4 ms·
Disabler that only responds to crypto-signed request encrypted with hardcoded per-device keys. Have fun. "It can be hacked" really only because good security p
by lordlimecat 9y ago
Disabler that only responds to crypto-signed request encrypted with hardcoded per-device keys. Have fun.
"It can be hacked" really only because good security practice like the above would involve extra costs and the dealership / hardware manufacturer have little incentive to do so. But as a maxim, it doesn't really work: good security is possible.
- rdtsc 9y ago> Disabler that only responds to crypto-signed request encrypted with hardcoded per-device keys. Have fun. Those keys will end up somewhere in a database.
- lordlimecat 9y agoSo now instead of just hacking a disabler, you need to: * hack a database to recover the symmetric key * hack the private key repository needed for signing the requests * do it all without being noticed / getting the key revoked And really, all of those boil down to "gain unauthorized access to a system", which is to say now we can make the maxim "if it can be hacked, it can be hacked." That, I can agree with.