disable smart key options

Just traded my 2016 tundra for a 2021 (long bed baby!) Got real lucky with how this worked out. It was a custom order that somehow got messed up, I got lucky. The only thing I don't like is that it has smart keys. I work in cyber security, and IMO these things are a joke. We're quite literally handing keys to thieves here. A buddy's ram was stolen 3 weeks ago while he was at dinner for his anniversary in San Antonio, recovered in Laredo trying to cross the border, no damage no sign of forced entry. Its way too easy for them with these. I asked the dealer if he could re-key to non smart key, but he said no So, I'm looking at options. Keys are currently in the microwave, and a Faraday bag has been ordered. I'd like to understand as much as i can about the system to disable it as much as possible.

Is it really true you can't re-key to non-smart key? This is an SR5 where the smart key is an option. I'd very much prefer this.

It appears the proximity unlock requires handles that are a part of the system as well. Can we just unplug the handles to disable proximity unlock? Will this throw errors at all that prevent the truck from operating? If so, can we just throw a resistor or capacitor in the line so it thinks the handles are connected? Anyone know what size of either we'd need?

Does anyone know if the remote unlock rolls the unlock code? Is the unlock code in anyway associated with the proximity signal that enables the truck to drive?

I do have toyota's safety connect, is this easily defeated? I cant find any numbers on recovery rates with this service. Any success or failure stories here?


Open to any and all ideas to keep my truck mine. Specially right now when theres no inventory.

Thanks again and drive safe!

 

Will be a lot more trouble than it is worth. Should have bought a truck that did not have the smart key.

 

Good point, lets define what it'd be worth to me. I'd spent ~$2000 and/or ~30 hours of my own time to deter the theft of my $45k investment. I tried to order a Tundra at one of the largest dealers but they couldn't even ballpark a delivery date, and it would almost certainly be after they switched to the v6. They located the only long bed tundra in the 5 state area (I'm in Texas), it had all my required features so I went and picked it up. If I had an option of simply buying one without smart keys, I would have.

 

Is it insured????

 

Is that a serious question? Is my truck insured? Yes it's Insured, but so what? I need it now. I live 3-4 months a year in my camper, I can't wait for the chip shortage to be over and inventory be re-stocked in the case of an insurance payout. This forum is full of people doing mods to their trucks, do you reply to all of them saying they should have bought the truck with that feature? I don't follow your logic at all.

 

All I am saying is that the systems on this truck are so integrated, it would be very expensive if possible at all to do away with the smart key system. Your truck does not even have the key cylinder in the column. Is the wiring even there for it….will it require a new harness??

My thought process is, leave it as it is. It works fine. If you try this conversion, you will more than likely introduce more problems. If you do try to sell the truck later, you will kill the resale value because no one is going to want a truck that has been modified in this manner.

My question around the insurance may have come across a bit sarcastic, but if I were in your shoes, I would leave the truck as it is. In the unlikely event that it is stolen, fall back on your insurance that you are already paying for.

 

A determined thief is gonna find a way. I wouldn’t lose sleep over it if it was me. That’s why you have insurance. Or trade for a stripped out undesirable vehicle if it’s that important. Or put a disconnect in. Use your physical key to unlock. Pop the hood turn your master on and enjoy it. Reverse when you park it. Simple smart key override.

 

Also, you can stop the fob from receiving a signal by pressing the unlock button twice while holding down the lock button. Page 141 in the owners manual.

Don’t thinks this or trying to shield the keys will do anything for you because it is the truck that is sending the signal to the key.

My truck actually has the smart key. First vehicle I have owned that had it. Was skeptical at first, but i really like it now that I have had it for a while. Will it get stolen, maybe, maybe not. I am not going to lose sleep over it. It is insured, if it does get stolen, I will file the claim, find something else and move on.

 

I appreciate your opinion, and I'm not trying to ruffle feathers here but I'm trying to find out what is possible and at what cost. Even if I'm only paying for peace of mind in the end then it'll be worth it to me. The bottom line is the old system is way more theft deterrent. My buddy (image below) that had his truck stolen in minutes with no sign of entry, no alarm while at dinner had a really stressful week. Same thing happened to the singer of Shane Smith and the saints just a week or so prior, and they got his dog too. The dog was later found tied to a tree in a field, the truck wasn't recovered. Same attack, he was also just in and out. I'm not sure what it'll take for you to secure your truck, but if spending time and money on the older more secure system is an option then I'm going to exercise that option. If there's simple things like unplugging the door handles, I'm really interested in what those options are. If i could add an alarm system that has a cipher like the old key fobs have, I'm interested in that option. Stacking up the deterrents greatly increases the chances your truck stays put, that's the information I'm seeking out.

 

Well…..good luck with it. I don’t think anyone on this forum had tried this….or at least I have not seen it.

Report back how it goes and maybe your experiments can help inform others.

 

OP, I get your concerns. I don’t have a solution for you but wish you luck in your endeavors. Keep us posted. Welcome to the forum!

 

All the wiring diagrams are in the thread linked in my signature.

Pull them down and pour through them. Be sure to cross-reference individual switches, relays, ECMs, and connector pins - there are a LOT of things that are interconnected and interdependent. Then start researching part numbers based on the parts diagrams on parts.toyota.com for the different trim levels and lots of Google-fu.

Is it possible to “retrograde” your smart key SR5 to a “dumb” key SR5 using factory parts? I’m sure it probably is, because they do build them that way at the factory…except you may also find that certain other functions rely on the other system integrations that are only part of the “package” (for instance, an upgraded ECM that is what handles BSM/RCTA as well as the smart key module integration). Don’t forget that the CANBUS system in these trucks controls a LOT of things as well - it isn’t just old school switches and relays.

That’s also why the dealer said it wasn’t an option - it’s not an option for them to do it in a factory-authorized way that will maintain warranty. The same as you doing it will jeopardize or void any factory warranties.

If you were to determine you could make it all work, and wanted to do it using factory parts, I’m also going to bet $2000 won’t touch it from a cost standpoint…even just for the parts. At a minimum I’d expect you’ll be looking at new main ECM, security ECM, immobilizer system, steering column trim, ignition key tumbler and keys, steering spiral cable, connectors and terminals, wireless lock receiver(s), etc… plus tearing the cab apart to get to all those things to swap them.

Best of luck!

 

Keep your keys in a faraday pouch?
There’s a few guys on the u-toobs that say it works…

 

Is the key actually transmitting anything….from what I understand it is receiving a signal from the truck. Don’t understand how shielding the key will help in this situation.

When these vehicles are stolen, the thieves are using scanners near the vehicle and the fob is no where around.

See attachment below from ‘21 Owners Manual

 

Adding a kill switch sounds so much easier.

 

I am intrigued for sure, just watched a video on how the thieves are doing this. Apparently ya big issue in the San Antonio area.

Looks like the fob is needed for their plan to work. I just do not understand how they are grabbing anything from the fob if it does not transmit.

Looks like the battery saving feature described on P141 in the owners manual may help as it says the smart key system cannot be used when the fob is in battery saving mode.

Link to video below

https://youtu.be/xk_fTTlGcMA

 

This was going to be my comment. That’s what I would do, and have done in the past on other vehicles. Kill the fuel pump, hide the switch somewhere to your preference. At least they can’t get in and drive off. But if they show up with a flatbed, you’re screwed no matter what LOL

Also, I had one of these on a company work truck. @gotsmeatundra since you work in cyber security, you might appreciate something like this.https://www.ravelco.com/

 

Haha. Not if your truck is so fat it won’t fit on a flatbed.

 

Monster truck status! Have to bring the Skinny‘s just to fit it!

 

My understanding is that the Smart Key system is using two-way communication and active RFID devices. The truck is "pinging" for a signal from the key, and the key will actively send a signal back with a handshake to the truck when it receives the ping. You have to have a physical fob because you have to have the RFID device programmed for the truck to receive/sense in order for the truck to unlock or power up. The thieves are using devices that are searching for and snagging that RFID signal from the fob (including possibly sending out spoofed "pings" to get the key to respond). They are also using tools with much higher gain on the antennas compared to what is in the truck, which is why they can grab a fob signal that is so far away from the vehicle. Once they've picked up the signal off the fob and have grabbed it, they can either program a new fob or use a spoofing device to grab the rig and take off.

At least that's how I've seen it explained.

 

On the smart key systems I'm 99% sure its a constant/regular transmission. On the old style lock/unlock key fob, a transmission only happens when you hit the button. I haven't dusted off my SDR in a while but I'll try to grab a video or screen shot of the smart key signal soon. According to the FCC certification ID's in the owners manual, it uses the same frequencies as the old lock/unlock key fob's (screen shot attached). I also cant find any info on whether or not they are cycling the cipher though. This is really easy to do and adds a ton of security. cycling every 5 mins would at least mean thieves don't get far. Most multi factor Apps like Duo mobile cycle every 30 seconds. Once I dust off my SDR I'll try to get good enough resolution to see if they do cycle the cipher, and at what point.


I've got a farady bag ordered, and I tried the altoids box just now. The altoids box did not block the signal for me I was still able to open the truck and start it with the key fob in the altoids tin. Honestly the altoids tin with no holes in it should be more like a crappy antennae. faraday cages need to be tuned more or less. Its not a fine tuning, drilling holes in it might do the trick.

One web page suggests in some toyotas with smart keys has a kill switch is standard, and there's a button below the dash. I'm not finding it in my truck, but I've been known to look in the wrong place. Would love advise on where you'd put it on the 2021's. Link to page that mentioned possible stock kill switch: https://www.colonialtoyotact.com/blog/toyota-smart-key-faqs-and-troubleshooting-solutions/

This device looks pretty cool. If it can be put safely in a modern tundra, i like this option a lot.


This has gotten a conversation going, which is what i love about the internet. These kinds of conversations are what leads to community solutions. I thought I'd expand a little bit on the old vs new systems, just for those that are curious. As a lot of folks mentioned, a determined thief wont be stopped, but the majority of thieves are opportunistic. Make it harder to steal, your chances of theft drop off a lot. The old system was inherently harder to attack. Two important things to note, is the more factors in a system the harder it is to attack. I'm sure a lot of folks here use a multi factor authentication method to log onto work or banking websites (if not i really encourage you to look into it, your bank can help set that up). One factor may be your password (a thing you know) the second factor maybe a one time message to your phone (a thing you posses). The other note here is that if the signal you send is the same signal every time, then encryption (the cipher) doesn't matter. All you have to do is capture the encrypted signal, then replay it. Changing the encrypted signal after each use (cycling the cipher) adds security, which makes attacking the system a lot harder. On toyotas old system, the old key fob only broadcast an encrypted signal when you hit a button. This was a one time signal that then changed after the truck and key acknowledged the unlock code was successful. The easiest attack on this system was to be near the owner while he hit the button, listen to the unlock signal, then actively jam the acknowledgement. That's already more sophisticated than needed for the smart key system. If you manage to pull this off, you have yourself a code that'll unlock the vehicle once. This gets you inside, but to start the vehicle you still need a key that has it's own unique chip. A screw driver attack wont start these systems, because the key itself was a 2 factor system. Thefts still happened, but thieves needed more time or to be destructive and risk attracting attention to them selves.

The new system has essentially gone down to 1 factor. That 1 factor is broadcasting a signal at all times (I'm pretty sure of this, will verify as soon as i can). It's a really low power signal, but that doesn't mean it can't be amplified or captured. If you take wifi as an example, most wifi only goes a few hundred feet. However with a decent antenna, you can sit a few hundred yards away and listen to the wifi traffic. The same is true with the smart key fobs. Just listen their (publicly available) frequency and see what you pick up. You can easily make the effective range of the fob from a few feet, to several yards. If its a non cycling cipher (or poorly cycled), capture that and replay or relay it. The truck wont know its not the key's signal. This one signal opens the door and starts the truck. The thing that upsets me is this is really easy to fix. Cycling the cipher is one way. Adding an option for the chip based key on the column is another. Simply adding an dashboard configurable option to disable the proximity based unlock is another.

Anyhoo, I love all the suggestions and am actively looking into them. As I find stuff that looks promising and effective, I'll post it here. If there's a way to communicate to toyota directly, I'd love to know about it. If we all email in they may offer a software update that addresses some of the weakness.

 

I missed this before i replied. Great info. If this is the case, better cipher cycling or an option do disable proximity unlock should both be effective.

 

If you put the fob into battery saving mode, wouldn’t it solve the issue of grabbing the signal?

 

It does, but its not a one time thing. If you don't hit the lock button, the alarm isnt armed. So every time you get out, you lock, then battery saver, repeat. It's less convenient than the old system. Its what I'm doing now till my faraday bag arrives.

 

Figured I'd update for the (probly few) that are interested. I looked at what I could on the smart key fob and a non-smart fob from a 2016 tundra. In the attached image the red circles are two key presses from the smart key, and the the green circle is two key presses from the non-smart key. Pretty big difference, which is good. The old key sent two really short bursts right near 315 mhz. I was listening to the signal as well, it def sounded like a binary number getting sent. I'm pretty sure I can record and look at these codes with ease, though these will be rolling codes. There should be ~65k of them in this year of key, so re-using them is really hard to do. The new truck bounces between 312 and 314mhz consistently with each button press. I didn't record and compare directly yet, but initially there is no evidence the truck was 'talking back' to the key on this channel. The signal looks far more sophisticated though, which is good.

Still no update on the proximity portion. What I do know is the chip on the smart key has a 134khz RFID capability, which is a standard rfid frequency. My SDR goes from 10megahz to 6000megahz putting 134kilohz below the effective range of my gear Whats really interesting is this is normally the range of the passive (no battery) rfid's. This key fob has to be amplifying the rfid signal to get the read range to be 3 feet. In fact, if the battery in the smart key fob dies, you hold it up up to the start button. Thats much more like the range of passive rfid. A passive rfid is not powered on until an antennae from a reader gives it enough power over the air to turn on and send it's signal. Its used for building access cards/fobs, tracking packages, etc. The amount of power required to read a passive rfid from 300 feet away is huge. The amount of power required to pick up a signal from something with its own battery and boost the range to 300 feet is pretty small. When I use the rfid based unlock feature, no signal was detected in the 315 mhz range. This is expected and just illustrates these attacks are strictly rfid attacks, not attacks on tradition non-smart fobs.

For now I'm putting my key in sleep mode and keeping it in a faraday bag, all of which is a lot less convenient than the old way. I'm going to try to turn the signal from the fob into ones and zero's over the next couple days, but I fully expect the numbers to be randomized and unusable. For the 4th I'm going to a buddy's ranch who's also half nerd half redneck. We're going to try to read the rfid with his spectrum analyzer. If we an pull that off an verify the rfid doesnt cycle the number, a proof of concept will pretty easy to produce. With the ammo shortage I suspect we'll be spending a lot of time on this.