Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VW Has Spent Two Years Trying to Hide a Big Security Flaw

bloomberg.com

Post reply on HN
Print view View original

201–210 of 226 posts

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#201

Post by enraged_camel »

fnordfnordfnord wrote: post #183
jacobolus wrote: post #43

Earlier quoted context omitted.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

To a car owner, that's another security flaw of its own. An attacker can deny an owner access to their car with a simple code spammer hidden nearby.

Surely that's better than having your car stolen, right?

Security is about trade-offs, after all.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#202

Post by Havoc »

Honestly I'm not really bothered about the whole "hacking cars" thing. I've spent enough years in dangerous countries that this seems like a non-issue.

I do object to car companies knowing about a safety issue & keeping quiet due to it being "cheaper" to accept a couple of deaths than fix it. That kind of thing should be punished with eye watering fines in my view - not to save those 12 lives but to put the message out there that car companies need to get it right instead of playing the odds.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#203

Post by racecar789 »

vilhelm_s wrote: post #140
jacobolus wrote: post #43

Earlier quoted context omitted.

What I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.

It doesn't: according to the paper, when someone turns the ignition key, they car will generate about 20 challenges to the key fob, and if the fob does not successfully authenticate any of them, the car will give up and not start. The attack works by overhearing the exchange between the car and the key fob, and then doing an somewhat brute-force analysis to calculate what the secret key on the fob must have been.

Could someone explain why there is no delay after each failed attempt? The system allowed 197k brute force attempts in 30 minutes. I just cannot wrap my head around it.

I tried reading the paper (not an expert). In the recommendation section, it does not suggest implementing a delay either. Is it just not physically possible with RFID?

I mean, a 4 digit pin with a 5 second delay would take 14 hours for all combinations (better than the half hour with Megamos)???

I have to be missing something.....It can't be this easy.....

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#204

Post by icelancer »

stcredzero wrote: post #66
blackbeard wrote: post #15

Earlier quoted context omitted.

Wait until Teslas become cheaper. Until then, buy a Lada Niva. No one will want to steal it and it doesn't have anything complicated in it that can be hacked.

1993 Corolla with decayed paint. Utterly, utterly, reliable. Appears undesirable. It will also guarantee that you'll never get laid.

No way. Late-model Toyotas and Hondas get stolen a ton. Spare parts are still useful for tuners and sport compact car ricers.

Get an old American junker.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#205

Post by bigiain »

racecar789 wrote: post #203
vilhelm_s wrote: post #140

Earlier quoted context omitted.

It doesn't: according to the paper, when someone turns the ignition key, they car will generate about 20 challenges to the key fob, and if the fob does not successfully authenticate any of them, the car will give up and not start. The attack works by overhearing the exchange between the car and the key fob, and then doing an somewhat brute-force analysis to calculate what the secret key on the fob must have been.

Could someone explain why there is no delay after each failed attempt? The system allowed 197k brute force attempts in 30 minutes. I just cannot wrap my head around it. I tried reading the paper (not an expert). In the recommendation section, it does not suggest implementing a delay either. Is it just not physically possible with RFID? I mean, a 4 digit pin with a 5 second delay would take 14 hours for all combinatio…

As the previous comment says, there's a requirement to eavesdrop on at least one successful authentication.

My guess is that they're then doing the brute-forcing "offline", not against the vehicle's system. If you know the algorithm and the keysize, and you can see one successful authentication, you could ship the work of workig out which key replicates the authentication you just saw off to AWS or custom hardware (I wonder how readily Bitcoin mining ASICs can be tweaked to attack embedded or IoT authentication?) (Though it seems there's flaws somewhere in the crypto anyway - they somehow broke a 96bit key with under 2^18 attempts...)

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#206

Post by racecar789 »

bigiain wrote: post #205
racecar789 wrote: post #203

Earlier quoted context omitted.

Could someone explain why there is no delay after each failed attempt? The system allowed 197k brute force attempts in 30 minutes. I just cannot wrap my head around it. I tried reading the paper (not an expert). In the recommendation section, it does not suggest implementing a delay either. Is it just not physically possible with RFID? I mean, a 4 digit pin with a 5 second delay would take 14 hours for all combinatio…

As the previous comment says, there's a requirement to eavesdrop on at least one successful authentication. My guess is that they're then doing the brute-forcing "offline", not against the vehicle's system. If you know the algorithm and the keysize, and you can see one successful authentication, you could ship the work of workig out which key replicates the authentication you just saw off to AWS or custom hardware (I…

That helps. Thanks.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#207

Post by JoachimS »

The question I have is what VW did after receiving the injunction? Did they work with their customers for the last two years to fix the vulnerability? Or was the injunction their solution by itself?

If it was the latter case, somebody should really serve them a class action suit. Security by gag is not helping the end customer.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#208

Post by TwoBit »

bigiain wrote: post #205
racecar789 wrote: post #203

Earlier quoted context omitted.

Could someone explain why there is no delay after each failed attempt? The system allowed 197k brute force attempts in 30 minutes. I just cannot wrap my head around it. I tried reading the paper (not an expert). In the recommendation section, it does not suggest implementing a delay either. Is it just not physically possible with RFID? I mean, a 4 digit pin with a 5 second delay would take 14 hours for all combinatio…

As the previous comment says, there's a requirement to eavesdrop on at least one successful authentication. My guess is that they're then doing the brute-forcing "offline", not against the vehicle's system. If you know the algorithm and the keysize, and you can see one successful authentication, you could ship the work of workig out which key replicates the authentication you just saw off to AWS or custom hardware (I…

Clearly, the fact that listening to an exchange helped them proves that the security is fundamentally flawed.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#209

Post by TwoBit »

djrogers wrote: post #115
toyg wrote: post #100

I have a Passat from late 2013 -- it cannot be remotely started but doors are keyless. Twice in the last 16 months, somebody rummaged through it overnight, without breaking anything. We religiously close the car every night, especially after the first occurrence, but still it happened again. After it happened to my next-door neighbor's 2013 Golf as well, I reported it to VW and they never even bothered getting back t…

Your anecdote doesn't share anything in common with the article. One of two things are likely - your car wasn't actually locked this nights, or the theirs used a signal amplifier to make the car think your keys inside the house were next to your car. Neither of those things is VW's fault - if you don't like the wireless automatic door unlocking because the signal can be boosted maliciously, then you should disable it…

It strikes me as VW's fault that amplifier attacks work.

Re: VW Has Spent Two Years Trying to Hide a Big Security Flaw

#210

Post by TwoBit »

toyg wrote: post #100

I have a Passat from late 2013 -- it cannot be remotely started but doors are keyless. Twice in the last 16 months, somebody rummaged through it overnight, without breaking anything. We religiously close the car every night, especially after the first occurrence, but still it happened again. After it happened to my next-door neighbor's 2013 Golf as well, I reported it to VW and they never even bothered getting back t…

Put your keys in a Faraday cage at night.
Post reply on HN