What do you think about how the article listed devices being available for all the European manufacturers?
As far as I am aware: there are All Keys Lost (AKL) immobilizer bypasses for, for example, Volkswagen Immo 5, but not "Emergency Start" bypasses. The difference is the level of access required: AKL bypasses require involved, long term physical access to a car, for example at a shop. They're useful for independent or fly-by-night shops and in a post-theft scenario, but they're not going to boost a car out of a driveway. Meanwhile, Emergency Start bypasses are plain-and-simple theft tools like the fake Bluetooth speaker from the article.
All of the VW Immo 5 exploits which I am aware are of the AKL style and revolve around being able to extract cryptographic material (CS/MAC/ImoDat_noKeyMst/ImoDat_noKeySecu depending on who you ask what it's called) from a control module by physically removing it from the vehicle.
This is a far cry from tapping the CAN bus at a headlight and injecting an unauthenticated CAN message.
By design, all nodes on a CAN network receive all frames, which is the root of the problem. There are some differences in ECU validation, plus whether or not the vehicle supports UDS diagnostics, but these are differences by manufacturer and have nothing to do with the continent the car is being used on.
European, American, and Japanese cars have completely different immobilizer module cryptography implementations. In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow.
Generally, European cars have stronger immobilizer implementations. For example, in VW Immo 5, immobilizer messages are encrypted and authenticated using AES with a PRNG-based MAC. At a high level, participating modules need knowledge of a secret AES key in order to encrypt random number seed material. It's symmetric so it's still not perfect, but this type of simple "send one message through a headlight" attack would not be possible on these cars.
Update: ah, I see you edited your comment. Yes, it has nothing to do with where the cars are _used_. My point was that European _manufacturers_ tend to have more secure immobilizer implementations, and I will stand by that point.
You're the one that chose to interpret that as "stricter than American".
Right ? Because the messages are not authentified, once the car stolen, the thieves can even remove the immobilizer and put a DIY with a set of keys when they send the car in a container, to make it 'ready to ride' ouf-the-box
It's trivial to disable an immobilizer in software by re-flashing the ECU, yes, but modern ECUs have two strong protections against this:
* Cryptographic signature checking against update/re-flash payloads (I've done extensive research on these on VW Continental ECUs - https://github.com/bri3d/VW_Flash )
and an even better and more obvious protection:
* The ECU application software won't descend into the re-flash software (Customer Bootloader) unless the immobilizer is free (a valid key is present).
This is a lot of what helps to reduce surface area from an "emergency start" style attack to an AKL attack - now that the Customer Bootloader won't start without the Immobilizer being unlocked, an attacker needs to remove the control unit to flash it with a Supplier Bootloader exploit ( https://github.com/bri3d/simos18_sboot ) or physical access (BDM/JTAG).
At least in the US, there are portals for non-official repair technicians to buy access to reprogram ECUs/keys/etc for a given car (keyed by VIN) - I can see this being abused (it can't be that hard to buy access under a false identity), not to mention that professional car theft gangs might convince/coerce an insider to give them even deeper access to the signing service if not the raw private keys.
Once you have access to the signing service in one way or another and a valid network connection, can't you just perform the AKL process in the field by simulating a legitimate AKL procedure that a dealership might do? Presumably writing custom software to automate all that (vs having to manually click through a slow scan tool or the often-terrible official software) would cut down the required time to a couple minutes.
However, there are a few protections here:
* Most manufacturers do fairly aggressive KYC / risk protection for their online programming services. The VW one is called FAZIT/GeKo, you can find the subscription process online and it is similar to opening a business bank account. Still, you're right, aftermarket account sharing is a big thing and as always, a cat and mouse game that manufacturers are usually losing. You can easily rent VW online coding accounts by the hour on shady websites.
There's also second layer of protection for official AKL specifically which is harder to defeat, though:
* Most European manufacturers do not allow an All Keys Lost process to be carried out entirely online. For example, for VW, dealers or aftermarket vendors need to buy specific, physical "dealer keys" for a given VIN. These physical key fobs are seeded with some key material and registered with the shop and VIN in the backend / FAZIT database. The signing server backend for ODIS (GeKo) will not adapt keys to a car unless the key material matches and the VIN was already associated with the key in the backend. Of course, there are social engineering attacks here still, but it's basically 2FA for key programming, with a lead time of "they ship the key to you," and it prevents the attack you describe from being plausible by legitimate means.
HOWEVER, this is also one of the major weaknesses in the VW Immo 5 cryptosystem architecturally - since the actual message authentication is symmetric (MAC based), if the secret AES key material can be extracted from the immobilizer system, aftermarket tools (Abrites, Autel, VVDI/XHorse, etc.) can create and adapt a "Dealer Key" without prior authorization. So we get back to the current state of these systems - because authentication is symmetric, with long-term physical access to the car, specific control units can be removed and secret key material extracted and used for reprogramming. However, drive-by quick-and-dirty "plug two wires from outside" attacks are very challenging.
The threat model most automotive systems are designed against (when they are designed against anything at all) is absolutely not "we want to screw over those damn independent shops trying to run diagnostic routines!" - it's "how do we lock down the immobilizer, the ADAS, and protect ourselves from tuning-related warranty fraud." Independent shops and individual enthusiasts are just caught in the crossfire between thieves, ADAS tampering, and manufacturers/insurance/regulators.