How easy it is for a thief to reprogram PATS?

[1998Exp]

Lots of stories recently about thieves entering a vehicle, plugging a programmer into the OBDII port, programming a key and off they go - in a couple minutes or less. I know that our vehicles have a long delay - perhaps an hour, but is that a feature of the programmer (like Forscan), or of the PATS code in the PCM itself? Does anyone know?

 

[joney]

Lots of stories recently about thieves entering a vehicle, plugging a programmer into the OBDII port, programming a key and off they go - in a couple minutes or less. I know that our vehicles have a long delay - perhaps an hour, but is that a feature of the programmer (like Forscan), or of the PATS code in the PCM itself? Does anyone know?

Hm., very interesting, hadn't heard of that - can you point me to some of those stories? On the positive side, I'm thinking thieves MIGHT not be after our vintage 98 Explorers yet - I can say that from personal experience, locksmiths CAN do exactly that in half an hour or less including cutting the key - as I had only one key, and the local PopALock technician came out and made me one. They did plug something into my OBDII port to do it. But there is some proprietary software they have to do it with. Of course locksmiths aren't thieves BUT....obviously the technology is there.

Can't say anything about newer models however, some have pushbutton start and I don't know when that came in - so maybe no key cutting needed?

Edit: was looking around on the net, this has been going on a while! This: regarding Jeeps:

Stolen Jeep, not mine, anyones

www.wranglerforum.com

 

[1998Exp]

Don't know about the VIN trick; sounds like some newer versions of PATS require accessing a remote database to obtain a VIN-related password before a key can be reprogrammed. Covering the VIN decal perhaps works on the premise that there is an intentional delay in serving that password, so the thief moves on to an easier victim instead of being a sitting duck in the vehicle.
Oddly enough, newer vehicles are easier to steal, because of the keyless feature -- no need to be brutal with a screwdriver. Many of those guys don't even use the infamous Slim Jim to gain entry - they simply follow the target and steal the door code when the driver steps out and pushes the clicker. Moreover, they don't have to carry anything incriminating - just an innocent looking tablet.
Biometrics is the new buzz-word in theft protection - until that gets defeated too.
Oh, and one more trick: if they are after a specific model, they don't even need to reprogram anything: just open the hood, switch the PCM with one that they brought (programmed with no PATS) and off they go. Anybody has an old fashion fuel pump kill switch for sale?

 

[Josh P]

Some thieves own tow trucks, if they want it bad enough lead poisoning is about the only thing to permanently stop them.

 

[J_C]

Lots of stories recently about thieves entering a vehicle, plugging a programmer into the OBDII port, programming a key and off they go - in a couple minutes or less. I know that our vehicles have a long delay - perhaps an hour, but is that a feature of the programmer (like Forscan), or of the PATS code in the PCM itself? Does anyone know?

It seems fairly impossible to do that, that quickly. Even if PATs reprogramming were instantaneous, they're not going to happen to have a compatible lock cylinder, matching keyed key, and be able to swap them in, in a couple minutes. Maybe pick the lock cylinder instead (or force-break it) and duct tape the head of a new programmed key to it.

I don't see it happening, a thief with this skill set and level of pre-planning, would pick a more valuable vehicle, while kids just looking to go on a joyride, won't know what to do.

Anybody has an old fashion fuel pump kill switch for sale?

A fuel pump, or ignition, etc kill switch is not needing some proprietary switch specific to that application. Just mount your choice of single pole switch, rated for same o r higher DC amps the fuse on that circuit uses, on whatever circuit you want to interrupt. If the circuit powers multiple things then the switch wouldn't necessarily need to be same or higher amps as whole circuit, if you can determine max current of the subsystem you're cutting power to, through specs or series multimeter (or DC clamp meter) measurement.

You could also, or instead, do this to the OBD2 port so a thief can't get communication through it, then you don't have to flip the switch on and off every time you drive and park it, and a smaller/cheaper 1A rated switch would be more than capable too.

If a thief were to bring a compatible PCM with PATS2 programmed out... I'd wonder what you're doing wrong in life to be targeted like that, because otherwise it's practically unheard of for any vehicle that isn't worth an obscene amount of money, and a lot more work than just bringing a tow truck to take it.

 

[boominXplorer]

10 minute wait period and you have to have 2 keys. They are better off breaking in your house to get your keys then to try and program one.

 

[1998Exp]

10 minute wait period and you have to have 2 keys. They are better off breaking in your house to get your keys then to try and program one.

That's the "owners manual" way, which does not use any access to the OBD port. I was asking about the time delay for reprogramming the PCM through the OBD port - which does not require having any keys and is used by locksmiths, dealers, and of course, thieves. Forscan provides that in its extended version - for which you need to register. Didn't try, but I am sure there is a long delay built into that feature.

 

[1998Exp]

...
You could also, or instead, do this to the OBD2 port so a thief can't get communication through it, then you don't have to flip the switch on and off every time you drive and park it, and a smaller/cheaper 1A rated switch would be more than capable too.
...

A well concealed switch that turns off power to the OBD2 port is a much smarter idea than those silly lockable covers which have recently become popular. And you don't need to mess with it, except when scanning. In fact, the schematic shows that in addition to the power pin (#16), the OBD2 connector has a dedicated pin (#13) for reprogramming power supply. Need to read more about this -- perhaps just disabling that one does the trick, leaving the port otherwise available. Sounds too good to be true.

 

[boominXplorer]

That's the "owners manual" way, which does not use any access to the OBD port. I was asking about the time delay for reprogramming the PCM through the OBD port - which does not require having any keys and is used by locksmiths, dealers, and of course, thieves. Forscan provides that in its extended version - for which you need to register. Didn't try, but I am sure there is a long delay built into that feature.

That's also the forscan and Ford ids way...... How the hell is a theif already going to have 2 keys cut anyway?

Your much better off using a starter interupt if you want theft deterrent. Cut the signal wire going to the starter and wire up a relay so you have to turn the headlights on to start the car. This is how a friend of mine has all his older vehicles setup.