Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

611–620 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#611

Post by ngneer »

raizer88 wrote: post #47
markhahn wrote: post #29

Earlier quoted context omitted.

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

All CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.

Allow me to offer a different opinion. There is little sense in applying logical security when physical security is lacking. CANBUS should not be accessible by taking apart headlights. Communication buses must be protected from physical access, i.e., trip the alarm system or disable the car upon unauthorized access. There can be no logical security without physical security.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#612

Post by K0balt »

2024throwaway wrote: post #152
acdha wrote: post #75

Earlier quoted context omitted.

Maintenance is a big key management problem though: if only the owner has it, there will be problems when people inevitably lose it. If there are shared keys for service departments or databases, thieves will get access to them. Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibilit…

GP said the key is in the car key. You already give the car key to a mechanic, I don't see how this would make maintenance any harder.

Most modern keys already have cryptographic rfid transponders which must be in place to turn off the Immobilizer system.

Unfortunately, Immo can be trivially disabled/bypassed/reprogrammed on many cars using the canbus or odb2 interface.

Also trivially editable in many ICUs is the mileage, airbag (crash) history, etc.

The main vector is that this data typically exists alongside performance parameters and user data like registered keys and fobs, so is accessible either by catching the ecu in bootup/program mode, by buffer overrun attacks, or often just by asking nicely.

This is basically doable by anyone who can to chip tuning or ECU remaps. It’s technical, but not that technical. Many ECUs require JTAG access inside the ECU housing or even desoldering the serial flash chip, but many do not.

I just bought a whole setup for this from AliExpress for about 100 dollars and it’s worked well for me so far, just a specialised JTAG adapter with some cables really.

Pretty sure if you wrote drivers for chip tuning software to use a buspirate it would work just as well if not better.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#613

Post by bonestamp2 »

vkou wrote: post #539
bonestamp2 wrote: post #325

Earlier quoted context omitted.

I like the idea in theory, but I'm not sure if it's practical. There's no such thing as a secure system, there are only systems with no known security issues -- a vehicle that has no known security issues one day, is one discovery away from being completely open the next day. So, it would be hard to legislate the security of a system. The solution might be to incentivize a quick resolution. For example, if a security…

> There's no such thing as a secure system Nobody's demanding that auto manufacturers build a secure system , we are just expecting them to meet an incredibly low bar of security. The manufacturers in question, unlike their peers, have failed to clear it.

I agree with you, I'm just not sure how you'd wright the law that makes them clear the low bar when that bar might need to move up before the bill even becomes a law. That's why I would prioritize some kind of "security update bill" instead of trying to legislate the low bar that needs to be crossed.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#614

Post by LeifCarrotson »

myself248 wrote: post #383

If the environment can be presumed to contain at least one wolf, then building houses out of straw and sticks is considered negligent and lazy pigs deserve to get eaten. Responsible pigs who build from brick, sacrificing some profit in the name of security, are celebrated for their sound judgment and foresight. A fairy tale has been telling us this for at least 200 years and probably much longer, history is unclear o…

The argument for the Flipper Zero is that it's an independent building inspector.

People are being sold houses where the builder says they're made of brick, and if not for this product, the pigs might live in a house believing it's brick until a wolf blows it down and reveals a thin layer of stucco over straw.

The home sellers are saying "but wolves and building inspectors alike can use this tool to blow down houses!" (porcine building inspector use rather crude inspection methods). But it would be irrelevant if the houses were made of brick and not straw.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#615

Post by anigbrowl »

topspin wrote: post #595
anigbrowl wrote: post #576

The childishness of this headline is something else. People who like 'security tools' feel entitled to demand everyone else exhaust themselves in a never ending security arms race. Here's a compromise; things like Flipper Zero stay legal, but if you get caught with one, you're treated the same way as someone walking around with a crowbar.

I had exactly the opposite reaction. Tools like flipper zero are trivial. Banning these make as much sense as banning the next designer drug. Yet that's the idiocy we default to, and the logical conclusion is the "War On Electronics." Manufacturers have been reckless, featurizing their products and ignoring basic expectations of their customers. It isn't unreasonable to expect that some low life knucklehead can't jus…

I don't disagree with the premise that car manufacturers should do better, but the same people that insist messing around with a Flipper Zero is Serious Business tend to be the same people who say regulation of things like vehicle standards and an unwelcome interference with the free market. I stand by my claim that the headline reflects a childish mindset instead of looking at both sides of the issue.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#616

Post by alexb_ »

creaturemachine wrote: post #608
fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

[flagged]

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#617

Post by GuB-42 »

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs)

The Flipper Zero is not a SDR, it is less capable than that.

That's the ironic part, the Flipper Zero is a rather weak hacking tool.

It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of the car and in range of the Flipper. You can then open the door to the car, once, and only if the owner didn't open it first. There is a more advanced and maybe practical attack called rolljam, but I don't think the Flipper is capable enough to do that.

The only thing is that the Flipper Zero is fun, cheap(ish), and popular, but real thieves already have better tools for their job.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#618

Post by ggreer »

schaefer wrote: post #488

I have a younger brother that recently bought a Kia as his first car. It's been broken into 3 times in less than a of ownership year. Kia sent him a cheep "Club style" steering wheel lock... -- From my perspective, getting stuck with this lemon will significantly compromise his quality of life and finances for years to come. Where are our consumer protections? Kia should be on the hook for fixing the problem or buyin…

It's been broken into three times or it's been stolen three times? Because any car is easily broken into. Just smash a window.

South Korea's car theft rate is 5.3 per 100,000 per year. In the US it's 282. Canada is 217. Fewer cars had immobilizers a decade ago but theft rates were lower then. The main reason why car theft is higher is because of car thieves.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#619

Post by Zak »

kazinator wrote: post #462

I don't agree with the logic of their argumentation. It reads a little bit like this: "Lock-picking tools are based on metal stick technology. If you ban possession of lock-picking tools, you will hamper the entire economy of tools based on metal sticks: everything from screwdrivers to knives to scissors. Instead, you should ban all entrance doors that are not of bank vault pedigree." (Which is not to say that I agre…

I agree with their logic and would generally agree with its conclusion when applied to other technology, including lock picking tools. As an aside, criminals rarely use those; burglars are more likely to use a crowbar or hammer.

Lock picking tools are not banned in most jurisdictions. In some cases, carrying them in public combined with some other evidence of intent to commit burglary could be a crime, but that's also true of a crowbar, hammer, rock, or anything else that could be used to gain entry.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#620

Post by ceejayoz »

jonhohle wrote: post #544
ceejayoz wrote: post #155

Earlier quoted context omitted.

I agree with the article; that regulating car manufacturers who make insecure cars is the correct approach. This specific case illustrates the effectiveness of the approach.

I read this view as: it’s fine to steal a car without an immobilizer. That’s an insane take (and why we can’t have nice things). Meanwhile other modern countries (albeit with much stricter law enforcement and a more unified value system) can operate with 0.1% of the equivalent crime and that’s not what we aspire to. Instead we want to blame the manufacturer who must have certainly enticed antisocial, destructive beha…

> I read this view as: it’s fine to steal a car without an immobilizer.

No. Car manufacturers should still take reasonable steps to prevent it.

To make an analogy, people should not steal from banks... but it would still be negligent to leave the bank unlocked at night.

Post reply on HN