CAN Injection: Keyless car theft
kentindell.github.io
kentindell.github.io
Here's the problem everyone needs to pay attention to: If you demand Encrypted OR Signed CAN Bus, you will ABSOLUTELY get it from the manufacturers in the name of security. They will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car.
So be careful what you scream for. We already have enough un-repairable items.
First off, almost all vehicles are running CANbuses right to the edge of their available bandwidth. Making the signature data fit is a vehicle-wide refactor unless you've designed for it from the beginning.
Secondly, many automotive MCUs don't have hardware crypto support or enough spare cycles for signing/verification. You have to design for that from the beginning.
Third, key distribution is hard. There are a lot of parties outside the OEM that need to flash firmware for various reasons during production. Do you give them all private keys or do you put up a public image signing service anyone can submit binaries to?
There's lots of other issues I could go on about like what the key rollover looks like, but I hope it's clear that retrofitting cryptography onto complicated systems that weren't designed for it is anything but straightforward.
Anyways I’m not in this industry but work on SPIFFE and see similarities- you could have a centralized CA in the car that does attestation to remote workloads.
With CAN, you're pretty firmly in the land of tradeoffs because the safety-critical stuff you want to auth is also hard realtime and solutions that involve expensive coprocessors like HSMs are usually off the table for a number of reasons like cost, lack of vendors supplying high-integrity solutions, inability to do board spins, etc. Adding authentication also has the nasty problem of sometimes reducing your safety because it makes the channel less noise resistant, as demonstrated by Dariz et al [1]. Navigating these sorts of tradeoffs are why some manufacturers have gone with half-measures like only authenticating a small subset of messages.
I don't believe anything in this space is cost-prohibitive in the long term, or even in the medium term. It's just dev cost amortization, because the chips are cheap once they tape out.
I worked in this space (auto RE, including keyless entry) for a while, and there's almost no way this would work at scale without a top-down platform redo for automakers.
Is your concern that the key management can leave a mess of key disagreement? But that's like the sensors failing altogether, and that already has to be taken into account.
So yes, I would trust "that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road" because I have to trust that the computers will handle sensor failure correctly.
That said I'd only trust that if the crypto is sensible. Specifically authenticated encryption is essential. Key exchange, pairing -- those are important too. It needn't be complicated to set up: trust-on-first-use-after-reset (with reset being not trivial to execute) should suffice.
> [...] there's almost no way this would work at scale without a top-down platform redo for automakers.
That's possible, but I doubt it.
Without the key to see what the code is, no injector can spoof the frame.
With the after-market procedure making tons of noise and spectacle, and a nice long wait for the police to arrive, the thieves can't replace the key ECU.
With the system being simple, no key provisioning is needed, no non-public information, just an extra page in the manual and a software update.
No they won't. One the law requires them to allow third part diagnostics tool (only for things that are about emissions!). Two, the third party tool maters are paying a good chunk of money to get documentation on how to do diagnostics.
While new car buys won't care, car makers know that nobody can afford to buy a new car except by selling their old car (normally done as a trade in), and the buyers of used cars care that the car can be fixed so if third party tools don't work the car has a lot less value.
I can see how they got there. When you're moving getting rid of miles of cables that link everything and move your car to a CAN bus instead, it makes sense to say that you don't want a central blinker-controller that runs separate wires to every blinker. Instead you just run CAN and power to each blinker and give them their own little controller. Fewer wires, less conceptual complexity, at the cost of putting a little PCB in each blinker.
But because "analog" blinkers had the accidental feature that they blink faster if one blinker is broken, you have to replicate that somehow with your new blinkers. And the easiest way to do that is to have the blinker write that to the CAN bus, since it's already right there.
I do even doubt in length of wires point. You need a full bus plus a thick wire from power source per every lamp instead of just a one thick wire from relay.
Copper wiring is expensive and heavy.
It’s far more efficient to have a simple PCB controlling multiple local functions (headlights, high beams, blinkers, additional sensors) and a single power/ground pair.
Automotive systems are 12V, which results in high currents. High currents require thick wires, especially in automotive environments with high under hood temperatures where you might have to de-rate wires. It absolutely makes sense to reduce high current automotive wiring.
Common power wire will still require one or two extra wires for CAN, so it would make sense only as replacement for bundles of 3 or more wires going to the same place.
much cheaper and much less wiring needed if the bulbs (or bulb holders) can receive commands themselves.
Without a board: you need a big power wire for low beams, a big power wire for high beams, a smaller power wire for turn signal. And that's all you can do.
With a board: you need a big power wire for everything. And a two tiny wires for CAN--so you're already ahead. If your beams can move, or be directed, or have LEDs that can be modulated, or have a washer, you start coming out WAY ahead.
High power systems do exist, particularly in electric vehicles. They have different challenges to do with being incredibly dangerous to work on.
This is trivially observed if you take a moment to compare a modern day wiring harness to something older, while considering the functionality provided by the later.
That’s not what’s happening. The value in a CAN bus control is that you can significantly reduce the wiring requirements.
Old school blinkers and headlights would require separate power wires for every function: Blinker, low beams, high beams. Those separate wires would each be snaked through long wiring harnesses back to relays somewhere else in a central location.
With CAN, you can run a single large gauge power and ground pair and use the CAN bus to tell the remote module what to do with tiny signal wires. It may not sound like a big deal, but cars have a lot of electronic pieces all over. Simplifying wiring can add up to a significant weight and cost reduction. You now also have the ability to add more monitoring, such as simple sensors to detect when a bulb has failed
Vehicle manufacturing is ruthlessly optimized. Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.
Yet car manufacturers don't do this. CAN transceivers are still too expensive to build into every bulb. Instead, a single CAN transceiver and microcontroller will control a whole set of nearby bulbs (eg. brake, indicator, reversing lights). That then makes it vehicle specific, so you don't get the economies of scale of just making a single model of can-bulb which fits lots of places in many cars from many manufacturers.
It's really not a sustainable approach to try to address nodes on a CAN bus by serial number, though. CAN is content addressed rather than receiver addressed. Due to the way arbitration works on the bus, it's invalid for two nodes to transmit to the same CAN identifier. The arbitration mechanism breaks down and results in error frames, at which point the CAN bus is in a degraded state.
That would preclude a CAN enabled bulb from being able to send telemetry back, at least until the bulb was provisioned an identifier. That could be done by an ECU sending a frame with the bulb's serial number and assigned identifier. You still need a zero-conf discovery protocol, though, and so you're back to transmitting before provisioning. You could work around all that, but it's a lot of work.
Stepping back a bit, running a car's CAN bus over a light bulb socket is going to cause some practical reliability problems. Compared to a wire harness going into an ECU, a user serviceable bulb socket is going to be much more prone to intermittent connections from vibration, as well as oxidation and wear. Intermittent connections on CAN_H/CAN_L tend to cause a ton of frame errors, and significantly degrade the overall bus performance often to the point of system failure. When a node encounters enough error frames, it is compelled by the standard to go into a BUS-OFF state where it isolates itself from the bus. Because it's a bus and all the nodes share the same two wires, it's pretty much impossible to diagnose where an intermittent connection is without trial and error.
Ie, with CAN, each node only needs to do reg reads/writes/datasheet-spelunking for a narrow part; the other nodes just need to know the API that sits on top of the hardware.
See for example https://github.com/commaai/opendbc
Quite old and for Wundows, but a lot of code showing how to use a lot of CAN interface boxes is at https://github.com/rbei-etas/busmaster/tree/master/Sources/B...
There's rules of thumb about never overloading a CAN bus beyond, say, 50% utilization. That's because systems with poor prioritization management tend to start falling over around there. With a well thought out scheme, it's possible to push a CAN bus fairly close to 100% utilization. I built several safety critical systems that pushed 80% utilization on average. At that level, you really need to rely on redundancy rather than simple robustness, though. A CAN bus running at 80% falls over very hard when you have a flaky physical connection somewhere.
In the factory, you fit the bulbs in a certain order every time, and the computer knows that order.
Just imagining the customer support for this is gonna give me nightmares.
“Sir, you need to make sure your vehicle’s ignition is turned to accessory mode. Then wait for the light to blink twice, that’s the vehicle’s confirmation that it correctly identified the new light. If it blinks three times, it can’t confirm the light’s location, so you should try removing it and re-inserting it. If it blinks four times, that means you didn’t replace the bulbs in the correct order so you need to initiate a manual reset procedure by going to the driver’s seat and…”
I’m guessing you’ve never worked in customer support. The failure modes of mistakes would be nasty. Even smart people swap bulbs around when diagnosing faults.
Simplicity (good usability) is most always crushingly hard to achieve, doubly so for hardware.
Calling things “simple” is often a sign of shallow thinking in my experience - something a customer or manager might naively say but an engineer cannot (because they have to deal with all of the real requirements).
For example, the engineers that build cars can’t say “you simply push a button to start a car” - as an engineer the complexity behind that simple operation is very very deep.
No, that's not obvious at all.
Separating the control board and the bulb is obvious. You wouldn't want to replace your entire control circuit every time you need to replace a bulb, would you? You don't want to have to reprogram your ECU to know which bulb serial number corresponds to your front headlight because all of your bulbs are the same.
Moreover, this is impossible because there isn't a single bulb model that goes into a car. High beams, low beams, blinkers, and interior lights are all different. They also differ from model to model depending on the requirements.
> That then makes it vehicle specific, so you don't get the economies of scale of just making a single model of can-bulb which fits lots of places in many cars from many manufacturers.
Car companies make millions or tens of millions of cars per year.
When you're making 10s of millions of something every year (or 2X that for parts that come in pairs, like headlights), you already have economies of scale.
Automotive equipment manufacturers will also share components between car companies, and further upstream you have companies that make chips for auto makers who share chips across the companies.
Automotive manufacturing is a great example of economies of scale. It's not correct to say that auto manufacturers aren't leveraging economies of scale while producing 10s of millions of common parts per year.
That sounds like a good thing to me.
(I'm not sure though - it might be some headlight controller fails non incandescent bulbs)
You make it sound as though this intended to be a benefit to the consumer or the end product. Having worked on and around cars, and being friends with people who do for a living, I am really unconvinced that the manufacturers do a lot of this for any consumer-friendly reason, rather than simply trying to squeeze a buck out of you.
I can absolutely tell you that Volvo, for example, does what the GP is talking about, and then some. On an old school GM or Toyota, if you break a simple switch or knob, or things that really should just be simple devices, you can just pull it out, go to the junkyard or a parts retailer, and put the new one in and be on your way. Not so for Volvo (and I'm sure this has caught on in other manufacturers): if your switch or control or whatever fails, and its hooked up to the CAN-bus, whatever replacement you find simply won't work until you've gone to the dealership (if they even let you use a part that didn't come from there at all) and gotten them to flash the part and whatever other crap needs flashing like a BCM to get them to be compatible (I think just flashing the serial number of a BCM or whatever it needs to play nice with to the switch), at the tune of a couple hundred or more dollars each time.
So in essence, a stupid simple part, that should have been $5-10 that the manufacturer likely never would have seen a dollar from in the aftermarket, is now a $200+ dollar flash at the dealership, using the manufacturer scan tool, and also increasingly requires only parts the manufacturer can generate. So no, I really am extremely skeptical, given what occurs *today* that 95+% of the junk on CAN bus is there for any reason other than to boost dealership and manufacturer profits for no other reason than the fact they can.
It's often the case that consumers will seek out the lowest price no matter how high the cost.
How do you say this with a straight face?
they can be expensive, but you can buy them. you may need to visit a dealer to buy them, but you can buy them.
right-to-repair exists for consumer automobiles.
there are no "right to secure CAN buses" laws, unfortunately.
Say I only need to replace a $5 switch as the parent poster suggests. My options then are pay $200 to the dealership to flash and install it (if they'll even flash a third party part) one time, or I can pay thousands of dollars for a tool I'll use once and do it myself.
That isn't a real choice, and the auto makers are adhering to the letter of the law but not the spirit of the law. Which is legal for them to do, but it doesn't make it any less scummy.
There's a reason they're called stealerships - and the service department is where all the profit is. (Well, that and used cars).
Chrysler (and probably Stellantis so Jeep, Dodge, Fiat, RAM, etc) charges $35 per VIN per year. https://kb.fcawitech.com/article/vehicle-reprogramming-subsc...
Ford I believe now requires a subscription for diagnostics but I haven't seen anything about per VIN charges yet. I'm not sure about the British or Japanese brands either. This is AFAIK regardless of dealership or independent shop.
The problem is as I always point, that people want complexity and technology for everyday but as soon as something breaks they want it to be like 1990.
The article complains about CAN bus not being secure but this sort of attack is very rare, you need special tools, skills, physical access to the network and time. Regular car thieves don’t go and make a key to steal a car, that would be the same as a 1980’s one breaking a window and start trying to decode the cylinder and then cutting a key! How does a towing company get your car in 10 seconds? That’s how they’re stolen most of the time.
the automotive parts industry is massive and if you allow third party parts manufacturers to make parts for your car, you are undercutting your own parts replacement business. how do you counter that? you require that replacement parts come from you. the only way to do that is via electronic means, because anything purely mechanical can (and is) reverse engineered quickly.
insurance companies fight against this in court because 3rd party parts are much cheaper than official parts, and usually come with an associated dip in quality as well, which is another reason auto makers fight for first-party parts businesses.
Honda doesn't want Snake Oil Autoparts stuff installed on cars which are still under warranty after a collision, for example, but the insurance company paying for those repairs definitely does.
They lost the right to require things to do with thr car the y sold the car.
Electronic lockouts will be cobsidered theft one day
not if you want a warranty or any manufacturer support on the vehicle at all, and these are things that consumers value a lot.
> Electronic lockouts will be [considered] theft one day
among the most feverish people, they are considered a problem worth fighting, which I agree with, and I don't think it will ever be considered theft. the law just doesn't support electronic lockouts as theft, and precedent on this would be very difficult to undo without changes to laws defining what ownership actually is.
(Genuinely curious; I had no idea such laws existed for cars.)
And only for regular cars, there is no right to repair for commercial vehicles: https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_...
There are also long-standing legal requirements for automakers to be separate from car dealers, which also translate into making the repair/diagnostics equipment available.
Their profit margins will come from somewhere. If not from savings then from higher pricing.
I'm working on Right to Repair and we get asked for examples like this from various government agencies all the time. It would be very helpful, thanks!
If you're looking for something a little more formal, I think the factory service manual probably calls out that the R&R on a ton of parts will involve reprogramming. I no longer own any post-Ford Volvos nor do I have any interest in European cars, so unfortunately I don't have any newer FSMs. A way you might be able to get at one on the cheap is to pick a popular model/year later Volvo (maybe like a 2016+ XC60?), and get a subscription to the make/model/year on Alldata (which was something like $20 a year for just a single combination), or hunt for an FSM on eBay, if it's old enough to still have a paper FSM.
The "consumer friendly" part is competing on price; they don't care about repair cost, in fact parts for repair is just recurring revenue on top on (till before pandemic) slim margins on selling the car
Isn't that what's supposed to happen in capitalism? Everyone working is getting paid, supply matching demand, prices reducing and ostensibly zero profit for established sectors.
It's like putting everything over IP (VoIP, video over IP, audio over IP, etc.) and then just running Ethernet throughout your building. From an engineering perspective, it's just way easier. Routing wires -- on a circuit board, in a building, in a car, in anything -- is just a real PITA.
Now it's definitely true that having to flash something on the CAN bus to make it work is possibly due to greed, but the original idea of putting things on one bus is not.
There's no way I would ever recommend someone who wanted to keep their car past the first 50 or so thousand miles ever buy a VW or a VW with slightly shinier wallpaper (Audi). There's a reason the service techs on those and BMWs get paid well, and why they're often hated by mechanics.
I bought a $20 OBD2/J2534 cable, downloaded an easily-available ["pirated"] copy of Honda HDS, and seemingly had access to all the functionality a dealer would have. From looking at the Honda website, I could have paid by the day/week/etc for official access to flashing tools or the newer iHDS, which I might have needed for a newer car.
If I had wanted to reflash any of the modules, I probably would have wanted a better cable (though it's hard to know if module manufacturers really have such shoddy update processes that interrupting the flashing can really brick a device, or if that's just persistent superstition like so much in the car world). But I was able to replace the VSA/ABS module and perform the necessary "dealer reset" procedures no problem. I just wish I had obtained this setup before I went about misdiagnosing the problem based on a document that claimed to be the OEM service manual but actually wasn't. Luckily the part I misdiagnosed did end up being the problem!
Of course, I would love for there to be some sort of mandate for manufacturers to document the details of all CAN messages. Because there don't seem to be that many different module manufacturers, they must all be working to some kind of internal standards for their own interchange, and end-user visibility into computing systems is critically necessary for preventing computational disenfranchisement where people see these systems as impenetrable black boxes. But it feels at least in Honda land, much of that capability is practically available to the repair market (at least as of 2015 model years). One just needs to get over the activation energy of setting up the OEM software tool.
I'm adding a CAN bus to my 3d printer for this exact reason.
I know this stuff "pays off" for the manufacturers, but I really wish they'd avoid including unnecessary complexity such as those horrific touch screens, call connections, etc. That sort of thing is why I won't buy newer cars.
Maybe, but given the explosion of weight and cost of new vehicles, it's unclear where these savings went.
One huge problem is that they put the smart key on the same bus as other stuff (headlights, body control) to save money/wiring.
These kinds of busses should be buried far inside the dashboard or some other hard-to-reach area.
Toyota subscription services described here: https://www.toyota.com/connected-services/
One of these is "safety connect" that does stuff like SOS button and stolen vehicle locator.
It is not for the built-in safety features like collision detection and lane departure alert.
" eCall is a system used in vehicles across the EU which automatically makes a free 112 emergency call if your vehicle is involved in a serious road accident. You can also activate eCall manually by pushing a button. "
"Compulsory for new car models
If you buy a new model of car, approved for manufacture after 31 March 2018, it must have the 112-based eCall system installed."
https://europa.eu/youreurope/citizens/travel/security-and-em...
Needless to say, never again
Fuckin' good. Then they can give me the damn encryption key so I can diagnose it myself. I am absolutely not going to subscribe to any sort of narrative like these things are mutually exclusive. I'll keep screaming for the security and the repairability.
Couldn't the keys for decryption be stored in a trusted module that can only be unlocked with the presence of the actual car key? Yes, this means key cloning attacks still get you access to the CAN, but if you can clone the key you can drive away with the car anyway.
It's like in the old days when internet traffic was unencrypted and so was Wifi. You could have a lot of fun just watching what's happening in your home network, and perhaps your neighbors (so I heard..legal grey area). Today? Nope. Everything is locked down. Wireshark shows you only lots of SSL. And that's not even proprietary stuff as the car crypto will be. The bad guys will obtain the keys or workarounds somehow. The good guys will be locked out.
Autonomous driving something something, computer controlling human actions something something.
Without speaking specifically to Ford’s plans, authenticated CAN communications are absolutely coming. I don’t see many approaches that actually encrypt the data on the bus - instead a MAC is used for each frame with a shared key on both secure ECUs, and some protections against replay attacks and such.
I wouldn’t expect all CAN data to be protected by this kind of security - it’s a pain in the butt, and expensive. Instead, certain specific sensitive information (like whether there’s a key in the ignition!) is protected as needed.
The industry is also moving toward IP-based communications for a lot of vehicle networking, which comes with many of the benefits of the modern infosec world. Automotive has a lot of unique challenges, though - like another poster mentioned, key provisioning and management is a huge pain; latency and hard timing constraints are way more important in the onboard/embedded world; many automotive ICs have limited support for e.g., asymmetric encryption, and of course there’s a lot of pain generated from the way the industry does software development generally. It’s an interesting space.
Some premium brands will have the immobilizer await proper crypto from the key reader. In this case the key reader is just there to read the key and pass on the message, there is no decision being made outside of the immobilizer.
Some premium brands will also have immobilizers in other places, like the gearbox. It too will await proper crypto to shift into gear.
Some premium brands will have signed CAN/FlexRay/Ethernet frames that will prevent message spoofing, though that isn't only for this situation.
Most of the time the Gateway module has a static firewall - basically fixed routing tables so only modules that need to will be allowed to talk to each other.
Finally some premium brands will have an HSM both in the key and in the immobilizers to keep the material safe.
There is a lot more to this topic obviously but the reason some brands don't have this (and other countermeasures) is simple: cost.
This was exactly my thought. If the headlights, and any other easily access CAN bus wiring, were properly isolated from critical security ECUs via a properly configured gateway, this attack would be impossible.
The solution, as implemented by many automakers already, is just to authenticate immobilizer messages. It works, and there's not a great excuse for not doing this in 2023.
Something that should be noted for anyone who actually reads this is that the level of vulnerability is wildly different between automakers. No universal solution exists.
People that never worked in the industry greatly underestimate how much it really costs in R&D and production to make a car. Adding "authentication" and "encryption" in this environment is way more complex and has more implications than importing yet another library in a web app.
Even so a few manufacturers go to a great deal of effort to secure their stuff while others are using 20y old architecture because it works and it saves money.
I want to say that "premium" brands are much better, but there are a lot of exceptions. However cars with lower margins and lower overall cost will be worse.
I always assumed that immobilizers were already using cryptography to talk to the ECU otherwise this kind of attack would be obvious.
Manufacturers also aren't building every piece of software on a given vehicle. Many components will be done by suppliers that range from "meh" to "wtf" when it comes to security. Even the best reviewers will struggle to catch everything a sufficiently incompetent implementation screws up.
No trace of course once he got to the car / once the police was around, just a broken window. But the would-be burglars made a mistake; they went into the frame of the car (between the driver and rear passenger doors) through the plastic to disconnect a bundle of cables, but didn't fit the plastic back properly.
This bundle of cables went to the antenna that was required for the phone home functionality; if he hadn't had that addressed, the thieves would have been back a day or a week later to get into the car, with the pressure sensor / phone home alarm not being able to contact BMW HQ.
Organized crime has enough money, time, opportunity and incentive to buy cars and take them apart to find weaknesses.
Plus when the alarm does indeed go off, people are liable to ignore it because these alarms are always going off for nothing.
FYI, that would the "B Pillar". The A Pillar is the one between the windshield and the driver door, the C Pillar is the one behind the rear passenger door.
This is for a variety of reasons - a legal and insurance company focus on immobilizer technology through companies like Thatcham Research as well as a more active threat model geopolitically.
There are, of course, weaknesses in these cryptosystems, but the documented attack describes an extremely poor system by modern standards.
As far as I am aware: there are All Keys Lost (AKL) immobilizer bypasses for, for example, Volkswagen Immo 5, but not "Emergency Start" bypasses. The difference is the level of access required: AKL bypasses require involved, long term physical access to a car, for example at a shop. They're useful for independent or fly-by-night shops and in a post-theft scenario, but they're not going to boost a car out of a driveway. Meanwhile, Emergency Start bypasses are plain-and-simple theft tools like the fake Bluetooth speaker from the article.
All of the VW Immo 5 exploits which I am aware are of the AKL style and revolve around being able to extract cryptographic material (CS/MAC/ImoDat_noKeyMst/ImoDat_noKeySecu depending on who you ask what it's called) from a control module by physically removing it from the vehicle.
This is a far cry from tapping the CAN bus at a headlight and injecting an unauthenticated CAN message.
By design, all nodes on a CAN network receive all frames, which is the root of the problem. There are some differences in ECU validation, plus whether or not the vehicle supports UDS diagnostics, but these are differences by manufacturer and have nothing to do with the continent the car is being used on.
European, American, and Japanese cars have completely different immobilizer module cryptography implementations. In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow.
Generally, European cars have stronger immobilizer implementations. For example, in VW Immo 5, immobilizer messages are encrypted and authenticated using AES with a PRNG-based MAC. At a high level, participating modules need knowledge of a secret AES key in order to encrypt random number seed material. It's symmetric so it's still not perfect, but this type of simple "send one message through a headlight" attack would not be possible on these cars.
Update: ah, I see you edited your comment. Yes, it has nothing to do with where the cars are _used_. My point was that European _manufacturers_ tend to have more secure immobilizer implementations, and I will stand by that point.
You're the one that chose to interpret that as "stricter than American".
Right ? Because the messages are not authentified, once the car stolen, the thieves can even remove the immobilizer and put a DIY with a set of keys when they send the car in a container, to make it 'ready to ride' ouf-the-box
It's trivial to disable an immobilizer in software by re-flashing the ECU, yes, but modern ECUs have two strong protections against this:
* Cryptographic signature checking against update/re-flash payloads (I've done extensive research on these on VW Continental ECUs - https://github.com/bri3d/VW_Flash )
and an even better and more obvious protection:
* The ECU application software won't descend into the re-flash software (Customer Bootloader) unless the immobilizer is free (a valid key is present).
This is a lot of what helps to reduce surface area from an "emergency start" style attack to an AKL attack - now that the Customer Bootloader won't start without the Immobilizer being unlocked, an attacker needs to remove the control unit to flash it with a Supplier Bootloader exploit ( https://github.com/bri3d/simos18_sboot ) or physical access (BDM/JTAG).
At least in the US, there are portals for non-official repair technicians to buy access to reprogram ECUs/keys/etc for a given car (keyed by VIN) - I can see this being abused (it can't be that hard to buy access under a false identity), not to mention that professional car theft gangs might convince/coerce an insider to give them even deeper access to the signing service if not the raw private keys.
Once you have access to the signing service in one way or another and a valid network connection, can't you just perform the AKL process in the field by simulating a legitimate AKL procedure that a dealership might do? Presumably writing custom software to automate all that (vs having to manually click through a slow scan tool or the often-terrible official software) would cut down the required time to a couple minutes.
However, there are a few protections here:
* Most manufacturers do fairly aggressive KYC / risk protection for their online programming services. The VW one is called FAZIT/GeKo, you can find the subscription process online and it is similar to opening a business bank account. Still, you're right, aftermarket account sharing is a big thing and as always, a cat and mouse game that manufacturers are usually losing. You can easily rent VW online coding accounts by the hour on shady websites.
There's also second layer of protection for official AKL specifically which is harder to defeat, though:
* Most European manufacturers do not allow an All Keys Lost process to be carried out entirely online. For example, for VW, dealers or aftermarket vendors need to buy specific, physical "dealer keys" for a given VIN. These physical key fobs are seeded with some key material and registered with the shop and VIN in the backend / FAZIT database. The signing server backend for ODIS (GeKo) will not adapt keys to a car unless the key material matches and the VIN was already associated with the key in the backend. Of course, there are social engineering attacks here still, but it's basically 2FA for key programming, with a lead time of "they ship the key to you," and it prevents the attack you describe from being plausible by legitimate means.
HOWEVER, this is also one of the major weaknesses in the VW Immo 5 cryptosystem architecturally - since the actual message authentication is symmetric (MAC based), if the secret AES key material can be extracted from the immobilizer system, aftermarket tools (Abrites, Autel, VVDI/XHorse, etc.) can create and adapt a "Dealer Key" without prior authorization. So we get back to the current state of these systems - because authentication is symmetric, with long-term physical access to the car, specific control units can be removed and secret key material extracted and used for reprogramming. However, drive-by quick-and-dirty "plug two wires from outside" attacks are very challenging.
The threat model most automotive systems are designed against (when they are designed against anything at all) is absolutely not "we want to screw over those damn independent shops trying to run diagnostic routines!" - it's "how do we lock down the immobilizer, the ADAS, and protect ourselves from tuning-related warranty fraud." Independent shops and individual enthusiasts are just caught in the crossfire between thieves, ADAS tampering, and manufacturers/insurance/regulators.
There's a somewhat simple trick to get the engine to start without the immobiliser (but it requires special tools), but if the body ECU is immobilised most of the vehicle electrics will be locked out too.
Of course, I've had those and they have their own problems. Carburetors and point ignition systems have their issues.
So I instead live in a world where even my chainsaw has a CAN bus.
Once I went out to the car early one morning to find it parked up exactly where I'd left it, with 200 more miles on the clock, the petrol tank rather more full, and the engine still warm...
I suppose the big difference between a person stealing my car, and the immobilizer stealing my car is that my insurance has to pay out for that first one.
Could you elaborate? A friend of mine had his car randomly not starting the engine, but fixed it through the replacement of an electronic board, and some mechanics said they could circumvent that.
My dad had an early-80s Ford pickup when I was a kid. The cylinder in its ignition switch was broken in a way that you could hop in, turn the ignition switch, start the truck, and drive away -- all without a key. The ONLY thing preventing extremely easy theft was a few tiny pins in a lock cylinder.
This is an extreme case, but it illustrates how easy it was to steal cars before modern theft-prevention: bypass the mechanical lock to connect a couple wires together, and drive it away.
One of which is that if you apply 12V to the coil, you can bump-start the car and it will run. Theft of such cars is truly trivial.
Modern cars are in fact very hard to steal. Just because the car from the article has a flaw that allows you to unlock and start it via canbus, doesn't mean that all modern cars can be stolen like this.
Bump start?
Just jump the starter solenoid terminals with one of those remote start buttons or a screwdriver.
Car theft is largely a political problem, not a technical one.
Yet the car is trivial to break into. Hell, I've locked myself out a few times and the Key from another T3, a key from a bycicle lock and a nail-file could open the car (but not start it).
My countermeasures are mechanical too, though: hidden circuit breaker, a lock on the steering wheel, one on the gas-pedal and one on the hand-break. All of them easy to circumvent, given some time, but that's one thing thieves often don't have: time to figure out unknows and weird stuff. Actual "security by obscurity" in a way.
In terms of security, it's my most secure vehicle. Mechanical diesel means its gonna need to be glowed which I have it setup as a push button and no thief will know this. As well, my shutoff switch is a toggle switch under the dash I leave to "off". It'll just crank and crank forever. And my biggest security feature? It's a manual transmission. Most see that and won't even try.
Security by obscurity
? The car talking to the key first? Can't the key just not talk to the car at all unless the button is pressed on the key fob or shortly thereafter?
In the 2020s, I’m increasingly seeing smartphone (NFC?) keys being the sole thing you need to drive off with the thing so no fob is even necessary.
Or bluetooth. I'd rather have a pocket fob than have to take my phone out and hold it up to an NFC reader.
The problem with the bluetooth method is reliability. My Tesla decides not to unlock for me perhaps once every 20 times I walk up to it. Sometimes just a few seconds while it figures it out, sometimes I have to open the up and hit the door unlock button.
My wife's Bolt uses a pocket fob, and so far it has never refused to unlock the doors on command.
But yeah, morals are flexible, a lot of people don't care what their work is used for (whether they're directly aware or not). I mean personally I've worked for investment banking and the tobacco industry (websites/shops for e-smoking products), I've heard of others that have worked for gambling or "adult entertainment", and how many of you here work on either crypto or Amazon?
What's morally right, wrong and justifiable is flexible, is all I'm saying.
In many countries, engineering (especially hardware) don’t get paid a lot. I could imagine the pull of illicit sources of income being strong.
I would love to read an interview with someone who applied to work for, say, Facebook. After all the news about their complicity in trying to set the world on fire - what drives them?
My opinion is most of the negative reaction that people have to Facebook is intrinsic to websites where lots of people socialize online.
Military industrial complex?
Imagine if you were someone with specific knowledge that was not remunerated and someone else with ill intent noticed. https://xkcd.com/2347/
Disclaimer: I've personally not stolen a car.
Are you joking? This involves expertise, maybe just not certified through formally-mediated channels.
Sure it’s technically _possible_ someone who is terrible at other tasks and isn’t very bright put this together…but I doubt it.
Failure of the establishment is their primary driver. It's the free market in action, crime pays.
I'm not making excuses; there are plenty of ways that someone with these skills could make money legally with a felony conviction, like online freelance work. But, life choices so often come down to the path of least resistance, and if you add in a language fluency barrier, intermittent or slow internet access, or some other resistance, I'll bet it's a lot easier to say "Screw it. I've already got a record-- what do I have to lose?"
Don't know. A stolen car presumably?
To start the vehicle, other manufacturers have the key communicate with the ECU directly, bypassing the accessory CAN bus.
Something I'd like to see is a unique private RSA key given to car owners on a USB stick upon purchase of the vehicle to allow them to replicate their own keys.
> And part of the problem is that this isn’t a vulnerability disclosure and so the processes that Toyota does have in place are not appropriate.
I didn't follow this part. I hear that the authors think their "you can use CAN fault injection followed by a spoofed unlock command to steal cars" technical writeup is not a vulnerability disclosure. But why not? (Other than because they said so.)
The fact that the vulnerability is exploited in the wild doesn't prevent it from being appropriate to report it as a vulnerability -- quite the opposite. They even provide several fix suggestions.
(I'm not personally arguing that it is wrong to disclose the vulnerability without coordination. I'm arguing that it's weird to make a choice like that while claiming you aren't making one.)
(Of course it also doesn't surprise me in the least that Toyota isn't taking it seriously)
That certainly sounds like a yes.
I first heard of the CAN bus hacking late last year (in an owners forum) but it does seem to have become more wide spread this year.
In keeping thieves out, we're locking ourselves out.
Steering wheel locks and primitive offline immobilizers had their advantages...
Of course, the important thing is making sure the wiring is well done (proper wire gauge) and the switch is actually in a hidden spot.
Hold down the lock button Hit the unlock button twice
If a thief wants to steal the car, make it harder. There should be one physical path from the key system to the ECU that allows key operations, and it should be protected by a really annoying and time-consuming process so that theft is so annoying that most people won't ever try it. After that is done, they can start sprinkling it with magic crypto sauce. (It's also very hard to get magic crypto sauce right; unless you hire the few really talented crypto people, whoever you hire to write crypto will make mistakes, and a hacker has unlimited time to find one)
Obviously existing car models won't be changed, but future ones should be. Car theft isn't just an inconvenience for the owner; it makes committing other crimes easier and harder to trace, results in more property damage, increases the black market for chopped cars, increases insurance premiums, etc.
Sometimes simple hardware can be a good solution is for a software problem.
In said old days, my late grandfather had a steering wheel lock, basically a giant padlock with a metal bar attached and the whole thing painted yellow. I assume that would work just as well in today's electronic days.
1) add every alarm, immobilizer, hidden kill switch, steering wheel lock, driveway bollard you can possibly afford and keep the keys in a signal blocking pouch at night.
OR
2)Make sure the car is as easy to start and drive away as physically possible - don't add anything extra fancy to keep it safe other than what's already there from factory, keep the keys on a shelf right in front of the main door of your property, easily and clearly visible should anyone enter.
The reason is simple - for owners of fancy/exotic cars, if someone is coming to steal your car, they will take it. If you make it difficult, if you hide the keys and put locks on the steering wheel, they will come into your house and ask that you unlock it for them. And putting aside the idea of any heroics with self defense, the last thing you want the thieves to do is harm you or your family to take what is essentially just an object. Cars are replacable. Insurance will pay for the loss and therapy for you and your family - but insurance will do nothing about losing your life because you decided to stand up to someone with a weapon coming to take your car. Let them find and take the keys and fuck off as quickly as possible.
I was in group 1 when I started, now I'm in group 2 - the risks to me and my family are just not worth it.
Not in a jurisdiction where law enforcement doesn't care.
Back in the early 90's when I first met my not-yet-wife, she drove a rusted out '85 Datsun (not Nissan). There was a rust hole right in the door panel where you could reach your fingers in and manipulate the mechanical locking rod to unlock the door. One time someone "broke in" to her car and rummaged around in all her crap, didn't take anything, and was polite enough to re-lock the door when they were done.
Not if stealing your neighbours car is easier. Unless you own something very exotic and the thief has essentially been hired to steal your specific car, no one want to steal _your_ car. They want to steal N reasonably nice cars as quickly and safely as possible and get out of there before anybody notices anything.
That's the entire point of my post, sorry if it wasn't completely clear. Having been in the community of people who own very expensive/exotic vehicles, these cars almost never get stolen by opportunistic thieves. If someone is coming to steal your ferrari, they are coming to steal your ferrari. They don't care what your neighbour has(they probably know already and they decided to steal yours first).
(1) having a cheap car stolen incurs a smaller loss than having an expensive car stolen; and
(2) the pool of cheap cars is larger, reducing the probability of a given car getting stolen (unless the "demand", so to speak, is also higher?)
Overall, it seems that the expected loss (actual loss times the probability) should be quite a bit lower for cheap cars than for expensive cars.
Having said that, if one has enough money to buy an expensive car, they presumably have enough money to insure it from theft, rendering this whole line of argument moot (they just pay higher premia and spread the risk across a population of car owners)...
This doesn't seem to be true, given that as soon as it became hard to steal cars the number of car thefts dropped massively.
Your car thieves are willing to step up from car theft to attempted murder rather than steal a different car? What's the incentive for that?
If you were a thief why wouldn't you break in if you knew that's the level of enforcement.
Most car thieves would not dream of upgrading to randomly breaking into a house in the US as there would be a non-trivial probability of meeting a resident with a shotgun.
[0] https://www.budgetdirect.com.au/content/dam/budgetdirect/web...
[1] https://en.wikipedia.org/wiki/Estimated_number_of_civilian_g...
UK has 35% more car thefts per capita and 2x the robbery victims.
https://www.nationmaster.com/country-info/compare/United-Kin...
2) "Number of burglaries" is different from "Will upgrade from car theft to robbery".
Burglars and car thieves in the US are generally trying to make sure that nobody is around and would generally find a different target if that wasn't the case.
Few would upgrade to robbery as that very much would get the attention of the authorities in the US.
ECM
Hybrid vehicle control ECU
Forward recognition camera
No. 2 skid control ECU (brake actuator assembly)
Rack and pinion power steering gear assembly
Clearance warning ECU assembly
Steering sensor
Central gateway ECU (network gateway ECU)
Combination meter assembly
Airbag sensor assembly
---
There's nothing about smart key in here specifically. Not sure on later "ECU Security Key" vehicles though. If someone were to look up replacement instructions for the Smart Key ECU on Toyota's TechInfo, and if it has ECU Security Key update as a step or not, that could answer this.
You wouldn’t have a password being loudly screamed out of a speaker 24/7, so why would you design a car key to work that way?
This is "keyless theft" meaning "you can steal the car without the keys" not "you steal the car leveraging keyless entry."
Not much of an improvement. Without a transponder in the key they are no more difficult to bypass than a light switch.
Is my 11 year old car a little more "steal" proof to these elegant methods?
Any CAN bus? No, it takes time to sniff the bus and get all the control messages, older cars may be especially vulnerable since they likely don't have as many security precautions in place.
CAN has been in cars for quite a long time, the infiltration systems haven't due to high-cost/lack of electronics.
On a side note, the hack talked about in the article could be performed by a Arduino UNO and a $5 can bus transceiver.
They seem to also pull out the speaker to make room for the add on board which does all the magic.
• your “bank deposit” is just an unsecured loan to a company who may not manage risk as well as you’d think
• your “car” is a collection of computers operating in an insecure data center to which you trust the lives of you and your’n
Ethernet is great, don't get me wrong... but it is complex to implement in a system like a car. Each device needs to speak ethernet, be switched and likely have an IP stack. If you are lucky enough to have a built in MAC / PHY into your micro (which most don't), then you still need to put in transformers and protection circuits.
10BASE-T1S is the future IMHO, it is much simpler than traditional 10BASE-T, requires only 1 pair and can also provide power. For simple setups, only 2 resistors + 2 caps are necessary to implement and you can have multiple devices on a bus without requiring a switch.