Hacker News Reader

Comment by bri3d | Hacker News Reader

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own them all.

This wouldn't be that hard for car manufacturers to defeat if they really cared. It's the exact same trusted-boot problem as any mobile phone faces, except (so far) with much more limited attack resources. It's devilishly hard to get perfect (as every iPhone jailbreak proves) but it's easy to get started.

View on HN

There is actually a big security push in automotive that's sort of been slowly coming to the fore over the last few years. It's not the OEMs that are driving it really either, they are to some degree, but it's the suppliers starting to make security hardware and system protection available, as it really hasn't been for very long. It's still not really entirely there. Basic things like the microcontrollers and CAN hardware / protocol never had security designed in. No one was willing to invest significant engineering time or do expensive security in software when hardware cost is king, or even invest in the engineering cost of bringing in security from suppliers (seriously, there's like 20+ independent computers in your car and it's going to be 50+ on average soon if it isn't already and out of those you'd probably have to harden 10 or so, or introduce entire new ECUs) There's a number of solutions but none of them are cheap. As hardware support becomes widely available, development time for higher tier suppliers drops and they can economically offer secure solutions, and with scares like the Jeep remote control hack in 2015 and with cars getting more connected, OEMs are starting to see the business case for security.

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change.

This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new firmware, could you install and run it please?”.

Also I’m surprised they’d go after tuners, considering those are usually the most loyal customers you could dream of.

Witness Intel's unlocked CPUs: people who want access to the low-level stuff get charged a premium.

Yes, like I alluded to it's trivial drawing from any other trusted boot chain implementation.

The even better and less user-intensive way to do it would be with asymmetric encryption - the ECU only trusts flashes signed with the vendor public key and to make things even more secure, you could encrypt each flash file server side with a keypair derived each boot on the ECU and sent over the Internet (many manufacturers require online flashing anyway).

Manufacturers dislike tuners because they make warranty claims for tune damaged parts like blown turbos. VW especially are very, very aggressive about detection and enforcement around this. Long term I think giving a few dishonest tuned customers free turbos is probably fine but they seem to disagree and I assume they have access to the metrics driving this decision (which I don't).

> signed with the vendor public key

That part doesn't sound very secure to me :-)

they also dont like tuners because cars engines are often made the same for multiple "trims" so the car with 110 and 160 hp have the same engine but different "map" in the ecu. and only with ecu reflash you can get more power that would cost you x amount of money.

imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that.

and manufacturers dont like that

Actually, from my personal experience in the field - they only care for X. years under warranty. Then they don't care. I actually don't think they have much legal ground on their own around modifications in EU. At the end of the day you do own the car.

> imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that.

But isn't this already the case (except locking might be in CPU firmware)? AFAIR this is the case with GPUs.

It's not quite analogous:

https://en.wikipedia.org/wiki/Product_binning

The line between product binning and market segmentation is sometimes blurry.

Can't think of an example with CPUs, but you could unlock an AMD 6950 to a 6970[1]. Some brands would actually add features to help do this.

[1] https://www.techpowerup.com/articles/overclocking/vidcard/15...

Except that CPU manufacturers DO like that, and will give out special unlocked versions of their CPUs and even sponsor overclockers, to see what people can do with their hardware.

This also happens with car manufacturers, in racing and such. Tuners are more under the radar so they don't like that, as well as the warranty claims that were mentioned.

no, there is no software that i know of where you can as a consumer make your i3 an i5 with just a software unlock, that you can get for like 10 eur.

the difference on the base model mercedes c class between getting a less powerful engine and the one that is one level up is like 3.5-4k eur.

that is a lot of money. if i could unlock the bigger engine with just 400 eur i would buy the base model.

manufacturers don't want that, and is one part of blocking the touching of the ecu. the other is also that the navigation and a lot of other things is just disabled in ecu, and could be easily unlocked with software.

It’s not just more power though. My car has two version 130hp and 155. For the 2 grand I got 25 more horsepower and bigger brakes ,bigger clutch , bigger wheels with wider tyres and an LSD. The only time I can recall where the engine has been exactly the same inside was the mini one and Mini Cooper where the ecu only allowed for 86% throttle on the lower powered version. Every other engine has had a mechanical difference internally to support more power.

I'm looking into buying an Alfa Romeo Giulia, and engine-wise the difference between the 200bhp and 280bhp version is 100% software.

There are some other differences, the 280bhp is AWS vs RWD for the 200bhp version, and you can get the 200 with smaller wheels. However when going for larger wheels on the 200bhp, you also get the exact same larger brakes...

It's a cool €6000 difference, for a similarly equipped car. I actually don't want AWD and the chassis can clearly handle this much power on the rear-wheels alone, the top-of-the-line 510bhp version is also RWD - so going for the 200bhp version and giving a reputable tuner €700 is a tempting proposition...

f30 bmw 316d and 318d are exactly the same, 2011 325d and 330d also, 2013 114i and 118i of what i can rembember right now, i dont keep the exact list.

and if i would guess you are talking about mx-5 nd, those are natural aspired engines, where something like this is not really viable.

Mazda's 2.0 Gasoline Skyactiv is sold as both 120 and 165 HP. Same engine, same brakes, same clutch, different ecu mapping. The only mechanical difference is the gear box's final drive ratio (the 120's has longer gears for better fuel economy). Why would they do this? I assume economy of scale makes it cheaper.

I'm not so sure. The key has to be stored somewhere on the car. Why not desolder that and examine it?

(If we're going with "Theoretically possible," that is.)

The solution here is a combination of tamper-proof secure enclave and ephemeral keys, just like it is for trusted boot chains. Obviously it's not 100% secure and just like mobile phones (which, again, are the exact same problem space) it's eventually defeated, but the magnitude of difficulty can be multiplied without much effort.

My solution wasn't to protect against that - if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car.

This was just an idea to thwart installation of compromised firmware by thieves via the diagnostics port. It's just a little layer of security, not designed to be bulletproof, merely to slow down thieves by forcing them to actually swap the hardware.

if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car.

I demand a source that teaches me how to do this. :)

Orrr if you're in Chicago let's go figure it out ourselves!

CESVI in Argentina. Not very close to Chicago though :P , but I'm sure there's an US equivalent.

https://www.cesvi.com.ar/index2.html

I remember reading about the people that dismantled cars to find where manufacturers source the parts:

https://jalopnik.com/the-fascinating-company-that-tears-cars...

Those guys can probably switch you the ECU :)

This is awesome. Thank you!

In Europe: https://ecu.de/

So down the line after few years and changing owners you're unable to install any firmware or to install used ECUs, most of the manufacturers are now online-only for diagnostic and flashing of course charging some premium, that destroys independend shops as you need to pay a subscription for every manufacturer, and cars and its parts still get stolen, "high tech thieves" belong to the movies, real ones load your car on a tow and it goes straight to another country.

Why go after tuners? Well, if you are a giant automobile firm that has been lying about their mileage and emissions and covering it up with software that detunes the car just to pass testing- well, then you don't want people figuring out your algos for covering up lying.

Reply on news.ycombinator.com