6 ms·

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in mod

by bri3d 8y ago

Even more modern cars with "protection" (usually against tuning, not theft) use obvious, simple-to-reverse algorithms. For example, the Simos18 ECUs used in modern VWs use flash files encrypted with AES128. Except, they share the same key and IV across all ECUs on the platform, and the key and IV are stored in plaintext in the "upgrade" routines in the flash ROM. So once you've dumped one ECU's flash memory, you own them all. This wouldn't be that hard for car manufacturers to defeat if they really cared. It's the exact same trusted-boot problem as any mobile phone faces, except (so far) with much more limited attack resources. It's devilishly hard to get perfect (as every iPhone jailbreak proves) but it's easy to get started.

Rjevski 8y ago
Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change. This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new firmware, could you install and run it please?”. Also I’m surprised they’d go after tuners, considering those are usually the most loyal customers you could dream of.
- barrkel 8y ago
  Witness Intel's unlocked CPUs: people who want access to the low-level stuff get charged a premium.
- bri3d 8y ago
  Yes, like I alluded to it's trivial drawing from any other trusted boot chain implementation. The even better and less user-intensive way to do it would be with asymmetric encryption - the ECU only trusts flashes signed with the vendor public key and to make things even more secure, you could encrypt each flash file server side with a keypair derived each boot on the ECU and sent over the Internet (many manufacturers require online flashing anyway). Manufacturers dislike tuners because they make warranty claims for tune damaged parts like blown turbos. VW especially are very, very aggressive about detection and enforcement around this. Long term I think giving a few dishonest tuned customers free turbos is probably fine but they seem to disagree and I assume they have access to the metrics driving this decision (which I don't).
  - dmichulke 8y ago
    > signed with the vendor public key That part doesn't sound very secure to me :-)
  - disiplus 8y ago
    they also dont like tuners because cars engines are often made the same for multiple "trims" so the car with 110 and 160 hp have the same engine but different "map" in the ecu. and only with ecu reflash you can get more power that would cost you x amount of money. imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that. and manufacturers dont like that
    - jinzo 8y ago
      Actually, from my personal experience in the field - they only care for X. years under warranty. Then they don't care. I actually don't think they have much legal ground on their own around modifications in EU. At the end of the day you do own the car.
    - TeMPOraL 8y ago
      > imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that. But isn't this already the case (except locking might be in CPU firmware)? AFAIR this is the case with GPUs.
      - jdietrich 8y ago
        It's not quite analogous: https://en.wikipedia.org/wiki/Product_binning https://en.wikipedia.org/wiki/Product_binning
        TeMPOraL 8y ago
        The line between product binning and market segmentation is sometimes blurry.
      - 8y ago
- shawn 8y ago
  I'm not so sure. The key has to be stored somewhere on the car. Why not desolder that and examine it? (If we're going with "Theoretically possible," that is.)
  - bri3d 8y ago
    The solution here is a combination of tamper-proof secure enclave and ephemeral keys, just like it is for trusted boot chains. Obviously it's not 100% secure and just like mobile phones (which, again, are the exact same problem space) it's eventually defeated, but the magnitude of difficulty can be multiplied without much effort.
  - Rjevski 8y ago
    My solution wasn't to protect against that - if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car. This was just an idea to thwart installation of compromised firmware by thieves via the diagnostics port. It's just a little layer of security, not designed to be bulletproof, merely to slow down thieves by forcing them to actually swap the hardware.
    - shawn 8y ago
      if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car. I demand a source that teaches me how to do this. :) Orrr if you're in Chicago let's go figure it out ourselves!
      - GFischer 8y ago
        CESVI in Argentina. Not very close to Chicago though :P , but I'm sure there's an US equivalent. https://www.cesvi.com.ar/index2.html https://www.cesvi.com.ar/index2.html I remember reading about the people that dismantled cars to find where manufacturers source the parts: https://jalopnik.com/the-fascinating-company-that-tears-cars-apart-to-find-o-1787205420 https://jalopnik.com/the-fascinating-company-that-tears-cars... Those guys can probably switch you the ECU :)
- neuralRiot 8y ago
  So down the line after few years and changing owners you're unable to install any firmware or to install used ECUs, most of the manufacturers are now online-only for diagnostic and flashing of course charging some premium, that destroys independend shops as you need to pay a subscription for every manufacturer, and cars and its parts still get stolen, "high tech thieves" belong to the movies, real ones load your car on a tow and it goes straight to another country.
- bawana 8y ago
  Why go after tuners? Well, if you are a giant automobile firm that has been lying about their mileage and emissions and covering it up with software that detunes the car just to pass testing- well, then you don't want people figuring out your algos for covering up lying.
zormino 8y ago
There is actually a big security push in automotive that's sort of been slowly coming to the fore over the last few years. It's not the OEMs that are driving it really either, they are to some degree, but it's the suppliers starting to make security hardware and system protection available, as it really hasn't been for very long. It's still not really entirely there. Basic things like the microcontrollers and CAN hardware / protocol never had security designed in. No one was willing to invest significant engineering time or do expensive security in software when hardware cost is king, or even invest in the engineering cost of bringing in security from suppliers (seriously, there's like 20+ independent computers in your car and it's going to be 50+ on average soon if it isn't already and out of those you'd probably have to harden 10 or so, or introduce entire new ECUs) There's a number of solutions but none of them are cheap. As hardware support becomes widely available, development time for higher tier suppliers drops and they can economically offer secure solutions, and with scares like the Jeep remote control hack in 2015 and with cars getting more connected, OEMs are starting to see the business case for security.

by bri3d 8y ago

Rjevski 8y ago

Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the documentation, and the key needs to be presented before any firmware upgrade or configuration change. This isn’t bulletproof either, but surely more than “hey I’m legit, here’s your new firmware, could you install and run it please?”. Also I’m surprised they’d go after tuners, considering those are usually the most loyal customers you could dream of.

barrkel 8y ago
Witness Intel's unlocked CPUs: people who want access to the low-level stuff get charged a premium.
bri3d 8y ago
Yes, like I alluded to it's trivial drawing from any other trusted boot chain implementation. The even better and less user-intensive way to do it would be with asymmetric encryption - the ECU only trusts flashes signed with the vendor public key and to make things even more secure, you could encrypt each flash file server side with a keypair derived each boot on the ECU and sent over the Internet (many manufacturers require online flashing anyway). Manufacturers dislike tuners because they make warranty claims for tune damaged parts like blown turbos. VW especially are very, very aggressive about detection and enforcement around this. Long term I think giving a few dishonest tuned customers free turbos is probably fine but they seem to disagree and I assume they have access to the metrics driving this decision (which I don't).
- dmichulke 8y ago
  > signed with the vendor public key That part doesn't sound very secure to me :-)
- disiplus 8y ago
  they also dont like tuners because cars engines are often made the same for multiple "trims" so the car with 110 and 160 hp have the same engine but different "map" in the ecu. and only with ecu reflash you can get more power that would cost you x amount of money. imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that. and manufacturers dont like that
  - jinzo 8y ago
    Actually, from my personal experience in the field - they only care for X. years under warranty. Then they don't care. I actually don't think they have much legal ground on their own around modifications in EU. At the end of the day you do own the car.
  - TeMPOraL 8y ago
    > imagine a CPU where 6 and 8 core variants are the same but the 6 core is locked in bios and you can unlock it with some tuning software, its like that. But isn't this already the case (except locking might be in CPU firmware)? AFAIR this is the case with GPUs.
    - jdietrich 8y ago
      It's not quite analogous: https://en.wikipedia.org/wiki/Product_binning https://en.wikipedia.org/wiki/Product_binning
      - TeMPOraL 8y ago
        The line between product binning and market segmentation is sometimes blurry.
    - 8y ago
shawn 8y ago
I'm not so sure. The key has to be stored somewhere on the car. Why not desolder that and examine it? (If we're going with "Theoretically possible," that is.)
- bri3d 8y ago
  The solution here is a combination of tamper-proof secure enclave and ephemeral keys, just like it is for trusted boot chains. Obviously it's not 100% secure and just like mobile phones (which, again, are the exact same problem space) it's eventually defeated, but the magnitude of difficulty can be multiplied without much effort.
- Rjevski 8y ago
  My solution wasn't to protect against that - if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car. This was just an idea to thwart installation of compromised firmware by thieves via the diagnostics port. It's just a little layer of security, not designed to be bulletproof, merely to slow down thieves by forcing them to actually swap the hardware.
  - shawn 8y ago
    if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car. I demand a source that teaches me how to do this. :) Orrr if you're in Chicago let's go figure it out ourselves!
    - GFischer 8y ago
      CESVI in Argentina. Not very close to Chicago though :P , but I'm sure there's an US equivalent. https://www.cesvi.com.ar/index2.html https://www.cesvi.com.ar/index2.html I remember reading about the people that dismantled cars to find where manufacturers source the parts: https://jalopnik.com/the-fascinating-company-that-tears-cars-apart-to-find-o-1787205420 https://jalopnik.com/the-fascinating-company-that-tears-cars... Those guys can probably switch you the ECU :)
neuralRiot 8y ago
So down the line after few years and changing owners you're unable to install any firmware or to install used ECUs, most of the manufacturers are now online-only for diagnostic and flashing of course charging some premium, that destroys independend shops as you need to pay a subscription for every manufacturer, and cars and its parts still get stolen, "high tech thieves" belong to the movies, real ones load your car on a tow and it goes straight to another country.
bawana 8y ago
Why go after tuners? Well, if you are a giant automobile firm that has been lying about their mileage and emissions and covering it up with software that detunes the car just to pass testing- well, then you don't want people figuring out your algos for covering up lying.

zormino 8y ago

There is actually a big security push in automotive that's sort of been slowly coming to the fore over the last few years. It's not the OEMs that are driving it really either, they are to some degree, but it's the suppliers starting to make security hardware and system protection available, as it really hasn't been for very long. It's still not really entirely there. Basic things like the microcontrollers and CAN hardware / protocol never had security designed in. No one was willing to invest significant engineering time or do expensive security in software when hardware cost is king, or even invest in the engineering cost of bringing in security from suppliers (seriously, there's like 20+ independent computers in your car and it's going to be 50+ on average soon if it isn't already and out of those you'd probably have to harden 10 or so, or introduce entire new ECUs) There's a number of solutions but none of them are cheap. As hardware support becomes widely available, development time for higher tier suppliers drops and they can economically offer secure solutions, and with scares like the Jeep remote control hack in 2015 and with cars getting more connected, OEMs are starting to see the business case for security.