4 ms·

I would be shocked if OBD-2 is used for any key programming. They're almost certainly using a CAN bus (modern cars have both, OBD-2 strictly for legacy emissio

I would be shocked if OBD-2 is used for any key programming. They're almost certainly using a CAN bus (modern cars have both, OBD-2 strictly for legacy emissions testing and multiple CAN buses for everything else). Not that a CAN bus is any less accessible or more secure, but in almost all cases to do anything non-trivial over CAN like key programming requires the $20k dealer computer system (which is specific to every manufacturer and sometimes even model of car) or some serious reverse engineering chops and weeks of time to figure it out.

bri3d 5y ago
The OBD port exposes diagnostic interface on most cars, either K-Line or CAN. And indeed, many cars in the early 2000s supported key enrollment without cryptographic material using diagnostic tools, so it was only a matter of sniffing a dealership tool. More modern cars from most manufacturers require cryptographic material from a central server to enroll keys. These systems are still often broken (look up XHorse for a popular product in this space) but generally require more in-depth physical access or complex software exploits to bypass the signing process or extract private key material from hardware.
- qbasic_forever 5y ago
  My '05 Holden has multiple buses and I imagine every car of that era and beyond is the same. One is OBD-2 and accessible under the steering wheel. It _only_ has the mandated emissions equipment info connected to it, like oxygen sensor readings and such. It has an entirely separate and different physical connector for a CAN bus, one in the engine bay and another under the driver seat IIRC. This one has all the goodies--locks, entertainment system, full engine diagnostics and sensors, etc. I actually have the full factory service manual for the car and key programming is only possible with GM's tech 2 computer system connected to the CAN bus, not OBD-2.
  - bri3d 5y ago
    This split-connectors model is actually quite uncommon. Many newer cars have either a single CAN bus, a "Gateway" module which bridges Diagnostic CAN accessible through the OBD port to the various CAN buses used inside of the car, or Ethernet / DoIP exposed over "unused" pins on the OBD connector. For example, on modern VW AG cars, key programming is performed over the OBD connector, using specific UDS readLocalIdentifier and writeLocalIdentifier requests, but the data involved in the Immobilizer is both signed and encrypted using secret keys on a VW server (called FAZIT) over a subscription system called GeKo. The dealer diagnostic tool essentially sets up a tunnel over UDS between the Immobilizer software module in a control unit and the FAZIT server.
mox1 5y ago
I believe he meant the physical OBD-2 port. As an analogy: One can access a computers PCI bus over the Thunderbolt / USB-C connector, given the correct situation.
myself248 5y ago
I'm in the industry and most cars 2008-2017 or thereabouts have multiple CAN buses exposed on the OBD2 port. One (powertrain CAN) on the regulated 6/14 pins which is guaranteed to answer the emissions messages but probably exposes other stuff too, and then others (body CAN, infotainment CAN, etc) on other pairs of pins. Post-2018-ish, they tend to have a gateway module, and accessing anything interesting requires you to get into the wiring "behind" the gateway where all the internal buses are. But that's also trivial, in most cars it takes about 20 seconds once your wrist knows the way. > requires the $20k dealer computer system Or knowing the messages it sends. It's only $20k because it can be. > or some serious reverse engineering chops and weeks of time to figure it out. Which someone then packages into a $500 car-stealer they sell on aliexpress and then all the criminals have to do is buy that thing and push a button.

bri3d 5y ago

The OBD port exposes diagnostic interface on most cars, either K-Line or CAN. And indeed, many cars in the early 2000s supported key enrollment without cryptographic material using diagnostic tools, so it was only a matter of sniffing a dealership tool. More modern cars from most manufacturers require cryptographic material from a central server to enroll keys. These systems are still often broken (look up XHorse for a popular product in this space) but generally require more in-depth physical access or complex software exploits to bypass the signing process or extract private key material from hardware.

qbasic_forever 5y ago
My '05 Holden has multiple buses and I imagine every car of that era and beyond is the same. One is OBD-2 and accessible under the steering wheel. It _only_ has the mandated emissions equipment info connected to it, like oxygen sensor readings and such. It has an entirely separate and different physical connector for a CAN bus, one in the engine bay and another under the driver seat IIRC. This one has all the goodies--locks, entertainment system, full engine diagnostics and sensors, etc. I actually have the full factory service manual for the car and key programming is only possible with GM's tech 2 computer system connected to the CAN bus, not OBD-2.
- bri3d 5y ago
  This split-connectors model is actually quite uncommon. Many newer cars have either a single CAN bus, a "Gateway" module which bridges Diagnostic CAN accessible through the OBD port to the various CAN buses used inside of the car, or Ethernet / DoIP exposed over "unused" pins on the OBD connector. For example, on modern VW AG cars, key programming is performed over the OBD connector, using specific UDS readLocalIdentifier and writeLocalIdentifier requests, but the data involved in the Immobilizer is both signed and encrypted using secret keys on a VW server (called FAZIT) over a subscription system called GeKo. The dealer diagnostic tool essentially sets up a tunnel over UDS between the Immobilizer software module in a control unit and the FAZIT server.

mox1 5y ago

I believe he meant the physical OBD-2 port. As an analogy: One can access a computers PCI bus over the Thunderbolt / USB-C connector, given the correct situation.

myself248 5y ago

I'm in the industry and most cars 2008-2017 or thereabouts have multiple CAN buses exposed on the OBD2 port. One (powertrain CAN) on the regulated 6/14 pins which is guaranteed to answer the emissions messages but probably exposes other stuff too, and then others (body CAN, infotainment CAN, etc) on other pairs of pins. Post-2018-ish, they tend to have a gateway module, and accessing anything interesting requires you to get into the wiring "behind" the gateway where all the internal buses are. But that's also trivial, in most cars it takes about 20 seconds once your wrist knows the way. > requires the $20k dealer computer system Or knowing the messages it sends. It's only $20k because it can be. > or some serious reverse engineering chops and weeks of time to figure it out. Which someone then packages into a $500 car-stealer they sell on aliexpress and then all the criminals have to do is buy that thing and push a button.