few times (dead fob battery, etc.) that I’ve had to do it.
Although the worst has to be my sibling’s old Chevy Aveo where after unlocking manually, he’d then have to reach around the car from inside to unlock the other doors for passengers because there wasn’t even electronic locks from inside.
“Would these kinds of attacks work on my 2012 Prius v in the U.S.?”
Yes.
Not that I’m particularly scared of outright car theft where I am (my van was broken into in 2018 at my work lot and the subwoofer and tools stolen, and I’m sure someone with know-how could’ve bypassed the ancient aftermarket security system to steal the whole thing outright), but my car is ~10 feet from my bedroom and visible right through my window and that’s one thing I’ll sorely miss when I move next, I imagine.
My in-laws neighborhood got hit about 2 years ago. Stole their Grand Cherokee and 4 other cars. I think 3 of them were highlanders.
I avoid smart keys for this reason. The real physical key adds a layer of security. Manual transmissions another.
I remember the stories a few years ago of mass Jeep thefts. I don’t know if the Jeeps were extra-easy to steal electronically or if they were easier for the thieves to sell – but a lot of those found themselves down Mexico way without the owners’ consent.
Am I reading that chart wrong, or did 1.5% of all Toyota highlanders in the entire country of Canada get stolen last year? More than 1 out of every 100 highlanders in Canada got stolen in the 365 days of 2022?
Looks like you’re reading that correctly – as well, the 117k applies to the full ~20 year run of Highlanders (still licensed and insured in Canada), even if it’s more likely to be newer ones targeted.
That’s insane, think of how many Highlanders you drive past, and now 3/200 will be stolen within a calendar year.