Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I hacked my car

programmingwithstyle.com

Post reply on HN
Print view View original

111–120 of 142 posts

Re: I hacked my car

#111

Post by fmntf »

bri3d wrote: post #110
fmntf wrote: post #96

Kudos to the author! I did some research in my car a few years ago. Unfortunately, the update packages were properly signed. So I reversed the CAN traffic and replaced the infotainment ECU with my own reimplementation. I published my work and findings on medium thinking that nobody could notice them... I have got a job in the automotive industry instead.

That's pretty cool! I wonder how properly they were really signed - there are _so many_ mistakes even in systems that at least don't use an example key off the Internet. The most common ones I know of are: * Out-of-bounds write issues allowing "signature was validated" flags to be overwritten in Flash memory, like https://github.com/jglim/UnsignedFlash * State machine mistakes, like https://github.com/bri3d/VW_Flash/…

The infotainment of the car maker had some oddities: * the binaries were signed with a certificate emitted by a big certification company, repacking an update package could be challenging * the system ran a fork of Windows CE and was co-developed with Microsoft * the SoC documentation was only available under NDA (I was able to find only a one page datasheet)

For those reasons, instead of trying to repack the software for the original ECU, I started to sniff the CAN traffic and analyzing the binaries contained in the software update packages found online. That allowed me to reimplement the communication with other ECUs on a Linux SBC.

Re: I hacked my car

#112

Post by fmntf »

rasz wrote: post #98
fmntf wrote: post #96

Kudos to the author! I did some research in my car a few years ago. Unfortunately, the update packages were properly signed. So I reversed the CAN traffic and replaced the infotainment ECU with my own reimplementation. I published my work and findings on medium thinking that nobody could notice them... I have got a job in the automotive industry instead.

Any reason for not linking to that medium post? Did the new employer politely ask you to take it down?

I just do not like self promotion. My employer does not care of my posts, they were published before signing my current contract. I have stopped writing posts by myself since I have now access to tons of documents and specifications.

Re: I hacked my car

#113

Post by bri3d »

fmntf wrote: post #111
bri3d wrote: post #110

Earlier quoted context omitted.

That's pretty cool! I wonder how properly they were really signed - there are _so many_ mistakes even in systems that at least don't use an example key off the Internet. The most common ones I know of are: * Out-of-bounds write issues allowing "signature was validated" flags to be overwritten in Flash memory, like https://github.com/jglim/UnsignedFlash * State machine mistakes, like https://github.com/bri3d/VW_Flash/…

The infotainment of the car maker had some oddities: * the binaries were signed with a certificate emitted by a big certification company, repacking an update package could be challenging * the system ran a fork of Windows CE and was co-developed with Microsoft * the SoC documentation was only available under NDA (I was able to find only a one page datasheet) For those reasons, instead of trying to repack the softwar…

Yes, a full replacement absolutely makes sense in this situation! I don't think there are many Windows infotainment units left these days. Analyzing the binaries to figure out the meaning of the CAN traffic is an awesome (and underutilized IMO) technique - I see people sit and stare at CAN dumps in a vacuum a lot when really, whatever checksum or data they're looking for is often right there in the code.

Re: I hacked my car

#114

Post by MichaelCollins »

ReadTheLicense wrote: post #4
heynowheynow wrote: post #2

Don't expect much from a manufacturer who until recently didn't use immobilizers.

In what universe is 20+ years "recently"? Actually the Hyundai I had - with an immobilizer - was made in 1995 so 27 years. Is this American thing?

> In what universe is 20+ years "recently"?

One day, you too will be old.

Re: I hacked my car

#115

Post by fmntf »

bri3d wrote: post #113
fmntf wrote: post #111

Earlier quoted context omitted.

The infotainment of the car maker had some oddities: * the binaries were signed with a certificate emitted by a big certification company, repacking an update package could be challenging * the system ran a fork of Windows CE and was co-developed with Microsoft * the SoC documentation was only available under NDA (I was able to find only a one page datasheet) For those reasons, instead of trying to repack the softwar…

Yes, a full replacement absolutely makes sense in this situation! I don't think there are many Windows infotainment units left these days. Analyzing the binaries to figure out the meaning of the CAN traffic is an awesome (and underutilized IMO) technique - I see people sit and stare at CAN dumps in a vacuum a lot when really, whatever checksum or data they're looking for is often right there in the code.

Actually there still are a lot of Windows ECUs in the wild. I analyzed the update packets of newer cars than mine (equipped with Uconnect) finding even sndrec.exe and the default page of IIS! Fortunately my company produces Linux-based ECUs, and we use Windows only for Autosar stuff.

Re: I hacked my car

#117

Post by elcritch »

zaik wrote: post #42
TheRealDunkirk wrote: post #34

I worry that embarrassing cases like this are going to cause global corporations to call for the ban of general purpose computers for the public. I mean, look at all they’ve done. We’re at a tipping point with the right to repair movement, but John Deere still hasn’t lost yet.

Please don't give them ideas. Software freedom is already in a bad enough state.

Actually thats maybe the best reason for general right-to-repair laws I've heard yet.

Re: I hacked my car

#118

Post by bornfreddy »

dabigjhall wrote: post #41

This sort of idiocy is why I removed the modem from my Niro EV: https://www.kianiroforum.com/threads/how-to-remove-head-unit... (It is basically the same head unit, Kias/Hyundais share a lot of components.) IMO Kia makes great cars but I don't trust them with Internet security. Android device permanently connected to the Internet with unfettered access to the CAN bus of my car....no thank you. And even if it was rela…

Wow, nice! I don't own a Kia, but being able to disable built-in radio is a great feature in my eyes.

As for people commenting about "nothing to hide" and paranoia, I guess that they never worked on the other side. Seeing how even very innocent-looking data can be (ab)used, I would definitely prefer less data to be gathered about everyone.

Re: I hacked my car

#119

Post by alerighi »

AlotOfReading wrote: post #87
alerighi wrote: post #85

They say that I'm against progress when I say that I'm contrary to all this new things that are adding to cars since they are dangerous. And this article proves my point of view, if who made the software used publicly available encryption keys (one that knows what it's doing knows that to generate them with openssl you take 1 second) how can that software be trusted? To me self-driving car and all that amount of stuf…

I've been involved with the software side at a few companies producing autonomous vehicles and took a look at SSG-39 to see how much better nuke standards are. They're pretty dang similar to automotive standards (UL4600, SOTIF, etc). The difference is in the regulatory environment and execution. Automotive software is not well-regulated and most OEMs don't think either the software or the people that produce it are w…

Automobile software has good standard for critical parts. The problem is all the software never considered a remote attack, since it was not connected to the internet. The CAN bus was local and the only way to interact was to physically connect to the bus, thus it has no security built in (every device can send any command since every device is trusted). Now to enable all the smart stuff there is a connection between the car bus and the internet, of course indirectly trough the entratainment system, but if for example the entratainment system (for which coding standards are bad) is exploited, you have full access to the bus and thus can send commands to various parts of the car, which is very bad!

Re: I hacked my car

#120

Post by LightG »

_whiteCaps_ wrote: post #80
LightG wrote: post #31

Earlier quoted context omitted.

Agreed based on test drives. Hyundai are at the top of my EV list. Congrats on the car. Looking to pick one up inside 12 months.

Oh, so you put a deposit down a year ago? /s They're incredibly hard to buy right now, I've been on the waiting list for months.

12 months is if I get my act together AND they're available. Neither of which are likely!

I'd heard they're almost impossible to get hold of. I'm actually in no rush so I was tempted to wait for the next iteration. I'm all about V2H/X and I'm hoping / wondering if the next version will have that fully enabled or not.

Anyway, take my comment as just a strong compliment for Hyundai. I'm so happy they're around as a strong alternative to the incumbant.

Good luck getting yours. I'd get one just based on its looks, let alone any of the other goodness.

Post reply on HN