3 ms·

It looks like the same stuff that was presented in great detail at CCC over a year ago: https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scandal_dieselgat

by _wmd 9y ago

It looks like the same stuff that was presented in great detail at CCC over a year ago: https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scandal_dieselgate https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scand... Does anyone know how this research differs or builds upon the previous work?

rurban 9y ago
And also 2 years ago in even greater detail. What I read so far, the Fiat 500X delay trick is new, the Fiat/Chrylser investigation is new and the rest is stricter, formally better, but the conclusions behind are lacking. The CAN parametrization A2L cheat for the low temp trigger is missing/fixed, they identified it as acoustic mode. InjCrv_stNsCharCor, "Status der Akustikbedingung" All the other manifacturers they caught cheating are missing. But at least they confirmed now Bosch as the real culprit, in their EDC17 diesel ECU software. Major news and US law still is targeting VW only. In fairness I believe Bosch implemented the cycle detection as project for Audi, and the delay for Fiat/Chrysler. "Notably, we find strong evidence that both defeat devices were created by Bosch and then enabled by Volkswagen and Fiat for their respective vehicles" The real workflow for the 4 deactivating conditions is described better though, but the A2L is missing, which is what Bosch describes to their partners. How to activate the cheat. Read here: http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf [Update: The A2L is there, all clear.] For explanation: Car manufacturers/customers get the basic ECU diagram/model pictures and the A2L files, which contains the descriptions what they can do with the controller software in the ECU. So for this "crime" there needs to be a partnership between the creator (Bosch) and the user (VW), which demanded that feature, and then Bosch describing it to VW how to activate or deactivate it. Under which name it is hidden. Also note that under european law it is not a crime. European law only cares for emission testing during the test cycle, and also only for a few selected engines upfront. Under european emission law catching a real engine cheating with their NOx will have no consequences. US law is different. US regulations avoid the simple to detect cycles, and use a real driver on a chassis dyno. So the US is cheating by using specialized drivers who are experts like F1 drivers driving through the tests, while the Europeans and Asians use the test cycle detection SW.
- _0ffh 9y ago
  Not Simulink diagram, ASCET (https://www.etas.com/en/products/ascet_software_products.php https://www.etas.com/en/products/ascet_software_products.php) diagram. Also, it seems to me that the functions in question that enabled cheating can be seen as "dual use". The customer could have given some innocuous reason for their need for these customer specific functions, but then used them for cheating. If I remember the CCC talks correctly, it was quite the nontrivial/involved feat for VW to configure the software in such a way that the cycle detection signal influences ad blue injection rates, although the EDC architecture is quite data-driven.
  - rurban 9y ago
    Agree with the plausible deniability. They obviously came up with some innocent names and only told co-conspirators the real meaning behind. Interesting: https://www.etas.com/en/products/ascet_developer.php https://www.etas.com/en/products/ascet_developer.php Generates C via models. I prefer SimuLink RealTime-Workshop (now Simulink Coder) though. You only need very few C there.
- retSava 9y ago
  While there "must" be two parties to this, the enabling party (Bosch) and the performing party (the others), the act of enabling the cheat must be what is considered the bad part here, at least from a law point of view. I'd consider Bosch to have low ethics in this case, but it sounds like it is still within the boundary of law. An analogy could be that I can build and give you a gun (assuming I by law am allowed to), but it is you that pull the trigger while pointing it at something you shouldn't point at.

by _wmd 9y ago

rurban 9y ago

And also 2 years ago in even greater detail. What I read so far, the Fiat 500X delay trick is new, the Fiat/Chrylser investigation is new and the rest is stricter, formally better, but the conclusions behind are lacking. The CAN parametrization A2L cheat for the low temp trigger is missing/fixed, they identified it as acoustic mode. InjCrv_stNsCharCor, "Status der Akustikbedingung" All the other manifacturers they caught cheating are missing. But at least they confirmed now Bosch as the real culprit, in their EDC17 diesel ECU software. Major news and US law still is targeting VW only. In fairness I believe Bosch implemented the cycle detection as project for Audi, and the delay for Fiat/Chrysler. "Notably, we find strong evidence that both defeat devices were created by Bosch and then enabled by Volkswagen and Fiat for their respective vehicles" The real workflow for the 4 deactivating conditions is described better though, but the A2L is missing, which is what Bosch describes to their partners. How to activate the cheat. Read here: http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf [Update: The A2L is there, all clear.] For explanation: Car manufacturers/customers get the basic ECU diagram/model pictures and the A2L files, which contains the descriptions what they can do with the controller software in the ECU. So for this "crime" there needs to be a partnership between the creator (Bosch) and the user (VW), which demanded that feature, and then Bosch describing it to VW how to activate or deactivate it. Under which name it is hidden. Also note that under european law it is not a crime. European law only cares for emission testing during the test cycle, and also only for a few selected engines upfront. Under european emission law catching a real engine cheating with their NOx will have no consequences. US law is different. US regulations avoid the simple to detect cycles, and use a real driver on a chassis dyno. So the US is cheating by using specialized drivers who are experts like F1 drivers driving through the tests, while the Europeans and Asians use the test cycle detection SW.

_0ffh 9y ago
Not Simulink diagram, ASCET (https://www.etas.com/en/products/ascet_software_products.php https://www.etas.com/en/products/ascet_software_products.php) diagram. Also, it seems to me that the functions in question that enabled cheating can be seen as "dual use". The customer could have given some innocuous reason for their need for these customer specific functions, but then used them for cheating. If I remember the CCC talks correctly, it was quite the nontrivial/involved feat for VW to configure the software in such a way that the cycle detection signal influences ad blue injection rates, although the EDC architecture is quite data-driven.
- rurban 9y ago
  Agree with the plausible deniability. They obviously came up with some innocent names and only told co-conspirators the real meaning behind. Interesting: https://www.etas.com/en/products/ascet_developer.php https://www.etas.com/en/products/ascet_developer.php Generates C via models. I prefer SimuLink RealTime-Workshop (now Simulink Coder) though. You only need very few C there.
retSava 9y ago
While there "must" be two parties to this, the enabling party (Bosch) and the performing party (the others), the act of enabling the cheat must be what is considered the bad part here, at least from a law point of view. I'd consider Bosch to have low ethics in this case, but it sounds like it is still within the boundary of law. An analogy could be that I can build and give you a gun (assuming I by law am allowed to), but it is you that pull the trigger while pointing it at something you shouldn't point at.