3 ms·

I tried to hack my Mercedes, but CAN bus is really useless as it doesn't have anything usable and everything is encrypted over FlexRay and there are not easy wa

by ex3ndr 8y ago

I tried to hack my Mercedes, but CAN bus is really useless as it doesn't have anything usable and everything is encrypted over FlexRay and there are not easy way to hack essential parts of the car (unlike CAN bus in say Ford). May be i was wrong, but there are nothing on the CAN bus in latest generations of Mercedes.

bri3d 8y ago
I didn't know that FlexRay had made such inroads and I do apologize - I balked at your mention of Audi because I have personal experience there but it turns out I was just familiar with the one German place FlexRay hasn't reached yet! It does seem like most commodity FlexRay systems are still hackable although it's certainly harder than CAN where you can just attach a node and start spewing garbage from whichever address you'd like: https://brage.bibsys.no/xmlui/bitstream/handle/11250/2453093/16516_FULLTEXT.pdf?sequence=1 https://brage.bibsys.no/xmlui/bitstream/handle/11250/2453093... (I'd expect all modern BMWs to be similar or identical to this MINI for cost reasons, although as evidenced I may be surprised!). I still haven't found a robust use of end to end encryption anywhere in an automotive application - even the "most protected" routines like ECU flashing seem to be protected by weak XOR/known-secret seed/key security in tandem with symmetric cryptography using fixed key material.
- ex3ndr 8y ago
  I tried to find anything how to decrypt FlexRay paper your provided, but found only very limited observable information. Looks like it is AES-CBC with static IV, not very good, but not that bad. Still very very far from hackable. Even if you will be able to guess AES key (somehow) there are no way to hack asymmetric keys. Sure you can leak them during delivery of firmware, but i really feel that this is not the case for Mercedes. Also that's how they make money (and provide security) - lock down access to everything. At AUTOSAR encryption docs there are RSA and ED25519, that is very good encryption obviously. (https://www.autosar.org/fileadmin/user_upload/standards/classic/4-3/AUTOSAR_SWS_CryptoDriver.pdf https://www.autosar.org/fileadmin/user_upload/standards/clas...)

by ex3ndr 8y ago

bri3d 8y ago

I didn't know that FlexRay had made such inroads and I do apologize - I balked at your mention of Audi because I have personal experience there but it turns out I was just familiar with the one German place FlexRay hasn't reached yet! It does seem like most commodity FlexRay systems are still hackable although it's certainly harder than CAN where you can just attach a node and start spewing garbage from whichever address you'd like: https://brage.bibsys.no/xmlui/bitstream/handle/11250/2453093/16516_FULLTEXT.pdf?sequence=1 https://brage.bibsys.no/xmlui/bitstream/handle/11250/2453093... (I'd expect all modern BMWs to be similar or identical to this MINI for cost reasons, although as evidenced I may be surprised!). I still haven't found a robust use of end to end encryption anywhere in an automotive application - even the "most protected" routines like ECU flashing seem to be protected by weak XOR/known-secret seed/key security in tandem with symmetric cryptography using fixed key material.

ex3ndr 8y ago
I tried to find anything how to decrypt FlexRay paper your provided, but found only very limited observable information. Looks like it is AES-CBC with static IV, not very good, but not that bad. Still very very far from hackable. Even if you will be able to guess AES key (somehow) there are no way to hack asymmetric keys. Sure you can leak them during delivery of firmware, but i really feel that this is not the case for Mercedes. Also that's how they make money (and provide security) - lock down access to everything. At AUTOSAR encryption docs there are RSA and ED25519, that is very good encryption obviously. (https://www.autosar.org/fileadmin/user_upload/standards/classic/4-3/AUTOSAR_SWS_CryptoDriver.pdf https://www.autosar.org/fileadmin/user_upload/standards/clas...)