A Dutch first: Ingenious BMW theft attempt

Post by dmichulke » Fri, Aug 10, 2018, 5:05 AM UTC

bri3d wrote: post #162

Rjevski wrote: post #126

Earlier quoted context omitted.

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change. This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new fir…

Yes, like I alluded to it's trivial drawing from any other trusted boot chain implementation. The even better and less user-intensive way to do it would be with asymmetric encryption - the ECU only trusts flashes signed with the vendor public key and to make things even more secure, you could encrypt each flash file server side with a keypair derived each boot on the ECU and sent over the Internet (many manufacturers…

Post by jinzo » Fri, Aug 10, 2018, 5:19 AM UTC

disiplus wrote: post #192

bri3d wrote: post #162

Earlier quoted context omitted.

Yes, like I alluded to it's trivial drawing from any other trusted boot chain implementation. The even better and less user-intensive way to do it would be with asymmetric encryption - the ECU only trusts flashes signed with the vendor public key and to make things even more secure, you could encrypt each flash file server side with a keypair derived each boot on the ECU and sent over the Internet (many manufacturers…

they also dont like tuners because cars engines are often made the same for multiple "trims" so the car with 110 and 160 hp have the same engine but different "map" in the ecu. and only with ecu reflash you can get more power that would cost you x amount of money. imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that. and…

Post by rootw0rm » Fri, Aug 10, 2018, 5:26 AM UTC

rconti wrote: post #62

avar wrote: post #27

Reading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands? Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Meanwhile, wherever this guy lives they're sending officers because some BMW call cent…

As an American, I'm glad I'm not the only one :) That said, I thought that car theft was all but gone in the US, at least for modern cars, whereas in Europe it still seems common. (Eg, if you follow international forums for newer car models, nobody in the US talks about theft anymore, but our European counterparts talk about these highly complex theft schemes). But then someone was posting about theft in Sacramento,…

Post by bjelkeman-again » Fri, Aug 10, 2018, 5:39 AM UTC

todd8 wrote: post #188

StudentStuff wrote: post #170

Earlier quoted context omitted.

Teslas have been stolen in Europe, their high value for parts makes them well worth stealing. This is primarily Tesla's fault, as they refuse to sell parts to cars that have been in accidents. Your Tesla is essentially scrap after a non-minor accident, which is why most US insurers refuse to cover vehicles made by Tesla. Its as bad as rolling coal IMO, Tesla has created a massive eWaste problem. Meanwhile, rebuilding…

Relay attacks like those mentioned that Teslas are vulnerable to can also affect most other keyless entry cars. On new Mercedes one can turn off the keyless entry system by double klicking the lock button on the key when locking the car. The car key then will have to have its unlock button physically pushed to unlock the car, and in that state relay attacks won’t work.

Post by gambiting » Fri, Aug 10, 2018, 5:45 AM UTC

dzhiurgis wrote: post #128

gambiting wrote: post #58

Earlier quoted context omitted.

If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.

Is that how contactless payment cards are protected?