6 ms·

I Hacked My Car Guides: Creating Custom Firmware

140 points by zdw 4y ago

xnorswap 4y ago
> These values are actually the first AES 128bit CBC example key/iv listed in the NIST document SP800-38A. I'd love to have a better insight into how exactly this happens. Not that it sounds like it would have been much of an issue even if properly generated keys and IVs were used.
- Nextgrid 4y ago
  My bet is either subcontracting the development to a lowest-bidder with no understanding of the concepts behind the code they're writing, or malicious compliance by an engineer that sees no reason to prevent people from installing custom firmware on their own car but still needed something that "looked" secure to get approved by management.
- nanidin 4y ago
  At the end of the day, lack of competent security leadership at Hyundai. In my work with other auto OEM's, there is some kind of security officer assigned to a vehicle model or platform that specifies requirements and that requires formal attestations for things like private key material, SSL cipher suites, process isolation and so forth. At the other OEM's I have worked with, private key material lives on an HSM controlled by the OEM and all signing/encryption is done by the OEM for production builds. If they are using example keys from NIST and private keys from published tutorials, then I would not be surprised if they are also using defaults for TLS - for example: allowing TLS 1.0, allowing TLS 1.1, allowing weak cipher suites, etc.
InsomniacL 4y ago
I wonder how you can confirm you don't have jailbroken firmware when buying a second hand vehicle.
- CogitoCogito 4y ago
  I feel like I'd actually would value the blog author's car _more_ after the modifications. Well at the moment it would be either neutral or slightly positive (the author has demonstrated what's possible), but if any extra functionality would be added, I'd be a happy camper.
  - fake-name 4y ago
    The author's car (where you presumably have some assurance the firmware on the device is what is claimed? Sure. A random car from a 2nd hand car lot with a mystery custom firmware? Oh hellllllll no. This only add value if you assume there are no bad actors. I'd bet $100 if this becomes common, 2nd hand car lots will sell access to install creepy tracking firmware on all cars that pass through their hands.
    - CogitoCogito 4y ago
      I agree I’d like to made aware of any such changes made by previous owners, but I pretty much consider the makers of the OEM Software as bad actors at this point.
    - Nextgrid 4y ago
      > A random car from a 2nd hand car lot with a mystery custom firmware? Oh hellllllll no. Just like any random car can have a $100 GPS tracker or spy microphone hidden which you won't locate without dismantling the entire car. If someone wants to spy or be nefarious with a car I can think of many easier & cheaper ways than making custom firmware for the radio.
      - tailspin2019 4y ago
        You often connect your phone to this system though, via cable or Bluetooth, so I can see a pretty simple attack vector here to enable being way more nefarious than just GPS tracking…
  - InsomniacL 4y ago
jeroenhd 4y ago
Application development looks remarkably doable: https://programmingwithstyle.com/posts/howihackedmycarpart3/ https://programmingwithstyle.com/posts/howihackedmycarpart3/ I don't know how powerful the chip in the car is but I can see someone building quite a competent open source navigation system through Qt and some car APIs, assuming you can get some kind of map storage solution working
- LadyCailin 4y ago
  My experience (datapoint 1, working on ecocar in college a decade ago) was that they are exceedingly defensive revealing info about the CAN message format. It would likely require reverse engineering the protocol in order to make any apps that actually interface with the car somehow. Making a fully standalone app would be possible, but limited in usefulness.
  - bluGill 4y ago
    That depends on what you want to do. OBDII diagnostics is legally mandated by law and so not hard to do across all cars. It is minimal information, but enough for most things. If you want anything else it different for each car (not just each manufacture, sometimes sometimes the same car model will have more than one variant). The information you need isn't impossible to get: the manufactures make this available to third party scan tools, but they assume anyone wanting this information considers paying $100,000 a nominal cost and won't question it. In a previous job (I left in 2010) I had access to this information, but we still spent a lot of time reverse engineering things because the documents were too often wrong.
    - frosted-flakes 4y ago
      OBDII is only required for engine diagnostics, no? I've heard that Tesla cars don't have them, for example.
      - bluGill 4y ago
        It is only required for emissions diagnostics. Which is a small subset of total engine diagnostics, though the most common things to go wrong on an engine affect emissions so for practical purposes it is engine.
consp 4y ago
Quite a few people have already done this for the Ford Sync3 infotainment systems which are based on QNX6. You only need to connect a SD reader to the eMMC module on the daughterboard and mount the disk and install ssh. There are a few jigs around which you can buy to make this easier. The root password takes about 30 minutes with hashcat if you have an old model with broken signature checking so you can install a custom update package and install a ssh server that way (you do not need disk access for the digest, updates will get you there). Depending on where you live, this might be illegal though.
- tomrod 4y ago
  Where would you look to determine this?
akeck 4y ago
I've always wondered if a car is still insurable after one loads custom firmware.
- silon42 4y ago
  yes... but insurance might be void when you have an accident, if this is discovered (I'd hope it will only matter if there is an electronic problem impacting the accident).
  - johannes1234321 4y ago
    This means you have a (void) insurance contract, but the car isn't insured.
- Nextgrid 4y ago
  He's not loading custom firmware on the car - the title is clickbait. In fact, there is no "car" when it comes to firmware - there's not central computer that controls the "car". There are separate modules that do well-defined tasks and only a few of them would ever be relevant in an insurance/accident scenario (engine/transmission controller, power steering and maybe ABS). What he's done here is equivalent to installing an aftermarket head unit, something people have been doing for decades. But even editing firmware (or rather the data tables in there - also called "maps") from more "spicy" controllers such as the engine management controller is routinely done by auto tuning shops and in practice the worst that happens is blowing up your engine by pushing it beyond its limits.
  - TedDoesntTalk 4y ago
    After-market head units don’t seem to have access to the same data as this factory-installed one. Can after market head units read gas tank levels, battery voltage, door lock statuses (and lock/unlock doors with commands), probably interface with the climate control system, too.
    - 95014_refugee 4y ago
alufers 4y ago
My Dacia makes it easy for me :). If you reboot the infotainment system with a USB drive formatted with FAT it will run any commands in the `autorun_bavn/autorun.sh` file with root permissions. Some people are unlocking more maps in the navigation system by patching files which tell the infotainment application what options you purhased.
- yrgulation 4y ago
  Have you tried the new electric dacia? Wondering if one can just up the torque since it's electric. Would be dangerous, but curious how much faster it can get.
  - lelag 4y ago
    For this to be even remotely possible, the infotainment unit would have to have direct access to the CAN bus which is certainly not the case (at least I hope). Most probably, the car expose some feature through an API to the infotainment unit but that would not include any direct control on the car driving operations.
    - bluGill 4y ago
      I would expect the radio to have access to a CAN bus. The same diagnostics tool that uses can to read your engine should also be able to read the radio, and the infotainment should have all the ability to display all DTCs and what they mean. I would expect all controllers with safety critical functions are carefully firewalled so that you cannot do bad things via CAN.
      - adolph 4y ago
        It depends on what you mean by critical I guess. comma.ai and OpenPilot uses CAN to perform steering, acceleration and braking (I think). https://github.com/commaai/openpilot/blob/master/selfdrive/car/toyota/toyotacan.py https://github.com/commaai/openpilot/blob/master/selfdrive/c...
    - 4y ago
Cyder 4y ago
Always wanted to do this on my wife's Kia. But the head unit is so slow and the touchscreens die after only a few years so I've got a box of 3 of these bad oems and finally installed an after market unit.
blacklion 4y ago
It make car illegal, doesn't it? I don't speak about vendor's warranty, I'm speaking about road code. As far as I know, many countries forbids meddling with breaks, lights, engine exhaust system and other systems related to road safety. I understand, that infotaiment system is not the brakes, but still - many modern car allows to setup ABS and traction control modes via same interface, for example.
- ocdtrekkie 4y ago
  On a lot of cars the infotainment system explicitly doesn't do that because of the security implications. Our 2021 has a lot of non-critical settings in the touchscreen display, and all of the road behavior settings are set on the screen behind the wheel and configured with the arrow keys on the wheel.
  - archi42 4y ago
    Depends on the make. For my 2013 Volvo I can adjust some of the driving assistant configs (e.g. disable blind spot information) and switch the light to left-hand traffic. This won't explode the car, but might be enough control for some malware to cause an accident.
aorth 4y ago
On a related note, factory-installed Toyota display systems can sometimes be locked and require an "ERC" code to unlock. The display in my recently imported car was in Japanese and seemed to be stuck, as none of the buttons or rear camera worked. I learned from Google Translate that it was in some kind of anti-theft lock mode, and after going down the rabbit hole I found out that I could access a secret menu by holding radio power and turning the headlights on and off three times, which revealed a screen displaying the display's serial number and asking for an "ERC" code. It turns out some fine Internet people have written C# (https://github.com/alexeyfadeev/erc-calculator https://github.com/alexeyfadeev/erc-calculator) and Python (https://github.com/Berks/python_erc https://github.com/Berks/python_erc) packages to generate these codes. Was really cool to figure this out without having to pay some shady site in Bitcoins! The display is still in Japanese, but at least I can use Bluetooth and the rear camera! Hope that helps someone.
NonNefarious 4y ago
What are "car guides?"

140 points by zdw 4y ago

> These values are actually the first AES 128bit CBC example key/iv listed in the NIST document SP800-38A. I'd love to have a better insight into how exactly this happens. Not that it sounds like it would have been much of an issue even if properly generated keys and IVs were used.

Nextgrid 4y ago
My bet is either subcontracting the development to a lowest-bidder with no understanding of the concepts behind the code they're writing, or malicious compliance by an engineer that sees no reason to prevent people from installing custom firmware on their own car but still needed something that "looked" secure to get approved by management.
nanidin 4y ago
At the end of the day, lack of competent security leadership at Hyundai. In my work with other auto OEM's, there is some kind of security officer assigned to a vehicle model or platform that specifies requirements and that requires formal attestations for things like private key material, SSL cipher suites, process isolation and so forth. At the other OEM's I have worked with, private key material lives on an HSM controlled by the OEM and all signing/encryption is done by the OEM for production builds. If they are using example keys from NIST and private keys from published tutorials, then I would not be surprised if they are also using defaults for TLS - for example: allowing TLS 1.0, allowing TLS 1.1, allowing weak cipher suites, etc.

InsomniacL 4y ago

I wonder how you can confirm you don't have jailbroken firmware when buying a second hand vehicle.

CogitoCogito 4y ago
I feel like I'd actually would value the blog author's car _more_ after the modifications. Well at the moment it would be either neutral or slightly positive (the author has demonstrated what's possible), but if any extra functionality would be added, I'd be a happy camper.
- fake-name 4y ago
  The author's car (where you presumably have some assurance the firmware on the device is what is claimed? Sure. A random car from a 2nd hand car lot with a mystery custom firmware? Oh hellllllll no. This only add value if you assume there are no bad actors. I'd bet $100 if this becomes common, 2nd hand car lots will sell access to install creepy tracking firmware on all cars that pass through their hands.
  - CogitoCogito 4y ago
    I agree I’d like to made aware of any such changes made by previous owners, but I pretty much consider the makers of the OEM Software as bad actors at this point.
  - Nextgrid 4y ago
    > A random car from a 2nd hand car lot with a mystery custom firmware? Oh hellllllll no. Just like any random car can have a $100 GPS tracker or spy microphone hidden which you won't locate without dismantling the entire car. If someone wants to spy or be nefarious with a car I can think of many easier & cheaper ways than making custom firmware for the radio.
    - tailspin2019 4y ago
      You often connect your phone to this system though, via cable or Bluetooth, so I can see a pretty simple attack vector here to enable being way more nefarious than just GPS tracking…
- InsomniacL 4y ago

jeroenhd 4y ago

Application development looks remarkably doable: https://programmingwithstyle.com/posts/howihackedmycarpart3/ https://programmingwithstyle.com/posts/howihackedmycarpart3/ I don't know how powerful the chip in the car is but I can see someone building quite a competent open source navigation system through Qt and some car APIs, assuming you can get some kind of map storage solution working

LadyCailin 4y ago
My experience (datapoint 1, working on ecocar in college a decade ago) was that they are exceedingly defensive revealing info about the CAN message format. It would likely require reverse engineering the protocol in order to make any apps that actually interface with the car somehow. Making a fully standalone app would be possible, but limited in usefulness.
- bluGill 4y ago
  That depends on what you want to do. OBDII diagnostics is legally mandated by law and so not hard to do across all cars. It is minimal information, but enough for most things. If you want anything else it different for each car (not just each manufacture, sometimes sometimes the same car model will have more than one variant). The information you need isn't impossible to get: the manufactures make this available to third party scan tools, but they assume anyone wanting this information considers paying $100,000 a nominal cost and won't question it. In a previous job (I left in 2010) I had access to this information, but we still spent a lot of time reverse engineering things because the documents were too often wrong.
  - frosted-flakes 4y ago
    OBDII is only required for engine diagnostics, no? I've heard that Tesla cars don't have them, for example.
    - bluGill 4y ago
      It is only required for emissions diagnostics. Which is a small subset of total engine diagnostics, though the most common things to go wrong on an engine affect emissions so for practical purposes it is engine.

consp 4y ago

Quite a few people have already done this for the Ford Sync3 infotainment systems which are based on QNX6. You only need to connect a SD reader to the eMMC module on the daughterboard and mount the disk and install ssh. There are a few jigs around which you can buy to make this easier. The root password takes about 30 minutes with hashcat if you have an old model with broken signature checking so you can install a custom update package and install a ssh server that way (you do not need disk access for the digest, updates will get you there). Depending on where you live, this might be illegal though.

tomrod 4y ago
Where would you look to determine this?

akeck 4y ago

I've always wondered if a car is still insurable after one loads custom firmware.

silon42 4y ago
yes... but insurance might be void when you have an accident, if this is discovered (I'd hope it will only matter if there is an electronic problem impacting the accident).
- johannes1234321 4y ago
  This means you have a (void) insurance contract, but the car isn't insured.
Nextgrid 4y ago
He's not loading custom firmware on the car - the title is clickbait. In fact, there is no "car" when it comes to firmware - there's not central computer that controls the "car". There are separate modules that do well-defined tasks and only a few of them would ever be relevant in an insurance/accident scenario (engine/transmission controller, power steering and maybe ABS). What he's done here is equivalent to installing an aftermarket head unit, something people have been doing for decades. But even editing firmware (or rather the data tables in there - also called "maps") from more "spicy" controllers such as the engine management controller is routinely done by auto tuning shops and in practice the worst that happens is blowing up your engine by pushing it beyond its limits.
- TedDoesntTalk 4y ago
  After-market head units don’t seem to have access to the same data as this factory-installed one. Can after market head units read gas tank levels, battery voltage, door lock statuses (and lock/unlock doors with commands), probably interface with the climate control system, too.
  - 95014_refugee 4y ago

alufers 4y ago

My Dacia makes it easy for me :). If you reboot the infotainment system with a USB drive formatted with FAT it will run any commands in the `autorun_bavn/autorun.sh` file with root permissions. Some people are unlocking more maps in the navigation system by patching files which tell the infotainment application what options you purhased.

yrgulation 4y ago
Have you tried the new electric dacia? Wondering if one can just up the torque since it's electric. Would be dangerous, but curious how much faster it can get.
- lelag 4y ago
  For this to be even remotely possible, the infotainment unit would have to have direct access to the CAN bus which is certainly not the case (at least I hope). Most probably, the car expose some feature through an API to the infotainment unit but that would not include any direct control on the car driving operations.
  - bluGill 4y ago
    I would expect the radio to have access to a CAN bus. The same diagnostics tool that uses can to read your engine should also be able to read the radio, and the infotainment should have all the ability to display all DTCs and what they mean. I would expect all controllers with safety critical functions are carefully firewalled so that you cannot do bad things via CAN.
    - adolph 4y ago
      It depends on what you mean by critical I guess. comma.ai and OpenPilot uses CAN to perform steering, acceleration and braking (I think). https://github.com/commaai/openpilot/blob/master/selfdrive/car/toyota/toyotacan.py https://github.com/commaai/openpilot/blob/master/selfdrive/c...
  - 4y ago

Cyder 4y ago

Always wanted to do this on my wife's Kia. But the head unit is so slow and the touchscreens die after only a few years so I've got a box of 3 of these bad oems and finally installed an after market unit.

blacklion 4y ago

It make car illegal, doesn't it? I don't speak about vendor's warranty, I'm speaking about road code. As far as I know, many countries forbids meddling with breaks, lights, engine exhaust system and other systems related to road safety. I understand, that infotaiment system is not the brakes, but still - many modern car allows to setup ABS and traction control modes via same interface, for example.

ocdtrekkie 4y ago
On a lot of cars the infotainment system explicitly doesn't do that because of the security implications. Our 2021 has a lot of non-critical settings in the touchscreen display, and all of the road behavior settings are set on the screen behind the wheel and configured with the arrow keys on the wheel.
- archi42 4y ago
  Depends on the make. For my 2013 Volvo I can adjust some of the driving assistant configs (e.g. disable blind spot information) and switch the light to left-hand traffic. This won't explode the car, but might be enough control for some malware to cause an accident.

aorth 4y ago

On a related note, factory-installed Toyota display systems can sometimes be locked and require an "ERC" code to unlock. The display in my recently imported car was in Japanese and seemed to be stuck, as none of the buttons or rear camera worked. I learned from Google Translate that it was in some kind of anti-theft lock mode, and after going down the rabbit hole I found out that I could access a secret menu by holding radio power and turning the headlights on and off three times, which revealed a screen displaying the display's serial number and asking for an "ERC" code. It turns out some fine Internet people have written C# (https://github.com/alexeyfadeev/erc-calculator https://github.com/alexeyfadeev/erc-calculator) and Python (https://github.com/Berks/python_erc https://github.com/Berks/python_erc) packages to generate these codes. Was really cool to figure this out without having to pay some shady site in Bitcoins! The display is still in Japanese, but at least I can use Bluetooth and the rear camera! Hope that helps someone.

NonNefarious 4y ago

What are "car guides?"