29 ms·
To anyone with any background at all in computer security, this is such a "duh" moment. If Sony et al can't secure their massively important corporate infrastru
by coldpie 11y ago
To anyone with any background at all in computer security, this is such a "duh" moment. If Sony et al can't secure their massively important corporate infrastructure, what are the odds your car's wireless computers are secure in any way? They aren't, they knew it, and you knew it. Sorry.
It'll be interesting to watch the fallout from these obviously-present vulnerabilities. I see three possible outcomes, in decreasing order of likelihood: status quo, where they just "fix" the bugs as they hit the news; some sort of massive push towards real computer security, in this and other industries; or a massive reduction in features to avoid the flaws.
This is really just another symptom of the current state of computer security, best described as "a joke." My guess is in 50 years we'll have decent computer security. There's nothing that precludes it in theory. But it's going to be an ugly, ugly couple of decades while we pay off the wave of computer-security-debt that we have been riding.
- CaveTech 11y agoThe attack vectors available for use against a corporation is infinitely larger than those available for a car. It's not really a fair comparison.
- binarymax 11y agoNot only that - but the 'duh' moment for me was the 96bit key size.
- mkj 11y ago96 bits by itself probably isn't within reach of brute forcing - I assume the algorithm itself had flaws.
- jacobolus 11y agoWhat I want to know is why the car will continue to accept 100 trial keys per second after the first 100,000 attempts failed. Shouldn’t there be some kind of exponential back-off after failures? If after the first 1000 failed keys it would only accept e.g. one new try every few seconds, it would then take 2–3 orders of magnitude more time to brute force.
- lisper 11y agoThat could be exploited to produce a trivial denial-of-service attack.
- jacobolus 11y agoWouldn’t you need to have a device actively running within a few feet of the vehicle to run such an attack? Couldn’t the car start blaring an alarm or something in that case? We’re not talking about a website here.
- lisper 11y ago> Wouldn’t you need to have a device actively running within a few feet of the vehicle to run such an attack? Nope. Just a high-gain antenna. > Couldn’t the car start blaring an alarm or something in that case? It could. But that might not help. For example: you're driving your Mazerati down the road when it suddenly stops and the alarm goes off. The next day you get a letter saying, "If you don't want yesterday's little incident to become a regular event, send BTC500 to the following address...."
- jessaustin 11y agoIf the car responds to RFID keys at all when driving, that is a flaw.
- lisper 11y agoIf I get out of my car with the engine still running it starts beeping. I don't know if it will actually turn the engine off, but it obviously knows that the key has departed the vehicle.
- tarpherder 11y agoOr it detected your bum leaving its seat.
- paulmd 11y agoAccording to TFA, they "overheard 2 communications between the keyfob and the transponder", which reduced the number of possible keys to 196,607. This was brute-forceable in half an hour. So the answer is both - the algorithm was flawed enough to reduce the strength, but they were brute forcing it the rest of the way. 2 communications isn't much at all. Getting something from your car and locking it back up is all it takes.
- Someone 11y agoWorse, the paper says the cipher has only 56 bits of internal state (made me think of DES, but that isn't at play here) Even worse, they get it down to 48 bits.
- mikeash 11y agoYeah, that's kind of a weird comparison. You can't really tailgate someone through a car door to gain physical access, or social engineer your way to the car's server closet, or spam the car's employees with phishing e-mails.
- coldpie 11y agoIt was a general point about the state of computer security. In 2015, if you're connecting a computer to the internet, you're vulnerable. If your computer has non-trivial wireless functionality (in this case, keyless entry), you're vulnerable. The only question is whether someone cares enough to hack you, in particular.
- danielweber 11y agoThe article isn't about people remotely taking over cars or disabling cars. It's that the anti-theft system has a flaw. That's not nothing, but it doesn't put anyone's safety at risk.
- AnimalMuppet 11y agoIn particular, it's not necessarily worse than the status quo ante. Cars had mechanical locks, which were pickable. A "slim jim" could unlock many cars. Once you were in the door, you could hotwire the ignition. So to be able to defeat a computerized anti-theft system... no gain from the computerization, but is there any loss from it?
- spdionis 11y agoNo gain implying that lockpicking a car and hacking it is of the same level of difficulty.
- AnimalMuppet 11y agoTrue, and they probably aren't. So which do you think is harder?
- crpatino 11y agoIts not a matter of difficulty, but of reproducibility. Mechanical locks imply that each individual thief needs to learn how pick locks. With computerized locks, you only need one hacker to crack the security for each model of car, and then a bunch of two-dime thugs will only need to download the app and get going in with the car-thief franchise.
- toyg 11y agoThe difference is that physical attacks require 1) individual skills and 2) prolonged physical contact in compromising pose. Where every single thief had to be a skilled lockpicker before, now you just need a few specialized crackers and then you can mass-produce user-friendly hacking devices or even downloadable software. Where a thief had to spend several minutes in a compromising pose near the car, often carrying suspicious tools, now he can just sit on a bench nearby, wait for the magic click and then choose the right moment to stroll in. A passerby might as well think he's the owner.
- ProAm 11y agoWhat's the phrase? "Locks keep honest people honest." This has always been the case.
- rsync 11y ago"I see three possible outcomes, in decreasing order of likelihood: status quo, where they just "fix" the bugs as they hit the news; some sort of massive push towards real computer security, in this and other industries; or a massive reduction in features to avoid the flaws." Only one of those three is the correct answer, and it is the third one. Your car does not need a wireless network - since you have a newer, nicer one in your pocket every 18 months. Neither does your refrigerator nor your smoke detector. These are self-inflicted problems and they're easy to solve - just remove the gratuitous complexity.
- amirmc 11y agoMost people do not have a background in security so this is anything but a 'duh' moment for them. The more news like this that makes it to the mainstream media, the more hopeful I am that regular folks will learn the state of security today.