Live data from Hacker News

Hacking a VW Golf Power Steering ECU

blog.willemmelching.nl

41–50 of 174 posts

Re: Hacking a VW Golf Power Steering ECU

#41
post #26

Earlier quoted context omitted.

Then you solve the problem in the baltics, not use it as excuse to turn your cars into "iphones"

What are you proposing, that Sweden invades in order to stop car part theft?

You know they are in the EU? Surely there are political tools to solve why there is a demand for stolen car parts in the Baltics

Re: Hacking a VW Golf Power Steering ECU

#42
post #8
post #4

Earlier quoted context omitted.

>many EU modules started adding signature checking and encrypted updates in the late 2000s Ah, yeah, and this is irritating if you're a used car owner, particularly an owner of a car that's now lower value. I can't, for example, pick up a cheap used throttle body for my older Volvo because the main ECU will reject it until someone from the stealership charges me a LOT of money to "program" it.

This is unlikely to be related to encryption but just protectionism on an older vehicle. Generally speaking, until very recently (like 1-2 years ago), non-immobilizer related adaptation processes are just a matter of finding the correct UDS remoteRoutine to invoke, and aren't cryptographically protected at all. It's likely that the thing you're missing is the diagnostic documentation for the correct routine invocatio…

This is possible, though it's essentially the same because the tools require an active "VIDA" subscription. So the ECU gatekeeps normal stuff with a high level blocker type thing. And, perhaps there are ways around it, but enough hassle to kill right-to-repair.

Re: Hacking a VW Golf Power Steering ECU

#43
post #41

Earlier quoted context omitted.

What are you proposing, that Sweden invades in order to stop car part theft?

You know they are in the EU? Surely there are political tools to solve why there is a demand for stolen car parts in the Baltics

Just look at how many tailgates and catalysts are stolen from trucks in the US. That problem is not solvable by more law enforcement.

Re: Hacking a VW Golf Power Steering ECU

#44

> The electronics seemed to be fabricated using bare dies attached to some substrate, probably to lower cost and improve reliability at higher temperatures. The board is made up of two parts, a low-power part with the CPU and CAN transceivers, and some high-power part with 6 MOSFETs forming a three phase H-Bridge. > https://blog.willemmelching.nl/images/vw/IMG_3181.jpg It doesn't really look cheap to me (large machin…

Yeah, it looks like it's extremely optimised for reliability. The construction reminds me of some of the space stuff I'd seen made by a company I worked for (it was all done before my time though).

It probably wouldn't be incredibly expensive in this case (automotive) because all the wire bonding and tab welding can be automated, but clearly cost isn't the main concern behind the design!

Re: Hacking a VW Golf Power Steering ECU

#45
post #40
post #26

Earlier quoted context omitted.

Then you solve the problem in the baltics, not use it as excuse to turn your cars into "iphones"

You really think that is a realistic goal, for the car companies to solve crime in other countries? Just as Apple can’t prevent abusive people from having the desire to track, stalk, and creep on their own family members, I don’t think you have a practical outlook or plan here. The manufacturers do what they can, and they deserve all our respect for that, not derision.

Yet these big corporations spend billions of dollars lobbying the governments to their advantage every year. But when there is a practical problem, people like you come in here and throw their hands up "There is nothing we can do, but to lock our cars down"

Re: Hacking a VW Golf Power Steering ECU

#46
post #31
post #21

Earlier quoted context omitted.

Do you consider an automatic emergency break as less reliable than it helps? Because we do have a lot of numbers on cars were there is a computer in-between. Which should indicate to me that it is safer to drive with one instead of without one. Like just yesterday (I'm driving a new car) I thought about emergency breaking automatic vs. manual and I actually feel safer knowing that the car can potentially break faster…

> I thought about emergency breaking automatic vs. manual and I actually feel safer knowing that the car can potentially break faster. For me, the knowledge that some other engineer designed a system that is a complete black box (from my perspective), which can arbitrarily stop my car with incredible braking force is terrifying. What happens if the emergency braking system decides to have a bug while you are exiting…

I do share your concern... but somehow I (perhaps naively) feel there is a big difference between regulatory mandates like emergency braking, that all manufacturers in the EU has known and planned for since more than 15 years, and stuff like Teslas FSD-beta which is a disaster to happen running on our streets.

Re: Hacking a VW Golf Power Steering ECU

#47
post #8

Earlier quoted context omitted.

This is unlikely to be related to encryption but just protectionism on an older vehicle. Generally speaking, until very recently (like 1-2 years ago), non-immobilizer related adaptation processes are just a matter of finding the correct UDS remoteRoutine to invoke, and aren't cryptographically protected at all. It's likely that the thing you're missing is the diagnostic documentation for the correct routine invocatio…

Seeing the amount of part theft in Stockholm I understand why they do it. Particularly steering wheels, they steal them and send them to the baltics where they put them in vehicles where the airbag has fired.

I don't think they actually send them to baltics, as those are stolen from cars here also and they probably catch a better price in Stockholm anyway. Or sent a lot further than that.

The running "joke" is that insurers pay to put your original stuff back into car, as insurers somehow find "used" parts for mechanics.

Re: Hacking a VW Golf Power Steering ECU

#48
post #3

Earlier quoted context omitted.

> One interesting difference and trend in automotive control modules (also mentioned in Willem's fantastic write-up) is that many EU modules started adding signature checking and encrypted updates in the late 2000s Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. On the other hand i reckon t…

> Do you mean the XOR encryption used? As someone working on the embedded linux(!= than embedded MCU) side i was very surprised to find such a crude "encryption" scheme employed. I'm not a cryptographer - but I don't think there's anything wrong with XOR encryption, and I'm not sure why you're putting it in scare-quotes - XOR with a sufficiently large key is absolutely fine, and with a one-time pad is unbreakable. XO…

[deleted]

Re: Hacking a VW Golf Power Steering ECU

#49
post #29
post #15

Earlier quoted context omitted.

I will never purchase a vehicle for my own purposes that does not use hydraulics for brakes and steering. Putting a computer between my foot/hands and the physics unfolding in front of me is a total non-starter.

With EPAS your steering wheel still physically steers the wheel via the rack and pinion gears. With ABS and ESC, most cars on the road today have a computer involved in the braking system. It seems pretty safe.

> With ABS and ESC, most cars on the road today have a computer involved in the braking system. It seems pretty safe.

Absolutely. These systems have very simple feedback loops and controller algorithms. Determining that you lost traction is a simple problem to solve. Determining that a dangerous obstruction is in front of your vehicle is not.

ABS/ESC also tend to have a more limited impact on the vehicle, even if they do malfunction. You can typically disable these pretty easily (pull fuse/drive system configure).

Re: Hacking a VW Golf Power Steering ECU

#50
post #28
post #23

While I find this quite interesting, a street is not a lab. He should not do this on any public road and potentially he broke already some law.

The driver is always responsible for what their vehicle does. As long as the driver can override the steering (which they can), then there is really nothing to be concerned about. This is the same for cars using openpilot, or Tesla's self driving systems or any other steering assistance features.

This seems like a bit of an over-simplification.. A car needs to be type approved to run on our streets and the insurance companies need to accept whatever you did to the car in case of a crash. You don't really want to end up paying 100% yourself when you crash into that school bus with your mod.

However it would be interesting to learn how type approvals handle the self-driving things. Maybe they really do allow all kinds of computer-assisted things? I don't know. If you change some structural beams in the car you surely lose approval. But can you mod steering and braking? What about openpilot users that crash?

Post reply on HN