11 ms·

CAN network by its nature is supposed to be a "trusted network" with no external Inputs available (Air Gapped). But yeah, because headlights and blinkers needl

CAN network by its nature is supposed to be a "trusted network" with no external Inputs available (Air Gapped). But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99, yeah, we've sort violated the Air Gap principal. Here's the problem everyone needs to pay attention to: If you demand Encrypted OR Signed CAN Bus, you will ABSOLUTELY get it from the manufacturers in the name of security. They will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car. So be careful what you scream for. We already have enough un-repairable items.

drtz 4y ago
Encrypting everything on the CAN would be overkill and probably cost-prohibitive for manufacturers. Not all messages need to be encrypted -- just the ones that allow you to disable the immobilizer.
- leoqa 4y ago
  The solution is signing packets with PKI and verifying them on receipt. Nothing says you can’t flash firmware to add new packets etc but the CAN bus couldn’t be spoofed unless you had the private key.
  - heleninboodler 4y ago
    While I agree with this instinct: this sounds like a simple "just use PKI" solution but it's really not simple at all. How do the vehicles' or devices' cert keys get provisioned and protected? Are they unique per device, per vehicle, or per manufacturer? Per device or per vehicle increases manufacturing process overhead (read: price) immensely [edit: as well as overhead at service departments]. Every device that can sign messages needs access to perform private key operations, which necessarily either increases cost (eg by storing the keys in a device-local HSM or adding network-based key operations along with the corresponding one-turtle-down auth problems) or decreases security of those private keys. What happens when they inevitably get extracted and baked into spoofing tools? Can the manufacturer rotate the root keys? What happens to vehicles that are offline when that happens?
    - heleninboodler 4y ago
      I think to be feasible from a maintenance and consumer-friendliness standpoint, each vehicle should have its own local CA and have some sort of open standard for how individual devices can have certificates provisioned so that they can be installed on a car. A replacement-part-pairing function that can only be performed by having physical access to a specific secured component (e.g. not just bus access) should work without contacting the manufacturer. I'm in for this startup idea. :D
    - lamontcg 4y ago
      I thought it was covered in the article but all the devices on the bus would need secret keys that were unique across all devices manufactured. This isn't impossible though since we've been making unique MAC addresses on NICs for many decades, and motherboards often come these days with the actual serial number of the server flashed into the DMI information, etc. It will also take an electron microscope to read the keys out of the chips, which is not a very mobile attack to use against a parked car on the street.
      - heleninboodler 4y ago
        First, those unique MACs and serial numbers are not currently in storage that requires an electron microsocope to read, so that's a pretty big additional cost burden. Second, assuming all devices were to be given secure key storage parts, you also have the cost burden of the pairing process during manufacturing and maintenance, as I mentioned above (not to mention the design and development of that pairing database and its failure/diag/maintenance/factory-reset modes). It's far from trivial.
        lamontcg 4y ago
        If you don't provide a convenient interface to read a MAC address then you're going to need an electron microscope to pull it off a NIC chip as well. They just always provide the convenient interface to get at it.
        4y ago
  - AlotOfReading 4y ago
    As someone who has (successfully) implemented this at multiple manufacturers, it is absolutely not as easy as "just signing it". First off, almost all vehicles are running CANbuses right to the edge of their available bandwidth. Making the signature data fit is a vehicle-wide refactor unless you've designed for it from the beginning. Secondly, many automotive MCUs don't have hardware crypto support or enough spare cycles for signing/verification. You have to design for that from the beginning. Third, key distribution is hard. There are a lot of parties outside the OEM that need to flash firmware for various reasons during production. Do you give them all private keys or do you put up a public image signing service anyone can submit binaries to? There's lots of other issues I could go on about like what the key rollover looks like, but I hope it's clear that retrofitting cryptography onto complicated systems that weren't designed for it is anything but straightforward.
    - leoqa 4y ago
      I’m sure there are a lot of complexities, I think the general shape of the solution is the same. Another poster (perhaps you?) mentioned that luxury cars do sign CAN packets. Anyways I’m not in this industry but work on SPIFFE and see similarities- you could have a centralized CA in the car that does attestation to remote workloads.
      - AlotOfReading 4y ago
        That can be a solution, but I usually push to simply scrap CAN everywhere possible and move to IP networking as mentioned by others in a sibling thread. That requires a ground-up system redesign, but it has a lot of benefits like not requiring a bunch of automotive programmers to implement a custom crypto architecture on constrained systems in C. With CAN, you're pretty firmly in the land of tradeoffs because the safety-critical stuff you want to auth is also hard realtime and solutions that involve expensive coprocessors like HSMs are usually off the table for a number of reasons like cost, lack of vendors supplying high-integrity solutions, inability to do board spins, etc. Adding authentication also has the nasty problem of sometimes reducing your safety because it makes the channel less noise resistant, as demonstrated by Dariz et al [1]. Navigating these sorts of tradeoffs are why some manufacturers have gone with half-measures like only authenticating a small subset of messages. [1] https://doi.org/10.1109/MTITS.2017.8005670 https://doi.org/10.1109/MTITS.2017.8005670
- cryptonector 4y ago
  Sensors whose outputs are used to do cruise control and lane keeping assistance and so on should also be encrypted. I don't believe anything in this space is cost-prohibitive in the long term, or even in the medium term. It's just dev cost amortization, because the chips are cheap once they tape out.
  - quake 4y ago
    ASIL-critical inputs/outputs should not be encrypted,full end stop. Do I really trust that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road? Absolutely the hell not. I worked in this space (auto RE, including keyless entry) for a while, and there's almost no way this would work at scale without a top-down platform redo for automakers.
    - cryptonector 4y ago
      > Do I really trust that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road? Is your concern that the key management can leave a mess of key disagreement? But that's like the sensors failing altogether, and that already has to be taken into account. So yes, I would trust "that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road" because I have to trust that the computers will handle sensor failure correctly. That said I'd only trust that if the crypto is sensible. Specifically authenticated encryption is essential. Key exchange, pairing -- those are important too. It needn't be complicated to set up: trust-on-first-use-after-reset (with reset being not trivial to execute) should suffice. > [...] there's almost no way this would work at scale without a top-down platform redo for automakers. That's possible, but I doubt it.
wlesieutre 4y ago
Encryption isn't needed here, this could be prevented by messages from the smart key unit being signed with a key known to the immobilizer
- Nextgrid 4y ago
  Or just make the "smart key" controller a dumb passthrough of the key's messages and do the actual decoding and verification of the key messages in the engine ECU. I'm in fact surprised this isn't the case, but then again most "security" you see on cars is more about trying to lock out the legitimate owner from doing their own repairs or key programming as opposed to true security designed to defeat skilled attackers.
- nroets 4y ago
  And if anyone is thinking that DSA or RSA is too difficult, Carter and Wegman of IBM invented Universal Message Authentication Codes in the 1980s
- avidiax 4y ago
  Or just have the smart key ECU and the recipient ECU use a rolling code or even a 1 time shared secret. The other ECUs can learn the rolling code in the factory, or in after-service with the left door open, right blinker on, hood open, and horn tapped 8 times, and then wait 20 minutes. Without the key to see what the code is, no injector can spoof the frame. With the after-market procedure making tons of noise and spectacle, and a nice long wait for the police to arrive, the thieves can't replace the key ECU. With the system being simple, no key provisioning is needed, no non-public information, just an extra page in the manual and a software update.
bluGill 4y ago
> hey will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car. No they won't. One the law requires them to allow third part diagnostics tool (only for things that are about emissions!). Two, the third party tool maters are paying a good chunk of money to get documentation on how to do diagnostics. While new car buys won't care, car makers know that nobody can afford to buy a new car except by selling their old car (normally done as a trade in), and the buyers of used cars care that the car can be fixed so if third party tools don't work the car has a lot less value.
wongarsu 4y ago
> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks I can see how they got there. When you're moving getting rid of miles of cables that link everything and move your car to a CAN bus instead, it makes sense to say that you don't want a central blinker-controller that runs separate wires to every blinker. Instead you just run CAN and power to each blinker and give them their own little controller. Fewer wires, less conceptual complexity, at the cost of putting a little PCB in each blinker. But because "analog" blinkers had the accidental feature that they blink faster if one blinker is broken, you have to replicate that somehow with your new blinkers. And the easiest way to do that is to have the blinker write that to the CAN bus, since it's already right there.
- eimrine 4y ago
  How on Earth adding computer and a little PCB of demultiplexor logic instead of multivibrator-controlled relay might be considered as less of conceptual complexity? I do even doubt in length of wires point. You need a full bus plus a thick wire from power source per every lamp instead of just a one thick wire from relay.
  - PragmaticPulp 4y ago
    Simple PCBs are extremely cheap to manufacture at scale. Copper wiring is expensive and heavy. It’s far more efficient to have a simple PCB controlling multiple local functions (headlights, high beams, blinkers, additional sensors) and a single power/ground pair. Automotive systems are 12V, which results in high currents. High currents require thick wires, especially in automotive environments with high under hood temperatures where you might have to de-rate wires. It absolutely makes sense to reduce high current automotive wiring.
    - M95D 4y ago
      I don't understand how a PCB+MCU can reduce the copper wiring. The bulbs will consume the same amount of power requiring the same thickness of copper wiring, no matter if it's 10 separate thin wires, one for each bulb, or just one wire, but 10 times thicker (by section area and weight/meter, not diameter). Common power wire will still require one or two extra wires for CAN, so it would make sense only as replacement for bundles of 3 or more wires going to the same place.
PragmaticPulp 4y ago
> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99, That’s not what’s happening. The value in a CAN bus control is that you can significantly reduce the wiring requirements. Old school blinkers and headlights would require separate power wires for every function: Blinker, low beams, high beams. Those separate wires would each be snaked through long wiring harnesses back to relays somewhere else in a central location. With CAN, you can run a single large gauge power and ground pair and use the CAN bus to tell the remote module what to do with tiny signal wires. It may not sound like a big deal, but cars have a lot of electronic pieces all over. Simplifying wiring can add up to a significant weight and cost reduction. You now also have the ability to add more monitoring, such as simple sensors to detect when a bulb has failed Vehicle manufacturing is ruthlessly optimized. Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.
- exabrial 4y ago
  that part was a joke, fyi. CAN is very useful, but tends to be overused as well: https://www.caranddriver.com/news/a41611379/gmc-hummer-ev-taillights-expensive/ https://www.caranddriver.com/news/a41611379/gmc-hummer-ev-ta...
- londons_explore 4y ago
  And yet the obvious thing is for someone to be making and selling a "can bulb" - a tiny 4 pin bulb with 12V, GND, CAN-H/L pins. And all bulbs (led or not) on a car would be that. It would turn on/off commanded by the canbus and report status info back. Yet car manufacturers don't do this. CAN transceivers are still too expensive to build into every bulb. Instead, a single CAN transceiver and microcontroller will control a whole set of nearby bulbs (eg. brake, indicator, reversing lights). That then makes it vehicle specific, so you don't get the economies of scale of just making a single model of can-bulb which fits lots of places in many cars from many manufacturers.
  - robryk 4y ago
    How would the bulb know which one it is?
tantalor 4y ago
> monthly "safety package" for $7.99 Toyota subscription services described here: https://www.toyota.com/connected-services/ https://www.toyota.com/connected-services/ One of these is "safety connect" that does stuff like SOS button and stolen vehicle locator. It is not for the built-in safety features like collision detection and lane departure alert.
- kwhitefoot 4y ago
  All new cars in the EU have to have always online SOS connectivity so I don't think anyone can charge for it " eCall is a system used in vehicles across the EU which automatically makes a free 112 emergency call if your vehicle is involved in a serious road accident. You can also activate eCall manually by pushing a button. " "Compulsory for new car models If you buy a new model of car, approved for manufacture after 31 March 2018, it must have the 112-based eCall system installed." https://europa.eu/youreurope/citizens/travel/security-and-emergencies/emergency-assistance-vehicles-ecall/index_en.htm https://europa.eu/youreurope/citizens/travel/security-and-em...
  - tantalor 4y ago
    Okay, that's another way of saying everyone pays for it through higher prices or taxes or whatever, and you can't opt out of it.
    - kwhitefoot 4y ago
      That applies to all state mandated stuff I suppose. But it does mean the system can benefit from an economy of scale.
    - nerdbert 4y ago
      Wait until you hear about seat belts.
      - catiopatio 4y ago
        Seat belts don’t spy on me.
boomchinolo78 4y ago
I had a BMW with encrypted CAN or very similar to what that would be. Would refuse to use a new module unless you had the dealership key. Which my mechanic managed to get from his friend at the dealership but still... Needless to say, never again
- Tangurena2 4y ago
  That started with the high intensity headlights. They were such a high theft item that when they're disconnected from the battery, they go into a locked state that requires a dealership to do the unlock.
HPsquared 4y ago
That's just the next phase in the dialectic.
lcnPylGDnU4H9OF 4y ago
> you will ABSOLUTELY get it from the manufacturers in the name of security Fuckin' good. Then they can give me the damn encryption key so I can diagnose it myself. I am absolutely not going to subscribe to any sort of narrative like these things are mutually exclusive. I'll keep screaming for the security and the repairability.
- politelemon 4y ago
  They will never do that in the same name of security. Their aim is appl-ification and johndeerification; it's their object but will let you think it's yours as long as it's a revenue source.
- fps 4y ago
  you can scream all you want, most people who buy new cars won't care and will just lease for 3-5 years no matter what the manufacturer puts behind a paid upgrade/software subscription. They never have to repair their cars, because nothing breaks for the first 5 years. The used market might care, but manufacturers don't care about the used market at all, since they get no money from it.
efficax 4y ago
> So be careful what you scream for. We already have enough un-repairable items. Couldn't the keys for decryption be stored in a trusted module that can only be unlocked with the presence of the actual car key? Yes, this means key cloning attacks still get you access to the CAN, but if you can clone the key you can drive away with the car anyway.
yuuuuyu 4y ago
Agreed. Careful what you wish for. All those enthusiasts out their enjoying hacking their vehicles (in the traditional meaning of the term) would not like crypto and HSMs on that bus. It's like in the old days when internet traffic was unencrypted and so was Wifi. You could have a lot of fun just watching what's happening in your home network, and perhaps your neighbors (so I heard..legal grey area). Today? Nope. Everything is locked down. Wireshark shows you only lots of SSL. And that's not even proprietary stuff as the car crypto will be. The bad guys will obtain the keys or workarounds somehow. The good guys will be locked out.
rad_gruchalski 4y ago
> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... Autonomous driving something something, computer controlling human actions something something.
aaronbeekay 4y ago
I work at Ford on vehicle access and security and I’m quite familiar with CAN security challenges and solutions. (Of course, I don’t speak for my employer here.) Without speaking specifically to Ford’s plans, authenticated CAN communications are absolutely coming. I don’t see many approaches that actually encrypt the data on the bus - instead a MAC is used for each frame with a shared key on both secure ECUs, and some protections against replay attacks and such. I wouldn’t expect all CAN data to be protected by this kind of security - it’s a pain in the butt, and expensive. Instead, certain specific sensitive information (like whether there’s a key in the ignition!) is protected as needed. The industry is also moving toward IP-based communications for a lot of vehicle networking, which comes with many of the benefits of the modern infosec world. Automotive has a lot of unique challenges, though - like another poster mentioned, key provisioning and management is a huge pain; latency and hard timing constraints are way more important in the onboard/embedded world; many automotive ICs have limited support for e.g., asymmetric encryption, and of course there’s a lot of pain generated from the way the industry does software development generally. It’s an interesting space.
- deleted 4y ago
  [deleted]
AYBABTME 4y ago
s/principal/principle/g

drtz 4y ago

Encrypting everything on the CAN would be overkill and probably cost-prohibitive for manufacturers. Not all messages need to be encrypted -- just the ones that allow you to disable the immobilizer.

leoqa 4y ago
The solution is signing packets with PKI and verifying them on receipt. Nothing says you can’t flash firmware to add new packets etc but the CAN bus couldn’t be spoofed unless you had the private key.
- heleninboodler 4y ago
  While I agree with this instinct: this sounds like a simple "just use PKI" solution but it's really not simple at all. How do the vehicles' or devices' cert keys get provisioned and protected? Are they unique per device, per vehicle, or per manufacturer? Per device or per vehicle increases manufacturing process overhead (read: price) immensely [edit: as well as overhead at service departments]. Every device that can sign messages needs access to perform private key operations, which necessarily either increases cost (eg by storing the keys in a device-local HSM or adding network-based key operations along with the corresponding one-turtle-down auth problems) or decreases security of those private keys. What happens when they inevitably get extracted and baked into spoofing tools? Can the manufacturer rotate the root keys? What happens to vehicles that are offline when that happens?
  - heleninboodler 4y ago
    I think to be feasible from a maintenance and consumer-friendliness standpoint, each vehicle should have its own local CA and have some sort of open standard for how individual devices can have certificates provisioned so that they can be installed on a car. A replacement-part-pairing function that can only be performed by having physical access to a specific secured component (e.g. not just bus access) should work without contacting the manufacturer. I'm in for this startup idea. :D
  - lamontcg 4y ago
    I thought it was covered in the article but all the devices on the bus would need secret keys that were unique across all devices manufactured. This isn't impossible though since we've been making unique MAC addresses on NICs for many decades, and motherboards often come these days with the actual serial number of the server flashed into the DMI information, etc. It will also take an electron microscope to read the keys out of the chips, which is not a very mobile attack to use against a parked car on the street.
    - heleninboodler 4y ago
      First, those unique MACs and serial numbers are not currently in storage that requires an electron microsocope to read, so that's a pretty big additional cost burden. Second, assuming all devices were to be given secure key storage parts, you also have the cost burden of the pairing process during manufacturing and maintenance, as I mentioned above (not to mention the design and development of that pairing database and its failure/diag/maintenance/factory-reset modes). It's far from trivial.
      - lamontcg 4y ago
        If you don't provide a convenient interface to read a MAC address then you're going to need an electron microscope to pull it off a NIC chip as well. They just always provide the convenient interface to get at it.
        4y ago
- AlotOfReading 4y ago
  As someone who has (successfully) implemented this at multiple manufacturers, it is absolutely not as easy as "just signing it". First off, almost all vehicles are running CANbuses right to the edge of their available bandwidth. Making the signature data fit is a vehicle-wide refactor unless you've designed for it from the beginning. Secondly, many automotive MCUs don't have hardware crypto support or enough spare cycles for signing/verification. You have to design for that from the beginning. Third, key distribution is hard. There are a lot of parties outside the OEM that need to flash firmware for various reasons during production. Do you give them all private keys or do you put up a public image signing service anyone can submit binaries to? There's lots of other issues I could go on about like what the key rollover looks like, but I hope it's clear that retrofitting cryptography onto complicated systems that weren't designed for it is anything but straightforward.
  - leoqa 4y ago
    I’m sure there are a lot of complexities, I think the general shape of the solution is the same. Another poster (perhaps you?) mentioned that luxury cars do sign CAN packets. Anyways I’m not in this industry but work on SPIFFE and see similarities- you could have a centralized CA in the car that does attestation to remote workloads.
    - AlotOfReading 4y ago
      That can be a solution, but I usually push to simply scrap CAN everywhere possible and move to IP networking as mentioned by others in a sibling thread. That requires a ground-up system redesign, but it has a lot of benefits like not requiring a bunch of automotive programmers to implement a custom crypto architecture on constrained systems in C. With CAN, you're pretty firmly in the land of tradeoffs because the safety-critical stuff you want to auth is also hard realtime and solutions that involve expensive coprocessors like HSMs are usually off the table for a number of reasons like cost, lack of vendors supplying high-integrity solutions, inability to do board spins, etc. Adding authentication also has the nasty problem of sometimes reducing your safety because it makes the channel less noise resistant, as demonstrated by Dariz et al [1]. Navigating these sorts of tradeoffs are why some manufacturers have gone with half-measures like only authenticating a small subset of messages. [1] https://doi.org/10.1109/MTITS.2017.8005670 https://doi.org/10.1109/MTITS.2017.8005670
cryptonector 4y ago
Sensors whose outputs are used to do cruise control and lane keeping assistance and so on should also be encrypted. I don't believe anything in this space is cost-prohibitive in the long term, or even in the medium term. It's just dev cost amortization, because the chips are cheap once they tape out.
- quake 4y ago
  ASIL-critical inputs/outputs should not be encrypted,full end stop. Do I really trust that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road? Absolutely the hell not. I worked in this space (auto RE, including keyless entry) for a while, and there's almost no way this would work at scale without a top-down platform redo for automakers.
  - cryptonector 4y ago
    > Do I really trust that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road? Is your concern that the key management can leave a mess of key disagreement? But that's like the sensors failing altogether, and that already has to be taken into account. So yes, I would trust "that the dinky economy-scale micro that GM would pick is always going to hold up that encryption when I'm starting to drift off road" because I have to trust that the computers will handle sensor failure correctly. That said I'd only trust that if the crypto is sensible. Specifically authenticated encryption is essential. Key exchange, pairing -- those are important too. It needn't be complicated to set up: trust-on-first-use-after-reset (with reset being not trivial to execute) should suffice. > [...] there's almost no way this would work at scale without a top-down platform redo for automakers. That's possible, but I doubt it.

wlesieutre 4y ago

Encryption isn't needed here, this could be prevented by messages from the smart key unit being signed with a key known to the immobilizer

Nextgrid 4y ago
Or just make the "smart key" controller a dumb passthrough of the key's messages and do the actual decoding and verification of the key messages in the engine ECU. I'm in fact surprised this isn't the case, but then again most "security" you see on cars is more about trying to lock out the legitimate owner from doing their own repairs or key programming as opposed to true security designed to defeat skilled attackers.
nroets 4y ago
And if anyone is thinking that DSA or RSA is too difficult, Carter and Wegman of IBM invented Universal Message Authentication Codes in the 1980s
avidiax 4y ago
Or just have the smart key ECU and the recipient ECU use a rolling code or even a 1 time shared secret. The other ECUs can learn the rolling code in the factory, or in after-service with the left door open, right blinker on, hood open, and horn tapped 8 times, and then wait 20 minutes. Without the key to see what the code is, no injector can spoof the frame. With the after-market procedure making tons of noise and spectacle, and a nice long wait for the police to arrive, the thieves can't replace the key ECU. With the system being simple, no key provisioning is needed, no non-public information, just an extra page in the manual and a software update.

bluGill 4y ago

> hey will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car. No they won't. One the law requires them to allow third part diagnostics tool (only for things that are about emissions!). Two, the third party tool maters are paying a good chunk of money to get documentation on how to do diagnostics. While new car buys won't care, car makers know that nobody can afford to buy a new car except by selling their old car (normally done as a trade in), and the buyers of used cars care that the car can be fixed so if third party tools don't work the car has a lot less value.

wongarsu 4y ago

> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks I can see how they got there. When you're moving getting rid of miles of cables that link everything and move your car to a CAN bus instead, it makes sense to say that you don't want a central blinker-controller that runs separate wires to every blinker. Instead you just run CAN and power to each blinker and give them their own little controller. Fewer wires, less conceptual complexity, at the cost of putting a little PCB in each blinker. But because "analog" blinkers had the accidental feature that they blink faster if one blinker is broken, you have to replicate that somehow with your new blinkers. And the easiest way to do that is to have the blinker write that to the CAN bus, since it's already right there.

eimrine 4y ago
How on Earth adding computer and a little PCB of demultiplexor logic instead of multivibrator-controlled relay might be considered as less of conceptual complexity? I do even doubt in length of wires point. You need a full bus plus a thick wire from power source per every lamp instead of just a one thick wire from relay.
- PragmaticPulp 4y ago
  Simple PCBs are extremely cheap to manufacture at scale. Copper wiring is expensive and heavy. It’s far more efficient to have a simple PCB controlling multiple local functions (headlights, high beams, blinkers, additional sensors) and a single power/ground pair. Automotive systems are 12V, which results in high currents. High currents require thick wires, especially in automotive environments with high under hood temperatures where you might have to de-rate wires. It absolutely makes sense to reduce high current automotive wiring.
  - M95D 4y ago
    I don't understand how a PCB+MCU can reduce the copper wiring. The bulbs will consume the same amount of power requiring the same thickness of copper wiring, no matter if it's 10 separate thin wires, one for each bulb, or just one wire, but 10 times thicker (by section area and weight/meter, not diameter). Common power wire will still require one or two extra wires for CAN, so it would make sense only as replacement for bundles of 3 or more wires going to the same place.

PragmaticPulp 4y ago

> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99, That’s not what’s happening. The value in a CAN bus control is that you can significantly reduce the wiring requirements. Old school blinkers and headlights would require separate power wires for every function: Blinker, low beams, high beams. Those separate wires would each be snaked through long wiring harnesses back to relays somewhere else in a central location. With CAN, you can run a single large gauge power and ground pair and use the CAN bus to tell the remote module what to do with tiny signal wires. It may not sound like a big deal, but cars have a lot of electronic pieces all over. Simplifying wiring can add up to a significant weight and cost reduction. You now also have the ability to add more monitoring, such as simple sensors to detect when a bulb has failed Vehicle manufacturing is ruthlessly optimized. Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.

exabrial 4y ago
that part was a joke, fyi. CAN is very useful, but tends to be overused as well: https://www.caranddriver.com/news/a41611379/gmc-hummer-ev-taillights-expensive/ https://www.caranddriver.com/news/a41611379/gmc-hummer-ev-ta...
londons_explore 4y ago
And yet the obvious thing is for someone to be making and selling a "can bulb" - a tiny 4 pin bulb with 12V, GND, CAN-H/L pins. And all bulbs (led or not) on a car would be that. It would turn on/off commanded by the canbus and report status info back. Yet car manufacturers don't do this. CAN transceivers are still too expensive to build into every bulb. Instead, a single CAN transceiver and microcontroller will control a whole set of nearby bulbs (eg. brake, indicator, reversing lights). That then makes it vehicle specific, so you don't get the economies of scale of just making a single model of can-bulb which fits lots of places in many cars from many manufacturers.
- robryk 4y ago
  How would the bulb know which one it is?

tantalor 4y ago

> monthly "safety package" for $7.99 Toyota subscription services described here: https://www.toyota.com/connected-services/ https://www.toyota.com/connected-services/ One of these is "safety connect" that does stuff like SOS button and stolen vehicle locator. It is not for the built-in safety features like collision detection and lane departure alert.

kwhitefoot 4y ago
All new cars in the EU have to have always online SOS connectivity so I don't think anyone can charge for it " eCall is a system used in vehicles across the EU which automatically makes a free 112 emergency call if your vehicle is involved in a serious road accident. You can also activate eCall manually by pushing a button. " "Compulsory for new car models If you buy a new model of car, approved for manufacture after 31 March 2018, it must have the 112-based eCall system installed." https://europa.eu/youreurope/citizens/travel/security-and-emergencies/emergency-assistance-vehicles-ecall/index_en.htm https://europa.eu/youreurope/citizens/travel/security-and-em...
- tantalor 4y ago
  Okay, that's another way of saying everyone pays for it through higher prices or taxes or whatever, and you can't opt out of it.
  - kwhitefoot 4y ago
    That applies to all state mandated stuff I suppose. But it does mean the system can benefit from an economy of scale.
  - nerdbert 4y ago
    Wait until you hear about seat belts.
    - catiopatio 4y ago
      Seat belts don’t spy on me.

boomchinolo78 4y ago

I had a BMW with encrypted CAN or very similar to what that would be. Would refuse to use a new module unless you had the dealership key. Which my mechanic managed to get from his friend at the dealership but still... Needless to say, never again

Tangurena2 4y ago
That started with the high intensity headlights. They were such a high theft item that when they're disconnected from the battery, they go into a locked state that requires a dealership to do the unlock.

HPsquared 4y ago

That's just the next phase in the dialectic.

lcnPylGDnU4H9OF 4y ago

> you will ABSOLUTELY get it from the manufacturers in the name of security Fuckin' good. Then they can give me the damn encryption key so I can diagnose it myself. I am absolutely not going to subscribe to any sort of narrative like these things are mutually exclusive. I'll keep screaming for the security and the repairability.

politelemon 4y ago
They will never do that in the same name of security. Their aim is appl-ification and johndeerification; it's their object but will let you think it's yours as long as it's a revenue source.
fps 4y ago
you can scream all you want, most people who buy new cars won't care and will just lease for 3-5 years no matter what the manufacturer puts behind a paid upgrade/software subscription. They never have to repair their cars, because nothing breaks for the first 5 years. The used market might care, but manufacturers don't care about the used market at all, since they get no money from it.

efficax 4y ago

> So be careful what you scream for. We already have enough un-repairable items. Couldn't the keys for decryption be stored in a trusted module that can only be unlocked with the presence of the actual car key? Yes, this means key cloning attacks still get you access to the CAN, but if you can clone the key you can drive away with the car anyway.

yuuuuyu 4y ago

Agreed. Careful what you wish for. All those enthusiasts out their enjoying hacking their vehicles (in the traditional meaning of the term) would not like crypto and HSMs on that bus. It's like in the old days when internet traffic was unencrypted and so was Wifi. You could have a lot of fun just watching what's happening in your home network, and perhaps your neighbors (so I heard..legal grey area). Today? Nope. Everything is locked down. Wireshark shows you only lots of SSL. And that's not even proprietary stuff as the car crypto will be. The bad guys will obtain the keys or workarounds somehow. The good guys will be locked out.

rad_gruchalski 4y ago

> But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... Autonomous driving something something, computer controlling human actions something something.

aaronbeekay 4y ago

I work at Ford on vehicle access and security and I’m quite familiar with CAN security challenges and solutions. (Of course, I don’t speak for my employer here.) Without speaking specifically to Ford’s plans, authenticated CAN communications are absolutely coming. I don’t see many approaches that actually encrypt the data on the bus - instead a MAC is used for each frame with a shared key on both secure ECUs, and some protections against replay attacks and such. I wouldn’t expect all CAN data to be protected by this kind of security - it’s a pain in the butt, and expensive. Instead, certain specific sensitive information (like whether there’s a key in the ignition!) is protected as needed. The industry is also moving toward IP-based communications for a lot of vehicle networking, which comes with many of the benefits of the modern infosec world. Automotive has a lot of unique challenges, though - like another poster mentioned, key provisioning and management is a huge pain; latency and hard timing constraints are way more important in the onboard/embedded world; many automotive ICs have limited support for e.g., asymmetric encryption, and of course there’s a lot of pain generated from the way the industry does software development generally. It’s an interesting space.

deleted 4y ago
[deleted]

AYBABTME 4y ago

s/principal/principle/g