Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VW Has Spent Two Years Trying to Hide a Big Security Flaw

bloomberg.com

Post reply on HN
Print view View original

51–60 of 226 posts

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#51

Post by usrusr »

So the immobilizer does not immobilize as much as expected/hoped. While that sure isn't something the manufacturer should be proud of, it is hardly a really critical problem, nowhere close to "stop driving until resolved". Immobilizers may have lowered car theft before, but never fully stopped it. The incentive situation for thieves has shifted a bit, that's all, a gradual change, not a 180 degree bit flip.

The bigger mistake than sourcing imperfect components is the attempted cover-up and I am positively surprised that this is even reflected in the headline. (at least theoretically: the first glance takeaway message for this story will always be "security hole in car!", no matter how much the author tries to put the cover-up in focus)

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#52

Post by porsupah »

[deleted] wrote: post #11

[deleted]

The Thai finance minister, apparently:

http://www.smh.com.au/articles/2003/05/13/1052591776195.html

"Suchart said he was on his way to give a speech to central bank officials from 17 countries when his ministry-assigned BMW car stalled on a road, not far from his house.

The engine stopped, the air conditioning shut down, the doors got locked and the windows wouldn't roll down, he said, adding that he was trapped for about 10 minutes.

"We couldn't breath because there was no air," he said.

Suchart and his driver waved at passers-by to draw attention to their plight, but it took a while to make them understand that they wanted the windows smashed.

Finally, a guard of a nearby building came to their rescue with a sledgehammer and broke a window. Suchart then climbed out of the car through the hole."

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#53

Post by coldpie »

ibejoeb wrote: post #49

If I read this correctly, the vulnerable vehicles are not really left in a worse state because of this defect. If they did not have cryptographic electronic start, they'd simply be vulnerable to old-fashioned hotwiring. I could be wrong, as I haven't been in a recent model, but I assume there is still a physical steering column lock that needs to be disabled, no?

No. The whole point of keyless entry is that you don't need to physically handle a key to enter and start the car. Its presence in your pocket is sufficient to enable the Start button to work. Or, as this article demonstrates, the car's belief that the key is in your pocket is sufficient.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#54

Post by paulmd »

mkj wrote: post #23
binarymax wrote: post #20

Earlier quoted context omitted.

Not only that - but the 'duh' moment for me was the 96bit key size.

96 bits by itself probably isn't within reach of brute forcing - I assume the algorithm itself had flaws.

According to TFA, they "overheard 2 communications between the keyfob and the transponder", which reduced the number of possible keys to 196,607. This was brute-forceable in half an hour. So the answer is both - the algorithm was flawed enough to reduce the strength, but they were brute forcing it the rest of the way.

2 communications isn't much at all. Getting something from your car and locking it back up is all it takes.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#55

Post by greg5green »

circa wrote: post #42

Happy to see the GTI not listed on there but why would that be any different from the other models? You think they would use the same across the board.

I'm pretty sure they sell them as the Golf GTI in Europe where the research was done, so probably included under the Golf model.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#56

Post by bri3d »

Miner49er wrote: post #50
nulluk wrote: post #9

Earlier quoted context omitted.

As far as my limited understanding goes using the the key fob for remote central locking does not expose any risk, instead its the immobiliser part, so manually opening your door with the physical key provides no extra safety, its when the key is present near the ignition barrel, thats where the immobiliser kicks in and where this venerability exists

From what I understand, they have to capture two uses of the key fob to be able to brute force, so if you don't use it then they can't capture anything. Or they just captured two uses from a random car and now it'll work on any car. I wish the article went into more detail.

The paper is right here: https://www.usenix.org/sites/default/files/sec15_supplement....

They captured 2 uses of the RFID-based immobilizer. That gets used every time you start the car, regardless of how you unlocked the car. It's completely separate from the UHF-based keyless entry system which you use to unlock the car.

The paper makes this distinction in the first paragraph, but of course the article fails to distinguish.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#57

Post by gambiting »

bri3d wrote: post #47
binarymax wrote: post #17

Earlier quoted context omitted.

You could always use a club: http://www.amazon.com/Club-1000-Original-Steering-Wheel/dp/B... But anyone waiting to spend 30 minutes with an electronic crack is also smart enough to use liquid nitrogen to crack this too. The difference is that a keyless hack can look natural since there is no physical force for entry or ignition. A funnel and chisel would raise some eyebrows.

This attack is against the RFID immobilizer for the engine, which means an attacker would have to break into the car, break the steering wheel lock and break the physical ignition lock prior to starting the car. The full paper here: https://www.usenix.org/sites/default/files/sec15_supplement.... has a lot better detail.

No, it's also an attack on the actual wireless key which is used to open and start the car. It's just making the car "think" that the key is inside, so you just press the Start button and the car starts, after which you drive it away like normal.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#58

Post by bri3d »

gambiting wrote: post #57
bri3d wrote: post #47

Earlier quoted context omitted.

This attack is against the RFID immobilizer for the engine, which means an attacker would have to break into the car, break the steering wheel lock and break the physical ignition lock prior to starting the car. The full paper here: https://www.usenix.org/sites/default/files/sec15_supplement.... has a lot better detail.

No, it's also an attack on the actual wireless key which is used to open and start the car. It's just making the car "think" that the key is inside, so you just press the Start button and the car starts, after which you drive it away like normal.

Fair, but only on cars which have only passive security (that is - where you don't need to use the fob to unlock the car and you don't need to use a physical key to turn the ignition).

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#59

Post by ibejoeb »

coldpie wrote: post #53
ibejoeb wrote: post #49

If I read this correctly, the vulnerable vehicles are not really left in a worse state because of this defect. If they did not have cryptographic electronic start, they'd simply be vulnerable to old-fashioned hotwiring. I could be wrong, as I haven't been in a recent model, but I assume there is still a physical steering column lock that needs to be disabled, no?

No. The whole point of keyless entry is that you don't need to physically handle a key to enter and start the car. Its presence in your pocket is sufficient to enable the Start button to work. Or, as this article demonstrates, the car's belief that the key is in your pocket is sufficient.

Oh, right, I do remember now. I had a CC for a bit. I was always leaving the fob in the cupholder.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#60

Post by jacobolus »

lisper wrote: post #48
jacobolus wrote: post #43

Earlier quoted context omitted.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

That could be exploited to produce a trivial denial-of-service attack.

Wouldn’t you need to have a device actively running within a few feet of the vehicle to run such an attack? Couldn’t the car start blaring an alarm or something in that case?

We’re not talking about a website here.

Post reply on HN