2022 RAV4 stolen

[Adaml99]

I had my 2022 Dynamic RAV4 stolen last night from a NCP car park. Completely and utterly shocked, I’ve never experienced anything quite like this before. I thought new cars would be much more secure but judging from all these comments and articles I’ve read, it seem all too common. Shouldn’t Toyota be addressing this and taking it more seriously? No way should it be this easy to steal £40K cars and being so helpless to prevent it. 😠

Even the NCP car park security didn’t seem bothered at all. I asked if this has happened before and they replied saying it occurs often. This is in a multi-storey car park with CCTV footage. Honestly, I’m trying to be calm about this but the whole situation is terrible. It’s beyond believe that someone can literally steal your car within a matter of minutes with minimal effort in a busy car park and drive off without raising any suspicion because they hacked it. Toyota need to do something!!

[Cyker]

It always amazes me how little care these car park operators have for their customers - For instance, the carpark in Chinatown; It's notorious for people's cars being broken into or even stolen, and they literally don't care, and just point at their many disclaimers.

It's particularly egregious given how much they charge to park there!

 

re. the Faraday pouch, note that you can put the key to sleep on most modern Toyotas by holding LOCK and pressing UNLOCK twice - It'll prevent relay theft AND extend the life of the Battery, as it shuts down the key's radio systems completely.

You won't even be able to get into the car with keyless entry until you wake it up again, by pressing one of the buttons.

Won't help against the CANbus attack tho', since that bypasses the key authentication completely.

[Strangely Brown]

1 hour ago, Adaml99 said:

I had my 2022 Dynamic RAV4 stolen last night from a NCP car park. Completely and utterly shocked, I’ve never experienced anything quite like this before. I thought new cars would be much more secure but judging from all these comments and articles I’ve read, it seem all too common. Shouldn’t Toyota be addressing this and taking it more seriously? No way should it be this easy to steal £40K cars and being so helpless to prevent it. 😠

Even the NCP car park security didn’t seem bothered at all. I asked if this has happened before and they replied saying it occurs often. This is in a multi-storey car park with CCTV footage. Honestly, I’m trying to be calm about this but the whole situation is terrible. It’s beyond believe that someone can literally steal your car within a matter of minutes with minimal effort in a busy car park and drive off without raising any suspicion because they hacked it. Toyota need to do something!!

Where is the NCP car-park from which your car was stolen? Your Location says Other/Non-UK. Is the car HEV or PHEV?

BTW, it's not just Toyota. The problem exists industry wide, it's just that RAV4s have a well-known weakness.  Any car with a CANbus that is accessible without triggering the alarm and without causing unacceptable damage is vulnerable.
 

[FROSTYBALLS]

2 hours ago, Adaml99 said:

Toyota need to do something!!

Toyota don't visit Toyota Owners Club, so they won't see this. You need to feedback directly to your Toyota importer, whichever country you're in.

[Adaml99]

2 hours ago, Strangely Brown said:

Where is the NCP car-park from which your car was stolen? Your Location says Other/Non-UK. Is the car HEV or PHEV?

BTW, it's not just Toyota. The problem exists industry wide, it's just that RAV4s have a well-known weakness.  Any car with a CANbus that is accessible without triggering the alarm and without causing unacceptable damage is vulnerable.
 

Not sure why my location doesn’t say the UK.

My hybrid was stolen from Stratford. I got a notification on the app to say the Hybrid system has severe failure, but I only saw this after I re-installed the app shortly after I realised the car had been stolen. 

I also managed to track my car to another underground car park in London and told the police straightaway. They took a look last night and couldn’t find it. I’ve called the car park security of the last known location and they said they have the car on camera going in, but not coming out. I suspect they left on different plates. 
What is strange is the app has a time stamp  of a few hours ago saying it’s at that same location??! How is that possible? There has been no recent journeys made since the car was initially stolen, only the address of the current car location. I can’t really make sense of it all. 😞 

[Strangely Brown]

Hi, Adam.

Thanks, that fits the pattern. London, Night, ideally secluded.

AIUI, the last known location is not a direct communication with the car but simply the last position that the car reported back to Toyota's servers. The MyT app and website can only read the data that they have. If the thieves have disabled the ability of the car to "phone home" then the last position at that time is all you will see.

It's a shame that the CCTV from the car-parks is not more helpful. Makes you wonder what's the point of it.
Have you visited the last reported location to check for yourself?

Adding one or two AirTags to a car seems more like a good idea every time I think about it.

[Adaml99]

55 minutes ago, Strangely Brown said:

Hi, Adam.

Thanks, that fits the pattern. London, Night, ideally secluded.

AIUI, the last known location is not a direct communication with the car but simply the last position that the car reported back to Toyota's servers. The MyT app and website can only read the data that they have. If the thieves have disabled the ability of the car to "phone home" then the last position at that time is all you will see.

It's a shame that the CCTV from the car-parks is not more helpful. Makes you wonder what's the point of it.
Have you visited the last reported location to check for yourself?

Adding one or two AirTags to a car seems more like a good idea every time I think about it.

Thanks for the info. That makes more sense. I thought it was the car pushing the signals to the server rather than the server requesting a response. But that explains why there are recent timestamps if the app is presenting the server’s activity.
I’ll be honest, I was totally clueless that the car could even be tracked without an internet connection (via bluetooth connected phone), so I was really surprised to see the journey the car thieves took when I opened the app! I thought I had struck some luck and the police would find it. 

I’m disappointed about the lack of interest from the car park security. I was expecting a bit more from them. In my head, stealing a car is a really big deal and even more so if it’s from a well established car park with a reputation such as NCP. But they didn’t even ask me for me for a vehicle registration, or make any effort to investigate. I suppose they just have a process they follow when these things happen. 

Unfortunately I live over 100 miles away and made my long journey back home, because at that time I hadn’t realised about the car tracker.

I highly recommend getting an AirTag too, perhaps hiding it in the car somewhere. Seems like a no brainer for how little they cost.

[Strangely Brown]

8 hours ago, Adaml99 said:

I thought it was the car pushing the signals to the server rather than the server requesting a response.

That's correct. AFAIK it is a client push model rather than server pull. The car sends data back to Toyota when you switch off.

I would like to know more about how it works but there is scant little information readily available.

[ToyotaFanDriver]

Absolutely terrifying reading the posts, especially as someone who is getting the car in a few months. 😶

 

Edit: it seems its the front left arch/headlight they target. If I park right next to a wall on that side where no one can fit in, I assume I am safe?

[ernieb]

1 hour ago, ToyotaFanDriver said:

Absolutely terrifying reading the posts, especially as someone who is getting the car in a few months. 😶

 

Edit: it seems its the front left arch/headlight they target. If I park right next to a wall on that side where no one can fit in, I assume I am safe?

Good idea, maybe worth still investing in a steering wheel lock for times when you’re not at home?

[Strangely Brown]

3 hours ago, ToyotaFanDriver said:

Absolutely terrifying reading the posts, especially as someone who is getting the car in a few months. 😶

 

Edit: it seems its the front left arch/headlight they target. If I park right next to a wall on that side where no one can fit in, I assume I am safe?

I wouldn't assume anything. Yes, it will certainly help by making access that bit harder but do not underestimate people who do not think like you.

I have seen a recent theft video where the thief appeared to pull the bumper forward rather than pull the wheel arch down. They still got access to the back of the light and the car was gone in a few minutes with not a lot of visible damage.

The name of the game is to prevent or discourage them from trying in the first place and something obvious and visible that will cause them problems they don't want, like a StopLock, will hopefully get them to jog on to easier pickings.

[Rigsby]

22 minutes ago, Strangely Brown said:

I have seen a recent theft video where the thief appeared to pull the bumper forward rather than pull the wheel arch down. They still got access to the back of the light and the car was gone in a few minutes with not a lot of visible damage.
 

I posted the link to that video, it’s on page 38 of this thread for anyone who missed it 

[Radoslaw]

I have recently installed ghost immobilizer in my RAV4 2020 HEV and after one month i had to remove it...

When engine was charging the Battery or when i was slowly driving while on petrol it was rough idling, some times backfiring (it wasn't regular ). First i have checked if it was something with my car but i did major service and they did not found any problems. So i phone the company to remove the ghost. Problem dissapeared. At the moment i have ghost not installed and asked the company what are my other options to secure the car maybe a tag ? I don't know...

[Zak.Ahamed]

We as customers need to put more pressure in the dealers, call them trouble them. Basically create a scene in the show rooms. 
I have installed a Ghost 2 immobiliser and Steering bar lock. 
Will sneak in an Air tag too

 

[jamiem1987]

Gone back a few pages and couldn't see for definite - is it the case the PHEV is immune to the canbus attack?

 

Crossing my fingers!

[ernieb]

7 hours ago, jamiem1987 said:

Gone back a few pages and couldn't see for definite - is it the case the PHEV is immune to the canbus attack?

 

Crossing my fingers!

Currently that is the general consensus of opinion.

[Strangely Brown]

4 minutes ago, ernieb said:

Currently that is the general consensus of opinion.

Be careful that it is not "internet received wisdom". Unless there are some significant differences in the CAN between HEV and PHEV then I do not see how it can be. If it is then great, what's the difference and how can similar be applied to HEVs.

I hope you're right, but I would not rely on it being the case. Are you prepared to bet your car on it?

[Dushio]

I have to say I’m very disappointed with the continuous theft situation of modern Toyota group cars and Toyota’s silence on the matter. Toyota know which after market immobilisers are most effective because if you call them they will give you a price to fit them. So anyone purchasing a Toyota just needs to negotiate £500 off the silly prices being charged these days and the problem goes away. My neighbour along the rd had Lexus fit an alarm for free after he found his Lexus RX 2022 model one morning with the bumper and wheel arch hanging off. Lucky for him as a 3 times returning customer to the same dealership (Hills Woodford). Good luck All and in the meantime use a KrookLock - it does seem to be the only deterrent that stops either theft or attempted theft because it’s visible. 

[ernieb]

43 minutes ago, Strangely Brown said:

Be careful that it is not "internet received wisdom". Unless there are some significant differences in the CAN between HEV and PHEV then I do not see how it can be. If it is then great, what's the difference and how can similar be applied to HEVs.

I hope you're right, but I would not rely on it being the case. Are you prepared to bet your car on it?

Somewhere in this thread one of the posters has indicated that his garage told him the protection plate was not necessary on the PHEV as it was not affected by the problem. That appears to be some additional information that until recently we did not have other than no one has reported a PHEV theft.

However, I agree it’s not a confirmation but the best we have as Toyota themselves are being very quiet.

And no right now I would not bet my car on it which is why I have fitted a Milenco steering wheel lock as soon and the issue was raised and will keep it even if it turns out that the connector arrangement is somehow different on the PHEV.

[nlee]

42 minutes ago, Strangely Brown said:

Be careful that it is not "internet received wisdom". Unless there are some significant differences in the CAN between HEV and PHEV then I do not see how it can be. If it is then great, what's the difference and how can similar be applied to HEVs.

I hope you're right, but I would not rely on it being the case. Are you prepared to bet your car on it?

If it's true (and I'm not so convinced yet), I could only imagine the difference is there are additional "checks" that the PHEV has to do before it will go into ready state. The obvious one is to check it's not still plugged in (charge flap open)! Maybe this changes the package/sequence of Can signals.

In any case, as mentioned above, would it avoid the damage being caused? Would the thieves check the Badge first to see if it was a plug-in? I'm sure the masterminds behind these thefts and develop the tech, are switched on, but not so much those that risk being caught who actually take the vehicles. 

[Shootgun]

I had just brought thge car back from the main dealer after the theft. 

They supplied and fitted 2 anti theft brackets to deny the access to the front area of the vehicle from underneath the front wings. I only had to pay £84 for the labour. 

[Hybrid21]

Hi Dorin, does that fitment prevent them whipping the front bumper off, which also gives access ?

[Strangely Brown]

44 minutes ago, ernieb said:

Somewhere in this thread one of the posters has indicated that his garage told him the protection plate was not necessary on the PHEV as it was not affected by the problem. That appears to be some additional information that until recently we did not have other than no one has reported a PHEV theft.

However, I agree it’s not a confirmation but the best we have as Toyota themselves are being very quiet.

And no right now I would not bet my car on it which is why I have fitted a Milenco steering wheel lock as soon and the issue was raised and will keep it even if it turns out that the connector arrangement is somehow different on the PHEV.

That is exactly my point. One poster said that a garage told him it was not necessary because PHEV not affected ... without an explanation of why or how the PHEV is not affected that is just hearsay and very much approaching received wisdom. I do not doubt for a second that the information is accurately reported and relayed, it's just not helpful.

I agree that a PHEV being stolen via a CAN attack would falsify the hypothesis and until then, arguably, the hypothesis stands. But I wouldn't bet my car on it either.

Thought: if it were true that PHEVs are immune, and thieves are aware of this and do not target them, I wonder how easy it would be to add Plug-In badges and a dummy charge flap to an HEV. 🤔

Note: not entirely serious.

[Terry10]

41 minutes ago, Shootgun said:

I had just brought thge car back from the main dealer after the theft. 

They supplied and fitted 2 anti theft brackets to deny the access to the front area of the vehicle from underneath the front wings. I only had to pay £84 for the labour. 

Hi Dorin,can you tell us the dealer name please that fitted these brackets for you.Any extra protection has got to be worth the effort 

regards Terry

 

[kucyk]

27 minutes ago, Strangely Brown said:

That is exactly my point. One poster said that a garage told him it was not necessary because PHEV not affected ... without an explanation of why or how the PHEV is not affected that is just hearsay and very much approaching received wisdom. I do not doubt for a second that the information is accurately reported and relayed, it's just not helpful.

I agree that a PHEV being stolen via a CAN attack would falsify the hypothesis and until then, arguably, the hypothesis stands. But I wouldn't bet my car on it either.

Thought: if it were true that PHEVs are immune, and thieves are aware of this and do not target them, I wonder how easy it would be to add Plug-In badges and a dummy charge flap to an HEV. 🤔

Note: not entirely serious.

This was explained a couple of times, however, we have a very limited information regarding this and it's based on the research from people working on the openpilot project.
In PHEV and 23' HEV and other new Toyota cars the communication between the ECU and components is signed using a digital signature that proves the identity of the source. This way ECU "knows" that the commands to open and start the car are coming from the legitimate source and it's dropping any injected / spoofed messages from the attackers.

I wouldn't bet my car on it too but so far this theory seems to be true. And don't expect Toyota to confirm this and tell you what they do, the research from openpilot is the best we can get.

Also, the car can still be stolen using the gameboy method which will emulate the key. I guess the only way to protect from that is turning off the smart entry and steering wheel lock. Steering wheel lock on its own is probably the best way to protect your car. Whether it's a can attack, gameboy or relay attack, the thieves will move on to the next car when they see it.