While teenagers with USB cords are causing mayhem across America in stolen Kias, a more sinister sort of car theft is going on across the northern border. Vehicles stolen from the Canadian provinces of Ontario and Quebec are reportedly being shipped overseas through the Port of Montreal to fund organized crime. How bad is the situation? According to federal documents obtained by the CBC, government-issued Toyota Highlanders used by the Canadian Minister of Justice have been stolen three times in the past three years.
In 2022, some 105,673 vehicles were stolen across Canada, the highest number in twelve years. Clearly, this is a more organized sort of crime than joyriding. The immobilizers that have been mandatory in Canadian vehicles since 2007 may thwart the common car thief, but not the networks that exist to scout, steal, pack, ship, export, and resell vehicles all across the world. Compared to drug or weapons trafficking, the payout to criminals for stolen cars is high, the risk relatively low, and everyone pays for it through rising insurance rates and psychological fears.
So how are these vehicles getting stolen, and how are they getting out of the country? In most modern vehicles with immobilizers and proximity keys, there are a few ways thieves can make off without disturbing a vehicle’s owner. Relay attacks used to be the norm, and are still commonly used today. The term refers to relaying the signals used by the car and its keyfob. It’s a two-person operation: using radio gear, a thief close to the target vehicle relays the vehicle’s signal to their partner, who is stationed close to the vehicle owner’s home at a location the key fob is likely to be – the front door, for example. The second thief transmits the relayed signal to the fob, which responds as if it were close to the target car. The fob’s signal is relayed back to the thief stationed by the vehicle, at which point the car “thinks” the key is present and makes itself available for operation. The thieves can now simply pull the door handle, unlock the car, hop in, press the start button, and make their getaway.
However, relay attacks don’t work so well if the key is in a faraday cage, or if the key isn’t near a home’s exterior aperture. That’s when CAN injections come into play. Using devices that can be bought off the dark web, thieves simulate a vehicle’s key receiver simply by tapping into an easily-accessible Controller Area Network line, like some modern cars have on their headlights. As automotive security expert Dr. Ken Tindell explained in a blog:
When first powered on, the CAN Injector does nothing: it’s listening for a particular CAN message to know that the car is ready. When it receives this CAN message it does two things: it starts sending a burst of CAN messages (at about 20 times per second) and it activates that extra circuit connected to its CAN transceiver. The burst of CAN messages contains a ‘smart key is valid’ signal, and the gateway will relay this to the engine management ECU on the other bus. Normally, this would cause confusion on the control CAN bus: CAN messages from the real smart key controller would clash with the imposter messages from the CAN Injector, and this could prevent the gateway from forwarding the injected message. This is where that extra circuit comes in: it changes the way a CAN bus operates so that other ECUs on that bus cannot talk. The gateway can still listen to messages, and can of course still send messages on to the powertrain CAN bus. The burst repeats 20 times a second because the setup is fragile, and sometimes the gateway is not listening because its CAN hardware is resetting itself (because it thinks that being unable to talk is an indication of a fault – which in a way it is).
Once the engine management computer gets the message, the vehicle can be started and driven away. It takes but minutes for thieves to rip out a headlight, hook up the device, and get away, usually without owners ever being alerted.
There is a third method of car theft that some criminals have chosen to use, although it’s not particularly subtle. As CTV News reports, some car thieves have taken to forcefully breaking into homes to look for keys.
In one case this fall, two thieves clad in hoodies and masks kick down a door together in a home in Rosedale. They come face-to-face with the man who lives there, who screams at them to get out.
“I was lying in bed and heard a crash, and it jolted me, waking me up,” said the man, Richard, who asked not to use his last name. “I walked down the stairs, and two guys were in the house, running around the main floor, clearly looking for my keys.
“It was scary, man. Super scary,” he said.
Yeah, home invasions are scary. While the victim in this case managed to maintain life and limb, what if the car thieves who broke into his home were armed? Just something to think about. Speaking of violent crime, CBC News reports that the number of violent carjackings in Toronto last year stood at more than 300.
Once these stolen cars are stuffed in containers, they’re exported to far away lands. Last month, CTV News reported that a shipment of 251 stolen Canadian vehicles headed for the Middle East were intercepted on a container ship in Italy. Another thriving market for these stolen exports? Africa. In fact, CBC News found one Torontonian’s stolen Acura RDX in Ghana.
The call from Ghana woke Len Green at the Toronto home where his prized vehicle had been stolen a year earlier.
“I’m calling from CBC News,” said the journalist on the other end of the phone. “We’re doing an investigation into stolen vehicles, and I’m pretty sure I’m sitting in your vehicle … in West Africa.”
“Whoa,” he replied. “I can’t believe it … that’s crazy.”
That certainly is crazy, as are potential reasons why these stolen vehicles aren’t caught before they exit the country through facilities like the Port of Montreal. Part of the problem is that the people investigating border-related crimes in Canada are incredibly underqualified. As per a Canadian Border Services Agency audit published this year:
The analysis of training completion data indicated that no Investigator working in the Program as of had completed the full set of Investigator courses as outlined in the NTS, and only 48% of all investigators have completed the CBSA’s introductory in-class course, Foundations of Criminal Investigations (S4013-N). The completion rate for this course was as low as 14% for one region.
I believe the phrase we’re looking for here is a jaw-dropping lack of oversight. It’s astonishing that under-training this severe has been left unchecked for so long, and not exactly surprising that thieves may be using it to their advantage.
So, what’s currently being done to fight Canada’s big car theft problem? Well, following a national summit on auto theft, the Canadian federal government has announced $28 million in spending to tackle car theft. The Canadian government claims in a media release that “With this new funding, the Canada Border Services Agency (CBSA) will have more capacity to detect and search containers with stolen vehicles, as well as further enhance collaboration and information sharing with partners across Canada and internationally to identify and arrest those who are perpetrating these crimes.” In addition, new vehicle detection technologies are said to be on the table, although specific methods haven’t been specified beyond including “advanced analytical tools, such as artificial intelligence.”
In the meantime, there’s only so much owners of heavily targeted vehicles can do. Some have installed GPS trackers and hidden immobilizers, while others have resorted to tire boots and clamps. Deterrence goes a long way, but it certainly isn’t foolproof. If the 2022 list of most stolen vehicles in Canada by insurance crime association Equite suggests anything, it’s that Canadians should stay away from frequently-stolen vehicles like the Range Rover, the Honda CR-V, the Toyota Highlander, the Lexus RX, and all domestic half-ton pickup trucks. Stay safe out there.
(Photo credits: Toyota, Lexus, Honda, Ford, Equite Association)
Support our mission of championing car culture by becoming an Official Autopian Member.
-
Let’s See If We Can Identify This Fatal Hit-And-Run Car From These Headlight Fragments
-
Some Idiot Thought It Might Be Possible To Evade Police In A Reportedly-Stolen PT Cruiser
-
Kia Is Going To Put A Sticker On My Dad’s Car So A Teen With A USB Cable Hopefully Doesn’t Try To Steal It
-
Kia Actually Sent My Dad A ‘Club’-Style Steering Lock Because They Built A Car That Teens Could Steal With A USB Cable
-
Kias And Hyundais All Over The Country Are Getting Stolen By People With USB Cables
Got a hot tip? Send it to us here. Or check out the stories on our homepage.
Car theft in Australia has not caught with the technology available overseas as yet.
Certainly we do get some house break ins by gangs of youths who are typically immigrants from worn torn African countries where their grasp of legal/illegal activity is ….ahem….weak. They pinch the keys and go joy riding until they run out of fuel or crash it, but nothing that is at the level of ‘gone in 60 seconds’ organised crime yet.
What does happen here is that older Japanese 4x4s get pinched (Toyota Landcruiser, Nissan Patrol are prime targets) and broken down into parts and panels and packed into shipping containers to who knows where. Its not high profile but I think it is fairly constant.
Off topic a little but currently there is an organised crime war going on over tobacco shops (at least in Melbourne) because they have discovered how much money can be made selling illegal tobacco when a pack of 30s is AUS$50 and Vapes are now illegal. There is one or two tobacco shops being fire bombed every week by the different gangs based on turf. Only a matter of time until someone dies in fire set by one of these numskulls. Fun times.
That’s 106K thefts in a country of only 40M population. Extrapolate it to a US-sized population of nearly 400M to get a feel for the strength of the impact of these thefts
Call me paranoid, but I do keep my keyless fobs in a Faraday cage. More than anything I figure that since I live <100 miles from a border that if one of our cars were stolen and driven directly out of the U.S. it would probably be much trickier to recover once it passes into a different country. That said, I’d imagine demand for Ford-era Volvos is pretty low.
Car theft has indeed been an issue in La Belle Province for a while now, but in the last few years it has absolutely skyrocketed, so from ‘gros problème’ to “osti de gros criss de problème. Tabarnak!”
Auto insurance rates have been been going up by hundreds a year. 20 years ago when I got my first car, we were told that young men have higher insurance rates, but just wait till you’re in your 30s…. I’m nearing 40 and never saw rates go down. And I don’t have claims.
It is so bad that in local francophone media, stories of people victims of multiple car thefts/attempts are considered as normal as a moose on a highway. Every couple days, an article comes out about 15-21 year olds (often minors) creating a chase and crashing a stolen car. And that’s not counting Catalytic converter thieves. I’m all for reinsertion and a justice system that aims to help, but a slap on the wrist can only encourage more thriving, especially when it’s an easy ‘in’ for would-be gang members (not stereotyping, this is factual)
Like they’re not even trying to hide themselves. Investigations led by a major media outlet (Journal de Montréal) discovered tens of stolen trucks in the former Soviet republics of central Asia (the ‘Stans) and in Africa and they didn’t even bother taking company or city-name stickers off the vehicles. So for example, I think it was a Sprinter in Uzbekistan with “Ville de Belœil” on its side is quite obvious.
My insurance is up for renewal this spring and I’m expecting it to increase about 1k. It’s about time they do something, but I’ll wait to see the results because currently many people have GPS trackers, notify the authorities while the car is still in Canada, sometimes at the Port, and ..
Nothing.
$28 million? That’s enough to get every border agent a few cups of Timmie’s and a large box of TimBits. We’ll show those scofflaws!
My boss literally had his 2021 Ram 1500 stolen a few weeks back. Thankfully he had the app still active and the GPS scrambling kicked out when the truck got about 30 minutes out from his house so he was able to track it. The thieves dropped it at a warehouse in Scarborough and he had the cops there within about an hour, so it was recovered. Still waiting for repair parts though.
Word on the street. The Underwear Gnomes have branched out…
What was wrong with traditional keys? Most of us still use them for our doors…
And plenty of those old locks and be picked super easy, or just started with a screwdriver.
It’s all about the automakers cheaping out, no different back then when they used shitty tumblers than it is now not having decent encryption on the key signal.
Personally I trust shitty hardware more than I trust shitty software, but that’s just me.
You mean the ones on Hondas that used to be stolen wholesale and trucked off to Mexico? Remember when the Accord was the most stolen car in America?
Two separate systems > a single system.
Defeat door lock, then get car started without a key vs unlock car door wirelessly and car will start from the push of a button.
I’d take a car with physical key unlocked doors, physical key start, and a manual transmission over a new car with an electronic key and push button start.
Where there’s a will there’s a way. When it was only keyed cars of course the Hondas were desirable because they were easy to get into and their parts were in demand. Now it’s more convenient to boost signal for Camries whose owners are too lazy to put their fob in a metal box. It’s just a matter of if thieves have more know-how or more tech on their side, nothing more or less to it. I get around it by driving an undesirable vehicle that no one wants to steal 🙂
I think you gaslit yourself into thinking a damn faraday cage should be necessary for everyday life.
How hard would it be for automakers to just include a hard off switch for one’s keyfob? if anything it should save battery
Only speaking for me and my ingrained laziness, but I know that if that suddenly became a thing, I’d have many annoyed days touching my car handle waiting for it to unlock, before cursing and taking the key out of my pocket (the action I haven’t had to do for over 5 years now) and toggling the switch (which would also have to be specially designed to not be easily flipped while in the pocket anyway).
I mean, eventually it’d become muscle memory to toggle the switch when putting it down inside and then again on picking it back up, but “when did the security become my problem beyond just not leaving the keys in the car, and/or the windows down?”
I will also add, I got the keys locked in my ’97 Econoline once and had to wait for AAA. For my 2012 Prius v, unless I carry both sets of keys, it’s practically impossible to lock the keys in the car.
I take it you’ve never had a dead battery in a car with electrical latches.
I once left my coat in the “Trunk” of an LR3 which had the included cargo partition. Battery died, damn near had to dislocate my shoulder to get my coat out.
If your battery dies good luck getting the doors unlocked without charging and or replacing the dead battery.
I mean, the latches themselves aren’t electrical. There’s a “jump point” for the battery under the hood, and if I need to remove the battery altogether, there is still a way to get in through the front, manually open the trunk from inside, and get the battery out without power. Wouldn’t be happy about it, but not the end of the world.
If they’re locked, and they have no keyholes, how do you unlock them? How do you unlatch the hood to get access to the dead battery under those same conditions?
I might be misunderstanding your scenario, so please correct me if I’m wrong.
If my key fob’s battery is dead, I can still use the car. The mechanical key is included in the side of the fob to unlock the driver door, and the fob itself just has to be used to depress the start button for “authentication”. So a dead fob is an annoyance, but not the end of the world.
My hood’s latch/release is mechanical, to get to the jump point. If that fails, the battery is under the trunk floor. The trunk’s latch, from outside, is electronic-only, unfortunately, but there is a small plastic panel from inside that can be pried away to manually open the trunk. I’m pretty sure a key (to use as a pry tool) or flathead screwdriver is all you need for that.
But of course, the Prius v is an MPV, not something with a cargo partition, so I don’t envy the position you were in.
I’m referring to cars without physical keys.
Oh, okay. Yeah, I don’t know how many cars have literally no mechanical key even as a backup. That’s a different story, I don’t know what the “emergency measures” for them are either, and I wouldn’t want to find out.
It’s a metal box—I’ll bet you have a bunch around you right now. I use an old cookie tin with a hinged lid. Can’t unlock the car with the fob inside it so it seems to work fine. Again, I don’t see how it’s any more or less secure than when cars could be pried open with a crowbar and started with a screwdriver. It’s just changing priorities, that’s all. Crowbar + screwdriver replaced by a hundred dollar signal booster/replicator.
It is big problem.. but banning tools like Flipper Zero or HackRF type SDR seems to be a dumb way to go about it. Maybe they can force Canadians not to drive cars that are attractive to foreign buyers (ie body on frame vehicles).
https://arstechnica.com/security/2024/02/canada-vows-to-ban-flipper-zero-device-in-crackdown-on-car-theft/
I have apparently lived long enough that a traditional ignition lock with a key is now an anti-theft device.
There are three cars in my driveway, all of which are too old to “hack into.” And I intend to keep it that way until my death, or until I get so old I have to surrender my driver’s license.
It is more like path of least resistance, the thieves don’t have to break anything, do it really quick with these wireless hacks.. you bust an ignition lock you have to replace it.
Moral of the story:
Park your vehicle in a locked garage – and quit buying the same-same CUV/Trucks as everyone else up and down the continent.
*steps off the soapbox*
But large corporations have the financials to improve the security (when it starts to hurt their bottom line)
https://www.express.co.uk/life-style/cars/1838058/jaguar-range-rover-car-crime-theft-security-update
I remember years ago being flabbergasted to find out that the Ford Taurus and the Honda Accord were two of the most stolen cars in the United States, until I read further about the black market for extremely common car parts. In my naivete, I thought of stealing a car in order to have the car, not in order to illegally sell off every piece of it.
Well there is a saying that an item is worth more than the sum of its parts, with cars the sum of its parts is worth more than the item.
1. In this case shouldn’t someone’s unassembled project car be worth more?
2. Shouldn’t junkies a vehicle be worth more?
If they know so many stolen cars are going through the port of Montreal why haven’t they been focusing on car sized containers passing through Montreal for stolen cars? X-Ray all the things!
https://www.leidos.com/products/vacis
Also if this is such a problem why not use lojack or some similar recovery system for (at the minimum) leased, high at-risk vehicles?
Canadian here. This should really be reported as a Toronot + Quebec problem. I’m not from either, and am not experiencing this.
*Toronto
Some would agree with Toronot!!!
Come try the new, 1968 Canadian-market only Oldsmobile Toronot!
So a system I know of being used, is kids walking in to an unlocked house. If they get caught, basically say “is Jimmy here?” The response is obviously no. So they look really sheepish and say sorry, they thought it was Jimmy’s house, he said they could let themselves in. Apologise again, and leave quickly.
The other one, in Sydney back in the 90s, this was happening, but with expensive stuff. Cops didn’t care at first until someone started looking in to it. Issue was, by the time they worked it out, the gangs were loaded, and pretty powerful, and it’s been a struggle since apparently.
That kid then gets a security camera still shot of his face plastered all over Nextdoor.
Any close break-ins that precede or follow, that kid becomes suspect #1.
Since I began “borrowing” my folks cars at 8 years old, and learned how to hot wire them by myself, I have a thought here. Does this guy have any damn kids?
Just wondering…
Who, me?
What happened tojust shooting uninvited guests? I’m pretty sure the thieves would think that getting shot is too high a price to pay
Not really a big thing shooting people in Australia.
Well it was a Canada story but Australia maybe arm a few Kangaroos and take the bastards out? (We got a Crocadille Dundee Marathon today) I am not talking wholesale bloodbath but a few a month would certainly lessen most of the thieves willpower.
Kangaroos can be plenty nasty all on their own:
https://wildexplained.com/blog/are-kangaroos-dangerous/
Yes I’ve seen other videos but with I assuming American tourist’s
Its Australia. Who needs gun when you can:
Dump a bucket of redbacks on them. Or giant centipides. Or bull ants.
Throw an angry brown snake
Sic your attack kangaroos. Or dingos. Or a salty.
Its Australia, you have lots of options.
Grand Theft Ottawa
My company fleet had such a problem with Highlander thefts we sold every one in Toronto and Quebec that was out of its minimum contractual hold period and relocated the remainder to other cities. Expeditions were bad the year before, and some of the other usual suspects are commonly stolen, but nothing as bad as the Highlanders.
We’ve been lucky enough to have a handful of other models recovered in assorted ports, but most of the bigger stuff is gone forever. Although, I have access to another OEM’s dealer system, and have seen a handful of missing units pop up in UAE and Iran for warranty service.
Perhaps Canada should switch to RHD vehicles so they are less internationally popular?
Save the manuals!
I’m pretty sure there were 4 Highlander thefts in town just in the last month or so… two last week.
Teased a guy at work about it… he waited 15 months for a Highlander only to worry about it being stolen all the time.
People are going to have to start booting their own cars.
The article says some are already doing that!
Stick shift cars on list? That’s the ultimate anti theft device currently.
Correct answer
How are there no Kias on that list? Sorry, I had to!
It’s actually easier to steal a Jeep, CR-V or Toyota in Canada. The USB trick doesn’t work here on Kia’s due to the mandatory immobilizers.
So, out of curiosity I looked into CAN networks used in cars. The thing is, there is a built in option to require all devices connected to the CANbus to be authenticated. That way a new device that is not authenticated is just ignored by network.
But guess what manufacturers did? They allowed any device connected to the CANbus to have full super user rights on the network. Plug a key programmer into the headlight port of a RAV4 and the cpu will immediately program new keys for the car. Then drive away.
With Range Rovers there is a CANbus port in the trunk and it is apparently trivial to access without tripping the car alarm. Again, plug in a key programmer in that port and program some new keys. Then drive away.
I’ve spent decades in computer and network security and the security 101 is to never trust any device on the network until properly authenticated. But apparently car manufacturers forgot this basic principle and make it trivial to steal those cars.
Idiots.
I remember reading about that and I hate it. It’s just.. ugh.
I’d venture to guess they didn’t forget as much as work really hard to make sure the “benevolent backdoor” was codified in the CAN protocol.
Protect your paint, and deter theft with ShitBox wrap! tm. Choice of heavy corrosion simulation, or twenty year back-model.
Does it have the David Tracy model with both ?
You’ll have to contact the redundancy dept.
The department of redundancy department ?
So you’re acquainted, they thrive on repeat clientele!
Just smear the paint and door handles with fresh cat shit?
Issue is that in Toronto they salt everything all the time. 20 year old cars are rare. 10 year old with simulated rotten rockers or cab corners.
Winnipeg too, make Edmonton cars seem pristine
However, relay attacks don’t work so well if the key is in a faraday cage
E.G. drop your keys in a soup can.
Which works well on 2 fronts. 1 reduces the LF(125kHz) signal to the key (only 1 bit error needed), as well as the RF(315, 434,902MHz) out of the Key
And country chic.
I put mine in my tin foil hat.
Even better!
Empty it out first
Pretty sure that hat never held much of anything in the first place… :p
Like the front of your pants?
Oh no I didn’t. Lol
Its pretty impressive the Dodge Ram 1500 ranks so high, considering the newest ones are 15 years old
Dodge Ram is like X/Twitter. They can protest all they want, but it’s still a Dodge Ram.