Hacking an Audi: performing a man-in-the-middle attack on FlexRay | Hacker News Reader

Hacking an Audi: performing a man-in-the-middle attack on FlexRay

medium.com

85 pointspd0wm30 comments

I wish I could hack my Lexus RX350's LKAS. It's pretty bad and seems to bounce left and right between the lanes. It gets to the point that I just shut it off since I don't want to fight it when driving long distances as it's very tiring. It's probably a timing issue as the computer isn't getting updates fast enough and has to keep correcting which causes the bouncing between the lane. A Tesla this is not!

Does your vehicle actually have lane centering or just lane keep? Lane keep, which is more common, does not attempt to keep the vehicle in the middle of the lane. It just prevents departing the lane without signaling.

Part of the problem with these new technologies is that every car company gives each capability a unique name. It takes considerable effort to untangle the meaning of all the manufacturer-specific names to determine whether Audi Active Lane Assist is the same as Lexus Lane Keeping Assist but not Mercedes Distronic Plus unless it's Mercedes Distronic Plus with Steering Assist.

True, but I fear being more specific would lead to extremely long names that still wouldn’t matter to people who can’t be bothered to read the details or understand their vehicle.

Could the average person tell the difference if they just called one Lane Departure Prevention and the other Lane Departure Prevention with Centering or might people just assume they’re the same? Idk, maybe we should try it.

> Part of the problem with these new technologies is that every car company gives each capability a unique name.

It's because of Mickey Mouse (copyright/patent law). Same like with "4x4" and "all wheel drive". They don't want to get sued by competitors. They also want to sound like clickbait.

Actually when Subaru first built their EyeSight system, it was almost Tesla Autopilot, but Japanese authority feared it’ll lead to Autopilot type crashes.

The authority was right in hindsight, but then couldn’t conceive the idea of mandatory driver monitoring system, and instead ordered Subaru to ensure driver is alert by making intervention too little and late.

So most LKA/LKAS should do just as well as Tesla’s, only the firmwares are built deliberately with different parameters. Technology wise it should be the same.

> It's pretty bad and seems to bounce left and right between the lanes.

2019 Audi SQ5, exact same problem, had to disable it too. I really wonder if these non-Tesla manufacturers are getting pre-fab'd chipsets from the same place. It's really an impediment rather than driver assist.

I've noticed that it steers by itself pretty well on long curves, but anything other than and I'm weaving in the lane and begging for a roadside sobriety check.

> wonder if these non-Tesla manufacturers are getting pre-fab'd chipsets from the same place

That's exactly the case. The 'strains' I'm aware of are Subaru/Hitachi, MobilEye, NVIDIA, Bosch, Continental and there shouldn't be more than 3 other than these. Most car manufacturers buy one of these or pay one of them to install another of them, as a camera that speaks in steering angles. You'd notice a lot of those camera units look identical across brands.

I think yours is MobilEye(same as Tesla AP1).

Have you double checked the settings for lane keep assist on your Audi? I have a 2018 Q5, and you have the options between "early" correction and "late" correction. If it's set on "late" correction, then it seems to bounce between lanes as your described.

When it's set to "early" correction, it indefinitely stays centered (assuming it can see the lanes).

Interesting, I haven’t seen options for those. I’ll check in the settings tomorrow, thanks!

LSSP? I've noticed that some TSSP openpilot users use an alternate steering angle sensor for their openpilot installations called ZSS because the stock sensor isn't too accurate.

If this is stock though, there's more than just timing I think.

On Ford it’s timing. The LKAS is read by the PCM which then relays info to the PSCM. The idea is that the steering module is fire walled by the PCM. The CCM and ABS are similar. Toyota and Lexus expose the power steering controller to the CANBUS allowing takeover attempts

Maybe it's just me, but the regulatory oversight around these automated features seems insufficient. I'm trying to imagine equivalents from older passive safety technology like seatbelts that don't always work, airbags that pop out prematurely, or cruise control that accelerates without warning. Doesn't seem like those would pass muster "back in the day"? (Not to mention Uber autonomous vehicle flat out killing a pedestrian with no criminal culpability.)

Maybe it's a case of severity -- automated lane guidance isn't viewed as a serious problem when it fails? But who makes that decision?

I don't drive much anymore but when I do it's in a Zipcar with relatively recent Subarus that have this lane guidance technology. I always turn it off as it invariably makes mistakes within a few hours of usage and seems more dangerous on than deactivated.

Regulating technology is difficult. You can easily set up a mechanical seatbelt test that tests a mechanism 1000 times, but how would you test an algorithm? Also, many people died before seatbelts became mandatory; so much for "back in the day".

>how would you test an algorithm?

You can send out drivers that test if it works well. And then you can record that data, and check what is causing the issues and add these frames as test data?

But the testing IMHO is a bit too late. You need UX designers and psychologists giving inputs from the start. You need SW quality by design, not by process. You need to rid yourself of any management layers that don't understand software.

Automotive peoples’ mindset of safety and computing is weird.

They say it’s better to floor it when leading car is not moving, or better to engage lane centering at a borderline safe moment, to make drivers used to it. Or they say they want computers to delay software edge-case issues after it had occurred.

They have passions but the whole industry don’t seem to have much background handling sentient beings.

Yes. I was dead shocked when I took a brand new Audi rental car on the German highway. Per 150 miles driven I probably had one severe incident, including: sudden deceleration from 100mph to almost full stop with no car in front but a couple behind, the car actively steering out of the lane (construction site, straight lane), sudden deceleration when the car in front leaves the highway and slows down (but I stay on the highway), not detecting the giant SUV in front of me and almost rear-ending it. On a 400miles drive I usually have ALL of the above. I never had an accident in 20 years of driving. From developing software I know: your users may interpret the UX differently from you or your designers and communicating well with your users is hard. In these circumstances I am always thinking: like what the heck are those Volkswagen people thinking about how the 5% of people having a different interpretation of this user interaction will end up!? I mean, how often do people end up doing things with software nobody expects them doing? “Oh, lets give them a functionality that completely ‘out of the blue’ potentially kills them every 200miles”.

The lane-tracing on the 2019 Toyota RAV4 is also very poor. I rented one for a long road trip and was surprised how often it lost the lines (even when clearly painted, in good weather, during the day), and how much it ping-ponged, even when it supposedly 'saw' the lines.

I hope to not buy another car until lane-centering gets decent, or is updated by non-Tesla car companies OTA. I understand Cadillac has a good system, but everything I've tried (Toyota, Honda, Subaru) has been so mediocre as to be useless.

> On the Q8, the FlexRay bus has cycle time of 5 ms, so each ECU can send messages at 200 Hz.

That's weirdly worded. The cycle repeats (disregarding multiplexed PDUs) every 5 ms, but there are lots of messages within a cycle.

Even on CAN, it's not uncommon to have > 2000 msg/s (looking at Daimler trucks with 70% utilization).

This is a fantastic writeup and it's truly brilliant what the very clever folks at comma.ai are up to.

Very slick stuff indeed.

I really wanted the company to be called ",,," when i read: "This medium post is about a project by three comma employees"

They do not know about Vector Canoe ? I did this "hacking" every other day when testing software on a prototype vehicle

Maybe drifting a bit, but I hate the business model Vector has. They have reasonably good software, but their Canoe SW has that horrible scripting language that is... well, horrible, but that everybody uses and because it's historically been used and the vendors have all the test panels and whatnot in it, the developers are locked in to pay for exceptionally expensive SW for a sub-par product.

Better than most other sw in automotive but it pales with open-source SW that does more complex things in other fields.

Seems like the https://www.vector.com/int/en/products/products-a-z/hardware... has some similar functionality. I have never used it, but by reading the documentation I'm not sure if it would have been useful here. The frame with ID 65 which needs be overwritten, actually contains 4 different messages indicated by the last byte in the payload. To properly time the modification you need to sync up on that, which the Vector box can't do.

Also price on request, so probably not in the price range of our target audience.

There's a pretty big difference between testing software with a protocol that you know and understand, and reverse-engineering the communications on a production vehicle.

I had to price out a CANoe license for a project at work a while back. They came back to us asking for low five-figures.

I didn't get it, FlexRay usually uses end-to-end encryption and it seems that everything is in a plain text? Audi just decided not to encrypt something?

From experimentation with recent Mercedes and BMW, its encrypted, although I do recall that early X5's were not protected.

Is this a 'man in the middle' attack for 3rd party nefarious purposes, like controlling someone else's Audi ... Or just plain reverse engineering of a communications protocol to hack the software for 1st party education and extension? Why the click-baity title as if this is some great compromise to the integrity of the Audi? Am I missing something?

The latter, "We built a python script to read a joystick and used a panda to send the CAN messages to the FPGA, which overrides the appropriate bits on the FlexRay bus to control the EPS. By combining the results from the previous steps, we were able to control the steering with a joystick."

Reply on news.ycombinator.com