Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

831–840 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#831

Post by 0xEF »

happytiger wrote: post #660
GuB-42 wrote: post #617

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of t…

The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.

I suspect, in part, that this article and people pushing for a ban wouldn't have even noticed the Flipper Zero if it didn't look like a toy. The case design looks like some advanced Tamagotchi and places in a more accessible part of the lowest-common-denominator mind. If it looked like a raw PCB and wires, or some rats nest jumble of little components, it wouldn't catch their attention as much. There is a lot to be said about how we package our hack tools, and the second you move into "magic box go brrrrr" territory, suddenly it gets real to those outside technical circles.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#832

Post by b112 »

0xEF wrote: post #831
happytiger wrote: post #660

Earlier quoted context omitted.

The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.

I suspect, in part, that this article and people pushing for a ban wouldn't have even noticed the Flipper Zero if it didn't look like a toy. The case design looks like some advanced Tamagotchi and places in a more accessible part of the lowest-common-denominator mind. If it looked like a raw PCB and wires, or some rats nest jumble of little components, it wouldn't catch their attention as much. There is a lot to be s…

Actually, there may be something here. Politicians seem to be blathering on about "prepackaged" hacking tools, and similar terms. They obviously aren't going to ban ICs, or breadboards, so in their minds I think it's all about "Tools that are designed for non-hackers to use, in ways we don't like".

Right or wrong re: Flipper's uses, the "just take this and go" is part of it.

I do wonder, right now lockpick tools are banned, unless you are a locksmith. I wonder if one day, you'll be charged with "hacking tools", because you have some hobby project in your backpack.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#833

Post by Chris2048 »

sidewndr46 wrote: post #535
Chris2048 wrote: post #482

Earlier quoted context omitted.

If thieves started towing cars, presumably people would be more observant, esp where it isn't obvious why a car is being towed. If it was in an urban environment, there might be cameras around anyway that could capture the reg plate.

I'm always dumbfounded by this obsession with video & license plates. What are you going to do with that information?

Give it to the police?.. Unless the tow truck is stolen, then who registered it?

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#834

Post by numpad0 »

strangattractor wrote: post #707
GuB-42 wrote: post #617

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs) The Flipper Zero is not a SDR, it is less capable than that. That's the ironic part, the Flipper Zero is a rather weak hacking tool. It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of t…

At one time is was possible to open car doors with a coat hanger. Nobody suggested banning coat hangers. They fixed the doors.

Intentions sometimes matter. There is a South African shotgun aspirationally named Street Sweeper, and it's famously classified as a Destructive Device in the US, which is two levels more strictly controlled category, AIUI, IANAL, than a manually operated Gatling gun.

FZ is intended to clone keys and bypass security, I suppose in significant part for users' lawful convenience, but is kind of intended to do what it should not.

Coat hangers aren't engineered with intent to be shoved into the weather seal on a door.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#835

Post by CTDOCodebases »

creaturemachine wrote: post #608
fargle wrote: post #583

stupid on stupid. - it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem - but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you fo…

Tik-Tok-inspired Kia thefts weren't a problem in Canada because they've required immobilizers since 2007, something Kia skimped on for the US market.

Same thing in Australia since 2001.

Most cars in are stolen here using key thefts or wireless relay.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#836

Post by numpad0 »

acdha wrote: post #721
numpad0 wrote: post #673

Earlier quoted context omitted.

I think you're in a desktop computer "whole product is one computer" moddel. A car is a set of computers, almost nothing in a car is central to itself. There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible. Infotainment? That's almost literally an aftermarket parts. American reviewers tend to se…

> There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible. This sounds like the old desktop mentality you mentioned. You can’t just reflash things to bypass a secure boot process – the entire point is to prevent things like that! You’d design the driver’s key to pair with the various onboard syste…

> This sounds like the old desktop mentality you mentioned. You can’t just reflash things to bypass a secure boot process – the entire point is to prevent things like that!

The actual real problem I failed to explain is manufacturers don't want to deal with networked authentication, broken physical keys, or day-to-day repair shop operations, so they keep most of the processes offline and send out re-pairing tools that leaks. Very few cars require breaking chain of trust to swap out parts which makes "If they need to create a custom engine controller, ..." part unrealistic as of now. It takes few more years before Apple starts delivering cars.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#837

Post by maxerickson »

sleepybrett wrote: post #694
arjvik wrote: post #690

Earlier quoted context omitted.

Genuine question - why do headlights need to be on the main CAN bus? Could they not be operated from somewhere closer to the ECU by wires that just carry power and maybe some very simple data lines?

It may be something as stupid as a wiring harness layout optimization. You can put the headlights controller at the headlights and only run a single set of CAN bus wires (which are probably in that area anyways), haven't played with CAN I assume they are fairly few and fairly thing gauge, through the firewall of the car.

CAN is a 2 wire serial bus using differential signaling. So a couple small wires and maybe some shielding.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#838

Post by maxerickson »

raizer88 wrote: post #47
markhahn wrote: post #29

Earlier quoted context omitted.

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

All CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.

It's an enormous amount of implementation effort aimed at tampering which, to some approximation, never happens. And as another poster has said elsewhere, partitioning the communications would be cheap.

That they are using the OEM software indicates that there is some authentication going on with the ECU to start the engine anyway. I bet they didn't truly plan for key rotation.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#839

Post by rerdavies »

TylerE wrote: post #540
Chris2048 wrote: post #89

Earlier quoted context omitted.

The same problem exist for car keys. The answer is, when a person "inevitably lose[s] it", they need to pay to get their electronics refit.

A traditional car key can be trivially duplicated at any hardware store. That's the difference. You can make as many spares as you want for a couple bucks a pop. No dependencies. No network.

Do any cars have "traditional keys" anymore? My 15 year old Corolla has an embedded RFID tag in the key, and can only be duplicated at a Toyota dealership.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#840

Post by romwell »

numpad0 wrote: post #834
strangattractor wrote: post #707

Earlier quoted context omitted.

At one time is was possible to open car doors with a coat hanger. Nobody suggested banning coat hangers. They fixed the doors.

Intentions sometimes matter. There is a South African shotgun aspirationally named Street Sweeper, and it's famously classified as a Destructive Device in the US, which is two levels more strictly controlled category, AIUI, IANAL, than a manually operated Gatling gun. FZ is intended to clone keys and bypass security, I suppose in significant part for users' lawful convenience, but is kind of intended to do what it sh…

You can literally order lock picks on Amazon in Canada[1].

Which were absolutely engineered with Internet to be shoved into locks to open them without a key.

To be clear: purchasing ans owning lockpicks is perfectly legal in Canada [2].

I don't think your logic applies to why that legislation was introduced. They're treating Flipper as a lockpick, but legislate it differently nevertheless.

Cheap, misguided hype seems to be a more plausible explanation.

[1] https://www.amazon.ca/Professional-Accessories-Suitable-Hand...

[2] http://lockking.ca/can-i-buy-lock-picks-in-canada/

Post reply on HN