30 August 2006

Expensive Primary Keys (A.K.A Hacking Your Car Key’s SecuriLock)

You may have thought this blog entry was about databases, but no.  It’s about Ford fleecing me on a set of keys.  Actually it’s more about me whining because I lost my keys and they are really expensive to replace, but whatever.  If you have a newer car with a computer chip’ed key, then you will probably find this interesting.  And if you are thinking to yourself, “My car keys don’t have a computer chip in them” then you may want to check into it because if they are a newer model vehicle, then they probably do.

In 2003 my wife and I became proud owners of a Ford Escape, which apparently has what Ford calls the second generation SecuriLock Passive Anti-Theft System (also known as the PATS II).  I also have a 1997 Camero which has the Chevrolet version of the SecuriLock system, but you can actually see the computer chip embedded in the part of the key that goes into the transmission.  Apparently they have more powerful chips now so they put the chip in the key handle instead of the stem.  If you are not sure if you have a computer chip in your key, take a good look at your key.  If you have a huge black handle on your key, and it’s a newer car, then chances are pretty good that there is a computer chip embedded in it.  Anyway, I had no idea about all the technology packed into this Ford Escape Key.

Long story short, I left some softball equipment in the Escape and my wife took the Escape to work and locked it.  Since she is a school teacher, I cannot just barge into the School and ask her for her keys.  And since she is a volleyball coach she wasn’t planning on coming home before my game that night.  So I told the dealership my sad story and told them I needed them to cut me a new key.  After confirming my identity through a tedious process, they told me the damage:  $36 bucks for the key.  Not bad, I thought, considering that I pay $40 for the Camero keys.  Oh, and then they informed me that the $36 bucks was just for the physical key itself, and that it would cost an additional $40 to program the key.

What?  That seems pretty outlandish to me.  I can understand the $36 bucks for a key because, hey, it’s a dealership and everything they have is overpriced.  I’m cool with paying a bit more at the dealership because they can cut it without having an original there, but a $40 dollar programming fee?  They send the intern to the back of the shop, stick the key in a computer, press a couple of buttons, and out comes your new programmed key.  Definitely not $40 bucks of work in my book.  I tried to console myself by saying that the machine they used to program the key must be expensive and this is their way of recouping the cost. 

Then I started looking into the PATS system.  Did you know that you can program a key in your own car? In the first generation PATS system, all you need is one programmed key and you can make a spare key in your own ignition.  You just put the original key in the ignition, turn the ignition to just before the engine starts up, turn off the ignition, put your new key in, turn the engine almost on, leave it for a few seconds until the security light flashes, and boom, you have a programmed key (at least that is the basic idea, check your car manual and Internet sites that you trust for specific instructions).  Maybe “hacking” is really not what to call it, but considering how few people seem to know about it I’ll allow it to stand.  And the fact that you can program a key in your own ignition just goes to show you that the $40 programming fee is a complete rip.  Anyway, I would have been in luck if I had a first generation PATS system.

The problem is that I have a second generation PATS system, which requires you have two fully functional keys if you want to program another one.  It’s pretty much the same process, but you have to put in two pre-programmed keys before putting in the one you want programmed.  The problem is that they only give you two keys to start out with, so by the time you loose one your have no choice but to resort to the dealership. 

Originally I thought the second generation PATS system was completely ridiculous because if a car thief has a set of my keys, he’s not going to be sitting in my driver’s seat worried about not being able to make a second set of keys.  He’s going to be driving off with my car.  But I can see a possible scenario where a sinister valet parker with a key grinder could make a single copy of your key, stick it in your car, use your existing key to program the copy, then figure out where you live and come steal your car from your house later that night.

But these PATS systems don’t seem to have stemmed the tide of new car thefts, so car thieves apparently have some way of circumnavigating the system.  So right now, all the PATS is doing for me making me upset that I have to shell out $75 bucks for a new key.

And don’t get me started on the little remote unlocking device that was on the key chain I lost either.

If you plan ahead, you can buy uncut, un-programmed PATS keys from EBay for as little as $10.  Of course, you have to be careful who you buy from because there is a lot of fraud out there with people selling keys that look like PATS keys that don’t actually containing a computer chip.  And you can program them yourself if you have enough keys (which is why you need to plan ahead).  For those of you interested in a bit more reading on the PATS system and how to make your own keys, here’s a start:

New Ford Vehicles with PATS

Keep up to date with Simple-Talk

For more articles like this delivered fortnightly, sign up to the Simple-Talk newsletter

This post has been viewed 61994 times – thanks for reading.

  • Rate
    [Total: 23    Average: 2.7/5]
  • Share

Damon Armstrong is a Senior Engineering Team Lead with GimmalSoft in Dallas, Texas, and author of Pro ASP.NET 2.0 Website Programming. He specializes in Microsoft technologies with a focus on SharePoint and ASP.NET. When not staying up all night coding, he can be found playing disc golf, softball, working on something for Carrollton Young Life, or recovering from staying up all night coding.

View all articles by Damon Armstrong

  • RaymondTaylor
    • Okc Dave

      I have no idea WTF you’re talking about but it definitely has nothing to do with Ford / PATS2 security system, but then you put that spam link at the end which was the whole point, right?

  • Okc Dave

    First off, the keys are not programmed. Not sure what really happened at the dealership, what you saw or what they said or what you assumed, but the Ford PATS2 keys are a set code and the vehicle computer is what learns that the new key/code is mean to be paired to the vehicle.
    PATS does in fact reduce car theft. Before it, anyone could just jamb a screwdriver in and go. Literally, any random crackhead (drug addicts are the majority of car thefts unless we’re talking about a vehicle with high value whole or in parts and Fords just aren’t one of those outside of a souped up mustang) with a $1 tool available at any walmart could steal your car.

  • Okc Dave

    1) That was a GM key not a Ford PATS2.
    2) That was not a computer chip at all, just a simple resistor.
    3) The problem with that system was there were a limited # of resistor values GM used so a thief could literally break the ignition lock then just try a couple dozen keys and get it started.
    4) Unlike PATS2, the nub on that resistor wears with each insertion into the cylinder. Ask me how I know… I have such a GM vehicle with a key that won’t work 3/4ths of the time, sometimes wiggling it will get the resistor to make electrical contact and work.

  • Okc Dave

    Actually the programming machine does cost $10K, but it doesn’t program the keys so I have no idea what they told you to make you think this. The vehicle is programmed to work with a new key that has its own set code. You cannot just walk in without any key nor the vehicle and have a working key made, UNLESS they happened to have your key codes in a database and made a clone key of one that came with the vehicle.

    The problem with a clone key is it doesn’t count as one of the two needed to program a third key. It considers both the original and a clone to be the same key, but perhaps if they cloned the one that you lost, then you got lucky and then had two different key codes to work with.