13 ms·
Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?
by markhahn 3y ago
Obviously, we want owners to have full access to their car's CANBUS.
So the question is: how should the OBD-2 plug (or wiring) be protected?
- hoofhearted 3y agoThe people in the Infiniti groups were recommending this obd2 lock haha https://www.amazon.com/Tune-Saver-OBDII-OBD2-Lock/dp/B0BRF5D18D/ref=asc_df_B0BRF5D18D/?tag=hyprod-20&linkCode=df0&hvadid=652442834773&hvpos=&hvnetw=g&hvrand=4707002145405608872&hvpone=&hvptwo=&hvqmt=&hvdev=m&hvdvcmdl=&hvlocint=&hvlocphy=9007915&hvtargid=pla-2084476101754&psc=1&mcid=7b3ab1c84fa231b2ae55620a204dc6f9 https://www.amazon.com/Tune-Saver-OBDII-OBD2-Lock/dp/B0BRF5D...
- irobeth 3y agoseems like a sophisticated theft ring would have access to the keys for the most common guards like this, reminds me of the TSA key debacle[1] [1]: https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys
- deleted 3y ago[deleted]
- macNchz 3y agoThe TSA locks have widely circulated master keys because that's a basic requirement of the system–every airport has to have some to be able to open bags. I don't know anything about these OBD port locks, but I don't see any reason they'd have a master key, other than laziness on the part of the manufacturer. Additionally, I'd imagine that such a tiny fraction of a percentage of cars have these kinds of locks that it'd barely be worth it for thieves to figure out how to bypass them, at least until there's more widespread adoption.
- kube-system 3y ago> I don't know anything about these OBD port locks, but I don't see any reason they'd have a master key Look at it in the picture and the review pictures. They're all 'keyed' alike. It's just a single offset pin. Also one review says it just holds on with friction and can be pulled off with force.
- raizer88 3y agoAll CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.
- acdha 3y agoMaintenance is a big key management problem though: if only the owner has it, there will be problems when people inevitably lose it. If there are shared keys for service departments or databases, thieves will get access to them. Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibility for multiple decades.
- Chris2048 3y agoThe same problem exist for car keys. The answer is, when a person "inevitably lose[s] it", they need to pay to get their electronics refit.
- kube-system 3y agoThe result of that may be that losing a key is financially devastating enough that it totals many vehicles. And/or if the odometer and other local storage is affected, that may cause permanent title issues for the car. The number of people who lose their keys vastly dwarfs the number of people who are having their car stolen with a flipper zero.
- Chris2048 3y agoPerhaps, or perhaps not. It has to be hard enough it can't be done in the street (without getting attention), but maybe it could be easy enough to do in a garage. But even if it is expensive, the result would be that either people with take more care, or they'll lose their car. Maybe it's not a bad thing that people who can't manage a key are less likely to be on the roads - or that its more likely they lose access to their car then it ends up in the hands of criminals. A car can be a dangerous thing, even an inexpensive one.
- adolph 3y agoAs I understand it, CANBUS is a message network among relatively low-power devices. There are two ways of doing this: + Some credential exchange between devices to establish a web of trust + Devices are locked similar to Apple parts
- amluto 3y agoPerhaps the OBD port should only work when the car is validly unlocked and the engine immobilizer accepts a key? Maybe it could stay unlocked thereafter while a device is connected? Android (adb) and iOS (iTunes backup) have solved this issue years ago.
- sokoloff 3y agoWhen I installed a remote starter on my old Jeep, I had to also install a CAN interface that would command a door unlock followed by a door lock command. That was enough to tell the ECM that it was okay to start the car by simulating the key switch closure for “run” and a temporary closure for “start”. Prior to adding the CAN interface, jumping “start” would set off the alarm.
- rolph 3y agoplace the port in the lockable cabin of the vehicle instead of behind a headlight.
- rasz 3y agoStart by not allowing thieves connect thru wheel well https://kentindell.github.io/2023/04/03/can-injection/ https://kentindell.github.io/2023/04/03/can-injection/
- mysterydip 3y agoInstead of technical/computational solutions, maybe there's a low tech cage/shell that can be put around it so anyone can't just plug in?
- sokoloff 3y agoThe CAN+ and CAN- wires run around the car in, well, a bus and tapping into them anywhere is enough to inject CAN messages onto the bus. It makes it less plug-n-play than the OBD2 connector, but thieves will still be able to do it.
- punnerud 3y agoSeems like the CANBUS is deactivated when the car is turned off on Volkswagen. Guess that is one way to fix it?
- michael1999 3y agoPut the powertrain lockout system on a signed and physically protected network segment. Let the headlights, mirrors, etc live on a less secure segment. This will impose higher costs when replacing these systems, because it will require key management of some kind. Either central cert management (with 20 year expiry?) or local key management. So only impose this on a tiny subnet for the starter/immobilizer.
- sonicanatidae 3y agoSadly, this involves costs, so it'll never happen. Good take, though.
- cogman10 3y agoYou don't protect the wiring, you protect the start protocol. Similar to asking "Can we protect the internet by protecting the ethernet cables?" Put a public key on the engine controller, have it challenge the key with a random start number, have the key respond with the signature of that number, engine starts. You can do that challenge over the can bus.