4 ms·

>So, not as wild west as unconstrained CAN bus access, but not really read-only either. I'd say mode eight makes it absolutely the wild west. In addition to c

>So, not as wild west as unconstrained CAN bus access, but not really read-only either. I'd say mode eight makes it absolutely the wild west. In addition to clearing the CEL, I can use my CAN bus to program everything from the TPMS IDs for my wheels all the way to the pre-sets in my radio along with everything in-between including the amount of power steering and brake assist applied.

tyingq 10y ago
I'm not convinced all of those things are done via mode eight, but rather, by direct CAN bus access. I know, for example, some models of cars only expose a limited number of actuators over mode 8, mostly emissions stuff. Do you have a reference? In any case, "mode 8" is a subset of what unconstrained CAN bus access gives you. Edit: The best info I can find is in this whitepaper: http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf You can see packet dumps on page 10. These aren't obd-ii packets. They are CAN bus "DeviceControl" packets. These are the ones they used to manipulate braking, etc. The context I'm trying to convey is that a dongle that exposes the OBD-II port wirelessly should probably expose only the "safe-ish" parts of OBD-II. No direct CAN bus access, no access to mode 8, mode 4, etc.
- patcheudor 10y ago
  >The context I'm trying to convey is that a dongle that exposes the OBD-II port wirelessly should probably expose only the "safe-ish" parts of OBD-II. No direct CAN bus access, no access to mode 8, mode 4, etc. Yes, it should but what does that mean in the context of a device you plug into your OBD-II port which can be made to run anything an attacker wants? Most of these devices are running full systems similar to LTE radios, etc., which have been demonstrated to be so vulnerable that it's possible to hijack the embedded computer to run code of choice. Just recently we saw the radio disclosure from Google and from several years back there was this one from a research team at Intel: https://www.youtube.com/watch?v=q4pRYZjzL_E https://www.youtube.com/watch?v=q4pRYZjzL_E Honestly, at the point an attacker can run arbitrary code, short of implementing some crazy in device firewall, expect a device like this to have access to a bunch of stuff by the fact it's plugged into the OBD-II port.
  - tyingq 10y ago
    The dongle is taking something that requires physical access and exposing it on a network, in this case with weak 8 digit pins. That implies a responsibility to be smart about it. I assume there's a microcontroller in front of the serial comms. That would be a good place to filter packets. These are fairly simple filters that probably only need to look at the first byte or two of a request to limit to OBD-II only, and only certain requests. That's not a crazy firewall, just simple microcontroller code. But sure, car manufacturers should do something as well. OBD-II port is a misnomer. It's like calling an ethernet port a "WWW Port". It doesn't need to expose everything that it does. The manufacturers know these are being used by consumers. They can put a more open port somewhere else for mechanics.

tyingq 10y ago

I'm not convinced all of those things are done via mode eight, but rather, by direct CAN bus access. I know, for example, some models of cars only expose a limited number of actuators over mode 8, mostly emissions stuff. Do you have a reference? In any case, "mode 8" is a subset of what unconstrained CAN bus access gives you. Edit: The best info I can find is in this whitepaper: http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf You can see packet dumps on page 10. These aren't obd-ii packets. They are CAN bus "DeviceControl" packets. These are the ones they used to manipulate braking, etc. The context I'm trying to convey is that a dongle that exposes the OBD-II port wirelessly should probably expose only the "safe-ish" parts of OBD-II. No direct CAN bus access, no access to mode 8, mode 4, etc.

patcheudor 10y ago
>The context I'm trying to convey is that a dongle that exposes the OBD-II port wirelessly should probably expose only the "safe-ish" parts of OBD-II. No direct CAN bus access, no access to mode 8, mode 4, etc. Yes, it should but what does that mean in the context of a device you plug into your OBD-II port which can be made to run anything an attacker wants? Most of these devices are running full systems similar to LTE radios, etc., which have been demonstrated to be so vulnerable that it's possible to hijack the embedded computer to run code of choice. Just recently we saw the radio disclosure from Google and from several years back there was this one from a research team at Intel: https://www.youtube.com/watch?v=q4pRYZjzL_E https://www.youtube.com/watch?v=q4pRYZjzL_E Honestly, at the point an attacker can run arbitrary code, short of implementing some crazy in device firewall, expect a device like this to have access to a bunch of stuff by the fact it's plugged into the OBD-II port.
- tyingq 10y ago
  The dongle is taking something that requires physical access and exposing it on a network, in this case with weak 8 digit pins. That implies a responsibility to be smart about it. I assume there's a microcontroller in front of the serial comms. That would be a good place to filter packets. These are fairly simple filters that probably only need to look at the first byte or two of a request to limit to OBD-II only, and only certain requests. That's not a crazy firewall, just simple microcontroller code. But sure, car manufacturers should do something as well. OBD-II port is a misnomer. It's like calling an ethernet port a "WWW Port". It doesn't need to expose everything that it does. The manufacturers know these are being used by consumers. They can put a more open port somewhere else for mechanics.