4 ms·
Actually, I was impressed how much security Bosch included in their device. For a IoT device I would give this a gold star. I am sure after this report was gi
by microDude 9y ago
Actually, I was impressed how much security Bosch included in their device.
For a IoT device I would give this a gold star. I am sure after this report was given to them, they patched their firmware.
- tyingq 9y agoI dunno...the dongle gives up it's certificate so that you can brute force it offline. It's an 8 digit numeric only pin. 100 million possible PINS, when you can do 100 million SHA-256 computations in 30 minutes on a typical laptop. That seems unwise. And it allows you to send and receive any CAN bus message you want, versus just some subset of OBDII. As far as I can tell, the features don't require anything other than querying OBDII for some very small subset of data. So if the dongle only passed those request packets, and dropped everything else, it would be miles more secure. Since it appears to be a simple passthrough device, I'm not sure there's enough horsepower in the dongle to fix that with firmware.