6 ms·

"Once inside, an electronic device that police say is typically used by mechanics to reset a vehicle to factory settings...From there, the vehicle is programed

by zelos 5y ago

"Once inside, an electronic device that police say is typically used by mechanics to reset a vehicle to factory settings...From there, the vehicle is programed to accept a key the suspects have brought with them that can then be used to start the car and drive away." It seems like that's the more important device here? It doesn't feel like there's much point having a unique key if you can reprogram the car without it.

yardie 5y ago
$1300 [0] gets you a pretty decent programmer. And for the dishonest they can scan the fob over the air. [0] https://smile.amazon.com/Autel-IM508-Advanced-Programming-Tool/dp/B08CK46G9V https://smile.amazon.com/Autel-IM508-Advanced-Programming-To...
athenot 5y ago
Even though there may be a legitimate use-case from a car serviceability standpoint, this does serve to illustrate the wider problem of creating backdoors in systems: they always end up getting abused and into the wrong hands.
- raverbashing 5y ago
  Sure but there must be a way for mechanics/dealerships to work around issues with lost keys. "Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
  - zelos 5y ago
    If you've lost the key then the manufacturer can presumably issue a new one once you prove you own the car.
    - mbreese 5y ago
      This is normally handled at the dealer level. Both because the dealer is the point of contact for the customer but also for speed and scalability. So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon. But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
      - jack_pp 5y ago
        I think he meant the dealer can give you a new copy of your old key, then you wouldn't need to reset the car.
        mbreese 5y ago
        But the dealer doesn’t have a stock of duplicate keys. That would be even worse! They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
    - ghaff 5y ago
      This is sort of a variation of the tradeoff if someone loses access to their Google (or whatever) account because they've lost their password, don't have access to a backup email, phone number, etc. They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
    - bellyfullofbac 5y ago
      Well, grandparent poster is arguing this is a backdoor. Sure it is, but for me it's an acceptable backdoor, not comparable to encryption backdoors that governments want, for example for messaging apps that use E2E encryption. And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
      - athenot 5y ago
        Yes. For cars, the risk is low, and there are mitigations such as insurance that can alleviate the pain. What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have. So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars. Maybe. I hope…
        ghaff 5y ago
        > how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor. Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
    - FDSGSG 5y ago
      >once you prove you own the car. Yeah, right. How would you do that? Have you ever bought a car? When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
      - ghaff 5y ago
        In the US, the "proper" way to do this would be to present a state-issued title that matched the government-issued ID of the person making the request. However, I've never needed to do that and, as various people have remarked, there are all sorts of reasons why that might be hard to do without spending time and effort.
        FDSGSG 5y ago
        This might work if you actually had to get a new title in order to sell the car, but you don't.
        zeusk 5y ago
        Title and registration are separate in the US. Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks). I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
        FDSGSG 5y ago
        > Title must be signed at sale Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox). Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
    - voussoir 5y ago
      What do we do when the manufacturer goes out of business? The manufacturer of my car certainly won't be sending me any keys.
  - j_not_j 5y ago
    I actually had a situation where the dealer disabled the electronic keys entirely (and by accident). They had disconnected the battery for some electrical diagnosis and neglected to re-enable the locks. When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.
lotsofpulp 5y ago
An accurate headline would get fewer clicks.
mrtksn 5y ago
Think of the implications of throwing the car away once you lose your keys. Environmentalists will hunt you and rightfully so, most of the emissions a car produces happen during its manufacturing. If they introduce a mechanism where the manufacturer only can unlock the car, it would mean that they will need to be involved in all kind of disputes people have over the ownership or usage of the car. You will also have people telling you that you don't own the car as with the case of the some agriculture manufacturers that lock down their systems against unauthorised repairs. I'm more in favour of leaving the police work to the police, let's not integrate the law enforcement and manufacturers. There's already interest in disabling cars when authorities deem necessary. The problem here is that the authorities might not be or may not remain your favourites.
- ziddoap 5y ago
  >all kind of disputes people have over the ownership At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc. Would this not stop whatever disputes over ownership you're referring to?
  - mrtksn 5y ago
    Sure, you can works something out but it would also mean that the company will need to maintain a system for unlocking cars for each country according to the local regulations. Then they will need to deal with stuff like "Toyota unlocked the car of a Putin critic", "Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died. They previously unlocked the car of Joe Rogan's girlfriend". You also will have issues where the legal owner and the regular user are different people(i.e. father and son, romantic partners etc). Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years. You will also have governments demanding you disable the cars of people who have problems with the regime. In Philippines the government might demand lock down the cars of LGBT people, in USA they might lock down the cars of people with debt. Who knows? It makes the manufacturer part of the running the car just the way Apple and Google are part of running your phone.
iamben 5y ago
I have absolutely no idea on how this all works, but assuming they're not replicating the current 'key' and forcing a new one - why not introduce a time delay on key changes? Like a reprogrammed key takes 3 hours before it works or something. No biggie if the car is on a mechanics forecourt, but what thief wants to wait 3 hours to drive away the car they've just screwdrivered into?

by zelos 5y ago

yardie 5y ago

$1300 [0] gets you a pretty decent programmer. And for the dishonest they can scan the fob over the air. [0] https://smile.amazon.com/Autel-IM508-Advanced-Programming-Tool/dp/B08CK46G9V https://smile.amazon.com/Autel-IM508-Advanced-Programming-To...

athenot 5y ago

Even though there may be a legitimate use-case from a car serviceability standpoint, this does serve to illustrate the wider problem of creating backdoors in systems: they always end up getting abused and into the wrong hands.

raverbashing 5y ago
Sure but there must be a way for mechanics/dealerships to work around issues with lost keys. "Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
- zelos 5y ago
  If you've lost the key then the manufacturer can presumably issue a new one once you prove you own the car.
  - mbreese 5y ago
    This is normally handled at the dealer level. Both because the dealer is the point of contact for the customer but also for speed and scalability. So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon. But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
    - jack_pp 5y ago
      I think he meant the dealer can give you a new copy of your old key, then you wouldn't need to reset the car.
      - mbreese 5y ago
        But the dealer doesn’t have a stock of duplicate keys. That would be even worse! They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
  - ghaff 5y ago
    This is sort of a variation of the tradeoff if someone loses access to their Google (or whatever) account because they've lost their password, don't have access to a backup email, phone number, etc. They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
  - bellyfullofbac 5y ago
    Well, grandparent poster is arguing this is a backdoor. Sure it is, but for me it's an acceptable backdoor, not comparable to encryption backdoors that governments want, for example for messaging apps that use E2E encryption. And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
    - athenot 5y ago
      Yes. For cars, the risk is low, and there are mitigations such as insurance that can alleviate the pain. What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have. So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars. Maybe. I hope…
      - ghaff 5y ago
        > how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor. Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
  - FDSGSG 5y ago
    >once you prove you own the car. Yeah, right. How would you do that? Have you ever bought a car? When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
    - ghaff 5y ago
      In the US, the "proper" way to do this would be to present a state-issued title that matched the government-issued ID of the person making the request. However, I've never needed to do that and, as various people have remarked, there are all sorts of reasons why that might be hard to do without spending time and effort.
      - FDSGSG 5y ago
        This might work if you actually had to get a new title in order to sell the car, but you don't.
        zeusk 5y ago
        Title and registration are separate in the US. Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks). I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
        FDSGSG 5y ago
        > Title must be signed at sale Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox). Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
  - voussoir 5y ago
    What do we do when the manufacturer goes out of business? The manufacturer of my car certainly won't be sending me any keys.
- j_not_j 5y ago
  I actually had a situation where the dealer disabled the electronic keys entirely (and by accident). They had disconnected the battery for some electrical diagnosis and neglected to re-enable the locks. When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.

lotsofpulp 5y ago

An accurate headline would get fewer clicks.

mrtksn 5y ago

Think of the implications of throwing the car away once you lose your keys. Environmentalists will hunt you and rightfully so, most of the emissions a car produces happen during its manufacturing. If they introduce a mechanism where the manufacturer only can unlock the car, it would mean that they will need to be involved in all kind of disputes people have over the ownership or usage of the car. You will also have people telling you that you don't own the car as with the case of the some agriculture manufacturers that lock down their systems against unauthorised repairs. I'm more in favour of leaving the police work to the police, let's not integrate the law enforcement and manufacturers. There's already interest in disabling cars when authorities deem necessary. The problem here is that the authorities might not be or may not remain your favourites.

ziddoap 5y ago
>all kind of disputes people have over the ownership At least where I am, when a car is registered the owner gets an "ownership" document, which is also registered with the government. Lists the vehicle, VIN, owner, etc. Would this not stop whatever disputes over ownership you're referring to?
- mrtksn 5y ago
  Sure, you can works something out but it would also mean that the company will need to maintain a system for unlocking cars for each country according to the local regulations. Then they will need to deal with stuff like "Toyota unlocked the car of a Putin critic", "Audi refused to unlock the car of a pregnant woman who lost her keys during the emergency, the baby died. They previously unlocked the car of Joe Rogan's girlfriend". You also will have issues where the legal owner and the regular user are different people(i.e. father and son, romantic partners etc). Someone passes or the relationship sours and now you have people begging the car company let them use the car they have been using for years. You will also have governments demanding you disable the cars of people who have problems with the regime. In Philippines the government might demand lock down the cars of LGBT people, in USA they might lock down the cars of people with debt. Who knows? It makes the manufacturer part of the running the car just the way Apple and Google are part of running your phone.

iamben 5y ago

I have absolutely no idea on how this all works, but assuming they're not replicating the current 'key' and forcing a new one - why not introduce a time delay on key changes? Like a reprogrammed key takes 3 hours before it works or something. No biggie if the car is on a mechanics forecourt, but what thief wants to wait 3 hours to drive away the car they've just screwdrivered into?