Hacker News Reader

Comment by codeka | Hacker News Reader

Isn't the solution here that only BMW authorized devices should be able to connect to the ODB? Or is that already the case? I guess it just takes one unscrupulous dealer to upload their certificate.

View on HN

OBD-II is legally required (in the US) to be open to consumers. The idea being that you can get diagnostics about your vehicle without being extorted by the dealer. (Originally for environmental data about emissions, but later expanded.)

http://lobby.la.psu.edu/_107th/093_OBD_Service_Info/frameset...

That makes sense, but I can see the argument that not all features need to be open to consumers.

Attackers might work for a dealer or otherwise fully decode the system. The only way to build a system like this securely is to have securely-held keys (cryptographic, not physical; physical locks are all easy to break), and ideally published and reviewed code for the security system, same as any other security system.

(I've actually thought about building a secure ignition system for cars, mainly to solve the car bomb problem -- the car responds outside an explosive radius when interrogated to tell you no one has tampered with it since you've left it. Theft is a financial problem, but bombs (or trackers, or whatever) attached to cars is a more serious problem (for a smaller subset of people). I solved this problem by just leaving my car unlocked with a guy with an AK guarding it, though.)

I solved this problem by just leaving my car unlocked with a guy with an AK guarding it, though.

How resistant is he to femme fatales?

Already had 3 wives, didn't need another.

Amusingly enough most of them aren't - OBD access to interesting features (as opposed to a very limited standard set) usually costs a LOT of money. $10K one-off charge plus an update subscription for example.

OBD-II has essentially failed by allowing so-called "extended" PIDs - which all manufacturers define in their own specific ways. See the Torque forum for endless threads of people wanting extended PIDs for specific models to use with the Torque OBD app.

I suspect this is one reason why good OBD scan tools cost a lot more than the parts cost of an ELM chipset and a few sockets - a trivial adapter costs £20, but a Bavarian Tech scan tool for BMW costs £200, presumably to recoup the costs of buying access to the extended PIDs.

That seems counter to the "we want full access to our systems and hardware" position commonly taken on HN.

It sounds very much like advocating for Apple's Gatekeeper [1] since it will keep unauthorized software from running on OS x.

[1] http://www.apple.com/osx/what-is/security.html

Yes, you're right. And thinking about it, I think projectedoptics's solution is just better all-round anyway - why can you connect to the OBD at all while the alarm is armed?

If you couldn't, what would dealers (or anyone) do when a customer has lost their keys?

But I'd rather not have to pay $200 for a spare key thanks...

I think you mean $200 for the key, plus $50 to cut it, plus $250/hr labor to program it at the dealer (minimum of an hour).

Um, it's a GBP 40K car; I don't care.

OBD-II is used on loads of vehicles. If the regulation didn't mandate that this was an open protocol in 10 years every $500 beater is going to be a write off as soon as you lose the keys.

Well, if that means an end to keyless / smart fob systems, I'm all for it; they are nothing but trouble in my opinion. Right now, I think the OBD port should be read-only unless a registered key is present, and recoding the ECU to accept a new key should require more than just physical access.

People don't expect to be able to recode their front door to accept a new blank key - why should a car be different?

A skilled locksmith or someone with a serious interest in locks will have no problem [1] to open your front door without any damage using a lock pick tool [2]. If there's no need for said lock to survive, a selection of power tools make it even easier.

[edit] Which is not to say that cars should be easy to pry open of course ...

[1] in most cases, high-end specialized locks can be an exception. [2] see http://www.lockpicks.com/ for examples.

That's not the point; I don't expect to be able to walk up to your front door with a random Yale key, jam it in and out a few times and have your lock reconfigured to accept my key instead of yours. That's what's happening here - it's not as sophisticated as a lock pick attack, nor as brute force as smashing the dashboard and shorting the appropriate wires.

It's a blind spot in the system that shouldn't exist if the car was locked. The OBD port simply shouldn't be physically connected if the doors are locked. A relay on the CAN bus pins trigged from the central locking might be a start.

There's no evidence the OBD port was actually used in this attack. The programmer could have been directly connected to an easily accessible CAN connected component such as the wing mirrors.

There has been evidence in the UK that this is how the thieves are doing it (people finding their cars with the drivers window smashed and the OBD cover lying on the floor). See http://www.e90post.com/forums/showthread.php?t=670339 - at least one of the guys posted there is police.

Which gentleman is a police officer?

I appreciate that you like to participate on the internet by speaking out loud and typing what you hear yourself say; once you've done that, you can go back and remove the "um" from the start.

BMW has a proprietary diagnostic system called MODIC with it's own connector near the engine under the hood. That provides more utility to the service tech than the OBD port. Those devices are only available to BMW dealers.

The security loophole here seems to be that someone could extract information out of the OBD port to generate a new key. That should only be available from the factory port.

With cars and fault diagnosis increasingly computerised, car makers were in a position to encrypt or obfuscate diagnostic messages so that you could only view and reset 'check engine' codes at official dealers who had costly diagnostic equipment.

The intention of OBD-II is to keep independent mechanics in business (and hence the car repair market operating properly) by preventing car makers from doing this. Sounds like a good idea to me - dealerships are already overpriced, I can't imagine how bad it would be without independent garages exerting downward pressure on prices.

Whether this should extend as far as an open standard for bypassing the keyless ignition without first presenting a valid key is another matter.

Reply on news.ycombinator.com