8 ms·
A New Wireless Hack Can Unlock 100M Volkswagens
- jacobsenscott 10y agoA legit service would be to replace lost keys for a few bucks rather than the $100's a dealer charges for one key.
- willempienaar 10y agoI'm in exactly this situation. Had my VW's key stolen, and now they are asking $200 for a replacement. It's easy to get a replacement key, but you need VW to program it. Hopefully that process becomes public.
- TwoBit 10y agoMany cars' keys can be programmed without the maker, at least if you have a copy of the original key. And you should always have two keys, lest you lose one.
- willempienaar 10y agoUnfortunately I don't have another electronic key. My model (2013 Polo Vivo Blueline) came with one electronic key/remote, and one mechanical key. So I can buy another electronic key, but I can't use the remote without VW programming it.
- wyager 10y agoAre you absolutely sure? The vast majority of cars have a way for you to re-program keys, key fobs, etc. provided you have at least one master (not valet) key available. You may have to look in weird corners of obscure forums, but you can probably find the procedure. I did this recently in my car and it involved pushing the brake pedal 8 times, accelerator 7, turning the wheel left-right-left, etc. It sounds like a ridiculous wild goose chase, but this is the sort of thing you can expect from car manufacturers.
- ams6110 10y agoFord requires TWO working keys to progam a new one in the car.
- Qantourisc 10y agoI didn't need to do this yet, but with Toyota when I skimmed the manual, it appears I could add and remove keys myself.
- fn42 10y agoIt's public if you poke around enough, I wrote up a little blog post: https://medium.com/@chairface/how-to-steal-an-audi-71d53cb5d70a https://medium.com/@chairface/how-to-steal-an-audi-71d53cb5d... you'll just need the contents of the 95040 eeprom on your ECU - you can dump it from the OBD2 port with various tools
- ams6110 10y agoMany locksmith shops can program a key -- IF you still have a working one. If you've lost all your keys you need to have the car there, which is difficult if you can't start/drive it.
- deleted 10y ago[deleted]
- adrianN 10y agoBig hardware companies like VW seem to still focus on "security by obscurity", because they're not used to a connected world with plenty of attackers with lots of free time on their hands. I'm quite worried about the future of networked cars.
- UnoriginalGuy 10y agoAnd worse then sue to try and keep exploits hidden. It is like the vehicle industry is stuck in the 1990s. We've moved so far beyond that elsewhere, software designed to be updated, working WITH not AGAINST white hats, and having designs secure on paper first before you implement. Vehicle manufacturers put convenience and speed ahead of solid security principles, and it is only going to get worse with more wireless connectivity making it into vehicles year upon year.
- CamperBob2 10y agoConsidering who's been the target of some of the more conspicuous hacks lately, my guess we're going to see some fairly draconian legislation during the upcoming Presidential and Congressional terms. Don't look for the CFAA to be nerfed anytime soon, let's put it that way. The politicians will hit back at hacker culture with the only weapon they have.
- AWildDHHAppears 10y agoNobody (including me!) expected extremely cheap software-defined radio transmitters and receivers to be available. A short key and a rolling code seemed like a good enough obstacle for a door lock 20 years ago.
- bArray 10y agoI don't know about not expecting it, I think as a general rule all expensive technology will likely be cheaper in the future, or simplified so that it's accessible to the masses. It's difficult to think of a counter example?
- makomk 10y agoI don't think this actually needs fancy software-defined radio hardware. That looks like a cheap, generic 315/433MHz ASK receiver for the keyfob, and those have been widely available for decades. They're essentially what you'd find in the car side of a remote-unlock system, or in most bargain-basement RF remotes of any kind.
- mrb 10y agoDirect link to research paper: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf https://www.usenix.org/system/files/conference/usenixsecurit... Basically VW use the same secret keys to authenticate wireless comms across millions of cars. They change the key every few years (new car platforms, etc).
- helthanatos 10y agoSilly silly car manufactures that leave the car systems vulnerable in almost every way because they can't think far enough ahead to actually be secure before having "cool" things like button less key fobs and button starts. Seriously... Why do so many people not care about security?
- micaksica 10y ago> Why do so many people not care about security? Security costs money.
- weinzierl 10y agoThis, and their culture is mostly defined by mechanical engineers - at least at German automakers.
- helthanatos 10y agoSecurity really doesn't cost much. To constantly maintain the best security does cost, but this is about something that they could have avoided with the tiniest bit of thought. Their simple approach of "it's secure as long as no one knows how to break in" is annoying and whether it affects many or not, it is about the possibility of bad things happening. GTA isn't thought of as a big crime for some reason and it can cost the owner a lot. It would be nice to think my car had someone make sure that trivial snooping would not allow access to the car or that my car's head unit cannot control other parts of the car such as breaks and steering.
- shandor 10y ago> Seriously... Why do so many people not care about security? Seriously? That's because as of today, not having security in this domain hasn't bitten anyone hard enough, ever. Just think about it. At least I haven't heard that despite all these car key hacks any significant number of people would've had their cars and/or belongings stolen. Nor have I heard that any one car manufacturer's sales have significantly plummeted because their cars "can be hacled". After that, it's just pure economics. As of now, the ROI for implementing good security in cars (or anything IoT for that matter) just doesn't pay itself back. At all. Now, I'd like for the car makers to actually do something before chaos-by-hacked-cars ensues as much as anyone and people have to actually die. But it won't happen before the incentive is there. This is one place where government regulation really, really should come into play. There should already be laws for massive fines plus complete obligations to fix every security and safety related bug in all cars sold. Sound too hard on the makers? I don't think so, just look at the mechanical side of the cars: call-backs to fix those are happening all the time, because everyone understands that you can't drive a car which may hit you with an airbag at 60 mph. Or have a broken airbag system.
- akerro 10y agohttps://twitter.com/internetofshit https://twitter.com/internetofshit
- dingo_bat 10y agoSo how do you make something secure when attackers have physical access for hours? I think cars cannot be perfectly secure like we expect computers to be purely because we don't leave our computers unattended for hours in public.
- Strom 10y agoFull physical access? It's hard, but seems an unrelated issue in regards to the linked post. The vulnerability here is that you can capture the key from air during transmission, without having physical access to the car or the key. We've had the technology to prevent this for a long time even before this system was designed. One could make a "good enough" argument for 1995, maybe even for 2005 although that would be seriously pushing it as that's after Blaster [1], but the fact that they're still selling vehicles with this system is really bad. [1] The Blaster worm woke up a lot of people to the very real problem of security vulnerabilities https://en.wikipedia.org/wiki/Blaster_(computer_worm) https://en.wikipedia.org/wiki/Blaster_(computer_worm)
- slavik81 10y agoI'm curious how secure physical car locks are for comparison. Bike locks and house locks are not particularly effective against skilled attackers. They exist mostly to stop the stupid and opportunistic.
- ams6110 10y agoCar locks are as secure as the pane of glass just above them.
- wepple 10y agoa modern iPhone can stand up pretty well to physical access for extended periods of time. In fact, the attack used in this whitepaper would've likely been thwarted had VW used a secure hardware device analogous to the iPhone's secure enclave.
- bArray 10y agoPosted about this yesterday, why did this one gain traction instead of the one I posted? Is there something I'm missing?
- mattm 10y agoNope. Luck is just a part of life.
- bArray 10y agoLuck isn't a word I like to use when it comes to Computer Science... Maybe it would be cool to try and implement a round robin for posts. So the new posts are shown to small distributions each - if they gain traction then they become more likely to appear in other's feeds? Maybe a person's feed would be a third new posts, two thirds round robin winners? Just an idea. I hate to think how much good material is missed because nobody sees it.
- jo909 10y agoNothing got missed, in this case at least. The topic was interesting, so a submission about it made it to the front page. Why this one and not yours? To be honest, I dont care about that too much. And you shouldnt either, optimizing submissions so they gain maximum upvotes is not the point of this community.
- bArray 10y agoNo, it's just the news could have hit the page earlier is my point. I'm not about point scoring.
- camillomiller 10y agoTime of the day maybe?
- bArray 10y agoPerhaps, it was just before dinner in the UK.
- bArray 10y agoWould just like to add that some of the security issues are to do with limitations set by governments. I think China and the US in particular insist on crappy security and it's cost effective to simply apply that everywhere else. Forbid anyone have something a government can't pry into... I think for car manufacturers, they are limited to 128 bit encryption and cars only have to stand up to about 15 minutes of hacking - that last one isn't particularly well defined either.
- maccard 10y agoHave you got a source for either of your claims?
- bArray 10y ago"128-bit encryption has now emerged as the standard of illegality.[16]" [1] [1] https://cyber.law.harvard.edu/privacy/Encryption%20Description.html#_ftnref16 https://cyber.law.harvard.edu/privacy/Encryption%20Descripti...
- raesene9 10y agoThat doesn't seem to have much to do with cars... Also properly implemented 128-bit encryption is generally secure for 15 minutes or 15 days or probably years (the largest key I'm aware of having been cracked is 64-bit and that took a lot of computers a looong time)
- enkid 10y agoThis is absolutely true. For example, the US gov depends on 128 bit equivalent crypto to stop quantum factoring attacks for the foreseeable future.
- akshatpradhan 10y agoA google search of "US Government 128 bit quantum factoring". Stop trying to blame the government for corporations not doing due diligence. If anything, the real failure is Government not enforcing agreeable security measures like NIST and ISO across all US Organizations.
- kowdermeister 10y agoThank you Volkswagen, technology, hackers, crackers and everybody involved that I can read titles like this that would totally fit into a 1999 sci-fi movie about the near future :)
- wckronholm 10y agoThese security issues are not exclusive to computer systems in cars. A valet recently used my physical car key to unlock a different car. (Same make, different model.) He only realized he was in the wrong car when the ignition wouldn't turn.