10 ms·
Car thieves using tech disguised inside old Nokia phones and Bluetooth speakers
- zelag 4y agoDon't these high end cars have hidden GPS devices inside of them? Or is that a myth?
- droopyEyelids 4y agoThey have them and it would solve this problem if victims could rely on a perfect police force with unlimited capacity.
- squishy47 4y agocurious if this is just against legacy car makers or whether it also works against tesla, rivian, lucid (or any other almost software first car company). presumably not?
- hardware2win 4y agoWhat makes you think that software companies would do better? Wasnt the mindset of computer security that "if they can access the hardware then it is over"?
- LeoPanthera 4y agoI don't think he's assuming that Tesla (etc.) cars are more secure, just that they're different, and so would need different tools.
- dwattttt 4y agoA quick Google suggests the Tesla S, X, 3, and Y all have multiple CAN buses (https://teslatap.com/modifications/extracting-internal-vehicle-data/ https://teslatap.com/modifications/extracting-internal-vehic...)
- londons_explore 4y agoNearly everything has multiple can busses because CAN is too slow for many/most usecases nowadays. Some car manufacturers you can even feel the random lag in everything from the accelerator to the brake lights due to the canbus being so full it adds a half second delay before updating everything. Automotive ethernet is faster and might be back to a single bus...
- TheLoafOfBread 4y agoNo, they have exactly same problems as regular OEMs https://www.theverge.com/2022/9/12/23348765/tesla-model-y-unlock-drive-car-thief-nfc-relay-attack https://www.theverge.com/2022/9/12/23348765/tesla-model-y-un...
- ahepp 4y ago> The sophisticated relay attack requires two thieves working together — one near the owner and one near the car
- hsbauauvhabzb 4y agoiOS is pretty resilient these days, unless you happen to have a zeroday ready.
- b3lvedere 4y agoYup. Physical access is access
- Nextgrid 4y agoBecause the kind of vulnerability being exploited here is basic "software engineering 101" that even a non-technical person should be able to figure out. It's the equivalent of putting something in a safe and then duct-taping the key to the safe itself.
- squishy47 4y agoi don't know anything about how cars work but the article says "At the moment, impacted vehicles are generally wide open to these sorts of attacks. The only proper fix would be to introduce cryptographic protections to CAN messages, Tindell told Motherboard in an email. This could be done via a software update, he added" and i'm kinda expecting software first companies to already have this stuff in place? also stolen car media seems to focus on legacy autos being stolen not so much the newer ones, hence the question but maybe the theives target better build quality, who knows.
- alecco 4y agohttps://archive.ph/wip/KRWzE https://archive.ph/wip/KRWzE But the acutal post with technical analysis is https://kentindell.github.io/2023/04/03/can-injection/ https://kentindell.github.io/2023/04/03/can-injection/ Discussed 16 days ago https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963
- Aissen 4y agoIt's the same subject, but it seems Motherboard did some additional research here.
- moremetadata 4y agoA weakness electrical systems and biological systems both have is they dont always know where the instructions were issues from, so if the can bus is viewed like a nervous system, injecting messages can cause problems especially if the device doesnt verify the authenticity of said message. Biological systems cant do this, but digital can take steps to improve the authenticity of said messages. In a way its a problem CPU's suffer as well, when thinking of code that pretends its a USB mouse and keyboard and then destroys stuff off the computer whilst masquerading as the user. Until such devices have self preservation built into them as standard, the ability to hack devices remains easy.
- T3OU-736 4y agoTechnical crux: ``` the attack, called CAN (controller area network) injection, works by sending fake messages that look as if they come from the car’s smart key receiver, the research continues. The underlying issue is that vehicles trust these messages without verifying them. Once the thieves have accessed the necessary cables by removing the headlights, they can use their device to send these messages, it adds. ```
- m00dy 4y agostone age in car security systems.
- deleted 4y ago[deleted]
- amelius 4y agostone age in regulation. I mean car manufacturers don't pay if a car is stolen, they benefit because someone needs a new car.
- lotsofpulp 4y agoWith license plate readers, it should be trivial for police to find and arrest thieves. Lack of law enforcement seems to be a problem as well.
- toss1 4y agoHow does that work when the car is driven only on a trip measured in minutes to the shop before it is even reported stolen, then is either disassembled in double-digit hours, or packed into a container headed for a 3rd-world country? The entire car is never seen in the country again. Bonus, even if the car could report itself stolen in real-time and ubiquitous license plate readers were online so it became a significant problem for thieves, how would it defeat the simple measure of slapping on a valid plate with a magnet for the trip to the shop?
- frankzander 4y agoWhy does the lights need a can bus connector nearby? No serious company put an ethernet port outside the building or use a wifi without encryption. I wonder what lunatics are this car designers/manufacturers .
- alufers 4y agoA car lamp will usually have a few different bulbs/LEDs (daylight running lights, headlights, high beam, indicators also the height adjustment motor), so it's less wiring to run a CAN pair and constant +12V to the fixture, than to wire each light type individually. I think the light can also report a failed lightbulb to the dashboard.
- trollied 4y agoSome are even more complicated. My car has lights that will track the road going round corners etc. I imagine there are other inputs it requires elsewhere in the car (cameras etc).
- moffkalast 4y agoThere are afaik already multiple CAN busses in your average car with different data rates, might as well have a separate one for all the risky stuff that's easily accessed? This is some basic security shit.
- oh_sigh 4y agoA problem with the CAN bus is that there is no way to tell what node sends what message on the bus, so you can't have something like a filter that only processes headlight-related messages coming from headlights. I guess you could actually do it, but it would require every node being able to sign their messages, which would add a lot of cost.
- adminu 4y agoI wonder what the thieve does with the car after stealing. Will you always need that Nokia to start it or is there some kind if aftermarket for counterfeit keys?
- newsclues 4y agoUsed for crime locally and dumped. Or chopped up for parts. Or shipped overseas complete in a container.
- m00dy 4y agowhy would you use a Nokia ? Raspberry could be a better option.
- andyjohnson0 4y ago> why would you use a Nokia ? Raspberry could be a better option. Deniability if searched by police.
- LastNevadan 4y agoThe thieves want plausible deniability if they are caught possessing it. If a policeman suspects you of being a car thief and catches you with a Raspberry Pi, that looks pretty suspicious. The same policeman wouldn't think anything suspicious about (what appears to be) a Nokia cell phone.
- 4y ago
- blowfish721 4y agoI remember seeing a french documentary about the french criminal world many many years ago, there they showed a professional car thief using a device bought from Russia that he plugged into the ODB2 port. Once plugged in it reset the car and it could be started with a blank key. A co-workers friend got his Audi RS4 stolen from a public garage with the thiefs using the technique described in the article and that was probably 6-8 years ago so it’s far from new but maybe more widespread now.
- kleiba 4y agoDid your friend get his car back after all? Or else how did he conclude which technique was used to steal it?
- sidewndr46 4y agoYeah I wonder about this as well. It was decades ago that a friends Mercedes was stolen in Poland and the police just immediately concluded that it had been taken to Russia. I'm thinking "well yeah, if you just decide all stolen vehicles go to Russia then they in fact are never found".
- blowfish721 4y agoHe never got the car back, don’t know if it was picked apart or they managed to send it abroad. The security footage from the garage caught it on video so that’s how they knew that they went through the headlights.
- gtech1 4y agoI think the documentary was Les Caids des Cites (?) https://www.youtube.com/watch?v=gajW7PNOJKw https://www.youtube.com/watch?v=gajW7PNOJKw
- fn42 4y agoI remember figuring this out when I needed to buy a new key for my Audi and the dealer wanted $200 to program it. https://www.audiworld.com/forums/a8-s8-d2-platform-discussion-8/how-pull-your-immo-code-pair-new-key-vcds-lite-2001-s8-2873134/ https://www.audiworld.com/forums/a8-s8-d2-platform-discussio... the software's available online, all you need to do is get access to the OBD port and you can make your car trust a new key!
- mothsonasloth 4y agoCAN bus is a brilliant thing for car diagnostics and modification but with every good system normally has a sword of damocles. I would imagine my Passat which has a CAN interface on the headlight cluster would be vulnerable to this attack as well. Maybe even the bonnet sensor could be vulnerable. Car manufacturers could remove CAN interfaces from peripheral systems (lights, wing mirrors) but they probably won't because it would make maintenance a little harder and less cost effective. The idea of a software update by the security researchers sounds sensible but updating ECUs (engine control units), CCU (climate comfort units), infotainment systems of legacy cars will not happen. Say goodbye to the old car thieves with their manual tools, hello techy thieves.
- zamnos 4y agoGiven range extender attacks on key fobs for cars (and subsequent methods to defeat that attack) techy thieves have always been around. There are rumors that the algorithm and secret key for various manufacturers has been broken, and that any car with a remote can be stolen after recording the unlock and start sequence from nearby. But if you had the code that would do that, it's not like you'd upload it to GitHub, so that rumor remains just that, a rumor.
- illiarian 4y ago> CAN bus is a brilliant thing for car diagnostics and modification but with every good system normally has a sword of damocles. There are over 100 issues (aka bugs) in the spec though. Uncovered by these guys: https://youtu.be/zi0rHwfiX1Q?t=1150 https://youtu.be/zi0rHwfiX1Q?t=1150 (starting at 19:10, includes examples)
- jon-wood 4y agoIt feels like this should be manageable without completely removing CAN interfaces from peripheral systems by having multiple busses that are interconnected to each other. Things like lights and wing mirrors can sit on a low security peripheral network, with the controller rejecting any commands that aren't whitelisted, it's not like you need to be able to plug arbitrary devices into your headlight socket.
- rmbyrro 4y agoI still have a hard time wrapping my head around the fact that cars are now computers on top of wheels.
- mdp2021 4y agoThere is a chance that all of this comes in waves, and that waves will go away...
- zamnos 4y agoHow would like like to define "computers" here? Electronic fuel injection was first introduced in 1960's and 70's, and the 70's are when microprocessors first hit the scene. Without the ECU in a EFI car, you're not going to get very far.
- LoveMortuus 4y agoTesla cars can play AAA games on their infotainment system. That's pretty much a normal computer/console right there.
- mbreese 4y agoThat’s not the point they were trying to make. The point (as I saw it) was that cars have relied on computing for quite a while. Aside from the infotainment/nav systems, cars have required on board computers for decades. And I think many of those chips are general purpose chips with specialized firmware. So, it’s been fair to think of them as computers (or rather a network of computers) for quite a while.
- rmbyrro 4y agoIn the context of this news, I'm thinking computer as something you can plug a USB stick and hijack it.
- zamnos 4y agoThe first USB flash drive was in the 2000s so at least then. It's hard to find when hijacking via USB was first a thing, if only because the more popular route is either plug in a replacement ECU, which supports tuning out of the box, or via a USB -> OBDII/other non-usb-port on car, which I don't think quite counts.
- MarkusWandel 4y agoThe fix for this doesn't need any cryptography. Nothing more than the key receiver and the main ECU agreeing on a randomized number in the "unlock" code. Allow unrandomized unlock once, agree on and store random number on both sides, from here on insist on this number. Sure this is insecure in the sense that a device listening to the bus can capture the fixed unlock code for that car, but who cares, it completely disables this attack (generic device can unlock ANY car of that model/series with no prior knowledge). Of course some sort of override is needed to reset the pairing in case one or the other side is replaced in a repair. But this can be made cumbersome enough for a thief not to bother. I'm sure this is well in scope for a field firmware upgrade, so hopefully this attack vector doesn't last long.
- flatiron 4y agoI believe you reinvented the one time pad.
- wallaBBB 4y agoIt's a CAN injection, has nothing to do with the immobilizer feature (between the fob and the car) that has a random SK exchanged on fob-car pairing and is mandated (by insurance companies to prevent hot wiring a car) for more than a decade.
- PinguTS 4y agoYou didn’t spent the time to understand what is being attacked, didn’t you? Ken has everything greatly documented. Ken is a long time fellow in the area. Btw, he has also solutions.
- MichaelZuo 4y agoLooks like it's back to steering wheel rods.
- ChrisMarshallNY 4y agoIf I saw one of those ancient Nokia bricks, I'd immediately be suspicious. There's probably people on this forum that have never seen one in the wild.
- jacquesm 4y agoThere are people that are still using them.
- ChrisMarshallNY 4y agoI didn’t even know they still worked. Aren’t they using old cell tech? I’m pretty sure it was last century, when I had that exact model (which was great, BTW).
- jacquesm 4y ago3G is getting harder and harder, but I also have a 4G version that is still going strong (and still has 5 days of battery stand by time). It's from after the reboot so that technically not a 'real' Nokia (N-800).
- ChrisMarshallNY 4y agoThen it's probably not the one I had. I really liked those old 2G phones. I remember, in the 1990s, in Japan, the phones kept getting smaller and smaller. It was pretty cool. One reason they could be so small, was they had antennas everywhere, and it was a fairly low-power system. I brought the last iPhone 13Mini. I will miss the smallness.
- tinus_hn 4y ago2G has been extended in some areas because there is a large amount of legacy hardware using it.
- masfuerte 4y agoI'm still using an elderly 2G Nokia in the UK. My carrier switched off data in January but I wasn't using it anyway. Surprisingly, reception is worst in dense city centre areas. I guess they have the fastest turnover to more recent technology.
- ed_balls 4y agoI know security through obscurity is not really a security, but thieves have a limited time to action and they would drop the car if there are problems or are spooked. How you can prevent a car theft? Hardware: - Kill switch - hide a switch somewhere to the battery/ignition - Steering wheel or pedal lock - annoying for the daily use. Not much of a deterrent if someone has a pick or liquid nitrogen. - Chain and a lock in your garage - the need to cut something would be too risky. Doesn't help in a public place. - Replace ODB with a fake - stops the hacking PsyOp: Have a message displayed or an extra devices that would communicate (this is car is being track, please leave the vehicle, police unit is dispatched etc.) Tracking: Thieves know how to disable car alarms with GSP, but Airtags maybe hard to find.
- matthewaveryusa 4y agowrt PsyOp, I would have agreed with you until my car was recently stolen with an airtag and a custom camera system. The theives could care less about the custom cameras and simply snipped the cables. They had an iphone and I'm guessing once the iphone got pinged they were tracked they tossed the airtag. It doesn't seem like they care all that much about anything to be honest. A hidden kill switch is probably the best idea since you actually need to find it which costs time. fun fact, when I told the cops there was an air tag in there their first reaction was "what's that", and their second was "our investigators tell us it's not accurate enough to be actionable information." I recovered it myself and in some sense they were right, the airtag was kind of useless in finally recovering the vehicle.
- dylan604 4y ago[flagged]
- l8rlump 4y agoThis software [1] on something like this hardware [2] work with the Airtag ecosystem, and won't ping any warnings. Beware of the ones lacking the external timing components. The battery won't last as long using the internal oscillator. [1] https://github.com/dakhnod/FakeTag https://github.com/dakhnod/FakeTag [2] https://www.aliexpress.com/item/1005003144393539.html https://www.aliexpress.com/item/1005003144393539.html
- freetanga 4y agoSo back to locking our cars with an iron bar then?
- blurbleblurble 4y agoInternet of things is off to an exciting start
- cs702 4y agohttps://twitter.com/internetofshit https://twitter.com/internetofshit
- the_pwner224 4y agoThis has absolutely nothing to do with Internet.
- JustSomeNobody 4y agoHere's what is going to happen. These thieving assholes are going to make it so that new cars will have to have an always on connection to the auto maker in order to start so that they can "verify" it is really you. This will be the "solution" the auto makers will come up with. Forget that it also will enable them to know a shit ton about you as a side-effect.
- vrglvrglvrgl 4y ago[dead]
- dilippkumar 4y ago> According to Tindell and Tabor's research, the attack, called CAN (controller area network) injection, works by sending fake messages that look as if they come from the car’s smart key receiver, the research continues. The underlying issue is that vehicles trust these messages without verifying them. Once the thieves have accessed the necessary cables by removing the headlights, they can use their device to send these messages, it adds. I have to ask - does the automobile industry hire from a different pool of systems engineers than the usual pool I’m used to interacting with? It seems like everyone I know would say “obviously you should verify that the security mechanism first”. Or is this a result of how the automobile industry is structured and what is outsourced to vendors/suppliers and what is done in house? I’m not going to be buy that this isn’t solvable for a technical reason at this point. We have had a lot of experience dealing with PKI infrastructures and zero trust architectures in other parts of the industry.
- ahepp 4y agoIt seems to me that computer systems have always been a secondary concern on ICE cars. It’s possible the ECUs in question have been so cost optimized there’s not a lot of power left to do asymmetric (or possibly even symmetric, idk) crypto. Bus capacity is also a concern.
- HeyLaughingBoy 4y agoThe "problem" is really that the need for security became obvious in the web/networked world first. Think back to how insecure devices were 20 years ago. That security is slowly trickling down to other areas of the software industry. Even when you have individual engineers or teams who understand that it needs to be more secure, their procedures don't have that built in. And securing the car needs to be done at a system level, which means coordinating across suppliers & subcontractors, which requires management buy-in. Similar problem in the medical device industry, but at least we have FDA cybersecurity requirements to adhere to.
- racl101 4y agoI am so terrified of getting a new car. Here's hoping my 2008 car lasts another 20 years.
- culopatin 4y agoWhy wouldn’t it? I drive a 1990, a 1981 and a 1979. As long as there are parts for it, it should run. Just keep rust away.
- brewdad 4y agoIf I'm required to own three cars just to be assured at least one of them is operable at any given time, that's a non-starter.
- culopatin 4y agoYou’re not. I just like cars and have a selection. My 90 is a daily, it’s never stranded me in the 7 years I’ve had it. Even with a dead battery I can start it by pushing it in neutral and dumping the clutch in gear, really can’t beat that. I just sold a 2013 I didn’t use because I enjoyed the 90 more. The 2013 has gotten me stranded with a dead battery. So has my gf’s 2016, but not the old trusty miat
- lloeki 4y agoIn a few years (1~3), regulations (Crit'Air and low emission zones) will prevent me from keeping my '08 car (or at least getting it out of a closed parking lot, controls are planned to be done via fully automated license plate recognition). Sad because it's stupidly reliable and in great mechanical condition, I expect it to run another 15 without batting much of an eye if properly maintained. Ironically if it were older (like, > 30 years old) I'd be able to keep using it, as it would be considered a collector car (... provided it's vetted on a case by case basis by local authorities). But then other regulations would take effect like max mileage per year and limited allowed range (e.g leaving local administrative area), which you can only exceed with more vetting from local authorities and under specific circumstances (e.g participating in a collector car showcase)
- jcpham2 4y agoMy Honda source say they “fixed” this in 2022+ meaning signed CAN bus messages and John Deere level ECU signing on headlight bulbs. In fairness the headlights were probably a $500 LED board anyways.