Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VW Has Spent Two Years Trying to Hide a Big Security Flaw

bloomberg.com

Post reply on HN
Print view View original

61–70 of 226 posts

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#61

Post by kllrnohj »

usrusr wrote: post #51

So the immobilizer does not immobilize as much as expected/hoped. While that sure isn't something the manufacturer should be proud of, it is hardly a really critical problem, nowhere close to "stop driving until resolved". Immobilizers may have lowered car theft before, but never fully stopped it. The incentive situation for thieves has shifted a bit, that's all, a gradual change, not a 180 degree bit flip. The bigge…

The title seems to just be the standard clickbait approach to titles.

They got an injuction so that's a pretty public way to go about trying to do a "cover-up".

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#62

Post by stcredzero »

lisper wrote: post #48
jacobolus wrote: post #43

Earlier quoted context omitted.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

That could be exploited to produce a trivial denial-of-service attack.

Which would be of no use at all to car thieves.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#63

Post by UnoriginalGuy »

altharaz wrote: post #21

"There's no quick fix for the problem - the RFID chips in the keys and transponders inside the cars must be replaced, incurring significant labor costs." What a nightmare. Car manufacturers have to design more resilient systems. Based on the difficulty to secure hardware systems after deployment, they will be for sure trying to put more and more features on the software-side. If so, they will also have to think about…

I almost want my next car to have a physical key, but a digital one. Back after mechanical keys but before wireless entry/start, there was a short period where you had to plug the entire keyfob into the dash to start the car... I want that back.

Mechanical keys have the "photograph" problem (i.e. a single photograph can be used to reproduce them). Wireless start has the wireless hacking problem (i.e. if you broadcast, that can be intercepted/manipulated/etc). Digital keys have neither of these, and can utilise real challenge/response protocols since the keyfob can be powered by the car while authenticating.

I will say I don't know if wireless entry will ever be secure. Too many technical problems to overcome, soon we'll be reproducing the military's channel hopping.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#64

Post by knowaveragejoe »

lisper wrote: post #48
jacobolus wrote: post #43

Earlier quoted context omitted.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

That could be exploited to produce a trivial denial-of-service attack.

...and that achieves?

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#65

Post by Roodgorf »

kuschku wrote: post #29
altharaz wrote: post #21

"There's no quick fix for the problem - the RFID chips in the keys and transponders inside the cars must be replaced, incurring significant labor costs." What a nightmare. Car manufacturers have to design more resilient systems. Based on the difficulty to secure hardware systems after deployment, they will be for sure trying to put more and more features on the software-side. If so, they will also have to think about…

Well, the advantage of VW is that the car itself is pretty secure. All messages on the CANBUS are securely signed, there are multiple rings of security where data can always pass only in one direction, etc. The only thing this exploit enables is that if you already have the car, managed to break the steering wheel lock, managed to replicate the magnetic signature of the key, and managed to start the motor, that you c…

Wait, so VW has an RFID immobilizer and a physical key? I've only ever seen cars having one or the other.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#66

Post by stcredzero »

blackbeard wrote: post #15
wlesieutre wrote: post #6

Earlier quoted context omitted.

Tesla's at least on top of their software updates, and I believe they designed some more sensible separation of systems than most cars. For affordable options, I have no idea.

Wait until Teslas become cheaper. Until then, buy a Lada Niva. No one will want to steal it and it doesn't have anything complicated in it that can be hacked.

1993 Corolla with decayed paint. Utterly, utterly, reliable. Appears undesirable. It will also guarantee that you'll never get laid.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#68

Post by blackbeard »

stcredzero wrote: post #66
blackbeard wrote: post #15

Earlier quoted context omitted.

Wait until Teslas become cheaper. Until then, buy a Lada Niva. No one will want to steal it and it doesn't have anything complicated in it that can be hacked.

1993 Corolla with decayed paint. Utterly, utterly, reliable. Appears undesirable. It will also guarantee that you'll never get laid.

Good cars. Too wet here in the UK for something to last that long. My 2006 Fiat is on its way out already...

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#69

Post by scott_karana »

kllrnohj wrote: post #61
usrusr wrote: post #51

So the immobilizer does not immobilize as much as expected/hoped. While that sure isn't something the manufacturer should be proud of, it is hardly a really critical problem, nowhere close to "stop driving until resolved". Immobilizers may have lowered car theft before, but never fully stopped it. The incentive situation for thieves has shifted a bit, that's all, a gradual change, not a 180 degree bit flip. The bigge…

The title seems to just be the standard clickbait approach to titles. They got an injuction so that's a pretty public way to go about trying to do a "cover-up".

They've had the injunction for two years, but haven't initiated a recall in the meantime!

"Cover up" sounds accurate to me.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#70

Post by robmcm »

jacobolus wrote: post #43
mkj wrote: post #23

Earlier quoted context omitted.

96 bits by itself probably isn't within reach of brute forcing - I assume the algorithm itself had flaws.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

I assume the software/hardware is so simple and specific that adding something like back off blocking would require memory chips, software, timers etc increasing the complexity dramatically.
Post reply on HN