Hyundai and Kia owners all over the United States are finding themselves in a terrible situation. Thieves–sometimes teenagers following TikTok trends–are exploiting their vehicles’ ignition systems to steal the cars. Thefts appear to be on a meteoric rise as these cars are reportedly easy to steal, requiring only a USB cable and about a minute of time. And worse, you can watch the phenomenon unfold right on social media.
Last year, news stations and police in Milwaukee, Wisconsin reported on an alarming problem. In 2021, some 10,479 vehicles were stolen in the city. That number is up from 2020’s statistic of 4,500 thefts.
What happened to make car thefts more than double in a single year? People–reportedly sometimes as young as 12–have found out that Hyundais and Kias are apparently easy to steal. Two-thirds of the vehicles stolen in the city in 2021 were Kias and Hyundais. Sadly, this year is looking no different. These stolen vehicles reportedly get used for joyrides, stunts, and in the commission of other crimes.
As Milwaukee deals with a second year of elevated car theft numbers, other cities are beginning to find themselves facing the same problem. As Carscoops reported earlier this month, authorities in St. Paul, Minnesota are reporting a 1,300 percent rise in thefts of Kias and a 584 percent increase in Hyundai thefts. What that translates to is 256 Kia and 212 Hyundai thefts this year thus far compared to just 18 and 31 last year, respectively. The statistics are looking very similar in Grand Rapids, Michigan, where 45 percent of the stolen cars this year are Kia or Hyundai. St. Louis, Missouri, Columbus, Ohio, Chicago, Illinois, and Memphis, Tennessee are among a long list of cities where Kia and Hyundai thefts are rising this year.
If you look up these thefts on social media you’ll quickly find that this may not be just a random rash of crime. Some of the people who allegedly steal these cars call themselves the Kia Boyz, and videos of them can be found on TikTok, YouTube, and Instagram.
I’ve spent the past couple of days going through scores of these videos and at times I couldn’t believe what my eyes were seeing. In one video tagged as #kiaboyz, a Kia with Illinois plates drives through a school’s sidewalk as students board buses.
https://www.tiktok.com/@tweakertales/video/7016317432755211526
In another, someone hangs out of a window and fires a gun. Other videos show Kia and Hyundai vehicles randomly swerving down city streets. Some show vehicles crashing and some appear to be filmed by bystanders watching as people pull up in one Kia to take another. The videos even show people in Kia and Hyundai vehicles taunting police. We cannot confirm if any of the featured vehicles are stolen, but at the very least, they’re being used recklessly.
And sadly, this also goes beyond just stolen property. The Columbus Dispatch reports that earlier this month, two 14-year-olds allegedly connected to Kia Boyz died after crashing a reportedly stolen Hyundai. Also this month, a suspected stolen Kia Sportage in Minneapolis killed a 70-year-old woman in a crash. There are a number of other similar stories like those.
Back when I wrote a few stories about this at the old lighting site, a question that I had is “how?” The news reports that I sourced said thieves are starting Kia and Hyundai vehicles by exploiting the cars’ ignition systems. From a Milwaukee Journal Sentinel report:
Officials have determined that the models of Kia and Hyundai vehicles being targeted lack engine immobilizers, an electronic security device that makes it more difficult to start a vehicle without a key.
And another, from a WISN 12 interview with Milwaukee Police Sgt. and spokesperson Efrain Cornejo and Ryan Martin, a manager of a Milwaukee area body shop:
“They take like pliers and they’re able to get the car started with just pliers,” Martin said. “That seems to be pretty simple.”
“There’s a mechanism that they manipulate and it could be as easily manipulated with a USB cord,” Cornejo said.
When asked specifically how, he said, “I don’t want to get into the particulars of it just because, you know, it is a concern that we have for other individuals to find out,” although the exponential increase in numbers indicates the word and method is out there in the public domain.
“It’s not connected or plugged into anything else. They use it kind of like you would use the tip of a screwdriver, for example,” he said.
The targeted vehicles–typically newer model years without push-button start–are said to lack immobilizers. Thieves get in by breaking a window then manipulating the vehicle’s ignition system with a USB cable.
But how? How do you start a Kia or a Hyundai with just a USB cable? Unexpectedly, I found a number of how-to videos on TikTok and YouTube, most of which have now been taken down. Assuming these videos weren’t staged, it appears that the process really is as easy as reports suggest. I watched a video of a self-proclaimed group of Kia Boyz breaking into a Kia. They tore apart the steering column, then shoved a USB cable into a broken ignition switch. It took less than a minute and the Kia fired up as if the USB cable were the car’s key.
And that was just one method. Another method that I saw a how-to for involved shorting out pins in a connector attached to the steering column. I won’t get into the specifics or share the videos that are still up, but it really does appear to be as simple as reported.
In 2021, a class action lawsuit was filed against the two automakers on behalf vehicle owners. Around the same time, news outlets as well as the city of Milwaukee requested comments from the automakers. Kia and Hyundai responded, saying at the time that 2022 vehicles will come equipped with immobilizers. From WTMJ-TV:
Kia says starting in model year 2022, its vehicles will feature an ‘immobilizer’ as a standard, so the cars will not be able to start in a nontraditional manner.
Unfortunately, as ABC 6 reports, 2022s are getting stolen as well. So immobilizers may not be enough to completely prevent thefts of these machines.
If you own one of these vehicles, there are a few ways to protect yourself. One sounds obvious, but if you have a garage, definitely park the car in it. And when the vehicle is parked outside, use a steering wheel lock. If you’re in Milwaukee, you can get a free steering wheel lock from the police. You will just need to show proof of ownership. A steering wheel lock won’t prevent a theft, but it adds an extra layer to stealing your car. That might be just enough to deter someone from taking your car. You can also pick up an aftermarket immobilizer. Again, a determined-enough thief can defeat one, but it’ll slow them down.
I reached out to Kia and Hyundai for comment on this story and received this statement back:
Kia America is aware of the rise in vehicle thefts of a subset of trim level vehicles. As of the current 2022 Model Year, all Kia vehicles have an engine immobilizer fitted as standard. All Kia vehicles for sale in the U.S. meet or exceed Federal Motor Vehicle Safety Standards. Kia customers with questions regarding their Kia vehicle should contact the Consumer Assistance Center directly at 1-800-333-4542 (4Kia).
Editor’s note: To be fair, we haven’t done an analysis on how different Hyundais and Kias are compared to the competition when it comes to ease-of-theft. The point here is that these particular vehicles are being targeted, in part, due to a trend on social media. -DT
Whistling past the graveyard of comments above, I see that owners are trying a class-action suit against KIA/Hyundai.
I wonder what their chances are. The manufacturer says the cars meet all required Federal standards. Assuming that to be true, what is the basis for a suit? Yeah, the cars are easier to steal than other, but so what – in a legal sense? The fact that the maker could have done something better but chose not to is not a manufacturing fault per se.
I live in Milwaukee. Can confirm, this has been a big problem in the city the last couple of years. I’ve got multiple coworkers who have traded in their Kias because either they’ve been broken into/stolen, or they know it’s only a matter of time. I won’t be considering a Hyundai or Kia next time I’m car shopping, which is too bad.
Every car ever made is easy to steal. Every single one of them. I could hotwire 60’s and 70’s era cars in like under a minute. And door locks? Jeez… if you know what you are doing you can pop a door in seconds.
Some posted comments apply:
If I was Mercedes or had Mercedes job, I would quit and become and undertaker or maybe a no charge hit-person.
We all know that a determined thief can steal your car no matter what you do to protect it, but c’mon Hyundai and Kia. You don’t need to make it that easy for them. You’ve fucked up big time if kids on Tik Tok can show other kids how to steal your cars in less than a minute.
Older cars are even easier to steal. Old Nissans can be stolen without even damaging the column in a matter of minutes (I did this because it was cheaper than a new ignition switch when mine failed) and hot wiring classic vehicles is almost as easy as they make it seem on TV. The social media trend is really the only thing notable about this, but since it is viral, people who know nothing about vehicles will probably try it, so taking extra precautions if you have a Kia is a good idea (we own 2).
Betcha David Tracy’s cars never get stolen!
A couple of genZ work buddies showed me a Kia Boyz video over the weekend. They said the Milwaukee police had a standard for breaking off a chase that was very easy to meet. Apparently swerving violently meets that standard (not criticizing the police here, just noting it. They don’t want bystanders hurt.). The clip of one barreling down a school walkway absolutely made me cringe. If I owned a Kia, I’d be buying a Club today.
Thieves figured out pretty quickly they couldn’t cut through the club, but they could rapidly cut through the steering wheel and get the club off without much additional time/effort.
For a while there, KIA/Hyundai were really going places. Now they are just going places contrary to the wishes of the true owners of their cars. And also, now that they have gone “Full-CVT” they aren’t going any places for very long.
If the black market hasn’t changed much since I was younger, professional thieves generally steal cars for their body panels. Hyundai / Kia have sold a lot of cars lately. Wouldn’t it make sense if there are more of these cars on the road, there’d be more of them getting damaged and therefore more of a market for stolen fenders?
I’d be curious to see if those increased numbers just kept pace with increased registrations of those brands.
Just in passing, I once had to replace the ignition on another car. Maybe a Ford. To get that lock out, I think you had to drill the heads off the tamper-proof retaining screws, or drill them and use an extractor. A serious PITA. On the Kia, doesn’t look like there was much holding the lock in place, mostly plastic. Wheel club or hidden disconnect a necessity.
Likely not a Ford. Any I’ve done from about the early 90’s on you just turn the cylinder to on, push up on a detent ball, and it comes right out.
For lame security there’s early 2000’s Chevies. They ditched the resistor in the key to querying the ignition switch ID when turned on. Except it only cares that the ignition switch was turned, not what turned it. So if you rake/bump the cylinder or bypass the cylinder entirely to just turn the switch directly it doesn’t care.
I’m staggered to learn that engine immobilizers in the US market weren’t standard equipment by now. But what this also highlights is that margins are so thin for carmakers that they’ll go to surprising lengths to save a few extra cents per car.
Almost all Kias and Hyundai (it’s the plural as well as the singular, right?) available in North America are also available in Australia and New Zealand, albeit in a mirror-world configuration. Engine immobilizers down under have been required factory fitment on all new cars sold for 23 years now under AS/NZS 4601:1999, and while they haven’t *eliminated* car theft, they’ve reduced theft rates to the point where the rates of joyriding and opportunistic theft of late model cars were almost negligible until the advent of keyless entry and keyless ignition systems.
As a consequence, most late model car theft in Australia is targeted and professional, and during the 12 years I spent working for a general insurer, I didn’t see a car theft claim file that hadn’t been automatically flagged as having a potential fraud indicator worthy of at least cursory investigation.
Of course this cuts the other way, too. My wife’s Australian-market 2013 Sorento lacks amenities like a power tailgate that are standard equipment for the same trim level in the US. But I’d rather reach up to close the tailgate a couple of times every day rather than worry that the car won’t be there when I get back to the parking spot…
Unfortunately for us in New Zealand, all the lovely new cars have immobilisers but there’s a huge number of Japanese secondhand imports which don’t and are trivially easy to steal. The JDM Mazda2/Demio and Toyota Prius C/Aqua are at the top of the most stolen charts and super popular with ramraiders as they can fit through many shop window apertures and some bollard installations. Or even in between the bollards and the storefront.
Yeah that’s an interesting problem. I’m surprised neither NZ or other Australian states have passed something like the WA legislation that requires an immobiliser be retrofitted to any car without one before a registration can be transferred into a new name:
https://www.transport.wa.gov.au/licensing/immobilisers.asp
USB A B or C?
See this is why Miata is always the answer. My Miata specifically.
If you want to steal it? Getting into the cabin is the easy part, since the doors are unlocked. (New doors are cheap. Replacing a ripped soft top after someone tries cutting their way in isn’t.)
OK, so you’ve done some cute wire splicing and jammed a screw driver into the ignition and even remembered to push in the clutch pedal (most non-manual-drivers don’t know about that step)…and fuck-all happens.
Maybe you realize that the battery ground has been disconnected by yours truly, so enjoy breaking into the trunk! Hopefully you have pianist hands to get into the trunk corner and attach the cable back to the battery.
Alright so now you have battery power. Time to start ‘er up! You once again do your wire splicing and pedal pushing and key turning and the engine starts!
And then it dies.
That’s OK, you can start it again!
And it dies again.
See, my electronic idle speed control valve has been stuck closed since the Clinton administration and I screw the idle control screw shut during long storage periods, so you have the pleasure of either figuring out what I did (unlikely) or keeping your foot pressing on the gas pedal throughout the entirety of the drive, especially while stopped or between gears.
Oh and have fun turning while fighting with the disabled power steering; I took the belt off because the AC compressor pulley bearing was making Satan sounds.
So if you only make it to the corner before giving up on stealing my Miata, no hard feelings.
I also leave my Miata unlocked. What’s the point? You can break in with a pocket knife and do $1000+ of damage to steal the nothing of value from the interior.
Good think I’ve got a stick shift in my Kia! Today’s best anti theft device!
Hyundai: If kids can build ‘em, kids can start ‘em.
Mercedes. Come on. You should know better than to parrot copaganda bullshit. Which is exactly what is going on here. Cops spouting pure nonsense propaganda.
2022 Kias do have an immobilizer. Always have. And guess what? I can bypass the immobilizer on every other fucking car on the road currently too. Every single one. Because guess what? As I keep saying and I keep screaming and I keep trying to hammer fucking home: AUTOMOTIVE SECURITY IS SHIT AND ONLY GETTING SHITTIER.
For fuck’s sake people. My last three jobs had me as Senior or Principal and I keep getting hit up for automotive programming jobs I super do not want, so yeah, I most certainly know what the fuck I’m talking about. Kia’s immobilizer is no more or less effective than anyone else’s. And guess what? It’s complete bullshit to claim that Kias don’t have immobilizers.
Quote the Kia Rio 2017-2020 service manual, BES:
https://kiamanual.com/kia-rio-yb/immobilizer_system-741.html
OH LOOK! It’s … an “encrypted immobilizer unit”! On the entry-level Rio! Well fuck, I’ve never heard of cops lying under oath, much less to an unquestioning press!
In other words; the cops are as usual proving ACAB as a truism.
What’s fueling them? Social media bullshit because Meta, Twitter, and so on won’t take shit down because it gets clicks. And clicks get profit. And oh look, there’s an easy to download app for Kia/Hyundai BCUs. If I published one for Hondas, and it went viral, then guess what would happen? Yep. Wave of Honda thefts. Ford? Ding. And they’re all susceptible to one or more of the exact same styles of attack.
Because building things securely, that costs more than $0.05. And that’s why I can buy your – yes, YOUR – social security number, home address, first born’s name, and first pet’s name on a Russian forum for about $50 per 10,000 people or thereabouts. And it’s also why I can pull out some hand tools, a Raspberry Pi, a few hours of Python at most, and steal pretty much anything on earth.
What, you think that shit is in any way secure? Difficult to break? Please. Automotive module security is orders of magnitude worse than the lazy assholes at Equifax. It makes PCI-DSS look comprehensive and forward-thinking.
And guess what? Fear-mongering bullshit like this is no different from the “OH NOES STORE YOUR BMW KEYS IN TINFOIL” and the “THEY CAN HAXXOR YOUR JEEP OVER THE INTERWEBS” and every other scare going back I don’t even want to think how many years now. It’s pure propaganda and of course, the only fix is to give the cops more money, bigger guns, and alligator crying about how they feared for their life and that’s why they put 60 rounds into a parked, non-running Kia.
Actually insist the automotive manufacturers take security seriously? Do something about the fact that anybody halfway competent can break their ‘protections’ in a matter of hours with a few hundred dollars in off the shelf junk? Don’t be ridiculous. The chief needs another SWAT team with an M1A1 Abrams. Only that will put a stop to car theft!
And no. I am not going to tell you any of the numerous ways to bypass immobilizers. Because then I’d get prosecuted under DMCA for ‘circumventing protections’ if not CFAA for ‘h4xx0ring t3h g1bs0n.’
In the early 00 it was Honda Civics you needed to fear owning. A flathead screwdriver, a piece of string and the ability to tie a decent slip knot is all you needed to take one for the weekend.
As technology advances the criminals will always keep up.
The only person responsible for protecting your stuff is you.
Kia doesn’t care they already sold it to you. Cops don’t care it’s just a property crime.
Take steps to protect your own shit.
That’s why I lock a few rattlesnakes in my car when I park it.
Wrangling them out from under the seats with a Nifty Nabber every morning is a bit of a chore (easier in the winter months for obvious reptile reasons) but I’ll be damned if some thug is gonna take my 2000 Chevy Prizm for a “joy ride”.
Jokes on them even if the snakes don’t get em. “Joy Ride” not in that car.
Protected By Vipers!
Oh please. It’s not even that. Do you have any fucking idea how easy it is to steal a car?
Trust me. You don’t.
You’ve never had to break into a car because the keys got locked inside. I used to be able to do it in under 10 seconds. My hands aren’t as good these days though. That still works on – let me check here – everything.
You’ve never had to disable an immobilizer because the RKE wires got melted, or the BCM decided to shit the bed, or the PCM got corrupted. Some cars I could do it under 15 minutes. Without the dealer tool.
I bet you don’t even realize how ridiculously easy it is to bypass the GM ‘chip’ keys; I actually had a ‘universal’ one I cooked up because the ignition cylinders were too much of a bitch to drill.
I used to be a mechanic. Electronic security modules? Very much in the wheelhouse of both of my specialties. Fill the thing to the headliner with rattlesnakes if you like.
The only thing you’ve done is make your car less convenient. If somebody really wants that car, there is absolutely nothing you can do. Nothing. I can just grab a tow truck and haul it off that way, deal with the snakes at my convenience.
Exact same as it is with computer security; the idiots leaving things unlocked and unpatched get pwned first because it’s cheap, easy, and convenient. If somebody decides they just have to get in, nothing you do is going to stop it.
Problem is, every auto manufacturer is leaving shit unpatched across 10+ model years, with the password written on a post-it taped to the monitor, says “oh it’s too hard to make it inconvenient,” and now you can learn how to steal every Honda in town with a 15 minute YouTube video or just by ordering a ‘for mechanics ONLY winkwinknudgenudge’ device off AliExpress.
“If somebody really wants that car, there is absolutely nothing you can do. Nothing.”
It’s the same issue with bicycles and bicycle theft. The only things that work are to make the theft less convenient and make the vehicle look less desirable.
In cars, many thieves don’t know how to drive a manual transmission. So arguably a manual transmission is a security upgrade. And owning a less desirable/basic vehicle probably also helps prevent thefts.
And when it comes to bicycles, what some do is scratch the bike in a unique way so it is uniquely identifiable.
And that also got me thinking about pickup trucks and how tailgate thefts are a big problem. And I was thinking the only effective solutions is to ether remove and hide the tailgate somewhere OR deliberately dent it so it’s still functional but looks less nice/desirable.
I’ve only ever owned manual cars and never had one stolen. Did have a bicycle stolen once, but at least it wasn’t a bike that was expensive or new.
The only other possibility is sticking tracking devices on stuff you want to protect. But then if it actually gets stolen, you have to be prepared to go on the offensive and steal back your property… and I’ve read a few stories of people doing that with their bicycles.
And of course the police self-servingly tell people not to do that. But that’s what they get for being useless for stuff like this.
“The only things that work are to make the theft less convenient and make the vehicle look less desirable.”
I figured a 7-year Soul with serious hail damage that was full of trash would do it. Nope. Convenience apparently won. I’ve got a steering wheel club now, though I’m driving it with USB key since there’s a 2-month wait for a body shop appointment.
“if it actually gets stolen, you have to be prepared to go on the offensive and steal back your property…”
Actually, the cop told me that if I found it, I just needed to call them before I drove it, so they wouldn’t treat it as a stolen vehicle if they noticed me.
You seem very knowledgeable on mainstream vehicle anti theft systems/devices.
Question: Are the security/anti theft systems used in Volvo’s produced in the past 5 years any better than the mainstream brands?
Kia does care. Stories like this can make it more difficult for them to sell new cars. From people worried that their car will disappear from the parking lot to insurance companies who will use any rumor to raise the rates, this could hurt.
Remember when old people were layering multiple floor mats in their Camrys and then when the throttle pedal got hung up on them and couldn’t return we got a year of stories about ‘unintended acceleration’?
You’re not wrong about any of this. The other day I found all the software that runs every bit of the interior of my car on the Bosch website. And it’s all basic unprotected Red Hat Linux. It even has the Java Game Environment Runtime. What for I don’t know. But now my car infotainment center can play videos, I can replace the 3D model of the car in the gauge cluster’s compass display with Krusty The Clown, and I can make it run unauthorized Python scripts for total blackout mode. If you know how to use even the simplest forms of Linux like Mint or POP! and know how to install packages from the terminal, you know how to make your car do weird shit. This stuff is secured by obscurity, which isn’t really secure at all.
Yup. The most ‘advanced’ secure infotainment systems run… QNX. Yeah, if you can’t figure out QNX, well, I dunno what to tell you. It’s just another Unix-like. It’s a little more secure, because you need to – let me check my notes – sign up for an account and download it. (Porting software is more difficult, but a lot of what you need is already there.) And unlike Linux, it has actually good documentation.
Tesla’s by far the worst – shitty buildroot with an utterly idiotic configuration and using IP networking. The kind of configuration that if it was an AWS EC2, would get pwned within an hour if not minutes. And unlike Bosch, who complies with the open source licenses, Tesla just ignores them and does whatever it likes. (Tesla is violating no less than a dozen GPL licenses. Minimum.) They used to have every car making a permanent OpenVPN connection to shitty, unmaintained Debian infrastructure.
People act like the ‘signed certificates’ make it more secure, but it doesn’t. It’s IP based and certificates are stored locally. You can already guess where I’m going there. Yes, the Intel SOC sometimes has eFuses, but it’s vulnerable to various hardware exploits as well. And Tesla’s just announced they’ll be switching to an in-house developed SOC (bahahaha, yeah, that’s gonna be more secure. Suuuuuuure.)
That tone is why people make jokes about IT/tech people with low EQ. For someone who purports to be advanced in his career, I would expect more tact. Maybe you’ve had a bad day, but don’t take it out on Mercedes. She’s one of the last people who would post “copaganda” or whatever politically triggered buzzblather you’re going on about.
I’ve found that rootwyrm is typically overly abrasive at the best of times. From what I can tell he knows his material, but that doesn’t really excuse the behavior.
In another article David had to tell him to take a second and breathe.
Whoa, take it easy friend. Let’s not let the comment section here end up like the other site.
There aren’t many auto sites left that have a comment section that isn’t a complete cesspool.
Always starts off ok, before the cesspool
So that quote is in regards to models *older* than 2022. Kia/Hyundai has already admitted that a number of vehicles older than 2022 do not always have immobilizers. That is why the company’s current PR statement about this is that all 2022 models do.
The companies won’t give out a list of trim levels without immobilizers (for good reason) but enthusiasts believe that they’re the cars without push-button start. That seems to agree with the findings of Milwaukee repair shops.
For example, in that service manual that you’ve provided, the ignition system of the 2017-2020 Rio is noted to work standard with a key or with an optional push-button start. Guess which version is doesn’t have the immobilizer?
Of course, you’re very correct that immobilizers are incredibly easy to overcome. As I noted, clearly the addition of an immobilizer isn’t enough to stop someone from taking your Elantra.
And here is where I wish for comment editing.
That service manual confirms that at least some keyed models have immobilizers.
But Kia/Hyundai admitted that not all pre-2022 models have immobilizers, so I wonder which ones really don’t.
Or maybe, disconnecting the ignition is all you need to do to bypass the immobilizer, which would be hilariously sad if true.
“And here is where I wish for comment editing.”
You and me both today. For the record, we cool. (Pain makes rootwyrm grouchy.)
“Or maybe, disconnecting the ignition is all you need to do to bypass the immobilizer, which would be hilariously sad if true.”
I can’t confirm or deny things for obvious reasons (namely, that I’m not an expert in Kia/Hyundai,) but there are at least four cars I know of where I would now owe you a cigar.
Yes, really.
Obviously Kia/Hyundai is taking the ‘security through obscurity’ route with refusing to disclose, which ultimately is completely useless. Always has been, but doubly so when five minutes with Google will get you the service manuals and procedures. Hell, it gets you the waveforms so you can spoof with a signal generator like say a Raspberry Pi. (Oops.)
But of course, that’s really not the problem here either. Yes, Kia/Hyundai’s design is ho-ho-holy fuck laughably bad. In every way. Which yeah, they bear 100% of the responsibility for. Seriously guys, you make beautiful, genuinely good cars, and you do this? Sigh.
But they’re also not the ones who made it a ‘trending topic,’ promoted videos showing how to do it, and continue to promote it as a hot topic that’s sure to get you followers. We had the same problem when TV news would run fear-mongering pieces about how thieves could steal your car with a screwdriver – suddenly every kid in town’s trying to boost Buicks with dad’s tools. Because – duh! – they just got told that all they need’s a screwdriver! Same deal here, except the USB connector’s the screwdriver. (I mean, you could use a screwdriver too.) Except now it’s spread faster, further, more efficiently, and instead of getting a car you get Internet Fame, likes, and an increased follower count! Yay Skinner Boxes!
The Internet is how I make my living, and I still think it was a mistake. 😛
That is definitely the annoyance right now. The Soul owners manual section on it is titled “Immobilizer System (If equipped).” Plus there really isn’t any reason for it to be listed on the sticker so it’s a bit of mystery.
Earlier this year I was in Milwaukee for a business trip and picked out a Kia rental car. The lady at the rental car place told me to wait while she checked if I could rent it, because all of their Kias kept getting stolen. Since it was a push-button start she ended up letting me take it, but that was the first I had heard of it.
SE Wisconsin native here – it’s been a TV new story for 3 years (especially during sweeps weeks) and neither the police nor Kia/Hyundai seem to really want to do anything about it. (Thus the class action suit.)
Had friends in town last year who had a Kia rental busted into, in broad daylight, on a Saturday in a yuppie neighborhood. There was gunfire and broken glass and run for your life action and all the cops did was take a report and tow away a damaged rental car.
My lucky friends have been able to get out of their Kia/Hyundai ownership and into nice Toyotas for now.
I don’t completely blame the manufacturers. I think a lot of the blame is on the cops who won’t even investigate a car theft report, and the courts that don’t sentence car thieves to any significant punishment (because the insurance companies pay out). This allowing of car theft by default is costing each and every person money in terms of vehicle loss (if your car is stolen) or via insurance premiums (because we pay – no insurance company eats the losses). What manufacturers have done so far while completely useless in terms of actual theft prevention, has made getting replacement keys, etc. for legal owners onerous and expensive. And as rootwyrm so clearly stated, the systems put in place are ineffective at stopping criminals.
Since a LOT of people clearly missed the point, or I didn’t communicate it well…
This happens regularly, the cops get out the propaganda every time, and nothing changes or improves. And after 30+ years of the same shit, well. If I could, I’d post a good two plus dozen links to constables in the UK breathlessly saying they need more money and resources, and keep your BMW keys in tinfoil. No joke. They recommended putting keys in tinfoil or in your fridge. Because professionals with expensive RF sniffers can easily break the rotating digit scheme that was never secure in the first place. Before that there was “oh no Toyota’s are easy to steal.” Honda had a turn last week. And the list goes on. Remember the “OHNOES THEY CAN HAXXOR YOUR JEEP OVER THE INTERWEBS AND KILL YOU”? That was hot news for almost a month.
This happens any and every time any amateur-level accessible method of stealing a car is widely disseminated or there’s some ‘scary’ vulnerability. Regardless of year, make, model. It happens regularly. Pre-Internet, when the TV news played it up. Post-Internet, any time it’s a big trend on a forum before and now social media. This is going back literally decades.
And every – every – time the cops trot out their spokesperson to breathlessly reiterate their copaganda to make everyone fear for their life. “OMG if you park your car outside it will be stolen by roving (teenagers, thugs, drug dealers, etc.) with (screwdrivers, pliers, $500 specialty tools, USB sticks, etc.) LOCK UP YOUR CHILDREN AND LOCK UP YOUR WIFE! And we’re helpless to do anything about it unless you give us more money!”
It’s classic fear-mongering, acting like it’s some horrifying existential threat to the community and country. Which frankly, is exactly why I get so pissed off about it when people just quote the cops word for word, and spread their bullshit further.
Their fear-mongering is ultimately completely irrelevant to the root of the matter. Always has been. They don’t deserve nor should they be taken seriously. The matter at hand is, simply, “social media – specifically TikTok – has popularized a way for amateurs to steal certain cars. And actively promoted and profited off spreading this trend.”
We don’t need the cops’ take on it, especially when they only use it to spread fear and blow dog-whistles, and it contains absolutely no beneficial information. Just “waah, waah, we’re helpless.” So you can’t, for example, remind people to ensure their cars are locked and recommend they park them in their garage if possible? To park in brightly lit areas and not leave valuables in their car? Yeah, no, that doesn’t get them another budget increase.
And more frustratingly? Autopian’s a website for car journalism with a focus on deep analysis. Repeating their fear-mongering is extra-irrelevant. This is an opportunity to instead discuss the problem of companies like TikTok, Twitter, and Meta actively promoting and profiting off harmful trends like this one, the ‘car wash’ trend, and so on. To analyze why manufacturers continue to make cars in ways that make them easy to steal. (Hint: “costs more than a nickel. No.”) To look back at the history of car theft trends like this one. Hell, we could talk about how the 1995-1999 Acura Integra was the most stolen car in America for 2000, 2001, 2002, 2003, 2004, 2005… (no, seriously. Look it up.)
Sorry, that didn’t help clear up your point. I’ve read multiple articles on this issue and all of them pointed out the link to social media and how it is the root cause of the trend. You’re doing an awful lot of bashing of both the police and the media in general (and this site specifically), when there is only a single quote from the police in the entire article, and it is only a spokesperson explaining in general how the cars are being stolen. I didn’t see any crying or complaining for additional funding, or a suggestion that somehow anyone is at fault besides the perpetrators and the car company who decided to put out a car that could be stolen in less than a minute with any small, flat piece of metal you might happen to have on hand.
The fact is, Kia/Hyundai models without push-button start are incredibly easy to steal with absolutely zero tools, programs, or equipment, and can be done so by anyone with no skills and a flat-blade screwdriver (or, apparently, a male USB end). Just because other cars can also be stolen doesn’t let Kia/Hyundai off the hook for having zero security on their cars with physical keys. It also doesn’t remove the blame from the kids who see a TikTok video and decide that trying out grand theft auto seems like a fun thing to do on a Thursday morning. Currently Kias and Hyundais are the low-hanging fruit for them, and that needs to be fixed.
“Because professionals with expensive RF sniffers can easily break the rotating digit scheme that was never secure in the first place.”
No they are not breaking the rotating digit scheme. They are relaying LF signals from the vehicle over a longer distance (standard range is 2m) to the keys, typically inside the house and the keys respond in UHF (300-915MHz depending on market).
This weakness has been known for 20+ years, but until recently (last 5 years) the equipment needed to execute cost more than 10 thousand dollars. Equipment prices have dropped drastically and devices can be made/bought for 100-3000 dollars at this point.
Additional features and technology to mitigate this are available but are not utilized by all OEMs or vehicle lines.
Ultimately it is a comparison of cost of attack vs cost of defense to decide level of security.
Clearly Hyundai/Kia vehicles with Keyed Ignitions have a poor design. Such that it is easy to quickly access the ignition switch wiring and unlock the steering column lock. This is a huge error on Hyundai/Kia’s part and is completely different from Relay Attack.
What department was the one that gave you a speeding ticket for 15 over the limit? Because it sounds like you should complain to them instead of venting your frustrations on the whole of Autopian, dude.
Cars are getting stolen. Whatever the reason is, it’s important to be aware of the situation because the police are the ones who have to deal with the aftermath. They’re taking action by offering free steering wheel locks in Milwaukee afterall. Don’t discredit them over whatever issues you have.
This makes me appreciate my caveman key technology all the more. My next car should be a stick with another $5 key cut at Home Depot.
But, were you not entertained by the report?
Settle down man, let’s keep it civil.
“It makes PCI-DSS look comprehensive and forward-thinking.”
Dealing with this exact thing regularly, you have ligetamized your entire rant (that I already agreed with) with that sentence. You KNOW!
Interesting. It would be fascinating to hear how they get round immobilizers but as you say sharing such things isnt an option.
If i ever have a car that i dont want stolen ,i’ll take security more seriously. I’ve got some ideas where a cut out switches could be hidden.
How much does a new key for a modern Kia cost? C’mon guys you can do better.
My DD can be unlocked and started with anything key shaped. The owner only had one key when I bought it. It was so worn down that I couldn’t get a decent copy without an hours work with a file. I decided to just delete the need for one by removing the pins and tumblers. You can’t tell by looking at it but pretty much anything will unlock the doors and start the ignition. The tiny file on nail clippers works.
This is one of the reasons I love old cars. The simplicity of the fix.
Bonus: Now I never have to worry about lost keys.
I do have a security system of sorts though.. a manual transmission with a touchy clutch.
I used to leave my ’94 MT ‘scort wagon unlocked and empty in Providence RI because honestly if the thieves wanted the car or anything in it they were going to get it. Towards the end of it’s glorious life you didn’t even really need a key to start it. Just jam something like a small screw drive in and it would crank just fine. I assume it never got stolen because the parts weren’t that valuable and maybe not joy riders because of the MT.
A friend in that same era had a new Honda Civic. Got stolen right out of the driveway, all the parts stripped off of it and found running on the side of the road by the police. Seriously, panels, electronics, air bag, seats. If it wasn’t part of the frame or engine, it was just gone.
Preach on brother.
I don’t lock my car doors either. I’d rather recoup what was stolen from the cabin than deal with and pay for broken glass.
There’s a certain freedom from worry that comes with shitbox ownership.
Will it get you there? Yup
Does anyone want to steal it. Nope.
When I was a kid my dad bought the first new car my family ever owned. He pulled it into the driveway and while we all stood around admiring it he pulled a penknife from his pocket and scratched the paint from front fender to door handle.
We were all so confused.
He said, “Now I don’t have to worry about it”
Cars are fun, cars can be an obsession but they will always be just cars.
I can’t imagine the daily torment of owning something extremely expensive or rare.
Give me the hassle of an old Ford Ranger with a leaking clutch slave cylinder over the all encompassing dread of finding a safe parking spot for my expensive G Wagon any day of the week.
+1
Honda Fit, the locks are biodegradable or something, tumblers in the lock cylinder wear out long before anything else on the car.
New ignition lock is $1000 from dealer and not available aftermarket.
Like you, took out the cylinder and removed the worn tumblers. So it’s about half of an ignition lock now..
The door lock had worn out five years ago, $500. Turns out the Fit base model has the remote unlock system installed but not activated. Get a Fit Sport key with the remote unlock button and program it, now I have a remote unlock and a very secure door which can’t be unlocked with any key 😉
On my first car, 1974 Hillman Vogue, the ignition lock broke. I hotwired the car and drove it that way for several months until the flying sparks from startup began to melt the carpet. Installed an aftermarket lock with a hose clamp and drove that for another five years..
My friend!
I had a 98 Ranger where the driver side door lock simply gave up serving its purpose. A few feet of braided steel cable and a couple of aluminum crimps fixed the problem. Hidden under the front of the door handle was a pinky sized loop that was connected directly to the door lock mechanism, pull it down door unlocks. Simplify!
My wife’s DD is a 2020 Kia Soul turbo. The day we bought it, we got a “Club” for it. Her idea. She even puts it on in our garage. Just in case. We know it won’t prevent a determined thief, but it’ll make it a less attractive target.
And we don’t have registration or insurance info in the car. We carry that in our wallets.
Early Ford Sierras had virtually no security at all, a slightly worn key from one would open and start any other one. I rented a red Sierra, parked it on the second, or third, level of a multi-story car park and went to get some supplies for my 250 mile trip home. Returned to the car park,third or second level, unlocked a red Sierra and went on my way. About 100 miles further north I stopped to fill up with petrol. That was when I realised, this was not the car I had rented.
The police were surprised, but quite helpful (eventually) when I turned up at the police ststion to report a stolen car. As the thief!
I still swear by steering wheel locks.
To no one’s surprise, I’m sure, I can confirm this to also be true for many Yugos, which is why most of the ones that are still around do in fact rock steering wheel locks.
Every single Ford from ~1982-1998ish could be opened and driven either with a slightly worn key, screwdriver, or just the key from any other Ford. They only had a few dozen different key patterns.
also 1990s Hondas – they had very minimal variation between different key shapes, you could take a random Honda key, file it down slightly in the right places, and have a master that would work in any of them
Yep. Really it was true of every manufacturer… except Chrysler.
But that’s because Chrysler’s ignition cylinders didn’t like to turn even for the correct key.
Heck, I once owned a 1997 Ranger that didn’t need a key at all. The ignition was so worn out that you just needed to turn to start.
When my future wife bought a ’90s Bronco and lost her key, she found a shop that collected the roughly 12 or so keys that a Bronco had. They made copies of all of them and sent them.
The thought that we could have taken any Bronco made me laugh, but we destroyed the other keys when we found the correct one.
Sounds like the old 92 Cherokee we used to have, where you could just remove the worn key while it was running. We gave it to some friends with a lot of family in town, and they quickly realized that they could just not lock the ignition switch, leave the car unlocked, and any of the various family members from around town could drive it without a key. Over a decade of abuse later, it’s somehow still going, with another generation taking it offroading and beating the crap out of it.
Back in the 90’s had a supervisor go to the State motor pool & request a loaner. Was given keys with a number on the fob. Walked out into the muli-level parking garage to a stall marjed with that number. The car was a later model (small) Mustang, which he thought was odd for a motor pool vehicle, but what the hell? Gets in, fires her up, and he’s on his way to a conference in a different city. While driving, he notices litter in the interior and butts in the ashtray, and thinks that’s odd for a motor pool vehicle, but what the hell?
Meanwhile, the Motor Pool folks are puzzling over the unused Escort (or whatever) in their outbound lot, and a state employee has reported her car stolen. Wasn’t ’til my boss returned late in the day that the coincidental placement of a car with a matching key explained all the weirdness.
FMVSS at that time had a low requirement for unique mechanical keys, like 1024….so the odds of this occurring are high. Especially if a single key was used for Door Locks and Ignition.
Not sure the number of unique keys Ford specified, but it would be at least 1024 to be in compliance.
I have the American version, the xr4ti. I performed a conversion from automatic to a manual transmission. I had wiring left from the neutral safety switch that I used to turn into a kill switch that was hidden in the transmission tunnel next to the driver’s seat.
Guess I’m calling Kia to find out if mine has an immobilizer or not.
There’s a reason immobiliers were made mandatory in Canada years ago.
Put a big dent in non-pro thefts.
The pros just use tow trucks.
Depends on the car. Anything AWD’s going to take a flatbed to haul without damaging it. And anything with a fully compromised security system (which ain’t fucking much) it’s just as fast to whip out the tool you bought off AliExpress, if not faster.
Yup. Mine got stolen Sunday (not in Milwaukee). Broke a window, pulled the ignition switch out, behind that there’s a nub that a USB plug is a perfect wrench for. That’s how I’m driving it until the shop can fix it. Terrible design. Car was recovered Monday. The perp must have wanted to impress his GF, because they cleared all the trash out of the car (ok, I’m a slob, you mean that passenger side footwell isn’t a trash bin?). Abandoned it a few blocks from where they stole it. Feh.
Hit-and-run valet service 😉
This reminds me of how easy it was to steal 80s GM A nad G bodies. The steering column collar was plastic, so a good whack with a hammer would shatter it exposing the ignition cylinder. My 86 Grand Prix was stolen this way from a crowded parking lot at a music festival.
Yep, almost lost my ’85 Jeep Cherokee XJ that way, was lucky that a fellow employee pulled into the lot and scared the thief off.
They took my ’87 XJ that way, just smacked the column and it was gone. Too bad, too, it was a clean 2-door 4.0 XJ.
Holy Grail!!!
I’m pretty sure it was all GM’s of that time. Possibly all American cars. It was not my thing, but I had friends in the 90’s that could be driving just about any vehicle in a short amount of time with very crude tools. If I saw them with a slide hammer, I knew what they were up to.
Yep, my 85 Cutlass Supreme was stolen the same way. My friends thought I forgot where I parked but when I got closer to where my car should be, I saw the chunk of plastic from my steering collar on the street.
Ah yes, Milwaukee. Land of innovation.
Hey at least we’re finally trend setters in something. (Other than alcoholism and segregation)