CAL Automotive Locksmith Security & Anti-Theft Technologies 2 — Questions and Answers
Question 1: What is the primary function of a vehicle's immobilizer system?
- Prevent unauthorized engine start without a valid transponder signal (Correct answer)
- Lock all doors simultaneously when the alarm triggers
- Disable the fuel pump when the vehicle exceeds a speed limit
- Encrypt Bluetooth communication between key fob and ECU
Correct answer: Prevent unauthorized engine start without a valid transponder signal
An immobilizer prevents the engine from starting unless the ECU receives a valid transponder code from the key.
Question 2: Which cryptographic algorithm is commonly used in HITAG2 transponders found in many European vehicles?
- AES-256
- RSA-2048
- Proprietary 48-bit cipher (Correct answer)
- SHA-1 hash
Correct answer: Proprietary 48-bit cipher
HITAG2 uses a proprietary 48-bit cipher that has been shown to be vulnerable to certain cryptanalytic attacks.
Question 3: A customer's car with a Megamos Crypto transponder will not start after a key was cloned. What is the most likely cause?
- The clone used the wrong frequency
- The rolling code was not synchronized after cloning
- The crypto challenge-response was not captured correctly (Correct answer)
- The transponder battery is dead
Correct answer: The crypto challenge-response was not captured correctly
Megamos Crypto transponders require a valid challenge-response exchange; an incomplete capture during cloning results in authentication failure.
Question 4: What does 'dealer-level programming' refer to in automotive locksmith practice?
- Programming performed only at an OEM dealership facility
- Using OBD-II or proprietary software to write new key data directly to the vehicle's ECU (Correct answer)
- Installing aftermarket alarm systems with dealer approval
- Bypassing the immobilizer using a factory reset code
Correct answer: Using OBD-II or proprietary software to write new key data directly to the vehicle's ECU
Dealer-level programming uses OBD-II or proprietary interfaces to add or replace key data in the vehicle ECU, matching what a factory dealer can do.
Question 5: Which of the following best describes a 'rolling code' (hopping code) in remote keyless entry systems?
- A fixed code that changes only when the battery is replaced
- A pseudo-random code that changes with each button press and is synchronized with the receiver (Correct answer)
- A code transmitted continuously while the button is held
- An encrypted PIN stored in the key fob memory
Correct answer: A pseudo-random code that changes with each button press and is synchronized with the receiver
Rolling codes use a synchronized pseudo-random sequence so each transmission is unique, preventing replay attacks.
Question 6: When programming a new key to a vehicle using the EEPROM method, what is the locksmith typically doing?
- Reading and writing data directly from the vehicle's memory chip after removal or in-circuit (Correct answer)
- Resetting the ECU by disconnecting the battery
- Sending a key-learn command via the OBD-II port
- Cutting a new key blade to the original bitting
Correct answer: Reading and writing data directly from the vehicle's memory chip after removal or in-circuit
EEPROM programming involves directly reading/writing the vehicle's non-volatile memory chip to extract or modify immobilizer key data.
Question 7: What risk does a 'relay attack' pose to passive keyless entry (PKE) vehicles?
- It drains the key fob battery by forcing continuous signal transmission
- It amplifies the key fob signal so the car thinks the key is nearby, allowing unauthorized entry and start (Correct answer)
- It jams the key fob signal preventing the owner from locking the car
- It corrupts the rolling code causing the fob to desynchronize
Correct answer: It amplifies the key fob signal so the car thinks the key is nearby, allowing unauthorized entry and start
A relay attack uses two devices to extend the PKE signal range, tricking the car into believing the legitimate key is present when it is not.
CAL Automotive Locksmith Security & Anti-Theft Technologies 2
What is the primary function of a vehicle's immobilizer system?