4 ms·

Spot on. Many manufacturers use extended OBD (UDS protocol) commands to handle specific tasks. Sometimes the DIDs (requestable variables) get "discovered" by r

Spot on. Many manufacturers use extended OBD (UDS protocol) commands to handle specific tasks. Sometimes the DIDs (requestable variables) get "discovered" by reverse engineering the dealership's software (or other third party vehicle specific diagnostic software). Most cars after 2008 use CANbus for the OBD port, so you can perform tasks and observe the messages using a cheap microcontroller+CANbus controller. Also, I don't know if you work on BMWs often, but I just wanted to add that you can clear/reset the battery subsystem on a modern BMW/Mini using a $20 K/D-CAN cable from eBay and illegally obtained BMW INPA software. You can use INPA to perform many tasks. Rain sensor recalibration, battery recalibration, ABS bleed procedure, transmission adaptation reset, etc... Either way, this is well beyond the ability of the average mechanic, which is why this issue is important. My father runs a body shop and he constantly has to call the "computer guy" to reset airbag lights. Some cars even require a reset procedure when headlights are changed...it's crazy. The only good thing is that since so many cars use CANbus everywhere, it's pretty hackable if you want to spend the time to figure out the message IDs and encoding.

devy 11y ago
Agree with Unklejoe but disagree with oppositelock that CANbus make modern cars MORE HACKABLE [0] rather than "more difficult" to work on. I am not even sure if it's true for the mechanical part but definitely not the electronics and computerized components, ECU included. Charlie Miller, a famous InfoSec expert who previous known for hacking iPhone was able to take complete control of a JEEP remotely [1]. I doubt that's possible for the older JEEPs without ECUs and cellular connectivity. And this is just a start, not only for JEEP but a lot of other cars too[3]. With EVs are gradually coming into mainstream, soon average consumers might be able to "fix" their EVs whereas they can't for the previous internal combustion engine (ICE) vehicles without even getting their hands dirty[4]. [0]: http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-with-Arduino-and-Seeed-C/ http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-wi... [1]: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high... [2]: http://www.wired.co.uk/news/archive/2016-02/24/nissan-car-hacked http://www.wired.co.uk/news/archive/2016-02/24/nissan-car-ha... [3]: http://www.canbushack.com/blog/index.php http://www.canbushack.com/blog/index.php [4]: http://www.bmwblog.com/2014/10/11/coding-tutorial-bmw-i3-electric-car/ http://www.bmwblog.com/2014/10/11/coding-tutorial-bmw-i3-ele...
- oppositelock 11y ago
  I think both statements are true, the cars are more difficult to work on for the garage mechanic, and the additional computerized systems make the cars more hackable as well. I'm appalled at the lack of security in modern cars. Cars have a single CANbus and abuse it to intermingle important control protocols with silly things like trip odometers you can see on your stereo. The internet connected systems aren't in the least bit secure - look at what happened with the Nissan LEAF, which had an API without any sort of authentication where the VIN number was sufficient to access private data - jeez, nobody could ever guess the VIN for a car could they, it's not like it's printed on the windshield...oh wait. I hope that companies like Automatic have taken precautions against people using their dongles as an attack vector for cars. Anyhow, I'm one of the people who does hack into my cars, mostly to learn how the systems work, but I don't represent the average case, since 20 years of building hardware and software gives me a background that most mechanics don't have. This stuff takes a lot of time to do, both to research then to make sure you've not screwed something up. It's not hard to brick an ECU, I've done it once, and replacing it is annoying too, due to regulations, the embedded VIN in the ECU and such, especially in CA where I live. On the upside, there are passionate hobbyists who do reverse engineer these cars, and there is a treasure trove of information on the web on how to hack your cars if you have the knowhow.

devy 11y ago

Agree with Unklejoe but disagree with oppositelock that CANbus make modern cars MORE HACKABLE [0] rather than "more difficult" to work on. I am not even sure if it's true for the mechanical part but definitely not the electronics and computerized components, ECU included. Charlie Miller, a famous InfoSec expert who previous known for hacking iPhone was able to take complete control of a JEEP remotely [1]. I doubt that's possible for the older JEEPs without ECUs and cellular connectivity. And this is just a start, not only for JEEP but a lot of other cars too[3]. With EVs are gradually coming into mainstream, soon average consumers might be able to "fix" their EVs whereas they can't for the previous internal combustion engine (ICE) vehicles without even getting their hands dirty[4]. [0]: http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-with-Arduino-and-Seeed-C/ http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-wi... [1]: http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high... [2]: http://www.wired.co.uk/news/archive/2016-02/24/nissan-car-hacked http://www.wired.co.uk/news/archive/2016-02/24/nissan-car-ha... [3]: http://www.canbushack.com/blog/index.php http://www.canbushack.com/blog/index.php [4]: http://www.bmwblog.com/2014/10/11/coding-tutorial-bmw-i3-electric-car/ http://www.bmwblog.com/2014/10/11/coding-tutorial-bmw-i3-ele...

oppositelock 11y ago
I think both statements are true, the cars are more difficult to work on for the garage mechanic, and the additional computerized systems make the cars more hackable as well. I'm appalled at the lack of security in modern cars. Cars have a single CANbus and abuse it to intermingle important control protocols with silly things like trip odometers you can see on your stereo. The internet connected systems aren't in the least bit secure - look at what happened with the Nissan LEAF, which had an API without any sort of authentication where the VIN number was sufficient to access private data - jeez, nobody could ever guess the VIN for a car could they, it's not like it's printed on the windshield...oh wait. I hope that companies like Automatic have taken precautions against people using their dongles as an attack vector for cars. Anyhow, I'm one of the people who does hack into my cars, mostly to learn how the systems work, but I don't represent the average case, since 20 years of building hardware and software gives me a background that most mechanics don't have. This stuff takes a lot of time to do, both to research then to make sure you've not screwed something up. It's not hard to brick an ECU, I've done it once, and replacing it is annoying too, due to regulations, the embedded VIN in the ECU and such, especially in CA where I live. On the upside, there are passionate hobbyists who do reverse engineer these cars, and there is a treasure trove of information on the web on how to hack your cars if you have the knowhow.