4 ms·

The buttons and keyswitch may be connected to the same CAN network which is the source of the vulnerability.

• AnthonyMouse 3y ago
  Modern cars have electronic keys that can use cryptography. You can't forge a digital signature by hotwiring the car.
  • thaeli 3y ago
    Isn't that pretty much what immobilizer bypass modules have done for years?
    • AnthonyMouse 3y ago
      Those are for cars with physical keys. In cars where the key switch is only telling the computer "is key present: [y/n]" they put a message on the bus that answers yes and the car starts. But if you're going to use the need for security as a defense then you don't start by designing your car like that. Some car manufacturers have also attempted to use encryption and implemented it so poorly that it was easily cracked. There is no technical reason that a car key can't effectively be a yubikey. The computer issues a challenge to the key, answering the challenge requires a secret stored in the key, so you need the key. It works as long as the encryption isn't broken. And if "car can be remotely controlled" and the encryption is broken then that's a much bigger problem than anything your local mechanic is doing.
      • neuralRiot 3y ago
        > The computer issues a challenge to the key, answering the challenge requires a secret stored in the key, so you need the key. This is how most modern “smart key” systems work.