Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keyless BMW cars prove to be very easy to steal

hackaday.com

Post reply on HN
Print view View original

21–30 of 111 posts

Re: Keyless BMW cars prove to be very easy to steal

#21

Post by codeka »

jonah wrote: post #15
codeka wrote: post #10

Earlier quoted context omitted.

That makes sense, but I can see the argument that not all features need to be open to consumers.

That seems counter to the "we want full access to our systems and hardware" position commonly taken on HN. It sounds very much like advocating for Apple's Gatekeeper [1] since it will keep unauthorized software from running on OS x. [1] http://www.apple.com/osx/what-is/security.html

Yes, you're right. And thinking about it, I think projectedoptics's solution is just better all-round anyway - why can you connect to the OBD at all while the alarm is armed?

Re: Keyless BMW cars prove to be very easy to steal

#22

Post by jrabone »

__alexs wrote: post #19
codeka wrote: post #10

Earlier quoted context omitted.

That makes sense, but I can see the argument that not all features need to be open to consumers.

But I'd rather not have to pay $200 for a spare key thanks...

Um, it's a GBP 40K car; I don't care.

Re: Keyless BMW cars prove to be very easy to steal

#23

Post by jrabone »

CamperBob2 wrote: post #14
__alexs wrote: post #6

Earlier quoted context omitted.

The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off. There's a number of cheap and obvious tricks BMW could have used to make the RF…

If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in. What in the world was wrong with plain old car keys -- especially w…

You might be over-thinking this. It's possible to disable the factory alarm motion sensor by double-pressing the lock button on the key fob. This is a feature for people (like me) who take their car on ferries, and who don't enjoy listening to a cacophony of car alarms while on the ferry (I appear to be in minority here, if recent trips were anything to go by)

Apparently a fair few owners don't know this feature exists (didn't read the manual/didn't have a manual) and were in the habit of "checking it was locked".

So, if you can't remember if you locked a BMW, UNLOCK it first, then LOCK it. Locking twice disables the alarm.

Re: Keyless BMW cars prove to be very easy to steal

#24

Post by rdl »

__alexs wrote: post #20
rdl wrote: post #17

Earlier quoted context omitted.

Regular car keys are a pain in a lot of ways, and not all that secure, either. To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a fara…

> To really do this correctly, you need to have cryptographic challenges between a key and an ECU, Nonsense. The problem isn't cloning the key, the problem is that you are reprogramming the lock to accept this new key you happen to have with you. No amount of crypto is going to save you when your verifier is full of holes. You can't even use signing to only accept approved programming devices since OBD regulations en…

1) The cryptographic challenges are a necessary but not sufficient part of building a secure car access control system. All the active components in a car are horrible from a security perspective, usually huge libraries from third-party manufacturers, and all kind of duct-taped together. So bad that a malformed audio cd in the entertainment system could actually totally pwn the car, including driving controls.

2) There are wireless extensions to OBD-II to run tire pressure monitors. You can do a no-touch OBD-II hack. Presented at USENIX last year.

Tesla is really the only manufacturer who is likely to do better, since they build a lot of stuff in-house vs. buying badly documented components. I would love to audit the Model S (especially if in doing so I got an earlier delivery position).

Re: Keyless BMW cars prove to be very easy to steal

#25

Post by michaelt »

codeka wrote: post #3

Isn't the solution here that only BMW authorized devices should be able to connect to the ODB? Or is that already the case? I guess it just takes one unscrupulous dealer to upload their certificate.

With cars and fault diagnosis increasingly computerised, car makers were in a position to encrypt or obfuscate diagnostic messages so that you could only view and reset 'check engine' codes at official dealers who had costly diagnostic equipment.

The intention of OBD-II is to keep independent mechanics in business (and hence the car repair market operating properly) by preventing car makers from doing this. Sounds like a good idea to me - dealerships are already overpriced, I can't imagine how bad it would be without independent garages exerting downward pressure on prices.

Whether this should extend as far as an open standard for bypassing the keyless ignition without first presenting a valid key is another matter.

Re: Keyless BMW cars prove to be very easy to steal

#26

Post by rdl »

__alexs wrote: post #19
codeka wrote: post #10

Earlier quoted context omitted.

That makes sense, but I can see the argument that not all features need to be open to consumers.

But I'd rather not have to pay $200 for a spare key thanks...

I think you mean $200 for the key, plus $50 to cut it, plus $250/hr labor to program it at the dealer (minimum of an hour).

Re: Keyless BMW cars prove to be very easy to steal

#27

Post by __alexs »

jrabone wrote: post #22
__alexs wrote: post #19

Earlier quoted context omitted.

But I'd rather not have to pay $200 for a spare key thanks...

Um, it's a GBP 40K car; I don't care.

OBD-II is used on loads of vehicles. If the regulation didn't mandate that this was an open protocol in 10 years every $500 beater is going to be a write off as soon as you lose the keys.

Re: Keyless BMW cars prove to be very easy to steal

#28

Post by jrabone »

[deleted] wrote: post #8
__alexs wrote: post #6

Earlier quoted context omitted.

The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off. There's a number of cheap and obvious tricks BMW could have used to make the RF…

[deleted]

See http://www.e90post.com/forums/showthread.php?t=670339 and http://www.e90post.com/forums/showthread.php?t=713085 - there are people who will do this in the UK.

Re: Keyless BMW cars prove to be very easy to steal

#29

Post by stevejalim »

projectedoptics wrote: post #12

If the alarm is armed shouldn't it be triggered if something connects to the OBD port? Not actually prevent the port functioning just trigger the alarm.

This makes such good sense. I wonder if BMW could even enable it with a software patch?
Post reply on HN