Hacker News Reader

Comment by o-__-o | Hacker News Reader

An immobilizer simply keeps the ecu from running the fuel pump, thus preventing the car from starting. The challenge-response from the key is used to authenticate the ecu. It’s not so much that it’s bad encryption (it is) it’s just that the access to override such encryption has physical controls (e.g. if one breaks the glass then one typically has complete access to the vehicle). Second the cpu of the time where maybe 4mhz in a good case so it required a system that was fast. This is very similar to the encryption used to immobilize Mercedes and BMW of early 90s.

Also I can tell you on all current and last gen Ford and Mazda’s, the inter-car encryption and authentication has vastly improved.

View on HN

<An immobilizer simply keeps the ecu from running the fuel pump>.

Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one of them which is Immobilizer. Even with correct key fob and authenticated, if your door is opened it will not let you drive. Of course, all these varies from car maker to car maker. Some will let you start it but you can't drive for more then 3 meters, others won't even let you idle the engine. You have a crapload of sensors that are part of BCM (tire-guard, wipers, door ajar, belt, etc etc) all of which are taken in consideration to yield that "yes"/"no" response.

And that's just a small part of what BCM does. Also poor ECU, an entire computer on its own right, reducing him to running the fuel pump is like saying a house is to shelter you from bad weather.

Saying immobilizer simply keeps the ECU from running the fuel pump is like saying that all you need to create Witcher 3 game is Visual Studio.

As per article, you can see for yourself this is not really true. My code that I've worked in those years (2005/2006) were to be deployed in 2007 Mazda RX-2 and 2008 Ford, so in regards to last gen (cca. 2010) I bet you're simply wrong again. I do hope latest gen has better encryption but I doubt, wanna know why? Because economics. Lemme tell you first hand experience. Managers care about economics and that means cheaper parts. Cheaper parts means less memory, less speed. The goal was always to have the BCM's CPU load between 70% and 90%. Did a smart code and you reduced the load bellow 70%? The higher-ups were jumping happily in the air because it meant a big fat bonus for them due to allowing them to stick a crappier chip on that PCB. That's what they care about, not strong encryption and elimination of theft. Also read about Ford/GM practices in 60's when they preferred to allocate about 200 millions USD/year for paying victims of accidents than have belts. Until they got regulated by law, they could not care less about lives.

The BCM is an ECU.

The encryption has been broken already but it’s basically trailing bmw and Mercedes etc by about 13 years, so definitely money related but likely they don’t want to or are unable to negotiate patent rights in their technology

BCM is Body Control Module. ECU is Engine Control Unit. 2 different parts (logically). Both are physically PCB's (Printed Circuit Board) that physically can sit either side by side or in very different sides of the car - that's car maker decision. I can't explain it simpler than this.

ECU is usually an Electronic Control Unit. Some OME's name one of there ECU's, Engine Control Unit to make stuff more complex. Not app manufacturers have Engine Control Unit or a Body Control Module. The electronic architecture of a Volkwagen, GM, Volvo or Tesla is very different. Hardly any of the ECU's have the same name.

It looks like Wikipedia agrees with me and in addition, the Engine Control Unit article state that they are usually called the Engine Control Module (ECM) to lower confusion. https://en.wikipedia.org/wiki/Electronic_control_unit https://en.wikipedia.org/wiki/Engine_control_unit

Different OEMs vary in architecture and naming. Making it a bit of a hassle working in a teir-1 with multiple customers.

Or PCM (powertrain control module, since the transmission and engine typically work as one unit) which has been used by Ford (and Mazda) since ODB-2 was standardized in the 90s.

It depends on the manufacturer. Some OEMs call the Engine Control Unit the ECU while others use the general terminology where all Electronic Control Units are ECUs and the engine controller is an Electronic Control Unit named the PCM (Powertrain Control Module) or ECM (Engine Control Module). In those cases, there are some strange ECUs... ex. the steering wheel is an ECU, the stereo headunit is an ECU, etc.

You mean Mazda MX-3, right? The Mazda RX-2 is from the 70's ;)

Or maybe the RX-8?

Reply on news.ycombinator.com