14 ms·

CAN Injection: Keyless car theft

• bobleeswagger 4y ago
  Comma.ai is another great example of CANBUS hacking. I'm a bit worried there are a bunch of zero days sitting out there on CAN implementations. It's such a complicated system.
  • ziziyO 4y ago
    Newer Toyotas (Rav4 Prime and 2022+ Model years) are not compatible with Comma due to encryption, I would guess that probably also defeats this attack.
    • baldeagle 4y ago
      I believe either the data from the adaptive cruise radar, or the data to control the steering is encrypted. I don't know if lock controls are. It was a small but important subset
    • crazysim 4y ago
      On a RAV4 Prime (or RAV4 PHEV for those outside of North America), these ECUs reportedly have "ECU Security Key" (A SecOC implementation) or signed/authenticated CAN bus commands since replacing them requires a check in with a Toyota server to "Update ECU Security Key" : ECM Hybrid vehicle control ECU Forward recognition camera No. 2 skid control ECU (brake actuator assembly) Rack and pinion power steering gear assembly Clearance warning ECU assembly Steering sensor Central gateway ECU (network gateway ECU) Combination meter assembly Airbag sensor assembly --- There's nothing about smart key in here specifically. Not sure on later "ECU Security Key" vehicles though. If someone were to look up replacement instructions for the Smart Key ECU on Toyota's TechInfo, and if it has ECU Security Key update as a step or not, that could answer this.
      • kaftoy 4y ago
        SecOC is based on symmetric key cryptography. If an ECU is replaced and has a new key, this key will have to be taught to all other ECU's in the vehicle communicating with it.
    • rasz 4y ago
      OF course it doesnt, Toyota locked out sensors and actuators used by Comma, not the immobilizer.
  • RockRobotRock 4y ago
    Would love if they could add a keyless unlock feature to their devices.
  • maxerickson 4y ago
    It's really only troublesome on stuff that has a radio. Like it's not great that you can take over an electronic device with brief physical access, but the physical access reduces the scope of the problem a lot.
• deleted 4y ago
  [deleted]
• adolph 4y ago
  The way things really work: • your “bank deposit” is just an unsecured loan to a company who may not manage risk as well as you’d think • your “car” is a collection of computers operating in an insecure data center to which you trust the lives of you and your’n
• bri3d 4y ago
  For what it's worth, most European cars have much more robust immobilizer systems that use actual cryptographic primitives to both obfuscate and authenticate start-release messages. This is for a variety of reasons - a legal and insurance company focus on immobilizer technology through companies like Thatcham Research as well as a more active threat model geopolitically. There are, of course, weaknesses in these cryptosystems, but the documented attack describes an extremely poor system by modern standards.
  • droopyEyelids 4y ago
    What do you think about how the article listed devices being available for all the European manufacturers?
    • bri3d 4y ago
      I would love to see a story about one! I don't work in automotive RE, it's only a hobby, so I don't have budget to go find and buy "emergency start" tools like these security vendors do. As far as I am aware: there are All Keys Lost (AKL) immobilizer bypasses for, for example, Volkswagen Immo 5, but not "Emergency Start" bypasses. The difference is the level of access required: AKL bypasses require involved, long term physical access to a car, for example at a shop. They're useful for independent or fly-by-night shops and in a post-theft scenario, but they're not going to boost a car out of a driveway. Meanwhile, Emergency Start bypasses are plain-and-simple theft tools like the fake Bluetooth speaker from the article. All of the VW Immo 5 exploits which I am aware are of the AKL style and revolve around being able to extract cryptographic material (CS/MAC/ImoDat_noKeyMst/ImoDat_noKeySecu depending on who you ask what it's called) from a control module by physically removing it from the vehicle. This is a far cry from tapping the CAN bus at a headlight and injecting an unauthenticated CAN message.
      • avree 4y ago
        What? This is a CAN bus hack, which is a standard that has been in EU cars for longer than US cars. I've worked with KeylessRide and also built my own hardware immobilizer/CANBUS device at a previous startup, and there is zero difference between European cars and American cars for this... By design, all nodes on a CAN network receive all frames, which is the root of the problem. There are some differences in ECU validation, plus whether or not the vehicle supports UDS diagnostics, but these are differences by manufacturer and have nothing to do with the continent the car is being used on.
• gambiting 4y ago
  The thing that has always bothered me about stuff like this is that there must be some incredbly skilled software and hardware engineers out there who can put this sort of thing together, and they basically decide to use their skills to steal peoples cars(or well, enable others to do that). On one hand I get it, on the other I really don't. I would love to read an interview with any of them and see what drives them.
  • Cthulhu_ 4y ago
    If I were to guess, money. Good scratch to be made selling these tools, or even just working for a contractor and never be found making the tools themselves - just a one-off sell of information on how to build a device like these. But yeah, morals are flexible, a lot of people don't care what their work is used for (whether they're directly aware or not). I mean personally I've worked for investment banking and the tobacco industry (websites/shops for e-smoking products), I've heard of others that have worked for gambling or "adult entertainment", and how many of you here work on either crypto or Amazon? What's morally right, wrong and justifiable is flexible, is all I'm saying.
  • jnwatson 4y ago
    This doesn’t look particularly sophisticated. It takes understanding of basic circuit design and embedded programming. The genius bit is leveraging a Bluetooth speaker. That’s a clever choice. In many countries, engineering (especially hardware) don’t get paid a lot. I could imagine the pull of illicit sources of income being strong.
  • edent 4y ago
    As opposed to the incredibly skilled engineers who... steal your personal data (or enable others to do that)? I would love to read an interview with someone who applied to work for, say, Facebook. After all the news about their complicity in trying to set the world on fire - what drives them?
    • markus_zhang 4y ago
      Money (and a chance to apply what he learned at a much larger scale)? It pays very well and you can FIRE in less than 10 years. Especially when FB is much more legal than say stealing cars.
• deleted 4y ago
  [deleted]
• user945234 4y ago
  Throwaway account. I have actually worked on this sort of stuff. These topics are well known in the industry and have been for a surprising amount of time (decades). Some premium brands will have the immobilizer await proper crypto from the key reader. In this case the key reader is just there to read the key and pass on the message, there is no decision being made outside of the immobilizer. Some premium brands will also have immobilizers in other places, like the gearbox. It too will await proper crypto to shift into gear. Some premium brands will have signed CAN/FlexRay/Ethernet frames that will prevent message spoofing, though that isn't only for this situation. Most of the time the Gateway module has a static firewall - basically fixed routing tables so only modules that need to will be allowed to talk to each other. Finally some premium brands will have an HSM both in the key and in the immobilizers to keep the material safe. There is a lot more to this topic obviously but the reason some brands don't have this (and other countermeasures) is simple: cost.
  • drtz 4y ago
    > Most of the time the Gateway module has a static firewall - basically fixed routing tables so only modules that need to will be allowed to talk to each other. This was exactly my thought. If the headlights, and any other easily access CAN bus wiring, were properly isolated from critical security ECUs via a properly configured gateway, this attack would be impossible.
    • bri3d 4y ago
      I don't think that segmenting CAN wiring is a good solution to this problem. The Powertrain CAN will always be accessible externally for some definition of "externally" (on older GM cars it ran across the bottom of the car to reach the transmission, for example), and even a separate "immobilizer" CAN would probably be accessible somewhere. The solution, as implemented by many automakers already, is just to authenticate immobilizer messages. It works, and there's not a great excuse for not doing this in 2023.
  • redblacktree 4y ago
    How does a person with a CAN tool and an insatiable curiosity for knowledge about his own car find detailed documentation for his own edification? Any leads?
• Thaxll 4y ago
  At that point if you have a recent car you need a steering wheel lock.
  • gambiting 4y ago
    Having owned some expensive cars and spent time with other owners, there are two schools of thoughts to this: 1) add every alarm, immobilizer, hidden kill switch, steering wheel lock, driveway bollard you can possibly afford and keep the keys in a signal blocking pouch at night. OR 2)Make sure the car is as easy to start and drive away as physically possible - don't add anything extra fancy to keep it safe other than what's already there from factory, keep the keys on a shelf right in front of the main door of your property, easily and clearly visible should anyone enter. The reason is simple - for owners of fancy/exotic cars, if someone is coming to steal your car, they will take it. If you make it difficult, if you hide the keys and put locks on the steering wheel, they will come into your house and ask that you unlock it for them. And putting aside the idea of any heroics with self defense, the last thing you want the thieves to do is harm you or your family to take what is essentially just an object. Cars are replacable. Insurance will pay for the loss and therapy for you and your family - but insurance will do nothing about losing your life because you decided to stand up to someone with a weapon coming to take your car. Let them find and take the keys and fuck off as quickly as possible. I was in group 1 when I started, now I'm in group 2 - the risks to me and my family are just not worth it.
    • Thaxll 4y ago
      From what I understand they just don't waste time trying to remove a physical lock, it's like bikes, it's a deterent.
      • gambiting 4y ago
        Yes, but like I said - if you have a Lamborghini or a Ferrari sitting in your driveway and someone comes to steal it, they didn't just happen to be walking past - they are there to take your car. Either on order, or it's been targeted through long time observation already. If there is a lock on the wheel they will come into your house, put a gun to your head and "ask" for you to take it off. There is no deterrent you can use because they are not there to be deterred - wheel locks work against opportunistic thieves because then yes, like with bikes - a thief will just move on to the next easier target.
• Cthulhu_ 4y ago
  Reminds me of a former colleague of mine who got an alert from his phone (I believe he got a call from a BMW support center); there was an attempted break-in of his car. He had a BMW that had an air pressure sensor in the cabin, which was triggered because someone had broken the window. No trace of course once he got to the car / once the police was around, just a broken window. But the would-be burglars made a mistake; they went into the frame of the car (between the driver and rear passenger doors) through the plastic to disconnect a bundle of cables, but didn't fit the plastic back properly. This bundle of cables went to the antenna that was required for the phone home functionality; if he hadn't had that addressed, the thieves would have been back a day or a week later to get into the car, with the pressure sensor / phone home alarm not being able to contact BMW HQ. Organized crime has enough money, time, opportunity and incentive to buy cars and take them apart to find weaknesses.
  • asdff 4y ago
    I feel like for most car break in's there's nothing you can do. The crime can take 10 second and only needs your tshirt wrapped around your fist. Or a spark plug. Or the air bladders tow truck drivers use that you can find at the hardware store. Plus when the alarm does indeed go off, people are liable to ignore it because these alarms are always going off for nothing.
  • rationalist 4y ago
    > frame of the car (between the driver and rear passenger doors) FYI, that would the "B Pillar". The A Pillar is the one between the windshield and the driver door, the C Pillar is the one behind the rear passenger door.
• exabrial 4y ago
  CAN network by its nature is supposed to be a "trusted network" with no external Inputs available (Air Gapped). But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99, yeah, we've sort violated the Air Gap principal. Here's the problem everyone needs to pay attention to: If you demand Encrypted OR Signed CAN Bus, you will ABSOLUTELY get it from the manufacturers in the name of security. They will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car. So be careful what you scream for. We already have enough un-repairable items.
  • drtz 4y ago
    Encrypting everything on the CAN would be overkill and probably cost-prohibitive for manufacturers. Not all messages need to be encrypted -- just the ones that allow you to disable the immobilizer.
    • leoqa 4y ago
      The solution is signing packets with PKI and verifying them on receipt. Nothing says you can’t flash firmware to add new packets etc but the CAN bus couldn’t be spoofed unless you had the private key.
      • heleninboodler 4y ago
        While I agree with this instinct: this sounds like a simple "just use PKI" solution but it's really not simple at all. How do the vehicles' or devices' cert keys get provisioned and protected? Are they unique per device, per vehicle, or per manufacturer? Per device or per vehicle increases manufacturing process overhead (read: price) immensely [edit: as well as overhead at service departments]. Every device that can sign messages needs access to perform private key operations, which necessarily either increases cost (eg by storing the keys in a device-local HSM or adding network-based key operations along with the corresponding one-turtle-down auth problems) or decreases security of those private keys. What happens when they inevitably get extracted and baked into spoofing tools? Can the manufacturer rotate the root keys? What happens to vehicles that are offline when that happens?
• m3kw9 4y ago
  Not sure why they are still using a 1000 year protocol when you have Ethernet as a faster alternative. Even commercial airliners uses tech based on Ethernet for their controls
  • blueflow 4y ago
    Ethernet is actually older than the CAN bus, even if not by much margin.
  • shandor 4y ago
    Cost, reliability, real-time operation characteristics, and simplicity of wiring (which means less weight and less cost)
  • zelos 4y ago
    I believe manufacturers are starting to switch to automotive Ethernet.
    • kaftoy 4y ago
      They are including Eth, not switching to it completely. They will keep the CAN buss there as long as it makes sense. Instrument clusters with graphical display output do use the Eth more and more because the amount of data beats the capacity of a CAN bus by far, but devices without big data transfer needs will stay on CAN. For example, what need is ther for Eth for an electronic gear lever? Not much data being exchanged.
  • genmud 4y ago
    I'm not sure if you know, but canbus is used all over the place, even in aviation. The main selling point is simplicity of wiring and circuitry, as well as the fact that many lower end / cheap microcontrollers have it built in. Ethernet is great, don't get me wrong... but it is complex to implement in a system like a car. Each device needs to speak ethernet, be switched and likely have an IP stack. If you are lucky enough to have a built in MAC / PHY into your micro (which most don't), then you still need to put in transformers and protection circuits. 10BASE-T1S is the future IMHO, it is much simpler than traditional 10BASE-T, requires only 1 pair and can also provide power. For simple setups, only 2 resistors + 2 caps are necessary to implement and you can have multiple devices on a bus without requiring a switch.
• Veliladon 4y ago
  And this is why security parts need to be fucking paired.
  • rasz 4y ago
    Like battery in an iPhone, right?
• msisk6 4y ago
  I often dream of going back to a car without any electronics at all. Of course, I've had those and they have their own problems. Carburetors and point ignition systems have their issues. So I instead live in a world where even my chainsaw has a CAN bus.
  • gambiting 4y ago
    Just a reminder(I remember those times too) that before the advent of immobilisers and electronic ignition locks, any car could be started in about 30 seconds with some very basic tools. Car theft has been absolutely rampant until the mass adoption of immobilisers where it has literally dropped off a cliff - it hasn't stopped thieves completely of course, but it's very much the case of electronics reducing crime by an order of magnitude(at least here in Europe).
    • sourcecodeplz 4y ago
      You could use a basic flat-head screwdriver for both the door and ignition ... Unreal really
      • Gordonjcp 4y ago
        I had an old Mercedes 230TE that could be unlocked and started with any flattish piece of metal roughly the same size and shape as the key. Once I went out to the car early one morning to find it parked up exactly where I'd left it, with 200 more miles on the clock, the petrol tank rather more full, and the engine still warm...
        • ilikehurdles 4y ago
          My family once found their car in the parking lot of the grocery store with the groceries of someone else already inside the car, and a note and contact info left on the windshield about how this person unlocked my parents’ car thinking it was theirs, accidentally loaded their groceries into the wrong identical vehicle, closed the trunk, and then couldn’t unlock it again after noticing the mistake.
• emptybits 4y ago
  I worry that industry solutions involving more proprietary layers and/or encryption on buses will make our vehicles and appliances even less modifiable, diagnosable, and serviceable by anyone except factory authorized techs. In keeping thieves out, we're locking ourselves out. Steering wheel locks and primitive offline immobilizers had their advantages...
• TheRealPomax 4y ago
  This title should be "CAN injection" in all capitals. It's not a verb, it's the acronym for the Controller Area Network. (And is used in all caps by the article itself)
  • AlphaWeaver 4y ago
    Agreed, it seems to have been caught up in the Hacker News automatic title reformatting behavior, which prevents words in all-caps.
    • copperx 4y ago
      Weird choice, given we have more acronyms than the military.
• cjbprime 4y ago
  Great article. But: > And part of the problem is that this isn’t a vulnerability disclosure and so the processes that Toyota does have in place are not appropriate. I didn't follow this part. I hear that the authors think their "you can use CAN fault injection followed by a spoofed unlock command to steal cars" technical writeup is not a vulnerability disclosure. But why not? (Other than because they said so.) The fact that the vulnerability is exploited in the wild doesn't prevent it from being appropriate to report it as a vulnerability -- quite the opposite. They even provide several fix suggestions. (I'm not personally arguing that it is wrong to disclose the vulnerability without coordination. I'm arguing that it's weird to make a choice like that while claiming you aren't making one.)
  • rwmj 4y ago
    He's definitely letting Toyota off the hook there. This absolutely is a vulnerability and whatever the size of the company they should have a way to promptly deal with vulnerabilities. (Of course it also doesn't surprise me in the least that Toyota isn't taking it seriously)
    • cjbprime 4y ago
      I can't tell whether they attempted to disclose it to Toyota through normal vulnerability disclosure channels, though. The article implies to me that they didn't.
      • mynameisvlad 4y ago
        > Ian has tried to get in touch with Toyota to discuss the CAN Injection attack, and to offer help, but hasn’t had much success. That certainly sounds like a yes.
        • cjbprime 4y ago
          I read that as more "we cold emailed people looking for a potential contact" than "we submitted this vulnerability to their PSIRT". The fact that they say this is not a vulnerability disclosure situation suggests that they did not use the vulnerability disclosure communication methods.
• MagicMoonlight 4y ago
  How about instead of keyless entry we just keep using keys. You wouldn’t have a password being loudly screamed out of a speaker 24/7, so why would you design a car key to work that way?
  • Spivak 4y ago
    Keys wouldn't stop this attack, they're simulating the key the way a screwdriver would in the ignition of an older car. This is "keyless theft" meaning "you can steal the car without the keys" not "you steal the car leveraging keyless entry."
  • outworlder 4y ago
    Keys, those things that rely on pins getting pushed by a piece of metal? Not much of an improvement. Without a transponder in the key they are no more difficult to bypass than a light switch.
• StephenAmar 4y ago
  FYI, you can temporarily disable keyless entry on Toyotas fairly easily: Hold down the lock button Hit the unlock button twice
  • peteri 4y ago
    On my Lexus that doesn't disable keyless entry, just puts the key fob into sleep mode. There is an option somewhere to disable keyless entirely, but when enabled it means you need to hold the key near (I think less than 10mm from meory) to the push button start.
• 1970-01-01 4y ago
  If you live in one of these high-theft areas, you can still use security via obscurity. Put a rag between your intake and air filter, or remove a critical relay (fuel pump, starter) or unclip a critical sensor (crank, cam, etc.) if it's easily accessible. Or do all 3. Each takes about one minute.
  • mdibiase 4y ago
    For ease of use, you could also hide a fuel pump switch inside the car that you have to press before going. It's an easy but effective solution for protecting your car and needs basic tools / wires. Of course, the important thing is making sure the wiring is well done (proper wire gauge) and the switch is actually in a hidden spot.
    • olyjohn 4y ago
      Magnetic switch hidden under your cup holders. And a magic cup with the right magnet glued to the bottom.
      • blackboxlogic 4y ago
        I installed a reed switch just under my windshield to unlock the doors. Swiping a magnet is easier than keeping a key in my pocket. Getting myself locked out is more of a concern than a stranger noticing the switch and finding a magnet. I'll even mention it on the internet, if any of you want to steal my car, please just fill up the gas and return it after. Thanks.
• miohtama 4y ago
  "Open sesame" attack
• NKosmatos 4y ago
  Typical corporate answer: We regret to inform you that the reported vulnerability is not in fact deemed as serious as you describe. A hacker/thief having physical access to your car, thus able to inject messages into the CAN bus, is not consider a serious security threat. Thank you for contacting our security department and perhaps you’d be interested in a monthly subscription for running a remote security diagnostic of you car!
• ChumpGPT 4y ago
  If you have a vehicle that you don't want stolen, perhaps a kill switch for the fuel relay is needed. Easy to install and hide. Will prevent the fuel pump from coming on. Something else to consider is a steering lock although it can be defeated, just more work for the would be thief. Sometimes simple hardware can be a good solution is for a software problem.
• redder23 4y ago
  Are there any modern cars that have good modern mechanical parts but have no computers in them whatsoever?
  • rconti 4y ago
    nope, wouldn't pass emissions.
  • rasz 4y ago
    Computer is not a problem here, bad design is. Ancient fully mechanical cars can be started by simply push starting.
• sebstefan 4y ago
  >Modern cars are protected against thefts by using a smart key that talks to the car and exchanges cryptographic messages so that the key proves to the car that it’s genuine. [...] The thieves found a simple way around this: they used a hand-held radio relay station that beams the car’s message into the home to where the keys are kept, and then relays the message from the keys back to the car. The car accepts the relayed message as valid because it is - the real keys were used to unlock the car. Now that people know how a relay attack works generally possible to defeat it: car owners keep their keys in a metal box ? The car talking to the key first? Can't the key just not talk to the car at all unless the button is pressed on the key fob or shortly thereafter?
  • ilikehurdles 4y ago
    A lot of cars in the 2010s made available touch-based convenience access. ie if I have the fob on my person, the car unlocks when I touch the handle of a door, or gesture to open the trunk. In the 2020s, I’m increasingly seeing smartphone (NFC?) keys being the sole thing you need to drive off with the thing so no fob is even necessary.
    • rootusrootus 4y ago
      > NFC? Or bluetooth. I'd rather have a pocket fob than have to take my phone out and hold it up to an NFC reader. The problem with the bluetooth method is reliability. My Tesla decides not to unlock for me perhaps once every 20 times I walk up to it. Sometimes just a few seconds while it figures it out, sometimes I have to open the up and hit the door unlock button. My wife's Bolt uses a pocket fob, and so far it has never refused to unlock the doors on command.
      • throitallaway 4y ago
        Interesting. What phone OS do you use? Maybe there's a battery optimization setting at play here for the OS or app.
        • 4y ago
• mdmglr 4y ago
  So the device is using the controller on the JBL speaker with a modified firmware? And the grafted on components are to interface with the CAN bus?
  • UncleEntity 4y ago
    It’s using the battery of the speaker and the obfuscation of carrying around a Bluetooth consumer device. To the cops it looks innocent enough. They seem to also pull out the speaker to make room for the add on board which does all the magic.
• vbezhenar 4y ago
  If you don't want your car to be stolen, why not installing proper security measures? I don't really understand why someone would trust manufacturer to protect a car. In my country nobody does that, first thing you do after you bought a new car is you install additional security devices to prevent theft.
  • 3-cheese-sundae 4y ago
    What's an example of the devices you're talking about?
    • deleted 4y ago
      [deleted]
    • vbezhenar 4y ago
      Additional security modules. They detect hits, they don't allow engine to start unless they're unlocked with remote control. In my country most popular brands are Starline and Pandora.
  • 98codes 4y ago
    For example?
• blobbers 4y ago
  Is this the sort of thing that works on any CAN bus car, or are older cars immune to it since their ignition might not be on this same system? Is my 11 year old car a little more "steal" proof to these elegant methods?
  • tonymillion 4y ago
    If you have push button ignition then yes there's a chance your car is vulnerable. Any CAN bus? No, it takes time to sniff the bus and get all the control messages, older cars may be especially vulnerable since they likely don't have as many security precautions in place. CAN has been in cars for quite a long time, the infiltration systems haven't due to high-cost/lack of electronics. On a side note, the hack talked about in the article could be performed by a Arduino UNO and a $5 can bus transceiver.
  • potatochup 4y ago
    Age doesn't really matter in this case. This is laziness on Toyotas part by not authenticating the messages between the "Smart Key" ECU and the main engine control microcontroller.
• 0xbadcafebee 4y ago
  One look at the basic CAN architecture diagram and you see the problem. There's no reason for a secure key exchange to be on the same network path as every other device. Wrapping it in magic crypto sauce is not a permanent fix, because someone will just find a novel way to defeat the cryptosystem, like they always have. If a thief wants to steal the car, make it harder. There should be one physical path from the key system to the ECU that allows key operations, and it should be protected by a really annoying and time-consuming process so that theft is so annoying that most people won't ever try it. After that is done, they can start sprinkling it with magic crypto sauce. (It's also very hard to get magic crypto sauce right; unless you hire the few really talented crypto people, whoever you hire to write crypto will make mistakes, and a hacker has unlimited time to find one) Obviously existing car models won't be changed, but future ones should be. Car theft isn't just an inconvenience for the owner; it makes committing other crimes easier and harder to trace, results in more property damage, increases the black market for chopped cars, increases insurance premiums, etc.
• nirav72 4y ago
  One day used cars with the least amount of tech are going to be worth a lot of money in secondary markets. Especially because of the recent move to subscription based feature options some auto makers are trying out.
  • fy20 4y ago
    To whom exactly? A handful of people wearing tin-foil hats? The rest of the world is going to be happy they can pay $9.99 a month to be able to remotely turn on the AC in their car.
    • nirav72 4y ago
      Sure people will people for convenience and automakers will charge a subscription for providing that remote connectivity. But that wasn't the point in context of this article - the specific exploit detailed in the article can be applied to almost any non-connected vehicle in the last decade.
• wkearney99 4y ago
  Many (most?) vehicles have more than one CAN bus and messages for other networks are NOT bridged across them.
  • kaftoy 4y ago
    Not sure what you mean by "not bridged across them", but devices on different communication busses (CAN, Flexray, Ethernet...) do communicate with each other through these devices called "Gateways".
• whimsicalism 4y ago
  Crazy that this attack developed in the wild. I'm impressed.
• WalterBright 4y ago
  Or just go back to having mechanical keys.
• 93po 4y ago
  At first I forgot what I was reading and assumed the vandalism was because this guy had annoyingly bright headlights and a neighbor was making a point for him to fuck off with that
• PanMan 4y ago
  It surprised me the hacking toolkit came in a JBL speaker - I guess they reverse engineered that as well, flashed it with custom firmware, and it had most of the hardware needed for this hack?
  • Nextgrid 4y ago
    The article shows they soldered a custom board with a microcontroller on top of the JBL board - the only parts of the speaker board that are reused is the battery charging side of things.
• nippoo 4y ago
  As someone who's designed a product that's legitimately meant to unlock cars over the CAN bus, I'll be sad when encrypted/authenticated CAN communications become the norm! Users should be able to connect to the CAN bus in their own car and remotely lock/unlock the vehicle. There are ways of making a car more secure (there are already several different CAN buses in modern cars - having a security-specific CAN bus inaccessible without physical access to the inside of the vehicle should be a minimum!) To start the vehicle, other manufacturers have the key communicate with the ECU directly, bypassing the accessory CAN bus. Something I'd like to see is a unique private RSA key given to car owners on a USB stick upon purchase of the vehicle to allow them to replicate their own keys.
• thesaintlives 4y ago
  Great post. One thing to add is most car door locks can be opened without much difficulty and without damage and usually not turning on the alarm. Open and plug device straight into the can bus. No need for headlight damage...
• red_admiral 4y ago
  In the old days, before cars were computer systems, thieves could still steal cars by hotwiring them - as I understand, the key ignition was basically a lock where if you turn the key then wire A connects to wire B (and if you turn it even further into "starter" position then wire C is somehow involved too) and a competent thief could easily strip out the lock assembly and just connect the wires with a jumper cable. Plus ca change. In said old days, my late grandfather had a steering wheel lock, basically a giant padlock with a metal bar attached and the whole thing painted yellow. I assume that would work just as well in today's electronic days.