This article was published on August 13, 2018

Dutch car thieves ingeniously hacked their way into this BMW


Dutch car thieves ingeniously hacked their way into this BMW

It was Sunday afternoon when I installed the roof rack on my new BMW F30 320i.

We were about to go on a 2 week trip to France and were intending to leave next Friday.

During that night, my girlfriend and I were fast asleep, when at 03:45 the doorbell rang. We looked at each other dazed. I got out of bed and attempted to journey downstairs in my boxers when the doorbell rang again.

Before opening the door I went into the living room to gaze out of the window. A police car with 2 policemen was standing in front of our house. I opened the door and was welcomed with the question whether I owned a BMW with a specific license plate.

They said that a car burglary had taken place.

The follow-up question was whether or not the alarm system was linked to an emergency call center. I knew my car was equipped with a class 3 alarm system but wasn’t sure whether or not that meant that it actually communicated with an external call center.

They told me that the call they received was from an emergency call center so it must have an external connection.

Mere vandalism?

After putting on some clothes, we went to the car to inspect the damage. The front window on the passenger’s side was partially broken. After looking around the car, I entered the car through the driver’s door and tries to turn on the interior lighting.

For some reason, none of the interior lighting buttons worked. Being sure that they weren’t broken before, but probably out of sheer tiredness, I didn’t think much of it at that time.

I only cared for it not being stolen. I looked around the car and couldn’t find anything missing or out of order. Was this simply a case of vandalism?

The police advised me to report it first thing in the morning. I decided to seal the window with a duct-taped garbage bag and went back to bed for the 1.5 hours I had before my alarm clock went off.

The next day

The first thing next morning was a phone call to my insurance company and to Car Glass, the glass repair company. I was able to get an appointment for 10:30 the same day.

When it was time to head out to Car Glass, I switched on the ignition and faced a severe error and a warning on the BMW iDrive interface. The severe error stated that there was an issue with the passenger’s side seatbelt.

The warning stated that the SOS button on the ceiling wasn’t in contact with BMW anymore.

The window was replaced within 30 minutes and I hoped that maybe after replacing the window, the warning and error notifications would also disappear.

Unfortunately, this was not the case. I decided to call the local BMW dealer. They advised me to drop by in the afternoon so that they could take a look at it.

A nasty surprise

That afternoon, on my way home, I dropped by the BMW dealer. After explaining the situation, one of the service employees followed me to my car.

He looked all around, trying to figure out what the burglars were trying to achieve. After being puzzled for a while, another service employee joined the search.

Neither of them had a clue why the car would suddenly malfunction like this, just because of a broken window.

It felt like they were about to dismiss the issues and ask me to come back after my holiday when one of the service employees saw a small opening on the inside of the jamb. He pulled it away.

We were able to see one end of the airbag and also a wire loom running through the jamb up to the ceiling of the car. After close inspection, I noticed that the wire loom was cut through.

The interior panel of the jamb after pulling it away

My first thought at that time was, does the interior alarm actually still work? We closed the doors and locked the car.

Not all too surprising, the alarm light underneath the interior mirror didn’t blink as it normally would. At that time, the service employee strongly advised me not to take my car home.

Cut through cable loom

Digging deeper

He explained that behind the air vents located on the ceiling, two sensors are located for detecting break-ins. The first is a radar, used for movement detection inside the car.

The other one was an air pressure sensor, used for detecting sudden changes in air pressure. This is the sensor that will, among other things, detect a broken window.

We looked at each other, less puzzled than before. It was crystal clear that these burglars were not ignorant. They knew exactly what they were doing.

Their grand scheme was to make it look like a simple break-in without theft, while cleverly disabling the internal alarm systems, and covering their tracks as best as possible.

Most likely, if I parked the car in front of our house the next night, they would break in again, without triggering an alarm. That would give them more than enough time to bypass the ignition interlock and steal the car entirely.

The service employee told me that he’d never seen this before and after asking around in the local dealership, nobody seemed to have heard of this modus operandi for stealing a BMW.

The follow-up

When I went back to the dealer a few days later to return the replacement rental car, I spoke to a different employee who was wondering which external call center rang the police.

He told me that a class 3 alarm system doesn’t have a tracking option. I told him about the cut wire and how it disabled the SOS button.

His thought was that it was actually the BMW call center which is hooked up to the SOS button. His suspicion was that, as soon as the button loses connection with BMW, they get notified.

I decided to call the police to inquire about the phone call. The officer I spoke to was unable to tell me which phone number or external call center it was, but that it was, in fact, a call center.

The message they passed on was that there was either a burglary attempt or that my car was involved in an accident. They gave the police the exact coordinates of my car and it only took the surveilling car 5 minutes to get to the car.

I explained the burglar’s modus operandi to the officer, and she would pass on the message, hoping that this would prevent other attempts.

The BMW service employee also told me that he rang the national BMW damage repair center. They confirmed that they also never seen a car theft attempt like this before.

As both the Dutch police and BMW in the Netherlands has never witnessed this modus operandi, I hope that by sharing this story I will be able to save other people from actually having their cars stolen in this way.

What about the vacation?

The BMW dealer had a 4 week waiting list for appointments but due to the severity of the case and my personal situation with the upcoming holiday, they really wanted to help out.

Unfortunately, they weren’t able to help me within the 3 days that were left before our planned vacation. As fortunate as we are, my girlfriend also has a car, so we were still able to leave.

TL;DR

So, if you find your passenger’s front side window broken and a warning regarding the SOS button having lost connection to BMW appears, immediately contact your dealer and make sure it’s parked at the dealer’s or in a secured area.

This article was originally published by Marc Rooding. Read the original article here.

Get the TNW newsletter

Get the most important tech news in your inbox each week.