3 ms·

What? This is a CAN bus hack, which is a standard that has been in EU cars for longer than US cars. I've worked with KeylessRide and also built my own hardware

by avree 4y ago

What? This is a CAN bus hack, which is a standard that has been in EU cars for longer than US cars. I've worked with KeylessRide and also built my own hardware immobilizer/CANBUS device at a previous startup, and there is zero difference between European cars and American cars for this... By design, all nodes on a CAN network receive all frames, which is the root of the problem. There are some differences in ECU validation, plus whether or not the vehicle supports UDS diagnostics, but these are differences by manufacturer and have nothing to do with the continent the car is being used on.

bri3d 4y ago
Calling something a "CAN bus hack" is like calling something an "Ethernet hack." It's just a bus, it's what's on the bus that matters. European, American, and Japanese cars have completely different immobilizer module cryptography implementations. In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow. Generally, European cars have stronger immobilizer implementations. For example, in VW Immo 5, immobilizer messages are encrypted and authenticated using AES with a PRNG-based MAC. At a high level, participating modules need knowledge of a secret AES key in order to encrypt random number seed material. It's symmetric so it's still not perfect, but this type of simple "send one message through a headlight" attack would not be possible on these cars. Update: ah, I see you edited your comment. Yes, it has nothing to do with where the cars are _used_. My point was that European _manufacturers_ tend to have more secure immobilizer implementations, and I will stand by that point.
- avree 4y ago
  You know that Toyota, the manufacturer here, is a Japanese company, right? European versus American regulations have literally nothing to do with this, which was your original point.
  - mynameisvlad 4y ago
    Their original point does not talk about American regulations at all, but rather that European regulations are stricter and therefore European cars will have tighter security. You're the one that chose to interpret that as "stricter than American".
- olabyne 4y ago
  > In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow. Right ? Because the messages are not authentified, once the car stolen, the thieves can even remove the immobilizer and put a DIY with a set of keys when they send the car in a container, to make it 'ready to ride' ouf-the-box
- Nextgrid 4y ago
  I suspect older immo bypasses used an engine ECU read/write primitive to read & rewrite the firmware over the diagnostics port (K-Line or CAN). Those primitives are usually based on undocumented commands used during a legitimate firmware update process (loading new "calibrations" as it's called in the industry) - there's a chance those same undocumented routines exist in newer ECUs, in which case you don't actually need to break the cryptography if you can rewrite the firmware to skip the check or seed it with your own key material.
  - bri3d 4y ago
    I did find an older VW "emergency start" product that claims to only work with Bosch MED17 and MED9, and I suspect it's using a memory-access primitive (either UDS or CCP) to release the immobilizer. It's trivial to disable an immobilizer in software by re-flashing the ECU, yes, but modern ECUs have two strong protections against this: * Cryptographic signature checking against update/re-flash payloads (I've done extensive research on these on VW Continental ECUs - https://github.com/bri3d/VW_Flash https://github.com/bri3d/VW_Flash ) and an even better and more obvious protection: * The ECU application software won't descend into the re-flash software (Customer Bootloader) unless the immobilizer is free (a valid key is present). This is a lot of what helps to reduce surface area from an "emergency start" style attack to an AKL attack - now that the Customer Bootloader won't start without the Immobilizer being unlocked, an attacker needs to remove the control unit to flash it with a Supplier Bootloader exploit ( https://github.com/bri3d/simos18_sboot https://github.com/bri3d/simos18_sboot ) or physical access (BDM/JTAG).
    - Nextgrid 4y ago
      Can't the AKL process effectively be turned into an "emergency start" attack anyway? At least in the US, there are portals for non-official repair technicians to buy access to reprogram ECUs/keys/etc for a given car (keyed by VIN) - I can see this being abused (it can't be that hard to buy access under a false identity), not to mention that professional car theft gangs might convince/coerce an insider to give them even deeper access to the signing service if not the raw private keys. Once you have access to the signing service in one way or another and a valid network connection, can't you just perform the AKL process in the field by simulating a legitimate AKL procedure that a dealership might do? Presumably writing custom software to automate all that (vs having to manually click through a slow scan tool or the often-terrible official software) would cut down the required time to a couple minutes.

by avree 4y ago

bri3d 4y ago

Calling something a "CAN bus hack" is like calling something an "Ethernet hack." It's just a bus, it's what's on the bus that matters. European, American, and Japanese cars have completely different immobilizer module cryptography implementations. In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow. Generally, European cars have stronger immobilizer implementations. For example, in VW Immo 5, immobilizer messages are encrypted and authenticated using AES with a PRNG-based MAC. At a high level, participating modules need knowledge of a secret AES key in order to encrypt random number seed material. It's symmetric so it's still not perfect, but this type of simple "send one message through a headlight" attack would not be possible on these cars. Update: ah, I see you edited your comment. Yes, it has nothing to do with where the cars are _used_. My point was that European _manufacturers_ tend to have more secure immobilizer implementations, and I will stand by that point.

avree 4y ago
You know that Toyota, the manufacturer here, is a Japanese company, right? European versus American regulations have literally nothing to do with this, which was your original point.
- mynameisvlad 4y ago
  Their original point does not talk about American regulations at all, but rather that European regulations are stricter and therefore European cars will have tighter security. You're the one that chose to interpret that as "stricter than American".
olabyne 4y ago
> In this case, the real weakness was that the immobilizer protocol allowed the car to start without message authentication, the CAN-related message injection thing was a sideshow. Right ? Because the messages are not authentified, once the car stolen, the thieves can even remove the immobilizer and put a DIY with a set of keys when they send the car in a container, to make it 'ready to ride' ouf-the-box
Nextgrid 4y ago
I suspect older immo bypasses used an engine ECU read/write primitive to read & rewrite the firmware over the diagnostics port (K-Line or CAN). Those primitives are usually based on undocumented commands used during a legitimate firmware update process (loading new "calibrations" as it's called in the industry) - there's a chance those same undocumented routines exist in newer ECUs, in which case you don't actually need to break the cryptography if you can rewrite the firmware to skip the check or seed it with your own key material.
- bri3d 4y ago
  I did find an older VW "emergency start" product that claims to only work with Bosch MED17 and MED9, and I suspect it's using a memory-access primitive (either UDS or CCP) to release the immobilizer. It's trivial to disable an immobilizer in software by re-flashing the ECU, yes, but modern ECUs have two strong protections against this: * Cryptographic signature checking against update/re-flash payloads (I've done extensive research on these on VW Continental ECUs - https://github.com/bri3d/VW_Flash https://github.com/bri3d/VW_Flash ) and an even better and more obvious protection: * The ECU application software won't descend into the re-flash software (Customer Bootloader) unless the immobilizer is free (a valid key is present). This is a lot of what helps to reduce surface area from an "emergency start" style attack to an AKL attack - now that the Customer Bootloader won't start without the Immobilizer being unlocked, an attacker needs to remove the control unit to flash it with a Supplier Bootloader exploit ( https://github.com/bri3d/simos18_sboot https://github.com/bri3d/simos18_sboot ) or physical access (BDM/JTAG).
  - Nextgrid 4y ago
    Can't the AKL process effectively be turned into an "emergency start" attack anyway? At least in the US, there are portals for non-official repair technicians to buy access to reprogram ECUs/keys/etc for a given car (keyed by VIN) - I can see this being abused (it can't be that hard to buy access under a false identity), not to mention that professional car theft gangs might convince/coerce an insider to give them even deeper access to the signing service if not the raw private keys. Once you have access to the signing service in one way or another and a valid network connection, can't you just perform the AKL process in the field by simulating a legitimate AKL procedure that a dealership might do? Presumably writing custom software to automate all that (vs having to manually click through a slow scan tool or the often-terrible official software) would cut down the required time to a couple minutes.