How the headlight attack works
The thief connects to the headlight wiring and through it sends the car a fake message that the key is genuine. The computers in a car talk over a network of wires. This network is called CAN. When you walk up with the key, the part of the car that receives the key signal reports over that network that the key is genuine. Only then do the doors unlock and the engine is allowed to start.
In most cars on the road, the computers take that message on trust and do not check where it came from. Part of the same network also runs through the headlight, so the thief reaches it from outside.
What the thief does, step by step
- Removes part of the bumper or the plastic above the front wheel and pulls out the headlight connector.
- Connects a device to the wiring. The device silences the real messages on that network, so the computers hear only the device.
- The device sends a message that the key is genuine. The factory immobiliser, the protection that lets the engine start only with the right key, trusts that message and lets the engine start.
- At the press of a button the device also sends an unlock message, as if you had pressed the button on your key.
- The thief unplugs the device, gets in and drives the car away.
The thief does not need your key, the key's signal or the OBD port. No door is forced and no window is broken. The car is driven away within a few minutes.
What does not stop the headlight attack
These protections work against other thefts, but not against this one:
- Factory immobiliserThe fake message tells the car that the key is present, and the factory immobiliser trusts that message and lets the engine start.
- Factory alarmNobody forces a door, and the car thinks you unlocked it yourself. That is why the alarm often does not go off.
- Key pouchThe thief does not need your key's signal, only the wiring at the headlight. A pouch protects against keyless theft. More about keyless theft
- OBD protectionThe thief connects to the wiring at the headlight, from outside, and does not touch the OBD port at all. OBD protection still protects against a different theft: making a new key through the port under the steering wheel. More about OBD protection
An immobiliser helps against this attack
An add-on immobiliser is a separate small device we fit alongside the factory one. The engine starts only when the car has both the genuine key and your confirmation. The thief does not get that confirmation from a fake message through the headlight wiring, so even with the car unlocked, the thief cannot drive it away.
The device is hidden among the car's wiring. You carry the fob in your pocket, so the engine starts as before. More about the immobiliser
What else helps
An alarm with an engine lockAn alarm that only sounds does not stop the thief. An alarm with an engine lock asks for your fob, so the engine will not start even when the car thinks the key is present. More about alarm installation- A steering column lockThe fake message opens the car, but not the lock. The thief has to cut it, which takes time and is loud. More about the steering column lock
GPS trackingGPS does not prevent theft, but it tells you as soon as someone moves the car and shows where it is. Thieves switch off or dump any GPS unit they find, so it should be hidden, under the trim. More about GPS tracking- A locked garageLeave the car in one when you can. The thief needs a few undisturbed minutes next to the car for this attack.
Which cars are targeted
The headlight attack is known from Toyota and Lexus. The device was sold for the Toyota RAV4, Prius, Highlander, Land Cruiser and GR Supra and for the Lexus ES, LC, LS, NX and RX. More about protecting a Toyota or Lexus
This is not a weakness of one make only. Other makes also have models that can be stolen the same way.
Is your car a target: it depends on where the wiring runs
- The thief picks a car whose network wiring runs close to the outside: at the headlight, behind the plastic above the wheel or at the rear light.
Cars stolen this way mostly do not stay in the country. Thieves change the plates and the chassis number and ship them abroad in a container. More about the most stolen cars in Europe
A removed headlight can be a theft attempt
A bumper pulled away, a removed headlight or pulled-out wiring at the headlight can be a theft attempt. Report it to the police on 192.
Before one RAV4 was stolen, the owner twice found the headlight removed and the wiring pulled out, and thought it was vandalism. A couple of days after the second time, the car was gone.
