Is it possible to use a phone as a BRZ key?
 

A few sources here and there say that the BRZ Limited uses Bluetooth as the comunication protocol for the keyless access features. This got me thinking that, with the right software, it would be possible to use some sort of programmable, Bluetooth-enabled device (like a phone or tablet or blue, tooth-shaped, Bluetooth-enabled, nano-buzzword device) in place of a key fob. Obviously, I don't have "the right software"; but, theoretically, someone could make software like that.

What are the problems with trying to do this? I'm talking about things like missing immobilizer transmitters, limited battery life, inability to determine where around the car that the phone is, and other logical issues that I ignore in my fantasies.

I don't know much about what the BRZ is doing here but I do know a bit about Bluetooth. I would just that subaru is using a different type of system, with proximity sensors and not BT. I'm saying that because of the way it operates, not allowing you to open the door over 5ish feet away and the way you can't pop the trunk if you lock the key in it. This is not how BT would react to that, it's more digital. It either works or it doesn't. That's not to say that Subaru did design a system that is Bluetooth with proximity included but they I'd say that your phone doesn't have the right technology to make this a reality.

Plus, it'd be supper hard to write an application that would intercept this very secure data. Other wise I'd have had my BRZ for free just by going to Target and waiting for one to park.

It's RF, not Bluetooth.

Ummm.... Bluetooth is still RF, so your point is?

Different protocols.

Okay, if it was BS when I first read it then all my questions are meaningless.

This is talking about computer peripherals but it's a good basic overview of the differences. The very short answer is that BT is only a VERY small part of the RF spectrum and is the only part of the RF spectrum that's standardized.
http://www.digikey.com/en/articles/t...-and-bluetooth

That's almost as useful as your previous statement.
RF is 'Radio Frequency' What protocol does 'RF' use?

You cell phone, car stereo, TPMS, and your key fob, (and yes Bluetooth) are all 'RF'.

I think what you are trying to say is that "Bluetooth and the proprietary system designed by Subaru/Toyota for the key fobs are different".

But do we really know that? It is conceivable that they use the same frequencies, receivers, and transmitters as bluetooth.
That would actually make sense as it would not require it's own FCC license.
So IF they chose to use the bluetooth receiver/transmitters for the system, then it is conceivable that you could figure out the protocol and hack a bluetooth device to communicate with it.
The answer is that none of us know at the moment.

Maybe I'll wander down to my test lab and play with a spectrum analyzer and see if I can figure out at least:
what RF freq. it uses
is the key fob active or passive
what modulation scheme it uses to transmit data.

My guess would be (if NOT bluetooth) that it is similar to a low power track transponder like the AMB I use in the racecar.
That would be 5Mhz BPSK

ANYTHING is possible but do we even know that the system is BT? I would say no based on security alone.

It is possible to make Bluetooth work that way. See: Kwikset Kevo.

IF they chose to use the BT physical layer (transmitter, receivers, and frequencies) they could still customize the protocol layer to have any kind of security they want.
My guess is that figuring out what RF modulation scheme they used is trivial.
Figuring out what the bits that are sent mean is the hard part. (what encryption scheme do they use if any)

It is kind of like using WIFI for a custom application.
How the bits get from point A to B is standard (802.11.G etc), but what the bits inside the packets mean can be anything you want.

Exactly. I know OEMs aren't renown for their security but I don't know that it's something most people are going to be able to figure out easily.

Ok, it most certainly is not Bluetooth.

The active portion of the keyfob has a carrier frequency of ~314 MHz.
BT is ~2.4 GHz

And they are the same keyfobs as used on the Prius & Lexus.
I am still wondering if there is a passive RFID hidden in the circuit board as well as the active transmitter.
You dont need to push a button for the car to know you are there.

There's most definitely a passive board in there. I'm pretty sure every proximity system uses a passive setup. I have no idea if we can use that to our advantage though.