Comment by unnouinceput | Hacker News Reader

Comment by unnouinceput | Hacker News Reader

Quote: "By contrast, the cloning attack the Birmingham and KU Leuven researchers developed requires that a thief scan a target key fob with an RFID reader from just an inch or two away."

Story time: Back in 2005/2006 when I worked for Siemens Automotive on Immobilizer feature (was involved in Mazda and Ford projects) I got my hands on the highly secret crypto source...and much to my surprise I've seen they implemented a Vigenere style of cipher. I was astounded by this. Having some crypto background as pet projects on previous years I knew this class of ciphers are at least 1.5 centuries obsolete and they are thought only from historical perspective. Therefore I prepared and called a panel of higher-ups (managers, group leaders and even including the hardware department chief) showing to them that the source code implementation is very dangerous and that for a criminal group to mass steal cars would be very easy. Including telling them exactly what the article is talking about - put an RF recorder under the handle door (how many car owners will check there?), record sessions of radio communications between key fob and the car, analyze that, extract the crypto key and steal the car with a duplicate no more then maximum a week after. Their reply? : "standard in industry call that we also allow mechanical keys to open doors/start the car, so a criminal group can do them as well much easier", and that was the end of that meeting.

I have a Ford from about that time, and the key broke in a way that caused it to fall off my keychain.

Instead of paying $100’s to rekey the car, I stuck the broken key into a machine at Home Depot. It cracked the encryption in a few minutes and produced a duplicate key. The brand on the replacement is “Ilco”. It’s bulkier than the OEM key, but it works great.

Anyway, I’m not at all surprised to hear the car uses an obsolete encryption protocol.

Are you sure you aren't misremembering?

DST40 https://en.wikipedia.org/wiki/Digital_signature_transponder used in Fords of that period is a Feistel cipher not a Vigenere cipher. Now, I wouldn't choose a Feistel cipher for this problem today but it certainly is not 1.5 centuries obsolete, this type of encryption wasn't even invented until the mid 20th century and a very famous example would be DES.

I am sure yes. Mind you, this was Immobilizer feature, sold by Siemens Automotive to auto-makers. As to what in rest of their car Ford itself was using I have no idea, since I was not working for them at the time.

Here is an analogy - Microsoft is Siemens and Ford is IBM. Microsoft sold DOS to IBM to equip their PC's. As for what IBM implemented/used for BIOS, was not Microsoft's job, get it?

An immobilizer simply keeps the ecu from running the fuel pump, thus preventing the car from starting. The challenge-response from the key is used to authenticate the ecu. It’s not so much that it’s bad encryption (it is) it’s just that the access to override such encryption has physical controls (e.g. if one breaks the glass then one typically has complete access to the vehicle). Second the cpu of the time where maybe 4mhz in a good case so it required a system that was fast. This is very similar to the encryption used to immobilize Mercedes and BMW of early 90s.

Also I can tell you on all current and last gen Ford and Mazda’s, the inter-car encryption and authentication has vastly improved.

<An immobilizer simply keeps the ecu from running the fuel pump>.

Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one of them which is Immobilizer. Even with correct key fob and authenticated, if your door is opened it will not let you drive. Of course, all these varies from car maker to car maker. Some will let you start it but you can't drive for more then 3 meters, others won't even let you idle the engine. You have a crapload of sensors that are part of BCM (tire-guard, wipers, door ajar, belt, etc etc) all of which are taken in consideration to yield that "yes"/"no" response.

And that's just a small part of what BCM does. Also poor ECU, an entire computer on its own right, reducing him to running the fuel pump is like saying a house is to shelter you from bad weather.

Saying immobilizer simply keeps the ECU from running the fuel pump is like saying that all you need to create Witcher 3 game is Visual Studio.

<Also I can tell you on all current and last gen Ford and Mazda’s, the inter-car encryption and authentication has vastly improved. >

As per article, you can see for yourself this is not really true. My code that I've worked in those years (2005/2006) were to be deployed in 2007 Mazda RX-2 and 2008 Ford, so in regards to last gen (cca. 2010) I bet you're simply wrong again. I do hope latest gen has better encryption but I doubt, wanna know why? Because economics. Lemme tell you first hand experience. Managers care about economics and that means cheaper parts. Cheaper parts means less memory, less speed. The goal was always to have the BCM's CPU load between 70% and 90%. Did a smart code and you reduced the load bellow 70%? The higher-ups were jumping happily in the air because it meant a big fat bonus for them due to allowing them to stick a crappier chip on that PCB. That's what they care about, not strong encryption and elimination of theft. Also read about Ford/GM practices in 60's when they preferred to allocate about 200 millions USD/year for paying victims of accidents than have belts. Until they got regulated by law, they could not care less about lives.

The BCM is an ECU.

The encryption has been broken already but it’s basically trailing bmw and Mercedes etc by about 13 years, so definitely money related but likely they don’t want to or are unable to negotiate patent rights in their technology

BCM is Body Control Module. ECU is Engine Control Unit. 2 different parts (logically). Both are physically PCB's (Printed Circuit Board) that physically can sit either side by side or in very different sides of the car - that's car maker decision. I can't explain it simpler than this.

ECU is usually an Electronic Control Unit. Some OME's name one of there ECU's, Engine Control Unit to make stuff more complex. Not app manufacturers have Engine Control Unit or a Body Control Module. The electronic architecture of a Volkwagen, GM, Volvo or Tesla is very different. Hardly any of the ECU's have the same name.

It looks like Wikipedia agrees with me and in addition, the Engine Control Unit article state that they are usually called the Engine Control Module (ECM) to lower confusion. https://en.wikipedia.org/wiki/Electronic_control_unit https://en.wikipedia.org/wiki/Engine_control_unit

Different OEMs vary in architecture and naming. Making it a bit of a hassle working in a teir-1 with multiple customers.

Or PCM (powertrain control module, since the transmission and engine typically work as one unit) which has been used by Ford (and Mazda) since ODB-2 was standardized in the 90s.

It depends on the manufacturer. Some OEMs call the Engine Control Unit the ECU while others use the general terminology where all Electronic Control Units are ECUs and the engine controller is an Electronic Control Unit named the PCM (Powertrain Control Module) or ECM (Engine Control Module). In those cases, there are some strange ECUs... ex. the steering wheel is an ECU, the stereo headunit is an ECU, etc.

You mean Mazda MX-3, right? The Mazda RX-2 is from the 70's ;)

Or maybe the RX-8?

Hopefully that's in writing somewhere for when the lawsuits happen. Financial consequences tend to motivate large companies to change their ways.

It's not. Was an internal meeting and around 2008 Siemens also sold its entire Automotive division. Also they are the original inventors of Immobilizer feature back in late 80's, and their code "stood" the test of time. You have no idea how much opposition you get to touch even a line of code in Automotive industry when codebase is a decade old, not to mention an entire feature. So I am not surprised this is now all over the place in all auto-makers.

Reply on news.ycombinator.com