Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Dutch first: Ingenious BMW theft attempt

mrooding.me

Post reply on HN
Print view View original

121–130 of 325 posts

Re: A Dutch first: Ingenious BMW theft attempt

#121

Post by Dayshine »

avar wrote: post #95
ARCarr wrote: post #49

Earlier quoted context omitted.

Well the call center said it was a break-in or an accident. I'm sure the Amsterdam police would come if it was an accident and someone could have been injured.

So all I need to do to get Amsterdam police to care about bicycle theft is to install some sort of ribbon that'll get torn off if the lock gets broken, which'll be indistinguishable from the frame getting broken in half ("an accident"). Hook that all up to a GSM modem and a call center and suddenly my local cops will care about crime.

Also known as crying wolf.

Don't you have insurance for theft? Kind mandatory in Amsterdam.

Re: A Dutch first: Ingenious BMW theft attempt

#122

Post by drglitch »

jiveturkey wrote: post #45
drglitch wrote: post #21

Earlier quoted context omitted.

Having recently gotten a new BMW (in USA), they give you a huge packet of about 30 pages explaining the BMW TeleService and the "SOS" button. They also make you sign a power of attorney-style doc giving them rights to notify police in case they believe your vehicle is in trouble and provide police/EMS with its exact location. Mercedes and Audi have similar systems, as do others via OnStar. This is one of few cases wh…

No, not entirely. Please give me the instructions on how to opt out. Whenever someone asks (which is rare), the forums are filled with replies like "why would you not want BMW to monitor you? are you a fraudster?" IOW the forums do not know how to opt out either. Everytime I take my 2016 in to service, I ask both sales and service to disable teleservices. They say they cannot. I then call BMW teleservices (every time…

There are three components to my knowledge. below is my anecdotal knowledge so pls verify if needed :)

- remote car monitoring/bmw connected app. this can be tweaked (its off by default) via idrive. I believe there is also some anonymized sharing with "parknow" and real time traffic apps.

- maintenance notifications. this is on by default and can be disabled in bmw's new "my car" website. They also send you a postcard letting you know its on periodically.

- "sos" services - I would call BMW and ask to have it turned off (its on by default). The signing of the doc might be depending on the state you're in. Mine's NJ reg, but NY dealer.

If BMW ever shares the location data with third parties other than police, I would have major issues with all of this.

To answer sibling post, SIM cards are located inside the Navi computer, which is a big gray/black metal box behind one of side access panels within the trunk (or under trunk for most sedans). BMWs can also be coded (google that- dealer wont do it) to not use SIM data completely. If you truly want teleservices disabled, find a friendly BMW modder shop adept at coding and they'll help you void your car's warranty :)

Re: A Dutch first: Ingenious BMW theft attempt

#123

Post by xkcd-sucks »

soneil wrote: post #7
ashleyn wrote: post #2

Immediately, I'd be wondering what very powerful spy agency or organisation felt the need to break into my car, and why.

I'm not sure I'd be so paranoid. We've read of people managing to hack the key openers, etc. They're an attractive target. I mean, if you were going to leave a box containing $30,000 on your doorstep. A box not only containing 30k, but a box that was labelled that it contained 30k. How would you protect it? Put a serial number on it so you can prove it's yours? A bike lock? A motion sensor? Cement it into the ground?…

Presumably it takes a business and facilities to to realize its value, so the barrier to entry is high. Like the thief needs access to a shady used car dealer or shady used parts business, unless it's a low volume rural thing where they can strip cars in the backyard and sell parts on eBay.

Assuming the 30000$ car is one ton, that's only 15$ per pound of car... Not too valuable.

Re: A Dutch first: Ingenious BMW theft attempt

#124

Post by drglitch »

driverdan wrote: post #66
jiveturkey wrote: post #45

Earlier quoted context omitted.

No, not entirely. Please give me the instructions on how to opt out. Whenever someone asks (which is rare), the forums are filled with replies like "why would you not want BMW to monitor you? are you a fraudster?" IOW the forums do not know how to opt out either. Everytime I take my 2016 in to service, I ask both sales and service to disable teleservices. They say they cannot. I then call BMW teleservices (every time…

Can you pull the SIM card?

Cards can be pulled physically but not replaced without changing out hardware associated with telenav units. See: https://f30.bimmerpost.com/forums/showthread.php?t=1149540

Re: A Dutch first: Ingenious BMW theft attempt

#125

Post by 21 »

avar wrote: post #27

Reading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands? Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming". Meanwhile, wherever this guy lives they're sending officers because some BMW call cent…

Don't you read the news? There have recently been articles in the international press that Amsterdam is a jungle right now:

> Official ombudsman, Arre Zuurmond told Dutch paper Trouw that "the city centre becomes an urban jungle at night". He added: "Criminal money flourishes, there is no authority and the police can no longer handle the situation."

https://www.mirror.co.uk/news/world-news/amsterdam-tourists-...

Re: A Dutch first: Ingenious BMW theft attempt

#126

Post by Rjevski »

bri3d wrote: post #118
Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own…

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change.

This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new firmware, could you install and run it please?”.

Also I’m surprised they’d go after tuners, considering those are usually the most loyal customers you could dream of.

Re: A Dutch first: Ingenious BMW theft attempt

#127

Post by tlrobinson »

Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

"Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?)."

Huh, is it legal to "crack" alarms/immobilizers without proof of ownership, especially if you suspect it might be stolen?

Re: A Dutch first: Ingenious BMW theft attempt

#128

Post by dzhiurgis »

gambiting wrote: post #58
jasoncartwright wrote: post #39

Earlier quoted context omitted.

Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.

If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.

Is that how contactless payment cards are protected?

Re: A Dutch first: Ingenious BMW theft attempt

#129

Post by N0RMAN »

jimmy1 wrote: post #22
noncoml wrote: post #4

I was sure he would wake up next morning and find the car missing. I think he was really lucky that this wasn’t the case and the thieves waited(?) for the next night.

Yeah, I don't understand this. After you went through all the work of disabling the SOS, you can just take the car then, unless breaking the window was the way they initially got inside, and maybe they were thinking that the person would blindly repair the broken window to increase the value of the car on the black market? I don't know.

Wouldn't a jammer do the thing?

Re: A Dutch first: Ingenious BMW theft attempt

#130

Post by mygo »

tlrobinson wrote: post #127
Rjevski wrote: post #101

I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of…

"Sometimes less so, but I’d do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?)." Huh, is it legal to "crack" alarms/immobilizers without proof of ownership, especially if you suspect it might be stolen?

anyone can call a mobile locksmith and ask them to help them get into their locked car stuck in the KFC parking lot with their keys inside. It’s usually up to the locksmith to obtain proof of ownership. otherwise they’re running the risk of committing a break-in. they usually have you sign something beforehand that tries to mitigate their liability. however I’ve used some shady locksmiths who just pulled up in the passenger seat of their friend’s ride and did it without a contract and took cash. at least they didn’t scratch my car.
Post reply on HN