A team at Johns Hopkins University in Baltimore and RSA Laboratories said the "immobilizer" security system developed by Texas Instruments that make possible high-security car keys and swipe-by gasoline passes could be cracked using a "relatively inexpensive electronic device" making it easier to steal a car or get a free tankful of gasoline. The team said criminals can easily decipher the code RFID system uses because of its simplicity. Avi Rubin, technical director of the Johns Hopkins Information Security Institute said the team found that the security measures built into the devices are inadequate. "An attacker who cracks the secret key in an RFID tag can then bypass security measures and fool tag readers in cars or at gas stations," Rubin said in a statement. The radio-frequency security system being used in more than 150 million new Fords, Toyotas and Nissans involves a transponder chip embedded in the key and a reader inside the car. If the reader does not recognize the transponder, the car will not start, even if the key inserted in the ignition is the correct one.
It's similar to the new gasoline purchase system in which a reader inside the gas pump is able to recognize a small key-chain tag when the tag is waved in front of it. The transaction is then charged to the tag owner's credit card.
Researchers said they were able to crack that code too.