91–100 of 144 posts
Earlier quoted context omitted.
Interesting. So do you have to put your fob in a bowl so it won't be moving to prevent it from being relay attacked, or some such?
Yes but I would assume that coming home and putting all your keys somewhere to lay down is a routine for most people.
Earlier quoted context omitted.
It doesn't work that way. iPhones NFC chips are still powered even if the phone battery dies. That's how transit cards work even when the battery is dead. https://bgr.com/2018/09/18/iphone-xs-vs-iphone-xr-nfc-chip-w...
That's better than nothing, but that doesn't describe "NFC works with dead phone", that describes "phone reserves up to five hours of emergency battery power for only NFC use". When my current car fob starts displaying a low battery warning I have at minimum weeks to replace the battery. (Not to mention my current car fob is resistant to being dropped, stepped on, etc.)
Earlier quoted context omitted.
[ Edited to insert: 1056 sort-of covers this, that's what I get for not having seen his latest video ] The lesson in 1052 sort of misses the point. LPL (his videos are a lot of fun by the way and I recommend them to anyone who is curious about lock picking) says: > So, if you are installing an access control system like this it is really important to use one that only transmits encrypted data This would defeat the ES…
> What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. Why do you need the keyfob to rely on a "surge of power"? Can't you put a battery in it and charge that battery when driving? If the battery runs down, you needed a backup anyway (physi…
dang, can we get a ruling? These headlines might not violate the letter of the "If the title begins with a number or number + gratuitous adjective" guideline, but they do violate the spirit. "Hackers Can Clone Toyota, Hyundai, and Kia Keys" gets the same point across without the sensationalism. I'm bringing it up because I've seen many of these "millions of [thing that exists in the millions]" headlines recently, and…
I'm not seeing the problem. Your suggested title makes it sound like they could clone all the keys from those manufacturers which isn't true. And if you inserted a word like "some", my first question would be, "Well, how many?" To me "millions" is useful in conveying it isn't just a niche issue, but it isn't everything, either.
It's not a terrible headline, but it could also be improved.
Earlier quoted context omitted.
I am sure yes. Mind you, this was Immobilizer feature, sold by Siemens Automotive to auto-makers. As to what in rest of their car Ford itself was using I have no idea, since I was not working for them at the time. Here is an analogy - Microsoft is Siemens and Ford is IBM. Microsoft sold DOS to IBM to equip their PC's. As for what IBM implemented/used for BIOS, was not Microsoft's job, get it?
An immobilizer simply keeps the ecu from running the fuel pump, thus preventing the car from starting. The challenge-response from the key is used to authenticate the ecu. It’s not so much that it’s bad encryption (it is) it’s just that the access to override such encryption has physical controls (e.g. if one breaks the glass then one typically has complete access to the vehicle). Second the cpu of the time where may…
Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one of them which is Immobilizer. Even with correct key fob and authenticated, if your door is opened it will not let you drive. Of course, all these varies from car maker to car maker. Some will let you start it but you can't drive for more then 3 meters, others won't even let you idle the engine. You have a crapload of sensors that are part of BCM (tire-guard, wipers, door ajar, belt, etc etc) all of which are taken in consideration to yield that "yes"/"no" response.
And that's just a small part of what BCM does. Also poor ECU, an entire computer on its own right, reducing him to running the fuel pump is like saying a house is to shelter you from bad weather.
Saying immobilizer simply keeps the ECU from running the fuel pump is like saying that all you need to create Witcher 3 game is Visual Studio.
As per article, you can see for yourself this is not really true. My code that I've worked in those years (2005/2006) were to be deployed in 2007 Mazda RX-2 and 2008 Ford, so in regards to last gen (cca. 2010) I bet you're simply wrong again. I do hope latest gen has better encryption but I doubt, wanna know why? Because economics. Lemme tell you first hand experience. Managers care about economics and that means cheaper parts. Cheaper parts means less memory, less speed. The goal was always to have the BCM's CPU load between 70% and 90%. Did a smart code and you reduced the load bellow 70%? The higher-ups were jumping happily in the air because it meant a big fat bonus for them due to allowing them to stick a crappier chip on that PCB. That's what they care about, not strong encryption and elimination of theft. Also read about Ford/GM practices in 60's when they preferred to allocate about 200 millions USD/year for paying victims of accidents than have belts. Until they got regulated by law, they could not care less about lives.
Earlier quoted context omitted.
> Leaving fobs in the car more often OTOH, it's much harder to leave a key in the car when you never have to take it out of your pocket in the first place.
Now i find the opposite situation happening and more difficult/ expensive to solve, that is leaving the keys outside the car and driving away without them.
If you have, I’d ask you to name it explicitly because I have yet to drive one (out of 10+ be driven) that does not visually and audibly scream at you that the key is not in the vehicle. That’s if it will even let you shift out of park (in a non-manual).
The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.
Earlier quoted context omitted.
An immobilizer simply keeps the ecu from running the fuel pump, thus preventing the car from starting. The challenge-response from the key is used to authenticate the ecu. It’s not so much that it’s bad encryption (it is) it’s just that the access to override such encryption has physical controls (e.g. if one breaks the glass then one typically has complete access to the vehicle). Second the cpu of the time where may…
. Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one…
The encryption has been broken already but it’s basically trailing bmw and Mercedes etc by about 13 years, so definitely money related but likely they don’t want to or are unable to negotiate patent rights in their technology
Earlier quoted context omitted.
. Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one…
The BCM is an ECU. The encryption has been broken already but it’s basically trailing bmw and Mercedes etc by about 13 years, so definitely money related but likely they don’t want to or are unable to negotiate patent rights in their technology
My reaction: Great! Reproducing these keys costs hundreds of dollars and a trip to the dealer. Maybe it can finally be affordable again. I'm less concerned about someone stealing my car. The local police department takes it seriously, no less because stolen cars are used to commit other crimes.
Wait, what are you advocating? Return to keys without an immobiliser??? You do realise that that's the feature that has single-handedly destroyed car theft that was so rampant by the 90s? That is what made cars so difficult to steal, but also what makes keys cost what they do and require an approved dealer to code the keys. Return to the old keys where you only had the key and nothing else would be......crazy, really…