Police say criminals are able to steal certain push-button start models within 15 seconds, using key reprogramming devices bought online.