8 ms·
2017 and 2018 vehicles. That's pretty surprisingly recent! I understand that, in general, door locks aren't considered to be very high-security in vehicles: do
by matthewdgreen 5y ago
2017 and 2018 vehicles. That's pretty surprisingly recent!
I understand that, in general, door locks aren't considered to be very high-security in vehicles: doors can be opened in other ways. But remote start is a very big deal. Article doesn't mention whether the car prevents people from driving away after it's been started. I would have loved to see a portion of the video where they tried to shift into D and move the car.
- PaulHoule 5y agoOnce you get the door open you can usually plug a programmer into the OBD-2 port under the steering wheel and pair a new key fob, then drive away. Back in the day it was pretty easy to get the door open like this https://www.wikihow.com/Use-a-Slim-Jim https://www.wikihow.com/Use-a-Slim-Jim
- macintux 5y agoI’ve been researching OBD-2 port physical locks, since I drive doorless most of the summer. Not much available.
- vgeek 5y agohttps://autocyb.com/shop/ https://autocyb.com/shop/ is this the leading contender?
- macintux 5y agoI don’t think I’d come across that one. It probably would be, but the website sends me to some 3rd party spam site every time I click a link.
- mh- 5y agoPretty sure their Wordpress site is compromised, it tries to load a malware domain sometimes. I accidentally lost the domain off my clipboard, but my uBlock rules caught it once. It had the word 'great' in it.
- vgeek 5y agoMay be worth trying Amazon-- it shows if you search there. Not going to give Bezos the satisfaction of the actual link to the product page, though.
- Scoundreller 5y agoJust rewire the pins and build your own jig that reverses it (or undo rewiring as needed). Might be able to short the right data pins from behind to ground and rip that out as needed. Or a hidden switch that does that.
- macintux 5y agoI’m reluctant to mess with the wiring on a brand new vehicle; a lock would make me much happier.
- javajosh 5y agoAlso reversing pins would be something that is very easy to forget - you end up shooting yourself in the foot!
- Scoundreller 5y agoCouple of vampire taps bridging together the right data lines to ground can be easily removed without too much evidence. I understand a lock, but just have a hard time seeing how it would actually lock (well), especially as a universal device.
- mshook 5y agoRewiring the pins doesn't necessarily do much these days as there are devices which will figure out the input pinout and route signals to the proper output pins. Think of it as a MITM device. A better way is to use a different kind of connector but you'll have to build yourself an adapter and to keep in your place or something.
- taneq 5y agoRemember to put a standard-looking dummy ODB2 port where the original was, so any would-be thief has a convenient place to plug in their dongle.
- qbasic_forever 5y agoDoes the hood or hood latch lock? If so just disconnect the battery negative after parking. Anyone that plugs anything into the OBD-2 while you're gone is going to get an unresponsive system. I doubt they're going to take the time to troubleshoot, pry open the hood and reconnect the battery, etc.
- macintux 5y agoHood doesn’t lock, and the dual battery setup (for ESS) is much too failure-prone on my Jeep.
- post-it 5y agoHaving to unlock and crack your hood every time you park takes away some of the coolness and convenience of a doorless Wrangler.
- Zircom 5y agoCould rig up a switch somewhere inside the car near the driver's seat pretty easily. I had an old motorcycle with some kind of electrical issue that would drain the battery if I left it off for more than a day at a time. But instead of spending days and weeks chasing it down, I spent maybe $30 on a battery cover with a little hidden flip switch. It was originally designed for turning on (illegal in my state)under lights, but I modified it slightly and had the switch connected to the ground terminal instead, so whenever I got off the bike I'd flip the switch and boom, problem solved, no more dead bike.
- qbasic_forever 5y agoAs a Jeep owner (an older one), get used to chasing electrical gremlins now and just put a battery kill switch on it. :)
- WWLink 5y agoAmusingly, you can and probably SHOULD lock a doorless wrangler. On a JL and even on the JK, the alarm system still locks out some functionality. And most people don't take the tailgate off, which when locked, kinda keeps people from getting at the little compartment under the cargo floor. It's not really an effective safe place, but just a neat thing. You can also put a lock on the hood, which is a good idea since that way nobody can disable the security system lol. Edit: Also of note, the JL wrangler uses an RFID chip for the ignition startup itself. It's separate from the rest of the keyless go system.
- thenewwazoo 5y agoDo you have a citation for this? In my experience, pairing a new key requires either providing a cryptographically signed certificate or having an existing paired key within range before a new key can be added.
- thought_alarm 5y agoCars with key fobs are easily stolen and shipped overseas by programming a new key fob. https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396215 https://www.cbc.ca/news/canada/marketplace-car-thefts-1.6396...
- CoastalCoder 5y ago> Do you have a citation for this? I don't think it was limited to Chevies.
- RavingGoat 5y agoCome for the car vulnerabilities and stay for the Chevy Citation jokes.
- serf 5y agothere isn't much citation needed; it's common practice at many dealerships for certain eras of cars. the 90s era hondas up to about 2001 use various key-turn-rituals to enroll/program keys into the immobilizer, the later ones use the Honda HDS system which is just a specialty Toshiba/Panasonic ToughBook with an obd dongle and special software.[0] I've enrolled keys myself for my 04 BMW with bootleg 'BMW MODIC' and 'BMW Rheingold' software packs pirated from The Pirate Bay. You don't need existing keys for either system. The trick (used to be) at the time that BMW keys were difficult to cut, and the key cutters were well controlled. This isn't the case any more, and in reality if a key was the deterrent you could always just program an immobilizer chip from another key, tape the key/chip to the column, and then use a pry bar and screwdriver to break the key tumbler and turn the switch without a key. This is neither rare nor hard to do -- and it used to be the defacto way to steal pre-immobilizer Hondas (breaking the column/tumbler, that is). It was common enough that an in-joke at the Honda dealership I worked at was that a flathead screwdriver could be referred to as a 'lazy CRX key', a majority of those era cars encountered were so worn that a flat head would turn most of their tumblers by the time I got to work on them. [0] : I was a Honda tech from 07ish to 09ish
- hereforphone 5y agoDon't all or nearly all modern vehicles use OBD-3?
- core-utility 5y agoMy 2017 and 2018 vehicles have OBD-II
- bri3d 5y agoThere is no such thing as OBD-3 currently. All cars sold in the US since 2008 use ISO 15765-4 OBD over CAN for emissions diagnosis, and almost all use ISO 14229 UDS for manufacturer/dealership diagnosis.
- kube-system 5y agoNot sure which particular protocol(s), but OBD-II was generally required for all cars from 1996 up in the US for emissions testing purposes.
- bri3d 5y agoPrior to 2008, OBD-II had several allowed wire protocols - SAE J1850 PWM (Ford), SAE J1850 VPW (GM), ISO 14230 KWP2000 (most other vendors), or ISO 15765 (OBD over CAN). In 2008, the US requirement switched to exclusively ISO 15765 OBD over CAN.
- PaulHoule 5y agohttps://straighttalkautomotive.com/articles/have-you-heard-of-%20obd-iii.html https://straighttalkautomotive.com/articles/have-you-heard-o... The intent of OBD-III is to use some kind of wireless mechanism to notify the state that your check engine light is on. In California, for instance, you have to pass a smog check every six months, so people driving four months with a failed emission control system are contributing a lot of emissions. It's been hung up forever because of privacy concerns, fears about rent seeking (being forced to buy a cell phone plan for your car), etc. These sort of applications https://www.nhtsa.gov/technology-innovation/vehicle-vehicle-communication https://www.nhtsa.gov/technology-innovation/vehicle-vehicle-... are also hung up indefinitely because the cell phone industry is pushing "secure" solutions that involve cellular infrastructure but not promising to invest enough in their network to cover all the places you might want them. That and the rent seeking, privacy, etc.
- qbasic_forever 5y agoI would be shocked if OBD-2 is used for any key programming. They're almost certainly using a CAN bus (modern cars have both, OBD-2 strictly for legacy emissions testing and multiple CAN buses for everything else). Not that a CAN bus is any less accessible or more secure, but in almost all cases to do anything non-trivial over CAN like key programming requires the $20k dealer computer system (which is specific to every manufacturer and sometimes even model of car) or some serious reverse engineering chops and weeks of time to figure it out.
- bri3d 5y agoThe OBD port exposes diagnostic interface on most cars, either K-Line or CAN. And indeed, many cars in the early 2000s supported key enrollment without cryptographic material using diagnostic tools, so it was only a matter of sniffing a dealership tool. More modern cars from most manufacturers require cryptographic material from a central server to enroll keys. These systems are still often broken (look up XHorse for a popular product in this space) but generally require more in-depth physical access or complex software exploits to bypass the signing process or extract private key material from hardware.
- qbasic_forever 5y agoMy '05 Holden has multiple buses and I imagine every car of that era and beyond is the same. One is OBD-2 and accessible under the steering wheel. It _only_ has the mandated emissions equipment info connected to it, like oxygen sensor readings and such. It has an entirely separate and different physical connector for a CAN bus, one in the engine bay and another under the driver seat IIRC. This one has all the goodies--locks, entertainment system, full engine diagnostics and sensors, etc. I actually have the full factory service manual for the car and key programming is only possible with GM's tech 2 computer system connected to the CAN bus, not OBD-2.
- bri3d 5y agoThis split-connectors model is actually quite uncommon. Many newer cars have either a single CAN bus, a "Gateway" module which bridges Diagnostic CAN accessible through the OBD port to the various CAN buses used inside of the car, or Ethernet / DoIP exposed over "unused" pins on the OBD connector. For example, on modern VW AG cars, key programming is performed over the OBD connector, using specific UDS readLocalIdentifier and writeLocalIdentifier requests, but the data involved in the Immobilizer is both signed and encrypted using secret keys on a VW server (called FAZIT) over a subscription system called GeKo. The dealer diagnostic tool essentially sets up a tunnel over UDS between the Immobilizer software module in a control unit and the FAZIT server.
- bri3d 5y agoThere was a limited time window in the early 2000s where many cars used only obfuscated access or a cryptographically insecure PIN code for key enrollment, but most modern cars use an attempt at cryptographic security with a centralized server. If you want to see what's possible with modern cars, keywords like "VVDI" or "Abrites" and "All Keys Lost" will show you what aftermarket tools are capable of. Generally speaking, the capabilities in these tools are roughly equivalent to those the most sophisticated criminals have, as they're usually just stealing the techniques from one another in a big circle. The level of security varies heavily from manufacturer to manufacturer. For example, most modern VW cars require using an ECU exploit (which depending on the specific ECU, almost always requires physically removing the control unit and sometimes requires opening it) to extract encryption key data (CS/MAC) or physical extraction of the instrument cluster EEPROM. However other manufacturers like Toyota seem to be more vulnerable to other exploits (I only research VW for the most part, so I frankly have no idea what's going on here), including a bizarre process which seems to require disassembling the steering column and unplugging a connector.
- PaulHoule 5y agoI look at the enrollment problem on Zigbee networks and similar things and it's hard for me to resist the conclusion that the most practical architecture is to have a private key in the hub and a private key in the device and have these authenticate against a central server and have the central server give them both a shared key -- as much as people hate the central control, lack of interoperability, etc.
- Teever 5y agoI think people hate mandated central control. Designing a system that is opt-in, and otherwise degrades gracefully to a reasonable state of functionality will win a lot of fans. Automobile companies won't do that however, they'll serve you subscription spyware/adware laden services and you'll have no choice.
- neuralRiot 5y agoCar thieves don’t go out to program new keys on the cars the want to steal, they just lift them with a tow truck. Quick, easy and nobody suspects anything.
- colechristensen 5y agoI was in the situation of trying to "steal" my own car after a cat knocked the keys in the trash without me noticing. I could get in the car, but it was not possible with the security system enabled without a currently working chipped key to program a new one without the dealership to do some I think cryptographic pairing of a new key to the car. I could start the car and it would after one second shut itself off after buying a replacement key and tried many things with many scan tools before giving up and getting towed to the dealer. There might be some sort of cracked tools out there but I was not able to find them, or get a straight answer if the very expensive software packages out there could actually solve the situation.
- WWLink 5y agoI'm on the fence about this sort of security. Do we really really want to make things completely locked down to the point that the manufacturer can close up shop and leave you totally screwed, in the name of "security"? I see that argument pushed a lot when it comes to computers and building stuff the way Apple does - soldering everything down lol. Would you rather a car where you could reprogram the keys yourself with a small chance it might be stolen? Or a car where if the keys get damaged you have to spend several thousand replacing all of the computers?
- colechristensen 5y agoI like that it is hard. Moving forward I actually can set it up so i can program new keys from third parties, it just isn’t possible while the car is locked without a functional key. There are also ways to permanently bypass the security but i don’t really want to do that either, it’s nice that it’s very hard to steal.
- taneq 5y agoWhy are the two options "manufacturer has exclusive control" and "insecure"? The manufacturer could just supply the access code to the purchaser when the car is sold.
- neoecos 5y agoRemote start just turns on the car but you're not able to drive. For drive requires the key to be near, thats the PKE system referenced in the article.
- makeworld 5y agoREADME says 2016-2020 vehicles affected. Where are you getting 2017 and 2018 only?
- matthewdgreen 5y agoThat's what the two CVEs specifically mention, didn't see the README.
- krnlpnc 5y agoTypically as soon as you touch the brake pedal (which is required to shift from park in an automatic) the engine will cut if the key is not present.
- xwdv 5y agoRemote start can be used for homicide by starting a vehicle parked in a garage and letting the carbon monoxide flood the house and kill all occupants.
- Spooky23 5y agoMy cars have a remote start timer where the cars shuts down after a period of time. That would be a crazy crime... hide in the bushes for an hour or two continuously restarting the car every 10 minutes.
- ilikepi 5y agoWe have a 2019 Honda Pilot. The remote start will work for two 10-minute cycles, but then it will not work again until you start it via the primary ignition switch inside the vehicle. Other manufacturers may differ on this behavior however.
- jrockway 5y agoStep 0.5, break in and disable all the CO detectors.
- BHSPitMonkey 5y agoThis assumes the target's attached garage is part of the conditioned space making up the rest of the home (i.e. that there's no air sealing around the door between the house and garage, but the garage door itself is perfectly sealed). That would be a pretty spectacularly bad house design.
- kube-system 5y agoOld houses can be pretty leaky between the garage and living space. Or doors can be left open. But many vehicles’ remote starters have a timeout exactly for this specific safety concern. Between this and modern catalysts, remote starting a car in the same room as you isn’t even likely to kill you.
- nanochad 5y ago