University of Michigan's Battery Sleuth foiled car thieves via a power-outlet keypad

Vehicle theft costs U.S. drivers and insurers more than $4 billion a year, and the electronics meant to secure modern cars are part of the problem. Key fobs communicate wirelessly, so attackers can relay or spoof their signals from outside the driveway, and the onboard computers that run the car were never designed to work together as a security system. The usual answer is another layer of protection on top of the existing electronics, which adds another layer of code an attacker can break.

Kang Shin's University of Michigan team chose the opposite route: ignore the wireless channel and the onboard network entirely. Battery Sleuth installs between the battery and the car's electrical system, and its default state powers accessories but starves the starter. A keypad plugged into the auxiliary power outlet sends a preset series of voltage fluctuations, a voltage fingerprint the device recognizes before releasing full current. The same fingerprint can be produced manually by flicking wipers, headlights, turn signals or door locks in the right order.

The design works because its channel has nothing to hack. There is no radio signal to intercept or relay, and no dependence on the carmaker's computer network, so compromising every other system in the car still does not start it. The device also guards itself: a siren sounds on illegitimate activity, and a resistor shuts down the electrical system if an unauthorized power source is connected. It fits existing vehicles as an add-on or new vehicles at the factory, and it can measure each vehicle's electrical parameters to calibrate itself.

In a field study on eight vehicles published in July 2022, the prototype was more than 99.9% effective at detecting and preventing illegitimate activity without interfering with normal operation. A $1.2 million National Science Foundation grant then funded large-scale testing at U-M's Mcity facility, with the team aiming for a commercially viable theft-deterrent prototype within three years and, later, a full entry-and-control system for applications such as vehicle sharing.

Put the lock on the battery wire, not the radio: no wireless signal to relay

The auxiliary power outlet is just a wire to the battery, so authentication rides on a channel with no protocol, no radio and no remote attack surface.

Defaulting to a starter that cannot draw full current makes theft fail by default: no recognized pattern means no start, whatever else the attacker breaks.

Bypassing both the key-fob channel and the onboard network keeps the lock secure even if the car's other computers are fully compromised.

Working as an add-on or a factory component means the same device can defend old and new vehicles without waiting for one carmaker to redesign its stack.

Ordinary switches can send the code, so the backup authentication path adds no wireless hardware of its own for attackers to study.

When every added security layer enlarges the attack surface, move the lock to the most primitive, un-networked channel the system already has.

The team's eight-vehicle field study was published in July 2022, and on July 17, 2023 the university announced the $1.2 million National Science Foundation grant for large-scale testing at U-M's Mcity facility; the announcement drew 247 points and 562 comments on Hacker News that day. The three-year goal is a commercially viable prototype, first as a theft deterrent and later as a complete entry-and-control system that could replace keys and fobs and support vehicle sharing. The article reports no commercial partner or production timeline beyond that plan.