671–680 of 916 posts
Earlier quoted context omitted.
Let's say a hardware exploit for iPhones becomes obvious and is spread through social media. Something absurd like "attaching a shorted iphone cable". Are you going to be the first to buy an add-on lock or immobilizer? And everyone should also have to purchase an add-on?
>And everyone should also have to purchase an add-on? Yes! -Apple
Earlier quoted context omitted.
Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?
Seems like the CANBUS is deactivated when the car is turned off on Volkswagen. Guess that is one way to fix it?
Earlier quoted context omitted.
The part that requires a signature will be taken out and replaced. Infotainment systems will get gutted and replaced with aftermarket ones.
Again, all of those lower the value to the thieves. If they need to create a custom engine controller, they’re going to need to pay a lot more than the $0 they currently spend. If they need to replace the entertainment system, the cost of doing so will cut into their margin. Don’t make the mistake of thinking that a system needs to be perfect to be worthwhile.
There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible.
Infotainment? That's almost literally an aftermarket parts. American reviewers tend to see it as integral part of a car or even a central computer, surely it's important in terms of product experience but architecturally it's more like a printer over Ethernet than a laptop integrated display.
Earlier quoted context omitted.
The manufacturer is not the victim here, the buyer is. If I pay a contractor to install a new door and lock on my apartment and it turns out they did a terrible job which made it trivial for a thief to break in, the contractor should be liable. Crime exists, this is the world we live in. Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is k…
> Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault. I don't…
Reviews rarely talk about things like this, this information is not explicitly given to reviewers or customers and neither can be expected to find out on their own (i.e. by trying to hack the car themselves), the car manufacturer spends insane amounts of money advertising to the buyer using every psychological trick in the book, the buyer is often under time pressure, the savings from cost-cutting are rarely passed down to the consumer...
Buying things in the current market landscape is a battle, not an optimization problem.
Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…
The issue people are mentioning with the headlights is easily solved by just moving the starter CAN to its own CAN bus between the immobiliser and the ECU (physically isolating the headlights), which costs about $5 total and requires no crypto unless thief is willing to cut the car nearly completely in half.
(The problem with crypto is the $10 safety MCUs used all throughout cars are only like 20MHz and they can’t really do the 2000+ crypto ops/sec on top of their current workload. Also the tooling support for crypto ATM is really poor in the model based design tools that are used for this safety relevant SW)
BTW I personally don’t believe that anything that involves cutting into a vehicle is negligence of anyone. I mean, from my perspective, anyone can just pop the hood and drive the car with their own BYO ECU. It’s just a hunk of metal and once you start cutting it up you can make it do whatever you want.
I am an automotive systems engineer.
> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of t…
Earlier quoted context omitted.
Yes, which is why I suggested a combination of measures to change that. An active per-device transaction would make it clear when a dealer’s access is being misused, and if it affects their business viability it would turn out that they could do a better job of controlling access. Hundreds of thousands of people work at banks, too, and many of them do not care about their employers but thefts from customer accounts a…
What would that look like in reality? Expecting dealerships to have the same physical security, procedures, and security vetting of a bank? There's already a shortage of workers in these roles, now we want the guys busting their knuckles on vehicle repairs to have a good credit score and good background check and perform elaborate opening and closing procedures with a buddy system? Storing tools in a vault? I really…
stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…
But I get it, it's easier to think about applying technological or even legal solutions instead of thinking about how to fix a societal problem.
Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…
Well for one thing the OBD port shouldn’t be designed so that it has direct access to any useful CAN bus. It should go to a gateway that requires authentication to do anything except read OBD, and all of the IDs that you are allowed to send should be whitelisted. The issue people are mentioning with the headlights is easily solved by just moving the starter CAN to its own CAN bus between the immobiliser and the ECU (…