3 ms·

These would not be problems if the car software/hardware is properly constructed. The issues with the odometer, alarm and doors could be solved by signing the r

These would not be problems if the car software/hardware is properly constructed. The issues with the odometer, alarm and doors could be solved by signing the relevant binaries/data with a digital key. The issue with the bus connector is close to negligence in my non-professional opinion (the fuel cap is locked on my car as is the switch to release the bonnet). The security by obscurity argument is pretty dead at this time -- it doesn't magically get resurrected just because the object we are securing is a car.

Dylan16807 11y ago
Signing? Or just don't let it be changed. Odometers don't need updates.
- rjsw 11y ago
  They do need updates if you need to replace the ECU where the odometer reading is stored.
  - Dylan16807 11y ago
    Weren't we talking about diagnostic tools and security as it relates to tampering? Replacing the entire odometer is a different issue entirely. And how does support for replacing a circuit board imply that the circuit board needs to support software updates? I don't understand what you're saying at all.
    - rjsw 11y ago
      A car is basically a LAN of fairly generic microcontrollers, they are fitted to the car then programmed in place to match their required function, the official odometer value will be stored in one of these microcontrollers picked at random for that particular car. The main function of the one that gets chosen could be anything, it could control seat position or electric windows for example. If this controller needs to be replaced then the new one will need to be programmed with the correct software then the old odometer value stored into it. The diagnostic tools provided to official dealerships handle reading fault codes and reprogramming the microcontrollers fitted to the car. I think that OBD-II is about as good a compromise as you are going to get to allow aftermarket diagnostics. In hindsight, it could have been better to have treated the car as a WAN, with every controller firewalled off from each other, particularly as the manufacturers have been talking for years about allowing access to the vehicle bus from outside so that cars can be linked together into a train and all changing speed at the same time. I don't think you would choose to do this with CAN though and I don't know of any proposals for newer network standards though it is a few years since I was a member of any of the ISO committees that worked on this.

Dylan16807 11y ago

Signing? Or just don't let it be changed. Odometers don't need updates.

rjsw 11y ago
They do need updates if you need to replace the ECU where the odometer reading is stored.
- Dylan16807 11y ago
  Weren't we talking about diagnostic tools and security as it relates to tampering? Replacing the entire odometer is a different issue entirely. And how does support for replacing a circuit board imply that the circuit board needs to support software updates? I don't understand what you're saying at all.
  - rjsw 11y ago
    A car is basically a LAN of fairly generic microcontrollers, they are fitted to the car then programmed in place to match their required function, the official odometer value will be stored in one of these microcontrollers picked at random for that particular car. The main function of the one that gets chosen could be anything, it could control seat position or electric windows for example. If this controller needs to be replaced then the new one will need to be programmed with the correct software then the old odometer value stored into it. The diagnostic tools provided to official dealerships handle reading fault codes and reprogramming the microcontrollers fitted to the car. I think that OBD-II is about as good a compromise as you are going to get to allow aftermarket diagnostics. In hindsight, it could have been better to have treated the car as a WAN, with every controller firewalled off from each other, particularly as the manufacturers have been talking for years about allowing access to the vehicle bus from outside so that cars can be linked together into a train and all changing speed at the same time. I don't think you would choose to do this with CAN though and I don't know of any proposals for newer network standards though it is a few years since I was a member of any of the ISO committees that worked on this.