Power Steering ECU... this things determines how the driving wheel makes the car turn. Safety issues must be considered.
Hacking a VW Golf Power Steering ECU
11–20 of 174 posts
Re: Hacking a VW Golf Power Steering ECU
#12Earlier quoted context omitted.
> One interesting difference and trend in automotive control modules (also mentioned in Willem's fantastic write-up) is that many EU modules started adding signature checking and encrypted updates in the late 2000s Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. On the other hand i reckon t…
> Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. I'm not a cryptographer - but I don't think there's anything wrong with XOR encryption, and I'm not sure why you're putting it in scare-quotes - XOR with a sufficiently large key is absolutely fine, and with a one-time pad is unbreakable. XO…
I'm assuming they meant XOR-ECB with a block size of 1/2/4 bytes.
Re: Hacking a VW Golf Power Steering ECU
#13Earlier quoted context omitted.
>many EU modules started adding signature checking and encrypted updates in the late 2000s Ah, yeah, and this is irritating if you're a used car owner, particularly an owner of a car that's now lower value. I can't, for example, pick up a cheap used throttle body for my older Volvo because the main ECU will reject it until someone from the stealership charges me a LOT of money to "program" it.
This is unlikely to be related to encryption but just protectionism on an older vehicle. Generally speaking, until very recently (like 1-2 years ago), non-immobilizer related adaptation processes are just a matter of finding the correct UDS remoteRoutine to invoke, and aren't cryptographically protected at all. It's likely that the thing you're missing is the diagnostic documentation for the correct routine invocatio…
Seeing the amount of part theft in Stockholm I understand why they do it. Particularly steering wheels, they steal them and send them to the baltics where they put them in vehicles where the airbag has fired.
Re: Hacking a VW Golf Power Steering ECU
#14As cool as this is, I will never EVER hack/jailbreak car steering. I can't put my faith in unsupported (non-OEM may be a better term for it) software keeping me safe. I watch the tesla autopilot videos of them totally messing up and that is fully supported but still failing too much. But cool POC for sure.
What did you get your elevator operator for Christmas?
Re: Hacking a VW Golf Power Steering ECU
#15Power Steering ECU... this things determines how the driving wheel makes the car turn. Safety issues must be considered.
I will never purchase a vehicle for my own purposes that does not use hydraulics for brakes and steering.
Putting a computer between my foot/hands and the physics unfolding in front of me is a total non-starter.
Re: Hacking a VW Golf Power Steering ECU
#16Earlier quoted context omitted.
> One interesting difference and trend in automotive control modules (also mentioned in Willem's fantastic write-up) is that many EU modules started adding signature checking and encrypted updates in the late 2000s Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. On the other hand i reckon t…
> Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. I'm not a cryptographer - but I don't think there's anything wrong with XOR encryption, and I'm not sure why you're putting it in scare-quotes - XOR with a sufficiently large key is absolutely fine, and with a one-time pad is unbreakable. XO…
> XOR with very large keys is how critical military encryption systems such as radios work.
Cool! Do you have any references?
Re: Hacking a VW Golf Power Steering ECU
#17This may go without saying, but a word of caution for anyone who wants to try this themselves: doing any sort of automated scanning of ECU hardware (e.g. the equivalent of trying to find undocumented opcodes in a CPU) stands a good chance of bricking the hardware (permanently), so plan to buy several of them if you want/need to go that route.
What does it mean to permanently brick the hardware?
Re: Hacking a VW Golf Power Steering ECU
#18This may go without saying, but a word of caution for anyone who wants to try this themselves: doing any sort of automated scanning of ECU hardware (e.g. the equivalent of trying to find undocumented opcodes in a CPU) stands a good chance of bricking the hardware (permanently), so plan to buy several of them if you want/need to go that route.
What does it mean to permanently brick the hardware?
Most ECUs have diagnostic messages that can read/write memory. This is often intended to be controlled by what "mode" the ECU is in (manufacturing/engineering/production/dealer-service), but these aren't always well tested or properly implemented controls. Fuzzing these leads to weird behavior and state machines with not-well-tested transitions. Whether you can reset these to a known state is ECU specific, and often will involve knowledge that isn't publicly known.
Re: Hacking a VW Golf Power Steering ECU
#19Earlier quoted context omitted.
> Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. I'm not a cryptographer - but I don't think there's anything wrong with XOR encryption, and I'm not sure why you're putting it in scare-quotes - XOR with a sufficiently large key is absolutely fine, and with a one-time pad is unbreakable. XO…
> XOR with very large keys is how critical military encryption systems such as radios work. Cool! Do you have any references?
For example the TETRA standard for trunked radio, "The key stream bits shall be modules 2 added (XORed) with plain text bits in data, speech and control channels".
Re: Hacking a VW Golf Power Steering ECU
#20Power Steering ECU... this things determines how the driving wheel makes the car turn. Safety issues must be considered.
I will never purchase a vehicle for my own purposes that does not use hydraulics for brakes and steering. Putting a computer between my foot/hands and the physics unfolding in front of me is a total non-starter.
[deleted]