A Dutch first: Ingenious BMW theft attempt • Hacker News Board

Re: A Dutch first: Ingenious BMW theft attempt

#181

Post by neuralRiot » Fri, Aug 10, 2018, 3:36 AM UTC

Rjevski wrote: post #126

bri3d wrote: post #118

Earlier quoted context omitted.

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own…

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change. This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new fir…

So down the line after few years and changing owners you're unable to install any firmware or to install used ECUs, most of the manufacturers are now online-only for diagnostic and flashing of course charging some premium, that destroys independend shops as you need to pay a subscription for every manufacturer, and cars and its parts still get stolen, "high tech thieves" belong to the movies, real ones load your car on a tow and it goes straight to another country.

Re: A Dutch first: Ingenious BMW theft attempt

#182

Post by bawana » Fri, Aug 10, 2018, 3:58 AM UTC

Rjevski wrote: post #126

bri3d wrote: post #118

Earlier quoted context omitted.

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own…

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change. This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new fir…

Why go after tuners? Well, if you are a giant automobile firm that has been lying about their mileage and emissions and covering it up with software that detunes the car just to pass testing- well, then you don't want people figuring out your algos for covering up lying.

Re: A Dutch first: Ingenious BMW theft attempt

#183

Post by bawana » Fri, Aug 10, 2018, 4:01 AM UTC

hellofunk wrote: post #53

avar wrote: post #27

Reading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands? Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Meanwhile, wherever this guy lives they're sending officers because some BMW call cent…

> Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Amsterdam currently has a big police shortage, that's why. It's not normal, it's just a problem in Amsterdam. https://www.dutchnews.nl/news/2018/07/amsterdam-is-not-lawle...

not just Amsterdam. I had a car accident on Route 128 in Massachusetts during rush hour. I called the state police - they asked if anyone was hurt and when I told them no they said 'just exchange information with the other driver'. The opportunity here is for fraud prevention. Maybe that's what will eventually drive our desire for ubiquitous surveillance.

Re: A Dutch first: Ingenious BMW theft attempt

#184

Post by danieltrembath » Fri, Aug 10, 2018, 4:07 AM UTC

I wonder if they were in fact intending to steal the airbag, but were disturbed in the process. Airbag theft is fairly common and lucrative. You can extract the A-Pillar bag through the window without opening the door. In cars without the radar/pressure sensors you have some chance of doing that without setting off the alarm.

Re: A Dutch first: Ingenious BMW theft attempt

#185

Post by db48x » Fri, Aug 10, 2018, 4:16 AM UTC

williamscales wrote: post #161

yc-kraln wrote: post #120

Earlier quoted context omitted.

I have built an access control system that does a similar thing. Long story short: Time Of Flight is patented and no one can use it. Our system used a nice workaround... We tried to convince car manufacturers to use or license our tech and they seemed happy with their current stuff.

How can one patent something so obvious as measuring how far away something is based on how long the signal takes to bounce back? That principle underlies...so many things. Edit: I looked up the patent. Here it is: https://patents.google.com/patent/US8930045 . I understand that patents protect novel inventions and that under some standard this may be considered "novel". On the other hand, I myself have frequently use…

You just have to convince the patent examiner that it's not obvious. There's bound to be prior art (radar), so it could probably be invalidated if you want to spend the money on it, and you don't have some alternative ready to hand.

Re: A Dutch first: Ingenious BMW theft attempt

#186

Post by fjsolwmv » Fri, Aug 10, 2018, 4:36 AM UTC

bawana wrote: post #183

hellofunk wrote: post #53

Earlier quoted context omitted.

> Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Amsterdam currently has a big police shortage, that's why. It's not normal, it's just a problem in Amsterdam. https://www.dutchnews.nl/news/2018/07/amsterdam-is-not-lawle...

not just Amsterdam. I had a car accident on Route 128 in Massachusetts during rush hour. I called the state police - they asked if anyone was hurt and when I told them no they said 'just exchange information with the other driver'. The opportunity here is for fraud prevention. Maybe that's what will eventually drive our desire for ubiquitous surveillance.

Why would you need police for an accident? Your insurance companies negotiate liability based on your statements. It's a civil matter, unless want to request criminal charges for reckless driving?

Re: A Dutch first: Ingenious BMW theft attempt

#187

Post by fjsolwmv » Fri, Aug 10, 2018, 4:39 AM UTC

Dayshine wrote: post #121

avar wrote: post #95

Earlier quoted context omitted.

So all I need to do to get Amsterdam police to care about bicycle theft is to install some sort of ribbon that'll get torn off if the lock gets broken, which'll be indistinguishable from the frame getting broken in half ("an accident"). Hook that all up to a GSM modem and a call center and suddenly my local cops will care about crime.

Also known as crying wolf. Don't you have insurance for theft? Kind mandatory in Amsterdam.

Pushing the problem to insure is blaming the victims, making the pay for crime.

Re: A Dutch first: Ingenious BMW theft attempt

#188

Post by todd8 » Fri, Aug 10, 2018, 4:44 AM UTC

StudentStuff wrote: post #170

Rjevski wrote: post #113

Earlier quoted context omitted.

I’ve never worked on a Tesla. I’ve left the trade long ago finding my way in software engineering instead. Tesla is probably the only one I’d trust though. While I don’t expect them to be bulletproof either (at least not at first), I expect them to quickly catch on should this kind of theft appear, and make the necessary fixes. In any case I doubt they’d be stupid enough to accept arbitrary code over a diagnostics po…

Teslas have been stolen in Europe, their high value for parts makes them well worth stealing. This is primarily Tesla's fault, as they refuse to sell parts to cars that have been in accidents. Your Tesla is essentially scrap after a non-minor accident, which is why most US insurers refuse to cover vehicles made by Tesla. Its as bad as rolling coal IMO, Tesla has created a massive eWaste problem. Meanwhile, rebuilding…

Relay attacks like those mentioned that Teslas are vulnerable to can also affect most other keyless entry cars. On new Mercedes one can turn off the keyless entry system by double klicking the lock button on the key when locking the car. The car key then will have to have its unlock button physically pushed to unlock the car, and in that state relay attacks won’t work.

Re: A Dutch first: Ingenious BMW theft attempt

#189

Post by fjsolwmv » Fri, Aug 10, 2018, 4:45 AM UTC

rachelbythebay wrote: post #167

williamscales wrote: post #161

Earlier quoted context omitted.

How can one patent something so obvious as measuring how far away something is based on how long the signal takes to bounce back? That principle underlies...so many things. Edit: I looked up the patent. Here it is: https://patents.google.com/patent/US8930045 . I understand that patents protect novel inventions and that under some standard this may be considered "novel". On the other hand, I myself have frequently use…

Hmmm. 2013? I beat them by a year. http://rachelbythebay.com/w/2012/02/07/ping/

A few years before 2002:

https://www.ibiblio.org/harris/500milemail.html

Re: A Dutch first: Ingenious BMW theft attempt

#190

Post by zormino » Fri, Aug 10, 2018, 4:46 AM UTC

bri3d wrote: post #118

Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own…

There is actually a big security push in automotive that's sort of been slowly coming to the fore over the last few years. It's not the OEMs that are driving it really either, they are to some degree, but it's the suppliers starting to make security hardware and system protection available, as it really hasn't been for very long. It's still not really entirely there. Basic things like the microcontrollers and CAN hardware / protocol never had security designed in. No one was willing to invest significant engineering time or do expensive security in software when hardware cost is king, or even invest in the engineering cost of bringing in security from suppliers (seriously, there's like 20+ independent computers in your car and it's going to be 50+ on average soon if it isn't already and out of those you'd probably have to harden 10 or so, or introduce entire new ECUs) There's a number of solutions but none of them are cheap. As hardware support becomes widely available, development time for higher tier suppliers drops and they can economically offer secure solutions, and with scares like the Jeep remote control hack in 2015 and with cars getting more connected, OEMs are starting to see the business case for security.