5 ms·

Can Injection: keyless car theft (2023)

71 points by fanf2 2y ago

sans_souse 2y ago
I admittedly haven't finished reading the whole write up - I am surprised that neither you nor Ian suspected that the "vandals" were on to something a bit more worth the risk, being in Security and tech in general. Just saying - I'm not in either field but once I see those wires, I'm already thinking.. then a second time and I'm hiding my vehicle, somehow, ASAP. Good read so far, thank you.
- ryukoposting 2y ago
  It occurs to me that the power locks in my car are broken, and only the driver's one works properly. So, I'm three quarters of the way to an attack mitigation!
  - JKCalhoun 2y ago
    My 1995 Miata doesn't even care/know whether the seatbelts are fastened or not, ha ha.
- snozolli 2y ago
  I am surprised that neither you nor Ian suspected that the "vandals" were on to something a bit more Hindsight is 20/20. Have you ever run across meth heads? They do completely random nonsense and they'll do it time and again. A local meth head's activities are indistinguishable from those of a thief using techniques you've never heard of.
Hamuko 2y ago
(2023)
- hawski 2y ago
  Also it really needs capitalization of the first word. CAN is an acronym. Otherwise the title is quite funny.
bri3d 2y ago
Previous discussion: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963 I’d say this rates as “midrange” in terms of car theft difficulty. Some cars (very new American and nearly all European cars) use some form of cryptography to authenticate that immobilizer messages came from a module which posses an immobilizer secret, so simple message injection won’t work like this. Others (older cars, famous US market Kias) have no immobilizer at all and not even this level of sophistication is necessary.
- _yb2s 2y ago
  Yeah almost all Euro cars have had strong cryptography immobilizers since the mid to late 90s. It’s pretty shocking how secure those early systems are - to this day car enthusiasts cannot find any weaknesses or bypasses other than flashing the ECU firmware to remove the immobilizer code. A lot of people would rather not have that feature anymore on a 25 year old beater where replacement keys might cost as much as the whole car is worth.
  - okdood64 2y ago
    Do you have a good source where could learn more about rolling codes & cryptography immobilizers? The wiki for it just brushes over it. https://en.wikipedia.org/wiki/Immobiliser https://en.wikipedia.org/wiki/Immobiliser
    - bri3d 2y ago
      Here's some basics about older systems: https://www.researchgate.net/publication/346706377_Dismantling_DST80-based_Immobiliser_Systems https://www.researchgate.net/publication/346706377_Dismantli... https://www.researchgate.net/publication/235916472_Gone_in_360_Seconds_Hijacking_with_Hitag2 https://www.researchgate.net/publication/235916472_Gone_in_3... https://blog.cryptographyengineering.com/2011/09/24/where-things-fall-apart-protocols-part/ https://blog.cryptographyengineering.com/2011/09/24/where-th... Newer systems use AES, which is at least less cryptographically unsound than the LFSR-based systems like Hitag2. Microchip present an interesting theoretical approach to AES-based immobilizer authentication here: https://ww1.microchip.com/downloads/en/DeviceDoc/article_open_immob_system.pdf https://ww1.microchip.com/downloads/en/DeviceDoc/article_ope... Note that these all focus on the key-authentication side. The inter-module communication ranges from completely insecure (like in the parent article - the key module says "OK, the key is auth'd!" and then just blasts an unauthenticated CAN message) to some variant of the key authentication strategy. For example, newer VW immobilizers use an AES-based nonce+MAC strategy similar to the theoretical Microchip one for both key communication _and_ module-to-module communication on the CAN bus.
sprite 2y ago
If you have a Stellantis product make sure to get the key lockdown flash done. If not thieves can just program a new key to your car and drive off with it in under a minute (My car was stolen twice this way). Initially the flash was only available for Challengers and Chargers which made Trackhawk's and TRX's even more of a target. https://media.stellantisnorthamerica.com/newsrelease.do?id=22944&mid=1 https://media.stellantisnorthamerica.com/newsrelease.do?id=2...
eschneider 2y ago
Lots of manufacturers are going to encrypted CAN to prevent these sorts of injection attacks. Of course it also makes life far more difficult for third party part suppliers. :/
deleted 2y ago
[deleted]
ChrisArchitect 2y ago
(2023) Some more discussion then: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963
Hizonner 2y ago
> lights are smart, and include things like motors to level the headlights (so when the car is loaded with heavy luggage, the lights are turned to compensate), steering headlights to illuminate the corners, to automatically detect if the lights have failed, to turn on pumps to spray water on the lights, and so on. There is no way all that crap can be worth the reliability cost or even the weight...
- b112 2y ago
  It's not worth it. It's also why cars are absurdly expensive these days, not due to part cost, but due to testing and reliability costs. And of course, everything is a new hack entry.
- dazc 2y ago
  Anecdotally, a manufacturer of car headlights told an an acquaintance, a few years ago, that some cars would be written off solely if headlights were damaged due to increasing cost. I wouldn't be surprised if this was becoming true, today?
  - Scoundreller 2y ago
    Another ass move is manufacturers forming their company logo into more plastic, so you can’t just replace with an aftermarket part for a repair in many insurance-repair situations. https://www.eastgatefordpartscanada.ca/oem-parts/ford-signal-lamp-fl3z13b374cc https://www.eastgatefordpartscanada.ca/oem-parts/ford-signal...
- snozolli 2y ago
  Headlight-leveling mechanisms have been around forever, and anyone who has been blinded by an oncoming, loaded pickup truck knows why. Headlights that either mechanically or electronically (as found in some motorcycles) point into a turn are a potentially massive safety increase. A headlight-leveling servo can last the lifetime of the vehicle. Not everything is a Chrysler.
  - SoftTalker 2y ago
CamperBob2 2y ago
> ...and because noise from an (airport) radar sweep is never going to look like a proper CAN frame, there is no spurious wake-up. Next up on HN: "Expensive cars being stolen with cheap microwave ovens"
- mdaniel 2y ago
  I recently saw a YouTube video[1] of a company trying to get analog circuits to market because they claimed that a great deal of modern electronics are using basically "polling" logic to test analog inputs for activation thresholds. They claimed that by pushing the logic further upstream along the analog path they could significantly reduce the power draw of those systems by removing the busy-wait loops 1: https://www.youtube.com/watch?v=6AgkTdQXFTY https://www.youtube.com/watch?v=6AgkTdQXFTY (Analog computing will take over 30 billion devices by 2040. Wtf does that mean? | Hard Reset)
TacticalCoder 2y ago
Back when cars had hardly any anti-theft mechanism, we'd put hidden toggle switch(es) that'd cut off the fuel pump and other stuff. In the 90s we'd get fancier and use (in addition to hidden toggle switch(es)) stuff like custom made transponder thinggies: we'd have a female port installed on the dashboard and the corresponding male "jack" on our keychain. These took a few hours to install and would shut some wires at different points. They were "dumb" in a way (it was obvious looking at the dashboard that a car had such a system installed) but not easy to remove: you had to follow the wiring for a long time to find where the various cut-off points where installed. Funnily enough after 30 years or so many of these transponders (?) start failing and it's a very common cause of youngtimer cars being stuck on the side of the road. While a dumb hidden toggle switch shall pretty much work forever (but is easier to neutralize as you only need to find the switch). A toggle switch is literally less than $5 and trivially installed. For added fun you can also add stuff directly on the fuses: they're easier to find but there are more advanced kits (for example you plug it on an important fuse and then you've got a remote on your keychain to "unlock" the mechanism). I mean: yup, you can look into cryptography and install this and that software countermeasure. Or, you, know, you can install (or have installed) a $5 toggle switch. P.S: this made me think... I'll probably install a fake toggle switch, obvious to be found, linked to the highest non legal alarm I can find on alibaba. So if anyone tries to steal the car, he'll toggle the switch and trigger the alarm. That's dumb as heck and yet may work just fine.
- CamperBob2 2y ago
  There's also the question of how the incentives are aligned. At a time when the chief competition for new cars is older cars that are still perfectly functional, I'm sure manufacturers love the idea of being "forced" to include a deliberate single point of failure. One that will probably survive the warranty period, but that will instantly render the car beyond economical repair, by design, when it does fail. "Please don't throw us into that briar patch," you can hear them begging the regulators.
  - bluGill 2y ago
    Not really old cars having value means someone who wants a new car can trade in their old. If cars only lasted three years rich would be buying $30000 cars and many would be skipping the heater and electric start to lower prices.
hunter2_ 2y ago
> ECUs are connected together [...] doesn’t hear from another ECU it needs to talk to [...] there is an ECU that controls the lights This is very unusual terminology. Most vehicles have exactly 1 ECU (occasionally 2, and addresses are allocated for ~4 depending on the gateway) which controls exclusively the engine parameters. The BCM, the HVAC, the ABS, the MIB, etc. are all other modules (nodes on the network) which go by names other than ECU. For example, TCU for the transmission. Any module can throw a DTC, but only a DTC from the ECU will illuminate the MIL (check engine light).
- bri3d 2y ago
  They just believe that ECU = Electronic Control Unit rather than ECU = Engine Control Unit. Both are accepted terminology in different parts of the industry, although I'd have just used the word "module" instead.
  - hunter2_ 2y ago
    I'd never heard of the former, but it seems that's the case! Thanks.
- deleted 2y ago
  [deleted]
- maxerickson 2y ago
  It's not wildly obscure. For instance Wikipedia currently uses it: https://en.wikipedia.org/wiki/Electronic_control_unit https://en.wikipedia.org/wiki/Electronic_control_unit Note that I'm not arguing Wikipedia using it means it is "correct" or whatever, just that it demonstrates it being at least somewhat commonplace.
  - hunter2_ 2y ago
    Interesting, though Wikipedia also uses it the way I do: https://en.wikipedia.org/wiki/Engine_control_unit https://en.wikipedia.org/wiki/Engine_control_unit
deleted 2y ago
[deleted]
CalChris 2y ago
It's CAN Injection. Controller Area Network. https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus
throwaway48476 2y ago
You can't solve a social problem with technology.

71 points by fanf2 2y ago

I admittedly haven't finished reading the whole write up - I am surprised that neither you nor Ian suspected that the "vandals" were on to something a bit more worth the risk, being in Security and tech in general. Just saying - I'm not in either field but once I see those wires, I'm already thinking.. then a second time and I'm hiding my vehicle, somehow, ASAP. Good read so far, thank you.

ryukoposting 2y ago
It occurs to me that the power locks in my car are broken, and only the driver's one works properly. So, I'm three quarters of the way to an attack mitigation!
- JKCalhoun 2y ago
  My 1995 Miata doesn't even care/know whether the seatbelts are fastened or not, ha ha.
snozolli 2y ago
I am surprised that neither you nor Ian suspected that the "vandals" were on to something a bit more Hindsight is 20/20. Have you ever run across meth heads? They do completely random nonsense and they'll do it time and again. A local meth head's activities are indistinguishable from those of a thief using techniques you've never heard of.

Hamuko 2y ago

(2023)

hawski 2y ago
Also it really needs capitalization of the first word. CAN is an acronym. Otherwise the title is quite funny.

bri3d 2y ago

Previous discussion: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963 I’d say this rates as “midrange” in terms of car theft difficulty. Some cars (very new American and nearly all European cars) use some form of cryptography to authenticate that immobilizer messages came from a module which posses an immobilizer secret, so simple message injection won’t work like this. Others (older cars, famous US market Kias) have no immobilizer at all and not even this level of sophistication is necessary.

_yb2s 2y ago
Yeah almost all Euro cars have had strong cryptography immobilizers since the mid to late 90s. It’s pretty shocking how secure those early systems are - to this day car enthusiasts cannot find any weaknesses or bypasses other than flashing the ECU firmware to remove the immobilizer code. A lot of people would rather not have that feature anymore on a 25 year old beater where replacement keys might cost as much as the whole car is worth.
- okdood64 2y ago
  Do you have a good source where could learn more about rolling codes & cryptography immobilizers? The wiki for it just brushes over it. https://en.wikipedia.org/wiki/Immobiliser https://en.wikipedia.org/wiki/Immobiliser
  - bri3d 2y ago
    Here's some basics about older systems: https://www.researchgate.net/publication/346706377_Dismantling_DST80-based_Immobiliser_Systems https://www.researchgate.net/publication/346706377_Dismantli... https://www.researchgate.net/publication/235916472_Gone_in_360_Seconds_Hijacking_with_Hitag2 https://www.researchgate.net/publication/235916472_Gone_in_3... https://blog.cryptographyengineering.com/2011/09/24/where-things-fall-apart-protocols-part/ https://blog.cryptographyengineering.com/2011/09/24/where-th... Newer systems use AES, which is at least less cryptographically unsound than the LFSR-based systems like Hitag2. Microchip present an interesting theoretical approach to AES-based immobilizer authentication here: https://ww1.microchip.com/downloads/en/DeviceDoc/article_open_immob_system.pdf https://ww1.microchip.com/downloads/en/DeviceDoc/article_ope... Note that these all focus on the key-authentication side. The inter-module communication ranges from completely insecure (like in the parent article - the key module says "OK, the key is auth'd!" and then just blasts an unauthenticated CAN message) to some variant of the key authentication strategy. For example, newer VW immobilizers use an AES-based nonce+MAC strategy similar to the theoretical Microchip one for both key communication _and_ module-to-module communication on the CAN bus.

sprite 2y ago

If you have a Stellantis product make sure to get the key lockdown flash done. If not thieves can just program a new key to your car and drive off with it in under a minute (My car was stolen twice this way). Initially the flash was only available for Challengers and Chargers which made Trackhawk's and TRX's even more of a target. https://media.stellantisnorthamerica.com/newsrelease.do?id=22944&mid=1 https://media.stellantisnorthamerica.com/newsrelease.do?id=2...

eschneider 2y ago

Lots of manufacturers are going to encrypted CAN to prevent these sorts of injection attacks. Of course it also makes life far more difficult for third party part suppliers. :/

deleted 2y ago

[deleted]

ChrisArchitect 2y ago

(2023) Some more discussion then: https://news.ycombinator.com/item?id=35452963 https://news.ycombinator.com/item?id=35452963

Hizonner 2y ago

> lights are smart, and include things like motors to level the headlights (so when the car is loaded with heavy luggage, the lights are turned to compensate), steering headlights to illuminate the corners, to automatically detect if the lights have failed, to turn on pumps to spray water on the lights, and so on. There is no way all that crap can be worth the reliability cost or even the weight...

b112 2y ago
It's not worth it. It's also why cars are absurdly expensive these days, not due to part cost, but due to testing and reliability costs. And of course, everything is a new hack entry.
dazc 2y ago
Anecdotally, a manufacturer of car headlights told an an acquaintance, a few years ago, that some cars would be written off solely if headlights were damaged due to increasing cost. I wouldn't be surprised if this was becoming true, today?
- Scoundreller 2y ago
  Another ass move is manufacturers forming their company logo into more plastic, so you can’t just replace with an aftermarket part for a repair in many insurance-repair situations. https://www.eastgatefordpartscanada.ca/oem-parts/ford-signal-lamp-fl3z13b374cc https://www.eastgatefordpartscanada.ca/oem-parts/ford-signal...
snozolli 2y ago
Headlight-leveling mechanisms have been around forever, and anyone who has been blinded by an oncoming, loaded pickup truck knows why. Headlights that either mechanically or electronically (as found in some motorcycles) point into a turn are a potentially massive safety increase. A headlight-leveling servo can last the lifetime of the vehicle. Not everything is a Chrysler.
- SoftTalker 2y ago

CamperBob2 2y ago

> ...and because noise from an (airport) radar sweep is never going to look like a proper CAN frame, there is no spurious wake-up. Next up on HN: "Expensive cars being stolen with cheap microwave ovens"

mdaniel 2y ago
I recently saw a YouTube video[1] of a company trying to get analog circuits to market because they claimed that a great deal of modern electronics are using basically "polling" logic to test analog inputs for activation thresholds. They claimed that by pushing the logic further upstream along the analog path they could significantly reduce the power draw of those systems by removing the busy-wait loops 1: https://www.youtube.com/watch?v=6AgkTdQXFTY https://www.youtube.com/watch?v=6AgkTdQXFTY (Analog computing will take over 30 billion devices by 2040. Wtf does that mean? | Hard Reset)

TacticalCoder 2y ago

Back when cars had hardly any anti-theft mechanism, we'd put hidden toggle switch(es) that'd cut off the fuel pump and other stuff. In the 90s we'd get fancier and use (in addition to hidden toggle switch(es)) stuff like custom made transponder thinggies: we'd have a female port installed on the dashboard and the corresponding male "jack" on our keychain. These took a few hours to install and would shut some wires at different points. They were "dumb" in a way (it was obvious looking at the dashboard that a car had such a system installed) but not easy to remove: you had to follow the wiring for a long time to find where the various cut-off points where installed. Funnily enough after 30 years or so many of these transponders (?) start failing and it's a very common cause of youngtimer cars being stuck on the side of the road. While a dumb hidden toggle switch shall pretty much work forever (but is easier to neutralize as you only need to find the switch). A toggle switch is literally less than $5 and trivially installed. For added fun you can also add stuff directly on the fuses: they're easier to find but there are more advanced kits (for example you plug it on an important fuse and then you've got a remote on your keychain to "unlock" the mechanism). I mean: yup, you can look into cryptography and install this and that software countermeasure. Or, you, know, you can install (or have installed) a $5 toggle switch. P.S: this made me think... I'll probably install a fake toggle switch, obvious to be found, linked to the highest non legal alarm I can find on alibaba. So if anyone tries to steal the car, he'll toggle the switch and trigger the alarm. That's dumb as heck and yet may work just fine.

CamperBob2 2y ago
There's also the question of how the incentives are aligned. At a time when the chief competition for new cars is older cars that are still perfectly functional, I'm sure manufacturers love the idea of being "forced" to include a deliberate single point of failure. One that will probably survive the warranty period, but that will instantly render the car beyond economical repair, by design, when it does fail. "Please don't throw us into that briar patch," you can hear them begging the regulators.
- bluGill 2y ago
  Not really old cars having value means someone who wants a new car can trade in their old. If cars only lasted three years rich would be buying $30000 cars and many would be skipping the heater and electric start to lower prices.

hunter2_ 2y ago

> ECUs are connected together [...] doesn’t hear from another ECU it needs to talk to [...] there is an ECU that controls the lights This is very unusual terminology. Most vehicles have exactly 1 ECU (occasionally 2, and addresses are allocated for ~4 depending on the gateway) which controls exclusively the engine parameters. The BCM, the HVAC, the ABS, the MIB, etc. are all other modules (nodes on the network) which go by names other than ECU. For example, TCU for the transmission. Any module can throw a DTC, but only a DTC from the ECU will illuminate the MIL (check engine light).

bri3d 2y ago
They just believe that ECU = Electronic Control Unit rather than ECU = Engine Control Unit. Both are accepted terminology in different parts of the industry, although I'd have just used the word "module" instead.
- hunter2_ 2y ago
  I'd never heard of the former, but it seems that's the case! Thanks.
deleted 2y ago
[deleted]
maxerickson 2y ago
It's not wildly obscure. For instance Wikipedia currently uses it: https://en.wikipedia.org/wiki/Electronic_control_unit https://en.wikipedia.org/wiki/Electronic_control_unit Note that I'm not arguing Wikipedia using it means it is "correct" or whatever, just that it demonstrates it being at least somewhat commonplace.
- hunter2_ 2y ago
  Interesting, though Wikipedia also uses it the way I do: https://en.wikipedia.org/wiki/Engine_control_unit https://en.wikipedia.org/wiki/Engine_control_unit

deleted 2y ago

[deleted]

CalChris 2y ago

It's CAN Injection. Controller Area Network. https://en.wikipedia.org/wiki/CAN_bus https://en.wikipedia.org/wiki/CAN_bus

throwaway48476 2y ago

You can't solve a social problem with technology.