An independent researcher Samy Kamkar has built a remote control which is able to unlock any kind of car doors at will. The universal remote control is known as RollJam and interestingly, it can be purchased over eBay for less than $50. He had tested it on his own car, a Lotus Elise models from 2005 and 2007 as well as Toyota, Cadillac and Cobra alarm keys used in some other vehicles.
How does the universal remote control works? It works by intercepting the authentication codes which is exchanged between the car and the key. Everytime the driver locks or unlocks the car, the system will generate a different authentication codes. This seems to be secured; however, the loophole is that there is no timeout on the codes and that is when RollJam comes in. RollJam will intercept the transmission so that the codes will never reach the car and it can be used later on, however, it only works on lock codes. Kamkar is reported to be able to convert it into unlock codes.
The device has a limitation whereby as different cars are using different chips for their car doors, Kamkar needs to implement each chip and it only work for the car doors which are using the same chip, the most is several models across several years.
To counteract this exploit, it is advisable that drivers should use physical lock for their car doors or always check whether there is unknown device placed near to the car and be very alert when the button did not unlock the car door properly. As for the car manufacturers, it is better that they implement time out for the time taken to sync the car key and car door so the authentication codes can only work in a specified time.