Hacker News Reader

Comment by jrabone | Hacker News Reader

Well, if that means an end to keyless / smart fob systems, I'm all for it; they are nothing but trouble in my opinion. Right now, I think the OBD port should be read-only unless a registered key is present, and recoding the ECU to accept a new key should require more than just physical access.

People don't expect to be able to recode their front door to accept a new blank key - why should a car be different?

View on HN

A skilled locksmith or someone with a serious interest in locks will have no problem [1] to open your front door without any damage using a lock pick tool [2]. If there's no need for said lock to survive, a selection of power tools make it even easier.

[edit] Which is not to say that cars should be easy to pry open of course ...

[1] in most cases, high-end specialized locks can be an exception. [2] see http://www.lockpicks.com/ for examples.

That's not the point; I don't expect to be able to walk up to your front door with a random Yale key, jam it in and out a few times and have your lock reconfigured to accept my key instead of yours. That's what's happening here - it's not as sophisticated as a lock pick attack, nor as brute force as smashing the dashboard and shorting the appropriate wires.

It's a blind spot in the system that shouldn't exist if the car was locked. The OBD port simply shouldn't be physically connected if the doors are locked. A relay on the CAN bus pins trigged from the central locking might be a start.

There's no evidence the OBD port was actually used in this attack. The programmer could have been directly connected to an easily accessible CAN connected component such as the wing mirrors.

There has been evidence in the UK that this is how the thieves are doing it (people finding their cars with the drivers window smashed and the OBD cover lying on the floor). See http://www.e90post.com/forums/showthread.php?t=670339 - at least one of the guys posted there is police.

Which gentleman is a police officer?

Reply on news.ycombinator.com