"Very easy" sound like a push. Getting into it, especially without the sensors 'spotting' you is surely pretty tough?
Keyless BMW cars prove to be very easy to steal
11–20 of 111 posts
Re: Keyless BMW cars prove to be very easy to steal
#12If the alarm is armed shouldn't it be triggered if something connects to the OBD port? Not actually prevent the port functioning just trigger the alarm.
Re: Keyless BMW cars prove to be very easy to steal
#13You wouldn't download a car.
[deleted]
Re: Keyless BMW cars prove to be very easy to steal
#14> It can then be used to program a new keyfob Is he programming the keyfob? or is he adding the key to the car's authorized_keys list?
The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off. There's a number of cheap and obvious tricks BMW could have used to make the RF…
If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in.
What in the world was wrong with plain old car keys -- especially with an added RFID security chip in the key handle or fob?
Re: Keyless BMW cars prove to be very easy to steal
#15Earlier quoted context omitted.
OBD-II is legally required (in the US) to be open to consumers. The idea being that you can get diagnostics about your vehicle without being extorted by the dealer. (Originally for environmental data about emissions, but later expanded.) http://lobby.la.psu.edu/_107th/093_OBD_Service_Info/frameset...
That makes sense, but I can see the argument that not all features need to be open to consumers.
That seems counter to the "we want full access to our systems and hardware" position commonly taken on HN.
It sounds very much like advocating for Apple's Gatekeeper [1] since it will keep unauthorized software from running on OS x.
Re: Keyless BMW cars prove to be very easy to steal
#16You wouldn't download a car.
I laughed, but seriously though -- this isn't Reddit, so try to avoid the memes, as relevant and appropriate as they may be. :)
Re: Keyless BMW cars prove to be very easy to steal
#17Earlier quoted context omitted.
The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off. There's a number of cheap and obvious tricks BMW could have used to make the RF…
If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in. What in the world was wrong with plain old car keys -- especially w…
Regular car keys are a pain in a lot of ways, and not all that secure, either.
To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a faraday cage and driving off to attack at his leisure, but that's hard to defend against (there, you probably have a continuous heartbeat signal and respond on loss of the signal, or just pay someone with a gun to guard your car...)
You should be able to put vehicle ignition control and access control logic inside a tamper-responding processor and secure it, even with all communications over an open bus. If you were going to be super paranoid, your vehicle would have vehicle-specific timing information built into the engine which was difficult to deduce from analyzing it after removing the ECU, so just swapping in a "skeleton key" ECU wouldn't work. No one is likely to do that for a car, but it is basically how the Permissive Action Links on nuclear weapons work (variable length wires for the explosive lenses on the primary; if you don't have the exact timing information to set them off at the right time, the weapon will be subcritical.)
Re: Keyless BMW cars prove to be very easy to steal
#18Earlier quoted context omitted.
OBD-II is legally required (in the US) to be open to consumers. The idea being that you can get diagnostics about your vehicle without being extorted by the dealer. (Originally for environmental data about emissions, but later expanded.) http://lobby.la.psu.edu/_107th/093_OBD_Service_Info/frameset...
That makes sense, but I can see the argument that not all features need to be open to consumers.
Attackers might work for a dealer or otherwise fully decode the system. The only way to build a system like this securely is to have securely-held keys (cryptographic, not physical; physical locks are all easy to break), and ideally published and reviewed code for the security system, same as any other security system.
(I've actually thought about building a secure ignition system for cars, mainly to solve the car bomb problem -- the car responds outside an explosive radius when interrogated to tell you no one has tampered with it since you've left it. Theft is a financial problem, but bombs (or trackers, or whatever) attached to cars is a more serious problem (for a smaller subset of people). I solved this problem by just leaving my car unlocked with a guy with an AK guarding it, though.)
Re: Keyless BMW cars prove to be very easy to steal
#19Earlier quoted context omitted.
OBD-II is legally required (in the US) to be open to consumers. The idea being that you can get diagnostics about your vehicle without being extorted by the dealer. (Originally for environmental data about emissions, but later expanded.) http://lobby.la.psu.edu/_107th/093_OBD_Service_Info/frameset...
That makes sense, but I can see the argument that not all features need to be open to consumers.
But I'd rather not have to pay $200 for a spare key thanks...
Re: Keyless BMW cars prove to be very easy to steal
#20Earlier quoted context omitted.
If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in. What in the world was wrong with plain old car keys -- especially w…
Regular car keys are a pain in a lot of ways, and not all that secure, either. To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a fara…
> To really do this correctly, you need to have cryptographic challenges between a key and an ECU,
Nonsense. The problem isn't cloning the key, the problem is that you are reprogramming the lock to accept this new key you happen to have with you. No amount of crypto is going to save you when your verifier is full of holes.
You can't even use signing to only accept approved programming devices since OBD regulations enforce it's openness.
> all communications over an open bus
Now this is an interesting point. The bus that the OBD is connected to controls a whole bunch of devices all over the car. It's possible that no access to the inside of the car was required to execute this attack. Looking at the video it doesn't seem like they really stoop inside the car to grab anything actually so perhaps there's a way to get at the CAN bus via the presumably electronic wing-mirror?