Obviously, we want owners to have full access to their car's CANBUS.
So the question is: how should the OBD-2 plug (or wiring) be protected?
So the question is: how should the OBD-2 plug (or wiring) be protected?
Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibility for multiple decades.
Of course they'd need to do a good job securing that database since inappropriate access to it would make stealing cars very easy.
Mechanical keys are not secure. They can be reproduced with basic skills. That's why there used to be a giant key cutting industry where much of the business was car keys (Thanks, GM.)
The whole idea of CA PKI and all modern TPM architecture on devices is that they CAN'T be reproduced or replaced in context without massive effort that would make the intended use moot; IE replacing the TPM and associated on both the key and car. This would require some bureaucratic pointless process to prove your identity, and it would be very expensive and frustrating, and completely at the manufacturers will.
Further, if the car CPU could allow this, it would be >.0001 second before theives use the same exact tools that the manufacturers use. This is basically what's happening now with current NFC/Radio Keyfobs. Basic access to existing cpu through canbus makes NFC/Radio moot.
Pretty much all of human history to this point says that this is a practical impossibility. If there is such a database/secret, it will get out.
The dealer can spend the two hours necessary to replace the encryption module, but thieves would have to also spend that same two hours.
Unfortunately, Immo can be trivially disabled/bypassed/reprogrammed on many cars using the canbus or odb2 interface.
Also trivially editable in many ICUs is the mileage, airbag (crash) history, etc.
The main vector is that this data typically exists alongside performance parameters and user data like registered keys and fobs, so is accessible either by catching the ecu in bootup/program mode, by buffer overrun attacks, or often just by asking nicely.
This is basically doable by anyone who can to chip tuning or ECU remaps. It’s technical, but not that technical. Many ECUs require JTAG access inside the ECU housing or even desoldering the serial flash chip, but many do not.
I just bought a whole setup for this from AliExpress for about 100 dollars and it’s worked well for me so far, just a specialised JTAG adapter with some cables really.
Pretty sure if you wrote drivers for chip tuning software to use a buspirate it would work just as well if not better.
1. all cars must be internet connected so they can pull CRLs
2. dealers and locksmiths are no longer able to replace keys, you will have to ship the car back to the manufacturer if you lose your keys.
Because there's no secure way to hand out the root cert to the thousands of organizations authorized to replace keys today.
I really don't see how any of this is merited or reasonable, especially when the vast majority of the cars being stolen in my neighborhood are either stolen with the keys or with a tow truck.
1. As a result, we'll see costs like losing the keys to a rental car go from a $250-500 fee to a $2500-5000 fee, due to the additional costs to process and the additional loss of use.
2. Criminal rings that steal high value cars will go from often using tow trucks, to exclusively using tow trucks.
3. The number of cars stolen via stolen keys will remain unchanged.
Yes, the key itself will be more secure, but I'm not really sure it will actually improve anything. More security is not better if the costs do not create real-world results.
The third point may be true for classic theft but would not be true for the growing category of thefts caused by abusing wireless keys. If you can’t easily get a new key, the resell value for that car is going down dramatically.
> If you can’t easily get a new key, the resell value for that car is going down dramatically.
Most of the vehicles that are stolen for resale are high value and sent overseas to parts of the world where the labor cheap to do something like entirely rip out all of the security components. I don't really think that these criminals will stuff a G-wagon in a shipping container for $100,000 but they won't do it for $80k or $90k.
Again, it’s possible but do you really think there isn’t even one thief who lacks easy access to a tow truck or will be caught firing up noisy equipment at 3am but not if they fumble around in their pocket while walking up to a car? Not a single teenager looking to joyride won’t give up if it’s harder than the Kia video they saw on Tik Tok?
Similarly, yes, people will still steal vehicles and ship them overseas but the more work they do the lower the resale market and value will be, and that will make it less tempting since you’d only be able to sell to people who are content never getting service from the manufacturer. Even if we assume that there are countries with skilled technicians and effectively no law enforcement, only something like 10-15% of stolen vehicles are shipped according to U.S. officials so even if you wrote those off entirely you would have plenty of room to improve by reducing the majority of thefts which never leave the country.
> Again, it’s possible but do you really think there isn’t even one thief who lacks easy access to a tow truck or will be caught firing up noisy equipment at 3am but not if they fumble around in their pocket while walking up to a car?
Canbus attacks, OBDII reprogrammers, and similar are typically pretty intrusive, they require cutting into fender liners, removing lamps, busting a window, or otherwise gaining physical access to the bus. They also require specialized tooling and expertise that are harder to get than the tools which physically move vehicles.
The one that might be an exception, and some savvy street criminal might be able to get their hands on is a tool to do is a relay attack, which is usually good enough to steal belongings from a car, but generally not capable of stealing the car.
> Not a single teenager looking to joyride won’t give up if it’s harder than the Kia video they saw on Tik Tok?
Definitely not. Vehicles with immobilizers are essentially never stolen by joyriders unless they have also stolen the keys.
> Even if we assume that there are countries with skilled technicians and effectively no law enforcement, only something like 10-15% of stolen vehicles are shipped according to U.S. officials
Yes, and almost all of the other ones either just lack immobilizers, or the thief also stole the keys.
The answer is, when a person "inevitably lose[s] it", they need to pay to get their electronics refit.
The number of people who lose their keys vastly dwarfs the number of people who are having their car stolen with a flipper zero.
It has to be hard enough it can't be done in the street (without getting attention), but maybe it could be easy enough to do in a garage.
But even if it is expensive, the result would be that either people with take more care, or they'll lose their car.
Maybe it's not a bad thing that people who can't manage a key are less likely to be on the roads - or that its more likely they lose access to their car then it ends up in the hands of criminals. A car can be a dangerous thing, even an inexpensive one.
The criminals doing more skilled attacks typically aren't joyriding or using it to commit other crimes, they typically doing it for financial gain: they want the car, its contents, or its parts.
Ultimately the overlap between the violent street criminals and those skilled at attacking digital security systems is not much.
> But even if it is expensive, the result would be that either people with take more care, or they'll lose their car.
The entire reason keys were explicitly designed with the functionality to program new ones is because that's not considered by most to be an acceptable solution.
And, it involves interacting with someone, who presumably can call the police afterwards, and activate any lojack / immobilisation device before it can be removed. Presumably the appeal of stealing a parked car it may be a while before it has been discovered and reported stolen.
Also, doing such a thing in a gas-station where there are likely cameras and even other people / attendants make it seem pretty risky to me. Are these dudes just hanging around the pumps in masks? What country is this?
> not considered by most to be an acceptable solution
Things change, but also, it's as much up to the government and/or insurance corps what's acceptable.
> who presumably can call the police afterwards, and activate any lojack / immobilisation device before it can be removed.
Yes, people who carjack usually aren't looking for a nice daily driver to hang on to for the next 3 years. Usually they want to joyride, or use the car for some other crime, in the immediate term.
> Also, doing such a thing in a gas-station where there are likely cameras and even other people / attendants make it seem pretty risky to me. Are these dudes just hanging around the pumps in masks?
Stealing a car, and being in possession of a stolen car, is pretty risky already. I think someone who does this type of crime is probably not very risk averse. Wearing masks is a pretty common way to thwart cameras when committing a crime in many places, I don't think this potential security issue is specific to certain countries. I think what you might be hinting at is that fewer people want to do carjackings in different places, but the same applies to canbus exploits. Nor do I think anyone really needs to "hang out" to find a car at a gas station. Many have cars filling up at them regularly throughout business hours.
> Presumably the appeal of stealing a parked car it may be a while before it has been discovered and reported stolen.
Yes, and while there are some instances of this happening electronically, I don't think closing those avenues will change anything, because towing cars is neither difficult nor suspicious in many places. Again, security is only as good as the weakest link. Nearly all criminals cut locks, even ones are very easily picked.
No idea, but my point stand on how they achieve this in the first place..
> towing cars is neither difficult nor suspicious in many places
because it's not a recognised method of theft. Also, buying a registered tow truck to commit a car theft doesn't sound easy to me.
One can also purchase, rent, or steal a trailer and attach it to a vehicle. There are several types of trailer which can haul a car, which are all widely available to the public.
The big switchover was in '96 when OBDII/CAN bus became mandatory. At that point it became pretty cheap to do things electronically, often cheaper than mechanically, so lots of things started switching over around then.
Same issue we have now with ghost guns honestly. CNC mills are powerful tools, with the right software you can essentially just place the properly sized chunk of metal in the box and hit go.
That's no different from this proposal. You just give them the keys, or the key card (or red key) if you've lost the keys.
You could make these tools more difficult to obtain, but that won't stop the crime.
Immobilizers and requiring a PIN to start the car are cheap, effective ways of preventing car theft without negatively impacting our ability to repair vehicles. It would behoove government agencies to include a list of anti-theft techniques on the window sticker and it would behoove insurance companies to be very upfront with the anti-theft features they think vehicles need.
I cannot imagine a scenario after years working with our own infra and clients where a car manufacturer would restrict access to the vehicle with a private key decryption on the FOB tpm, (that can't be exported or copied.)
Lost/broke fob? 4000 pound paperweight, to no ones benefit. Insurance nightmare that would also be violating right to repair in many states (which is a different issue) .
There SHOULD be a standard like every person has some device or process that is also a CA, who can then generate and dictate what keypairs can access a device, car etc. But we are very very very far away form that.
That they are using the OEM software indicates that there is some authentication going on with the ECU to start the engine anyway. I bet they didn't truly plan for key rotation.
Even so, it would be possible, I think.
There is also FlexRay. There is nothing interesting you can do with CANbus on new mercs. Even unencrypted CANbus messages go through gateways that (could) prevent headlights from reporting key presence.
There is a reason that some cars don't have reasonable attack vectors (excluding parachuting the driver out of the car) and some can be started with a screwdriver (or slight more involved way with CANbus). It's not complexity, it's cost.
https://www.amazon.com/Tune-Saver-OBDII-OBD2-Lock/dp/B0BRF5D...
Additionally, I'd imagine that such a tiny fraction of a percentage of cars have these kinds of locks that it'd barely be worth it for thieves to figure out how to bypass them, at least until there's more widespread adoption.
Look at it in the picture and the review pictures. They're all 'keyed' alike. It's just a single offset pin. Also one review says it just holds on with friction and can be pulled off with force.
This will impose higher costs when replacing these systems, because it will require key management of some kind. Either central cert management (with 20 year expiry?) or local key management. So only impose this on a tiny subnet for the starter/immobilizer.
Good take, though.
Android (adb) and iOS (iTunes backup) have solved this issue years ago.
That was enough to tell the ECM that it was okay to start the car by simulating the key switch closure for “run” and a temporary closure for “start”. Prior to adding the CAN interface, jumping “start” would set off the alarm.
Put a public key on the engine controller, have it challenge the key with a random start number, have the key respond with the signature of that number, engine starts.
You can do that challenge over the can bus.
It makes it less plug-n-play than the OBD2 connector, but thieves will still be able to do it.
+ Some credential exchange between devices to establish a web of trust
+ Devices are locked similar to Apple parts