Thieves Break Into Cars Using Mysterious 'Black Box' • Hacker News Board

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#31

Post by just2n » Sat, Mar 01, 2014, 2:10 AM UTC

lisper wrote: post #30

just2n wrote: post #28

This is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe). With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large. The same goes…

> How is this kind of thing handled in the medical and aviation industries? You need government approval (FDA or FAA respectively) to bring a product to market. Are you sure you want that kind of bureaucratic overhead (and the associated politics) in your car and home alarm?

I don't think "government" means "good engineering", I think that it should be thoroughly vetted by sufficient expertise.

I'm not sure if the FDA or FAA are capable of doing that, given how the government is really, really bad at building or contracting software (in general).

If only we could have some kind of standardized software to power these devices that is built by the community at large and thoroughly reviewed for correctness. Even at the cost of limiting hardware, I think that's an option.

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#32

Post by rjd » Sat, Mar 01, 2014, 2:25 AM UTC

seventytwo wrote: post #2

Anyone know how this is done? Maybe brute forcing the keyless entry? Maybe damaging the antenna/preamp with something high-powered would work if there's a fail safe feature to unlock the car in that event?

I read last year the (Texas?) police had some similar devices in there possession. The ones the article talked about listened to lock frequencies and could then work out the unlock frequency from it. So the criminals would scan car parks waiting for people to lock cars that where brought in, wait for the person to leave, then approach the car and unlock it with the captured frequency.

I have no idea if thats what all these devices are, or how legit the article was, but seems legit to me.

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#33

Post by baddox » Sat, Mar 01, 2014, 2:29 AM UTC

just2n wrote: post #28

This is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe). With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large. The same goes…

> The competition should not be in the critical software. That much needs to be standard. The competition should be around fluff, construction quality, body design, brand, perks, horsepower, etc.

Could you explain your reasoning for this claim? Does competition lead to better/more efficient products, or doesn't it? Why do you desire to leave non-critical parts to competitive forces, but not the critical parts?

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#34

Post by herbertwest » Sat, Mar 01, 2014, 2:29 AM UTC

just2n wrote: post #28

This is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe). With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large. The same goes…

I'm surprised that it's taking so long for these kind of stories to hit the news. Here's a paper from three years ago describing some disturbing attack vectors on a modern automobile: http://www.autosec.org/pubs/cars-usenixsec2011.pdf

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#35

Post by baddox » Sat, Mar 01, 2014, 2:31 AM UTC

hnriot wrote: post #22

WalterBright wrote: post #21

My anti-theft device is a gearshift. Nobody knows how to drive them anymore.

except everyone who didn't learn to drive in the USA.

In the USA, the vast majority of drivers, and probably an even larger majority of would-be car thieves, learned to drive in the USA.

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#36

Post by herbertwest » Sat, Mar 01, 2014, 2:32 AM UTC

Sae5waip wrote: post #3

seventytwo wrote: post #2

Anyone know how this is done? Maybe brute forcing the keyless entry? Maybe damaging the antenna/preamp with something high-powered would work if there's a fail safe feature to unlock the car in that event?

I've recently seen a presentation about attacks on a widely used system used in current cars. There are a couple of different ways that are significantly better than brute force (as in: works against real cars in seconds to a few minutes). (Though since key length is only 48 bit, even brute forcing might be practical.) This might interest you: https://www.usenix.org/system/files/conference/usenixsecurit...

I post this whenever this subject surfaces. Great paper.

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#37

Post by rl3 » Sat, Mar 01, 2014, 2:40 AM UTC

valarauca1 wrote: post #23

rl3 wrote: post #11

Too bad there isn't a market for modern vehicles with minimalist, open-source embedded systems. That would be cool.

Writing real time serial DAQ applications that will run for 20-30 years on end on custom 20 year old microprocessor isn't exactly for the faint of heart. Source: this is part of my job, I work in fuel systems.

I meant more in the sense that it would make all the subsystems of the vehicle subject to review by security researchers and hobbyists.

Things like backdoors in key/locking mechanisms or even gross incompetence would be difficult to hide when the underlying hardware and software was open source.

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#38

Post by vinalia » Sat, Mar 01, 2014, 2:49 AM UTC

There was a pretty good talk at 29C3 about side-channel analysis and how it can break secret keys of wireless devices and smartcards. [1]

With knowledge of cryptanalysis and lots of free time I think it's conceivable that someone could have cracked the system. I wonder if car companies test their crypto very rigorously?

1. https://www.youtube.com/watch?v=Y1o2ST03O8I

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#39

Post by awor » Sat, Mar 01, 2014, 3:17 AM UTC

just2n wrote: post #31

lisper wrote: post #30

Earlier quoted context omitted.

> How is this kind of thing handled in the medical and aviation industries? You need government approval (FDA or FAA respectively) to bring a product to market. Are you sure you want that kind of bureaucratic overhead (and the associated politics) in your car and home alarm?

I don't think "government" means "good engineering", I think that it should be thoroughly vetted by sufficient expertise. I'm not sure if the FDA or FAA are capable of doing that, given how the government is really, really bad at building or contracting software (in general). If only we could have some kind of standardized software to power these devices that is built by the community at large and thoroughly reviewed…

It'd be neat if they could come to some sort of a standard on this so that its an open, reviewable piece of software that handles the crypto side of things and then passes that off and they (the Automakers) can "customize" the rest of the software all they want.

Somewhat (but also not at all) like a more advanced ODBII[0]

[0]http://en.wikipedia.org/wiki/On-board_diagnostics#OBD-II

Re: Thieves Break Into Cars Using Mysterious 'Black Box'

#40

Post by just2n » Sat, Mar 01, 2014, 3:21 AM UTC

baddox wrote: post #33

just2n wrote: post #28

This is only the tip of the iceberg as far as this kind of thing is concerned (this kind of thing being people relying on software to keep them and their belongings safe). With peoples' lives at risk and with cars representing huge investments for many people, it's probably about time to get regulation that requires the software systems that are interacting with vehicles to be open to experts at large. The same goes…

> The competition should not be in the critical software. That much needs to be standard. The competition should be around fluff, construction quality, body design, brand, perks, horsepower, etc. Could you explain your reasoning for this claim? Does competition lead to better/more efficient products, or doesn't it? Why do you desire to leave non-critical parts to competitive forces, but not the critical parts?

It doesn't because 99% of people are entirely and completely ignorant of these systems and their importance. And no amount of discussion or even car theft is going to put it in terms that they understand. Here the news item is "with a black box that nobody understands." That wording is HORRIBLE for HN. Because it makes it sound like it's black magic and this group has found some genie that opens cars. Instead, it's more likely a simple exploit of a very vulnerable system. But that wording gives you a glimpse into how most people see technology. It's just magic. Their cares about how software works are nonexistent enough. There's no reference for "good" vs "bad" crypto, insecure design, etc.

Until we have a car that kills 500 people because of faulty software, it's just not that important to people, which means there's no pressure in industry to get it right. People understand "my car will kill me if X isn't good." That's why people understand getting their tires rotated and replaced. That's why they understand to get checkups and to replace belts, filters, oil, etc. That's why they understand you need to replace your brake pads and other such hardware, even if it feels a little expensive. But when you point out that very few people have ever even been injured by bad software in a car, they think "well it can't be that bad." And "good enough", especially in a market like the US where mediocre is what sells the most, is where the market stops innovating.

I hope a company like Tesla is a little more concerned with the quality, though. Maybe we can get a decent example of how to do things.