Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VW Has Spent Two Years Trying to Hide a Big Security Flaw

bloomberg.com

Post reply on HN
Print view View original

81–90 of 226 posts

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#81

Post by kllrnohj »

scott_karana wrote: post #69
kllrnohj wrote: post #61

Earlier quoted context omitted.

The title seems to just be the standard clickbait approach to titles. They got an injuction so that's a pretty public way to go about trying to do a "cover-up".

They've had the injunction for two years, but haven't initiated a recall in the meantime! "Cover up" sounds accurate to me.

A recall for what? There's no safety issue here. There's no functional loss.

Unless they advertised the car as being unstealable or anything close there's not even a marketing point that's not working as one could reasonably expect. Carmakers call this a theft-deterrant feature, they don't even call it anti-theft or similar.

The immobilizer is not as secure as one would hope, but nobody ever promised you anything here in the first place.

What keeps your car from being stolen is not the immobilizer. The government and laws are what keep your car from being stolen.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#82

Post by kuschku »

Roodgorf wrote: post #65
kuschku wrote: post #29

Earlier quoted context omitted.

Well, the advantage of VW is that the car itself is pretty secure. All messages on the CANBUS are securely signed, there are multiple rings of security where data can always pass only in one direction, etc. The only thing this exploit enables is that if you already have the car, managed to break the steering wheel lock, managed to replicate the magnetic signature of the key, and managed to start the motor, that you c…

Wait, so VW has an RFID immobilizer and a physical key? I've only ever seen cars having one or the other.

At least in Germany, yes. Usually the key is also secured with multiple other techniques and has a 3-dimensional unique pattern, plus additionally magnetic safety features.

And the fact that the car has a steering wheel lock (the steering wheel is locked in the right-most position) is also standard.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#83

Post by Encosia »

josu wrote: post #74
ajross wrote: post #35

Earlier quoted context omitted.

Right, the money quote in the article is: > The research team first took its findings to the manufacturer of the affected chip in February 2012 and then to Volkswagen in May 2013. The car-maker filed a lawsuit to block the publication of the paper - arguing that its vehicles would be placed at risk of theft - and was awarded an injunction in the U.K.'s High Court. But then they don't detail the legal situation that l…

People are usually bad understanding counter intuitive notions such as the fact that making security flaws public actually makes consumers more secure, not less.

I doubt you'd say that if you owned one of the affected VWs.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#84

Post by walshemj »

ceejayoz wrote: post #33
mikeash wrote: post #28

Earlier quoted context omitted.

Theft of newer-model cars is extremely rare and I don't think vulnerabilities will change that much. Anything that requires computers at all is going to be beyond the average car thief. If you're worried about safety, buy a car with a good crash safety rating. You're far more likely to get into a normal crash due to bad human drivers or mechanical failures than you are to be hacked. If you're worried about the financ…

> Anything that requires computers at all is going to be beyond the average car thief. Not for long.

really there has been an epidemic of thefts of range rovers in London - car theft gangs are not some kid with a screwdriver any more.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#86

Post by jessaustin »

lisper wrote: post #80
jacobolus wrote: post #60

Earlier quoted context omitted.

Wouldn’t you need to have a device actively running within a few feet of the vehicle to run such an attack? Couldn’t the car start blaring an alarm or something in that case? We’re not talking about a website here.

> Wouldn’t you need to have a device actively running within a few feet of the vehicle to run such an attack? Nope. Just a high-gain antenna. > Couldn’t the car start blaring an alarm or something in that case? It could. But that might not help. For example: you're driving your Mazerati down the road when it suddenly stops and the alarm goes off. The next day you get a letter saying, "If you don't want yesterday's li…

If the car responds to RFID keys at all when driving, that is a flaw.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#87

Post by kuschku »

emidln wrote: post #77
kuschku wrote: post #29

Earlier quoted context omitted.

Well, the advantage of VW is that the car itself is pretty secure. All messages on the CANBUS are securely signed, there are multiple rings of security where data can always pass only in one direction, etc. The only thing this exploit enables is that if you already have the car, managed to break the steering wheel lock, managed to replicate the magnetic signature of the key, and managed to start the motor, that you c…

Is this a specific feature of VW's implementation of CAN? CAN in general (at least not in 2007 when I last worked in the industry) is not secured. The only real security once you had access to the CAN bus were the separate rings (although several modules bridged). You probably couldn't start the car and keep it started unless you figured out the variant of crypto handshake used between whatever did ignition/skim/rke…

Almost all German manufacturers use these variations of CAN.

Bosch recently published how their variants are used to prevent stuff like break-in through the radio.

The system is safe against replay attack (by prepending a timing signal to the encrypted message), has seperate rings of trust (so your gas pedal can control acceleration, but your radio can’t), and is in general quite safe.

And, well, with a physical kit you might be able to start the kit, but the steering wheel lock can not be unlocked without a physical key. And even if you break through that, you need to stop the immobilizer.

So you end up breaking open the door, breaking with large tools a part of the steering wheel lock, (hoping the car does not have an anti-intervention system, usually a cat jumping onto the car already starts a loud alarm), then you have to actually start the car and run this 30-min brute force attack against the immobilizer, after having sniffed the owner before.

It’s theoretically possible, but it's not really a practical attack.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#89

Post by kllrnohj »

josu wrote: post #74
ajross wrote: post #35

Earlier quoted context omitted.

Right, the money quote in the article is: > The research team first took its findings to the manufacturer of the affected chip in February 2012 and then to Volkswagen in May 2013. The car-maker filed a lawsuit to block the publication of the paper - arguing that its vehicles would be placed at risk of theft - and was awarded an injunction in the U.K.'s High Court. But then they don't detail the legal situation that l…

People are usually bad understanding counter intuitive notions such as the fact that making security flaws public actually makes consumers more secure, not less.

Detailing how this works publicly makes nobody more secure.

Public release of the general problem is still worthwhile as information, but there is a net "security" loss here.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#90

Post by Roodgorf »

kuschku wrote: post #82
Roodgorf wrote: post #65

Earlier quoted context omitted.

Wait, so VW has an RFID immobilizer and a physical key? I've only ever seen cars having one or the other.

At least in Germany, yes. Usually the key is also secured with multiple other techniques and has a 3-dimensional unique pattern, plus additionally magnetic safety features. And the fact that the car has a steering wheel lock (the steering wheel is locked in the right-most position) is also standard.

Interesting, that seems like a pretty reasonable way to do it. Another case of convenience taking precedence over security, I guess.
Post reply on HN