4 ms·

Yeah almost all Euro cars have had strong cryptography immobilizers since the mid to late 90s. It’s pretty shocking how secure those early systems are - to this

by _yb2s 2y ago

Yeah almost all Euro cars have had strong cryptography immobilizers since the mid to late 90s. It’s pretty shocking how secure those early systems are - to this day car enthusiasts cannot find any weaknesses or bypasses other than flashing the ECU firmware to remove the immobilizer code. A lot of people would rather not have that feature anymore on a 25 year old beater where replacement keys might cost as much as the whole car is worth.

okdood64 2y ago
Do you have a good source where could learn more about rolling codes & cryptography immobilizers? The wiki for it just brushes over it. https://en.wikipedia.org/wiki/Immobiliser https://en.wikipedia.org/wiki/Immobiliser
- bri3d 2y ago
  Here's some basics about older systems: https://www.researchgate.net/publication/346706377_Dismantling_DST80-based_Immobiliser_Systems https://www.researchgate.net/publication/346706377_Dismantli... https://www.researchgate.net/publication/235916472_Gone_in_360_Seconds_Hijacking_with_Hitag2 https://www.researchgate.net/publication/235916472_Gone_in_3... https://blog.cryptographyengineering.com/2011/09/24/where-things-fall-apart-protocols-part/ https://blog.cryptographyengineering.com/2011/09/24/where-th... Newer systems use AES, which is at least less cryptographically unsound than the LFSR-based systems like Hitag2. Microchip present an interesting theoretical approach to AES-based immobilizer authentication here: https://ww1.microchip.com/downloads/en/DeviceDoc/article_open_immob_system.pdf https://ww1.microchip.com/downloads/en/DeviceDoc/article_ope... Note that these all focus on the key-authentication side. The inter-module communication ranges from completely insecure (like in the parent article - the key module says "OK, the key is auth'd!" and then just blasts an unauthenticated CAN message) to some variant of the key authentication strategy. For example, newer VW immobilizers use an AES-based nonce+MAC strategy similar to the theoretical Microchip one for both key communication _and_ module-to-module communication on the CAN bus.
SoftTalker 2y ago
If you can even get them. On some older cars with this technology, replacement keys are simply not available any longer. I agree it would be really nice to be able to (legally) disable the security for cars that are pretty much fully depreciated.
- folmar 2y ago
  The low-tech solution is to remove the electronics from key and glue the near the ignition switch, but needs to be done before you loose the last working original key.
  - SoftTalker 2y ago
    Yeah that works if the key uses simple RFID but not with other keys that must be physically inserted to activate (e.g. Mercedes-Benz keys from ~2000s era).
    - Scoundreller 2y ago
      The positive thing about those keys is that you don’t have to worry about the mechanical part of the key wearing out. That’s an issue for 20 year old mechanical key + immobilizer chipped keys. It’s not that you lost the key, it’s just finally in need of replacement. Of course; you could shuck the key from the old one and place it in the new one. Protip everyone with any mechanical keys: take a picture of your keys!!!!!
      - SoftTalker 2y ago
        And not just the key can wear out, so can the lock cylinder. I had a car where that was the problem. I removed the guts of the cylinder so that any key (or even a screwdriver) would turn it. Still needed the RFID nearby to actually start the car so it didn't seem like a big risk.
  - Scoundreller 2y ago
    Often it also means shucking the chip from all remaining keys too so your fixed chip doesn’t interfere with the mobile chips. I think you could also create a DoS attack in a parking lot by trashing the spectrum.
bri3d 2y ago
> It’s pretty shocking how secure those early systems are I generally don't think this is true; most early immobilizer systems were DST80 or Hitag2 based and are broken both cryptographically and practically. The reason enthusiasts re-flash ECUs is that it's easy, permanent, and works across a whole model line of cars, compared to reverse engineering immobilizer cryptography which is difficult, transient and requires re-work for each individual car. Even modern systems are generally broken in private; you can find "emergency start" and "all keys lost" products for most newer cars, even European ones using AES. However, they're usually much more complex to use than the fake JBL speaker in the parent article's attack - most revolve around extracting key material from a control module using a software exploit. Common approaches include leveraging a leftover development artifact of some kind which allows sensitive key material to be exfiltrated from RAM, or locating a state-confusion or memory safety exploit against a CAN message handler. But, at the end of the day, most modern cars are attacked using simple bent-pipe range-extension/relay attacks, so there's less investment in cryptographic attacks or compromising the actual system anyway.
- _yb2s 2y ago
  Thanks! To clarify, I had no knowledge of the actual technology used, and don't mean to indicate that it is crypographically secure or impossible to exploit. Only that people in the online car communities haven't found simple easy practical ways to bypass these systems for, e.g. when they lose their own keys. Which also, I would say means thieves aren't doing it either. Even when people do engine swaps to a new vehicle, they usually end up moving over the entire ECU, RFID antenna, and RFID tags because that's the easiest way to get the engine to run. Nobody is going to steal a 90s VW Jetta with Immo-2 when there are much easier to steal much more valuable cars everywhere. Neither shadetree mechanics, or street thugs that steal cars for drug money are spending a lot of time reading deeply into academic cryptography literature- it's only practically broken if you can either buy a $50 or less device, or follow instructions on a forum post to disable it.
nikau 2y ago
> It’s pretty shocking how secure those early systems are Compared to just a key it was a big step forward.
fragmede 2y ago
So have American cars. Just because Kia, famously a low-end brand, cheaped out on immobilizers for their cars doesn't mean everybody else didn't put them in their cars, despite not being required to by law.

by _yb2s 2y ago

okdood64 2y ago

Do you have a good source where could learn more about rolling codes & cryptography immobilizers? The wiki for it just brushes over it. https://en.wikipedia.org/wiki/Immobiliser https://en.wikipedia.org/wiki/Immobiliser

bri3d 2y ago
Here's some basics about older systems: https://www.researchgate.net/publication/346706377_Dismantling_DST80-based_Immobiliser_Systems https://www.researchgate.net/publication/346706377_Dismantli... https://www.researchgate.net/publication/235916472_Gone_in_360_Seconds_Hijacking_with_Hitag2 https://www.researchgate.net/publication/235916472_Gone_in_3... https://blog.cryptographyengineering.com/2011/09/24/where-things-fall-apart-protocols-part/ https://blog.cryptographyengineering.com/2011/09/24/where-th... Newer systems use AES, which is at least less cryptographically unsound than the LFSR-based systems like Hitag2. Microchip present an interesting theoretical approach to AES-based immobilizer authentication here: https://ww1.microchip.com/downloads/en/DeviceDoc/article_open_immob_system.pdf https://ww1.microchip.com/downloads/en/DeviceDoc/article_ope... Note that these all focus on the key-authentication side. The inter-module communication ranges from completely insecure (like in the parent article - the key module says "OK, the key is auth'd!" and then just blasts an unauthenticated CAN message) to some variant of the key authentication strategy. For example, newer VW immobilizers use an AES-based nonce+MAC strategy similar to the theoretical Microchip one for both key communication _and_ module-to-module communication on the CAN bus.

SoftTalker 2y ago

If you can even get them. On some older cars with this technology, replacement keys are simply not available any longer. I agree it would be really nice to be able to (legally) disable the security for cars that are pretty much fully depreciated.

folmar 2y ago
The low-tech solution is to remove the electronics from key and glue the near the ignition switch, but needs to be done before you loose the last working original key.
- SoftTalker 2y ago
  Yeah that works if the key uses simple RFID but not with other keys that must be physically inserted to activate (e.g. Mercedes-Benz keys from ~2000s era).
  - Scoundreller 2y ago
    The positive thing about those keys is that you don’t have to worry about the mechanical part of the key wearing out. That’s an issue for 20 year old mechanical key + immobilizer chipped keys. It’s not that you lost the key, it’s just finally in need of replacement. Of course; you could shuck the key from the old one and place it in the new one. Protip everyone with any mechanical keys: take a picture of your keys!!!!!
    - SoftTalker 2y ago
      And not just the key can wear out, so can the lock cylinder. I had a car where that was the problem. I removed the guts of the cylinder so that any key (or even a screwdriver) would turn it. Still needed the RFID nearby to actually start the car so it didn't seem like a big risk.
- Scoundreller 2y ago
  Often it also means shucking the chip from all remaining keys too so your fixed chip doesn’t interfere with the mobile chips. I think you could also create a DoS attack in a parking lot by trashing the spectrum.

bri3d 2y ago

> It’s pretty shocking how secure those early systems are I generally don't think this is true; most early immobilizer systems were DST80 or Hitag2 based and are broken both cryptographically and practically. The reason enthusiasts re-flash ECUs is that it's easy, permanent, and works across a whole model line of cars, compared to reverse engineering immobilizer cryptography which is difficult, transient and requires re-work for each individual car. Even modern systems are generally broken in private; you can find "emergency start" and "all keys lost" products for most newer cars, even European ones using AES. However, they're usually much more complex to use than the fake JBL speaker in the parent article's attack - most revolve around extracting key material from a control module using a software exploit. Common approaches include leveraging a leftover development artifact of some kind which allows sensitive key material to be exfiltrated from RAM, or locating a state-confusion or memory safety exploit against a CAN message handler. But, at the end of the day, most modern cars are attacked using simple bent-pipe range-extension/relay attacks, so there's less investment in cryptographic attacks or compromising the actual system anyway.

_yb2s 2y ago
Thanks! To clarify, I had no knowledge of the actual technology used, and don't mean to indicate that it is crypographically secure or impossible to exploit. Only that people in the online car communities haven't found simple easy practical ways to bypass these systems for, e.g. when they lose their own keys. Which also, I would say means thieves aren't doing it either. Even when people do engine swaps to a new vehicle, they usually end up moving over the entire ECU, RFID antenna, and RFID tags because that's the easiest way to get the engine to run. Nobody is going to steal a 90s VW Jetta with Immo-2 when there are much easier to steal much more valuable cars everywhere. Neither shadetree mechanics, or street thugs that steal cars for drug money are spending a lot of time reading deeply into academic cryptography literature- it's only practically broken if you can either buy a $50 or less device, or follow instructions on a forum post to disable it.

nikau 2y ago

> It’s pretty shocking how secure those early systems are Compared to just a key it was a big step forward.

fragmede 2y ago

So have American cars. Just because Kia, famously a low-end brand, cheaped out on immobilizers for their cars doesn't mean everybody else didn't put them in their cars, despite not being required to by law.