Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

wired.com

Post reply on HN
Print view View original

121–130 of 144 posts

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#121

Post by jeroenhd »

_iyig wrote: post #20
notlukesky wrote: post #17

The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.

>The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme: https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...

Shouldn't relay attacks be preventable by having the car inspect the timing of the response? A signal that needs to be received, reprocessed, transmitted, reprocessed again and then retransmitted should have a noticeable difference in timing, shouldn't it?

Is there any reason a challenge/response protocol with proper timing filtering isn't safe against relay attacks?

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#122

Post by ScottBurson »

amatecha wrote: post #115
unnouinceput wrote: post #95

Earlier quoted context omitted.

. Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one…

You mean Mazda MX-3, right? The Mazda RX-2 is from the 70's ;)

Or maybe the RX-8?

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#123

Post by solarhoma »

bonestamp2 wrote: post #117
aluminussoma wrote: post #16

My reaction: Great! Reproducing these keys costs hundreds of dollars and a trip to the dealer. Maybe it can finally be affordable again. I'm less concerned about someone stealing my car. The local police department takes it seriously, no less because stolen cars are used to commit other crimes.

> Maybe it can finally be affordable again. I like how some Chrysler products handle this. You can buy a $50 fob online and program it to your car yourself. The catch is, you need two key fobs to do it. This is so the valet attendant (who only has 1 of your key fobs) can't make his own copy. So, you just have to plan ahead and do it asap when you get a vehicle and always keep 2 in storage in case you want to make ano…

That is very forward of Chrysler. I just wish some of the more reputable brands would follow suit.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#124

Post by ProZsolt »

kweks wrote: post #113
fyfy18 wrote: post #105

Earlier quoted context omitted.

What you are describing is basically MIFARE, which is commonly used by transport cards. Rather than just being an ID, the card is responsible for storing and deducting the balance, and often stores other things like trip history. The allows them to be used without a internet connection on the ticketing machine (e.g. on a bus). There have been vulnerabilities found in older versions, but as far as I know, later versio…

Apologies if this reply seems a little pedantic; your reply is mostly correct, but there are some large shortcuts. MIFARE is not a card type, it's more a family of cards in the 13.56MHz space, produced by NXP. There are multiple cards under the banner of Mifare, including: - Mifare Classic 1/4k - UID + Storage space, with individual keys and crypto. Suffers/ed from multiple vulnerabilities. Used mainly in cheaper hot…

Do you have any resources on how to secure Mifare Classic against cloning? I thought it's inherently insecure.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#125

Post by brownbat »

Does Schuyler Towne read hacker news?

He made the point in one amazing talk (that included references to centaurs and American exceptionalism and possibly ancient sumerian) that we've long used locks not for security, but as a social symbol of security.

Anyone can just put a cinder block through your window and steal your car. The barrier isn't technological, it's social. Locks are a great defense against the kid or confused person who is wandering around and forgets that we have social mores against making off with thousands of dollars of other people's property on a whim. They are not designed to defend against dedicated thieves.

We defend against dedicated theives by hiring detectives and prosecutors and making it in general more hazardous as a profession than other professions that one might take up. We defend against theft by just generally making it more lucrative to apply the same amount of ingenuity and dedication to other endeavors, like giving amazing talks about perfect security and American centaurs.

I'm probably butchering or overextending his point though, would love for the man himself to weigh in.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#126

Post by kjaftaedi »

brownbat wrote: post #125

Does Schuyler Towne read hacker news? He made the point in one amazing talk (that included references to centaurs and American exceptionalism and possibly ancient sumerian) that we've long used locks not for security, but as a social symbol of security. Anyone can just put a cinder block through your window and steal your car. The barrier isn't technological, it's social. Locks are a great defense against the kid or…

The important point these days is one of responsibility.

Whether or not these locks are made to be appropriately 'secure' is the difference between the owner and the manufacturer being liable for the result of criminal action.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#127

Post by ianai »

brownbat wrote: post #125

Does Schuyler Towne read hacker news? He made the point in one amazing talk (that included references to centaurs and American exceptionalism and possibly ancient sumerian) that we've long used locks not for security, but as a social symbol of security. Anyone can just put a cinder block through your window and steal your car. The barrier isn't technological, it's social. Locks are a great defense against the kid or…

Indeed, most locks are societal items instead of actually being difficult to defeat. It doesn’t make a lot of sense to over engineer one part of a system that an OoB attack can easily defeat unless that other attack vector is much more often attacked. I doubt that’s the case here. People should avoid locations where their cars are likely targets.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#128

Post by yc-kraln »

jeroenhd wrote: post #121
_iyig wrote: post #20

Earlier quoted context omitted.

>The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue. Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme: https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can...

Shouldn't relay attacks be preventable by having the car inspect the timing of the response? A signal that needs to be received, reprocessed, transmitted, reprocessed again and then retransmitted should have a noticeable difference in timing, shouldn't it? Is there any reason a challenge/response protocol with proper timing filtering isn't safe against relay attacks?

Currently working in the Car industry, previously in the access control industry (and have developed active RFID systems which include timing information to prevent relay attacks)

Yes, you can do this. I have done this (restricted the negotiation to about 12 meters)--you're essentially racing the speed of light, see DE102012104955A1. Most of the reasonable approaches are patented by NXP.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#129

Post by jeroenhd »

yc-kraln wrote: post #128
jeroenhd wrote: post #121

Earlier quoted context omitted.

Shouldn't relay attacks be preventable by having the car inspect the timing of the response? A signal that needs to be received, reprocessed, transmitted, reprocessed again and then retransmitted should have a noticeable difference in timing, shouldn't it? Is there any reason a challenge/response protocol with proper timing filtering isn't safe against relay attacks?

Currently working in the Car industry, previously in the access control industry (and have developed active RFID systems which include timing information to prevent relay attacks) Yes, you can do this. I have done this (restricted the negotiation to about 12 meters)--you're essentially racing the speed of light, see DE102012104955A1. Most of the reasonable approaches are patented by NXP.

I see, very interesting! I could've figured someone would patent something like this. Thank you for explaining.

Re: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

#130

Post by o-__-o »

balp wrote: post #110
unnouinceput wrote: post #99

Earlier quoted context omitted.

BCM is Body Control Module. ECU is Engine Control Unit. 2 different parts (logically). Both are physically PCB's (Printed Circuit Board) that physically can sit either side by side or in very different sides of the car - that's car maker decision. I can't explain it simpler than this.

ECU is usually an Electronic Control Unit. Some OME's name one of there ECU's, Engine Control Unit to make stuff more complex. Not app manufacturers have Engine Control Unit or a Body Control Module. The electronic architecture of a Volkwagen, GM, Volvo or Tesla is very different. Hardly any of the ECU's have the same name. It looks like Wikipedia agrees with me and in addition, the Engine Control Unit article state…

Or PCM (powertrain control module, since the transmission and engine typically work as one unit) which has been used by Ford (and Mazda) since ODB-2 was standardized in the 90s.
Post reply on HN