Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Dutch first: Ingenious BMW theft attempt

mrooding.me

Post reply on HN
Print view View original

111–120 of 325 posts

Re: A Dutch first: Ingenious BMW theft attempt

#111

Post by justwalt »

rosege wrote: post #96
rconti wrote: post #28

Earlier quoted context omitted.

Because the police arrived 5 minutes after they disabled the SOS button. The next night, there would be no SOS notification when they broke the window again. Or maybe they'd only have to tear away a plastic bag, if the owner hadn't gotten the window replaced. Or maybe they were hoping to find a valet key in the car, making their job even easier, either that night, or the next night.

I don't know why he didn't talk to the police and tell them what he suspects and see if they would set up an ambush for the car thieves that night. Put the car back in place and wait for them to show up

The thieves didn’t have to come back the first night. Could have done it weeks later.

Re: A Dutch first: Ingenious BMW theft attempt

#112

Post by Rjevski »

samstave wrote: post #38
spockz wrote: post #18

BMW burglars appear to be very skilled. The entire board computer was taking from a friend’s car and the screws and cables etc were all tidily set aside as if it was a professional replacement. And this within an hour, on the front porch..

Makes me wonder how many of the thieves of modern cars are professionally trained service people from the respective car companies who are paid off to get the vehicle into a state where it can be cleanly taken away. You are basically just paid to bypass security.

The difference is that in IT, whether you are a professional or not, the systems you’re working on will still ask you for authentication.

In cars, it’s security by obscurity. If you know the protocol to talk to the car’s computers via the OBD port, you are pretty much root without even providing any credentials.

Re: A Dutch first: Ingenious BMW theft attempt

#113

Post by Rjevski »

kccqzy wrote: post #107
Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

Have you taken a look at a Tesla car yet? From PR materials I'm led to believe that they treat their car software seriously. I doubt one can install untrusted firmware on a Tesla car; is that so?

I’ve never worked on a Tesla. I’ve left the trade long ago finding my way in software engineering instead.

Tesla is probably the only one I’d trust though. While I don’t expect them to be bulletproof either (at least not at first), I expect them to quickly catch on should this kind of theft appear, and make the necessary fixes. In any case I doubt they’d be stupid enough to accept arbitrary code over a diagnostics port (if they have one even). I mean, even if we forget security, why would they? Teslas update remotely via the Internet.

Re: A Dutch first: Ingenious BMW theft attempt

#114

Post by leot »

Rjevski wrote: post #104
matthewdgreen wrote: post #63

Earlier quoted context omitted.

It's coming in the next generation of keyless systems: https://www.3db-access.com/

I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.

Why not relay that, too?

Re: A Dutch first: Ingenious BMW theft attempt

#115

Post by Rjevski »

j88439h84 wrote: post #110
Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

Seems like that's all you can ask for if the attacker has physical access to the machine. Would be happy to be corrected though.

Not sure I agree.

It’s one thing if you get physical access, replace the engine control module by a crooked one that will send the proper signals to the ignition and all the other actuators and start the car.

It’s another thing if you talk to the real engine control module (which should already be on alert because the car was broken into) and tell it “trust me, I’m legit, here’s your new firmware” and the computer just runs your code no questions asked.

Re: A Dutch first: Ingenious BMW theft attempt

#116

Post by Rjevski »

leot wrote: post #114
Rjevski wrote: post #104

Earlier quoted context omitted.

I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.

Why not relay that, too?

Relaying would still require the owner to push a button on the keyfob, right?

Re: A Dutch first: Ingenious BMW theft attempt

#117

Post by [deleted] »

avar wrote: post #27

Reading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands? Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Meanwhile, wherever this guy lives they're sending officers because some BMW call cent…

[deleted]

Re: A Dutch first: Ingenious BMW theft attempt

#118

Post by bri3d »

Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own them all.

This wouldn't be that hard for car manufacturers to defeat if they really cared. It's the exact same trusted-boot problem as any mobile phone faces, except (so far) with much more limited attack resources. It's devilishly hard to get perfect (as every iPhone jailbreak proves) but it's easy to get started.

Re: A Dutch first: Ingenious BMW theft attempt

#119

Post by giobox »

Rjevski wrote: post #104
matthewdgreen wrote: post #63

Earlier quoted context omitted.

It's coming in the next generation of keyless systems: https://www.3db-access.com/

I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.

The entire point, rightly or wrongly, of keyless entry is that you never have to touch the key, simply have it somewhere in the vicinity of the car, such as in your pocket. No button pressing or user input. You approach the car and it is already magically unlocked and ready to be started, usually via a starter button on the dash.

Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.

Re: A Dutch first: Ingenious BMW theft attempt

#120

Post by yc-kraln »

gambiting wrote: post #58
jasoncartwright wrote: post #39

Earlier quoted context omitted.

Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.

If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.

I have built an access control system that does a similar thing. Long story short: Time Of Flight is patented and no one can use it. Our system used a nice workaround... We tried to convince car manufacturers to use or license our tech and they seemed happy with their current stuff.
Post reply on HN