Relay attacks · key cloning · CAN injection · what actually stops them

Relay Attacks, Key Cloning & CAN Injection: What Stops the New Car Thieves

The thefts that remain as overall numbers fall lean increasingly on fooling the car's own electronics rather than breaking a window. Three methods dominate -- relay attacks, key cloning, and CAN-bus injection -- and all three share one weakness: they convince the car's computer, not a wire that's been physically cut.

Relay attacks

A relay attack uses two small devices working as a pair: one held near your key fob -- often just outside your front door -- and one near the car. The first device picks up your fob's signal and relays it to the second, tricking the car into thinking the key is right next to it. The attack takes seconds and the key never has to leave the house.

This isn't a rare edge case. ADAC (the German automobile association) tested more than 800 keyless vehicles across dozens of brands between 2019 and 2023, and found roughly 85% vulnerable to relay attacks. An earlier, more tightly controlled ADAC test of 237 keyless vehicles from 30+ brands found only 7 models that couldn't be compromised this way.

What helps: a Faraday pouch for your key fob blocks the signal from being picked up in the first place -- a simple, legitimate defense against this specific method.

Key cloning

Rather than relaying your real key's signal, key cloning copies its wireless identity outright, producing a working duplicate without you ever losing possession of the original. Unlike a relay attack, a Faraday pouch does nothing here -- there's no real-time signal to block, because the thief already has a copy.

CAN-bus injection

This is the most technical of the three, and it's been demonstrated in real thefts, not just a lab. Investigative reporting by The Drive documented a device -- in one case disguised as a JBL Bluetooth speaker containing roughly $10 in components -- that plugs into exposed vehicle wiring, commonly through the headlight harness. It sends a wake-up signal to the car's internal CAN network, silences the legitimate electronic control unit, and floods the gateway with spoofed messages telling the car a valid key is present. A button press then unlocks the doors and starts the car.

The method was used to steal a Toyota RAV4 in London in 2023, and researchers found devices built to target a wide range of brands sold in the US as well, including Ford, GMC, Honda, Jeep, Lexus, Nissan, and Toyota. A Faraday pouch does nothing against this method either -- the thief isn't relaying or cloning your key signal at all, just talking directly to the car's own network through its wiring.

The one thing all three have in common

Relay attacks, key cloning, and CAN injection all work by convincing the car that a legitimate key is present. That's the entire attack surface: the car's own decision about whether to unlock and start. A hardwired kill switch wired Normally Closed isn't part of that conversation at all -- it physically interrupts the starter circuit, independent of whatever the car's computer believes just happened. See the full explanation of NC wiring and why it matters here specifically.

Method	Faraday pouch helps?	Stopped by an NC kill switch?
Relay attack	Yes	Yes
Key cloning	No	Yes
CAN-bus injection	No	Yes

The two automatic layers that close the gap

Since none of these attacks require you to do anything wrong -- they happen whether or not you're careful -- the strongest defense is one that doesn't depend on catching the attack in progress. MooveTrax's scheduled kill switch disables the starter circuit automatically during set hours (overnight relay and CAN attacks are common), and the walkaway kill switch (MT3V tier) disables it the moment your paired phone isn't nearby, any time of day. Either way, a cloned or relayed key has nothing to start.

Frequently asked questions

Sources: ADAC keyless vehicle relay-attack testing (2019-2023, via DaxStreet reporting); The Drive, "Shadetree Hackers Are Stealing Cars by Injecting Code Into Headlight Wiring." Vehicle brands named reflect reporting on devices built to target those brands' systems, not a claim that every model from every listed brand is equally vulnerable.