3 ms·

Can't believe that they didn't think to include a way to verify the USB's integrity with strong crypto, and clear instructions on how to do this. Yes, non-tech

by jnbiche 11y ago

Can't believe that they didn't think to include a way to verify the USB's integrity with strong crypto, and clear instructions on how to do this. Yes, non-tech savvy customers would be vulnerable to phishing (since such a letter would simply omit this step), but at least it would be possible for tech-savvy individuals to do so. If they had done this right, they would have sent the USB with a validation step and widely advertised this step, so that all users would be aware of the need to do it, maybe even branding a simple software package to verify the contents as something like "UConnect SafeCheck". Hopefully, they at least have a secure way to download it online (but given actions up to now, I'm not optimistic). Edit: Owners can download it via https (albeit with SHA-1), but I'd be surprised if there's a way to validate the integrity of the downloaded file. Also, they're advertising that link without the SSL (and indeed, it allows non-SSL connections).

ricardobeat 11y ago
I wonder what the 'Secure' printed on it stands for. Maybe each car has it's own private key, meaning you'd have to physically hack the car first in order to get a fake update stick to work?
deleted 11y ago
[deleted]
tokenizerrr 11y ago
Better would be to have the car perform the validation. I'd be shocked if this didn't actually happen.
- brudgers 11y ago
  My understanding of the original hack is that the root of the hack is a flaw in the existing platform validation. In particular that the random seed is set from the clock [not a bad practice in itself] and the clock is activated the first time the car is fired up [a somewhat problematic, since an attacker can be assumed to have the vehicle date via the VIN]. However, it's not even that hard since the first time the vehicle is fired up, the clock is at it's default time and date, and this narrows down the seeds to the range of potential latencies between the clock coming on line and the generation of the entropy pool. In other words, the USB key can't use stronger crypto than vehicle and that crypto is poorly implemented [again, based on my understanding of the original hack].
  - NetDissent 11y ago
    Yep and Chrysler have managed to change the open 6667 IRC channel into a closed one. Without access to that, the hack is now obsolete
    - tokenizerrr 11y ago
      These cars use IRC?

by jnbiche 11y ago

ricardobeat 11y ago

I wonder what the 'Secure' printed on it stands for. Maybe each car has it's own private key, meaning you'd have to physically hack the car first in order to get a fake update stick to work?

deleted 11y ago

[deleted]

tokenizerrr 11y ago

Better would be to have the car perform the validation. I'd be shocked if this didn't actually happen.

brudgers 11y ago
My understanding of the original hack is that the root of the hack is a flaw in the existing platform validation. In particular that the random seed is set from the clock [not a bad practice in itself] and the clock is activated the first time the car is fired up [a somewhat problematic, since an attacker can be assumed to have the vehicle date via the VIN]. However, it's not even that hard since the first time the vehicle is fired up, the clock is at it's default time and date, and this narrows down the seeds to the range of potential latencies between the clock coming on line and the generation of the entropy pool. In other words, the USB key can't use stronger crypto than vehicle and that crypto is poorly implemented [again, based on my understanding of the original hack].
- NetDissent 11y ago
  Yep and Chrysler have managed to change the open 6667 IRC channel into a closed one. Without access to that, the hack is now obsolete
  - tokenizerrr 11y ago
    These cars use IRC?