6 ms·

And when manufacturers start doing that, people will complain that they don't "own" their cars anymore. [1] 1: http://boingboing.net/2015/05/21/gm-says-you-don

by csours 11y ago

And when manufacturers start doing that, people will complain that they don't "own" their cars anymore. [1] 1: http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-ca.html http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-c... Disclaimer: I work for GM.

saulrh 11y ago
Keep a suitable private key for signing firmware in the car, locked in a secure box that can only be unlocked with two copies of the car's ignition keys? I'd call that sufficient security, but it'd also clearly allow me to get to the keys if I want.
matteotom 11y ago
There is probably a middle ground here. For example, lock it down like the parent comment suggested, but have a process to unlock it, requiring (for example) physical access and some vehicle specific file from the manufacturer requiring proof of ownership and a scary warning. (I believe some phone manufacturers had a similar process for unlocking bootloaders a while back.) This would still allow enthusiasts and security researchers to "own" their vehicle and would keep malicious actors out (for the most part).
- pki 11y ago
  Wouldn't this basically make cars no longer street legal?
krasin 11y ago
There's still the right and secure way to go: 1) By default the cat is "locked", and uses a manufacturer-issued public key to verify the signature of updates 2) A car owner can "unlock" the car, by creating a key pair, and asking the manufacturer to add / replace (debatable) the new public key to the car. Right after that, the owner has an ability to modify the firmware, but everything is still secure. And it's up to the adult owners to manage their private keys and be careful with updates. 3) There should be a simple way to factory-reset the car (with either the owner, or the manufacturer signature).
- teraflop 11y ago
  Under this model, if you buy a used car, how can you be sure it doesn't have keys that are controlled by someone else? You can follow the "factory-reset" procedure, but how do you know the reset mechanism hasn't been tampered with?
  - mynameisvlad 11y ago
    I would assume in this perfect scenario that the factory reset lives in some ROM somewhere that nobody, not even the manufacturer can touch post-release.
  - tzs 11y ago
    They can design it so that the firmware is in two parts. The first part does minimal initialization and then gives control to the second part, which is where most of the functionality is. The first part is also the part responsible for implementing the firmware update protocol and the reset procedure. The first part would either not allow any update to replace the first part, or it would only allow the first part to replace with factory signed firmware. Alternatively (or in addition) they could have a diagnostic connector that lets external hardware read the firmware memory. You could then do the factory reset on your used car, and then hook something up to that diagnostic connector and have it compute a hash of the firmware that you can check to make sure it is the right firmware. An Arduino should be sufficient as the thing to read and hash the firmware.
    - btown 11y ago
      The second approach is likely preferable - with the first approach, FOSS Stalwarts will still complain that there's non-free software in the system.
      - dlubarov 11y ago
        They could still open source the first system's firmware code. FOSS doesn't imply easily modifiable, does it? E.g., rms says he used a Lemote Yeeloong because of its free BIOS, but AFAIK he couldn't have reprogrammed it unless he removed the BIOS chip from the motherboard.
peterwwillis 11y ago
We (consumers) had to deal with that over 10 years ago. My old Lexus still has some kind of proprietary diagnostic system that only dealerships can access, and we get stuck with dinky ODB2. Did manufacturers suddenly start getting more transparent and compatible with their vehicle diagnostic and control systems? Also: virtually every consumer in the world would choose safety from some 'evil hacker force' rather than the ability to maintain their factory entertainment system themselves. There's really zero reason the nav/entertainment system should be on the same communications network as the engine and brakes, anyway.
snowwrestler 11y ago
Put a key on a piece of hardware and provide it with the car. The firmware will not update without that key. Now the owner can update their firmware, or hand the key to their mechanic to do it for them. If they lose the key, they get to pay their mechanic to source and install a new controller that comes with a new key. Or heck, just put a switch on the controller that must be manually closed for a firmware update to proceed. What matters most is preventing quiet firmware updates over the air.
- Too 11y ago
  Even if the update is not quiet, how do you know that it's authentic? If the hackers can trigger a "update available, please flip the update switch and restart your car"- notification, you will not be able to tell if this came from the manufacturer or the hacker.
  - snowwrestler 11y ago
    In my first idea, the hardware "key" holds two cryptographic keys. One is a private key, whose public counterpart is held by the manufacturer. This authenticates the vehicle to the manufacturer. The other key is a public key, whose private counterpart is also at the manufacturer. This authenticates the manufacturer to the vehicle. My second idea does not accomplish any new authentication (beyond what over the air updates already do). However it does prevent silent updates, which is an improvement over today. Today, not only can a vehicle owner not tell if an update came from the manufacturer or hacker, they can't even tell that an update happened at all.
Qantourisc 11y ago
You could for example hook up the radio to a CANbus that has a minifirewall/proxy in it, allowing only read from the radio and write/read to the radio.

by csours 11y ago

saulrh 11y ago

Keep a suitable private key for signing firmware in the car, locked in a secure box that can only be unlocked with two copies of the car's ignition keys? I'd call that sufficient security, but it'd also clearly allow me to get to the keys if I want.

matteotom 11y ago

There is probably a middle ground here. For example, lock it down like the parent comment suggested, but have a process to unlock it, requiring (for example) physical access and some vehicle specific file from the manufacturer requiring proof of ownership and a scary warning. (I believe some phone manufacturers had a similar process for unlocking bootloaders a while back.) This would still allow enthusiasts and security researchers to "own" their vehicle and would keep malicious actors out (for the most part).

pki 11y ago
Wouldn't this basically make cars no longer street legal?

krasin 11y ago

There's still the right and secure way to go: 1) By default the cat is "locked", and uses a manufacturer-issued public key to verify the signature of updates 2) A car owner can "unlock" the car, by creating a key pair, and asking the manufacturer to add / replace (debatable) the new public key to the car. Right after that, the owner has an ability to modify the firmware, but everything is still secure. And it's up to the adult owners to manage their private keys and be careful with updates. 3) There should be a simple way to factory-reset the car (with either the owner, or the manufacturer signature).

teraflop 11y ago
Under this model, if you buy a used car, how can you be sure it doesn't have keys that are controlled by someone else? You can follow the "factory-reset" procedure, but how do you know the reset mechanism hasn't been tampered with?
- mynameisvlad 11y ago
  I would assume in this perfect scenario that the factory reset lives in some ROM somewhere that nobody, not even the manufacturer can touch post-release.
- tzs 11y ago
  They can design it so that the firmware is in two parts. The first part does minimal initialization and then gives control to the second part, which is where most of the functionality is. The first part is also the part responsible for implementing the firmware update protocol and the reset procedure. The first part would either not allow any update to replace the first part, or it would only allow the first part to replace with factory signed firmware. Alternatively (or in addition) they could have a diagnostic connector that lets external hardware read the firmware memory. You could then do the factory reset on your used car, and then hook something up to that diagnostic connector and have it compute a hash of the firmware that you can check to make sure it is the right firmware. An Arduino should be sufficient as the thing to read and hash the firmware.
  - btown 11y ago
    The second approach is likely preferable - with the first approach, FOSS Stalwarts will still complain that there's non-free software in the system.
    - dlubarov 11y ago
      They could still open source the first system's firmware code. FOSS doesn't imply easily modifiable, does it? E.g., rms says he used a Lemote Yeeloong because of its free BIOS, but AFAIK he couldn't have reprogrammed it unless he removed the BIOS chip from the motherboard.

peterwwillis 11y ago

We (consumers) had to deal with that over 10 years ago. My old Lexus still has some kind of proprietary diagnostic system that only dealerships can access, and we get stuck with dinky ODB2. Did manufacturers suddenly start getting more transparent and compatible with their vehicle diagnostic and control systems? Also: virtually every consumer in the world would choose safety from some 'evil hacker force' rather than the ability to maintain their factory entertainment system themselves. There's really zero reason the nav/entertainment system should be on the same communications network as the engine and brakes, anyway.

snowwrestler 11y ago

Put a key on a piece of hardware and provide it with the car. The firmware will not update without that key. Now the owner can update their firmware, or hand the key to their mechanic to do it for them. If they lose the key, they get to pay their mechanic to source and install a new controller that comes with a new key. Or heck, just put a switch on the controller that must be manually closed for a firmware update to proceed. What matters most is preventing quiet firmware updates over the air.

Too 11y ago
Even if the update is not quiet, how do you know that it's authentic? If the hackers can trigger a "update available, please flip the update switch and restart your car"- notification, you will not be able to tell if this came from the manufacturer or the hacker.
- snowwrestler 11y ago
  In my first idea, the hardware "key" holds two cryptographic keys. One is a private key, whose public counterpart is held by the manufacturer. This authenticates the vehicle to the manufacturer. The other key is a public key, whose private counterpart is also at the manufacturer. This authenticates the manufacturer to the vehicle. My second idea does not accomplish any new authentication (beyond what over the air updates already do). However it does prevent silent updates, which is an improvement over today. Today, not only can a vehicle owner not tell if an update came from the manufacturer or hacker, they can't even tell that an update happened at all.

Qantourisc 11y ago

You could for example hook up the radio to a CANbus that has a minifirewall/proxy in it, allowing only read from the radio and write/read to the radio.