Hacker News Reader

Comment by jobead | Hacker News Reader

I believe this means that the part's computer has the vehicle's VIN loaded into it with a computer that can only be purchased/used by a certified technician. If he was to buy a new part, it would have a blank VIN; and if he pulled one from a junker, it would have that car's VIN.

(edit: should also say, I think a VIN mismatch would cause the ECU to refuse to work with that part and shut down)

View on HN

Well that's dumb. I've never heard of that before. But I guess I shouldn't be surprised. Thanks!

It gets even more fiendish than that - you can have entire linked dependencies of locked modules. My old Saab’s key was locked to the security computer, to the column immobilizer, then to the engine computer.

Lost one key? Bummer. Lost all your keys? $2500, several hours of reprogramming time at the dealer, and a bunch of new parts shipped over from Trollhattan.

Thankfully the hacking scene has managed to bypass lots of this as Saab no longer exists to make parts. But this was the state of the art in 2003. I’m sure it’s even worse now.

It's going to get worse - on most cars the CAN bus is not encrypted and the messages are not signed. There was a comment here recently where a tech in the auto industry claimed that one manufacturer was planning to start signing the CAN bus packets. That will mean it likely becomes impossible to do things like re-code the PCM for a motor with a different VIN so you can re-use the PCM in another vehicle.

That will be quite hard to overcome.

BMW has been doing this for a while.

I wonder if this didnt start with 2005 7 series when it received FLIR Night Vision system. That thing was locked down due to ITAR and gave BMW excuse to pair with ECU.

Reply on news.ycombinator.com