3 ms·

How does that part know that it is being unprogrammed in the car and not in the thieves yard with cracked diagnostic tool? So basically I need to pretend to be

How does that part know that it is being unprogrammed in the car and not in the thieves yard with cracked diagnostic tool? So basically I need to pretend to be a new part to steal a car. Some common key as an attack vector.

vladvasiliu 4y ago
Presumably, if you're able to replace the lock on a locked car with your own, you don't need to fool anything, you're already inside the car. I guess the attack vector would rather be some unscrupulous mechanic replacing the part with a bogus one that would accept every unlock command, and the thief, in cahoots with said mechanic, would show up and unlock the car once the owner got it back from the shop.
- TheLoafOfBread 4y ago
  Well the thing is that this is how cars with encrypted immobilizer gets stolen today (deffo not the case of RAV4) - Open a hood - Connect new, unprogrammed ECU (no immobilizer loaded) - You can now start the car without chip in your key As I see, people are reinventing wheel here, and are creating same problems as OEMs did 10-15 years ago.
  - vladvasiliu 4y ago
    Assuming they're willing to break a window or sacrifice the hood and related bodywork to pop it open without a key, is it really so easy to swap an ECU without having to take half the car apart? My dad used to have a Citroën that would require taking out the whole front bumper assembly to change a freaking light, so it would be beyond stupid to have the ECU easily accessible...
    - TheLoafOfBread 4y ago
      Here Golf Mk7 - https://www.golfmk7.com/forums/index.php?threads/missing-engine-cover.376982/ https://www.golfmk7.com/forums/index.php?threads/missing-eng... ECU is on the right side in plastic cage next to a battery. To get into the car thief will use a relay attack on your key, so no damage to the car will actually occur. That ECU swap happens only if you have car with keys. If you have keyless car (start/stop button) then you can relay your way into starting engine.
      - vladvasiliu 4y ago
        So does a car with keys have somewhat better resistance to these attacks? Of course, they seem harder and harder to come by for some reason...
        TheLoafOfBread 4y ago
        That really depends on manufacturer. But in general it is more secure to use 2FA (Wireless link + mechanical token) than using 1FA (Wireless link and a button). Thief needs to jump through more obstacles, increasing the change of his failure. However even mechanical token can be generalized as this video shows: https://www.youtube.com/watch?v=9NtDH-8z95M https://www.youtube.com/watch?v=9NtDH-8z95M So I think that in the end it probably does not matter. When somebody wants to steal your car, you have probably no chance to prevent it.
    - mrguyorama 4y ago
      The ECU is in different places but they have pretty standardized plugs to connect to the wiring loom. You just unplug it and plug in a new one.
  - labcomputer 4y ago
    Yea, this attack doesn't make any sense as a threat model worth defending. If the thief is willing and able to replace substantial amounts of the car's electronics: 1. They're already in the car. So how you authenticate the ECU and door modules to each other is really irrelevant. They bypassed that already. 2. They can just go ahead and replace the ECU and all the door modules with their own. So, again, how auth works doesn't matter. 3. At some point, you have to ask: Am I replacing the electronics in the car, or am I replacing swapping all the non-electrical parts from one car to another?

vladvasiliu 4y ago

Presumably, if you're able to replace the lock on a locked car with your own, you don't need to fool anything, you're already inside the car. I guess the attack vector would rather be some unscrupulous mechanic replacing the part with a bogus one that would accept every unlock command, and the thief, in cahoots with said mechanic, would show up and unlock the car once the owner got it back from the shop.

TheLoafOfBread 4y ago
Well the thing is that this is how cars with encrypted immobilizer gets stolen today (deffo not the case of RAV4) - Open a hood - Connect new, unprogrammed ECU (no immobilizer loaded) - You can now start the car without chip in your key As I see, people are reinventing wheel here, and are creating same problems as OEMs did 10-15 years ago.
- vladvasiliu 4y ago
  Assuming they're willing to break a window or sacrifice the hood and related bodywork to pop it open without a key, is it really so easy to swap an ECU without having to take half the car apart? My dad used to have a Citroën that would require taking out the whole front bumper assembly to change a freaking light, so it would be beyond stupid to have the ECU easily accessible...
  - TheLoafOfBread 4y ago
    Here Golf Mk7 - https://www.golfmk7.com/forums/index.php?threads/missing-engine-cover.376982/ https://www.golfmk7.com/forums/index.php?threads/missing-eng... ECU is on the right side in plastic cage next to a battery. To get into the car thief will use a relay attack on your key, so no damage to the car will actually occur. That ECU swap happens only if you have car with keys. If you have keyless car (start/stop button) then you can relay your way into starting engine.
    - vladvasiliu 4y ago
      So does a car with keys have somewhat better resistance to these attacks? Of course, they seem harder and harder to come by for some reason...
      - TheLoafOfBread 4y ago
        That really depends on manufacturer. But in general it is more secure to use 2FA (Wireless link + mechanical token) than using 1FA (Wireless link and a button). Thief needs to jump through more obstacles, increasing the change of his failure. However even mechanical token can be generalized as this video shows: https://www.youtube.com/watch?v=9NtDH-8z95M https://www.youtube.com/watch?v=9NtDH-8z95M So I think that in the end it probably does not matter. When somebody wants to steal your car, you have probably no chance to prevent it.
  - mrguyorama 4y ago
    The ECU is in different places but they have pretty standardized plugs to connect to the wiring loom. You just unplug it and plug in a new one.
- labcomputer 4y ago
  Yea, this attack doesn't make any sense as a threat model worth defending. If the thief is willing and able to replace substantial amounts of the car's electronics: 1. They're already in the car. So how you authenticate the ECU and door modules to each other is really irrelevant. They bypassed that already. 2. They can just go ahead and replace the ECU and all the door modules with their own. So, again, how auth works doesn't matter. 3. At some point, you have to ask: Am I replacing the electronics in the car, or am I replacing swapping all the non-electrical parts from one car to another?