6 ms·

The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usuall

by __alexs 14y ago

The keys are generally just passive RFID chips so it's more like an authorized_keys file. The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off. There's a number of cheap and obvious tricks BMW could have used to make the RFID portion of this attack a lot harder. Including, making the OBD port more difficult to actually get at without actually sitting in the car and not letting the new key start the car for some reasonably long period of time.

deleted 14y ago
[deleted]
- jrabone 14y ago
  See http://www.e90post.com/forums/showthread.php?t=670339 http://www.e90post.com/forums/showthread.php?t=670339 and http://www.e90post.com/forums/showthread.php?t=713085 http://www.e90post.com/forums/showthread.php?t=713085 - there are people who will do this in the UK.
lbotos 14y ago
I think there is a legal requirement that the ODB-2 port needs to be in a standard location. (Driver's Side, Under dashboard)
CamperBob2 14y ago
If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in. What in the world was wrong with plain old car keys -- especially with an added RFID security chip in the key handle or fob?
- rdl 14y ago
  Regular car keys are a pain in a lot of ways, and not all that secure, either. To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a faraday cage and driving off to attack at his leisure, but that's hard to defend against (there, you probably have a continuous heartbeat signal and respond on loss of the signal, or just pay someone with a gun to guard your car...) You should be able to put vehicle ignition control and access control logic inside a tamper-responding processor and secure it, even with all communications over an open bus. If you were going to be super paranoid, your vehicle would have vehicle-specific timing information built into the engine which was difficult to deduce from analyzing it after removing the ECU, so just swapping in a "skeleton key" ECU wouldn't work. No one is likely to do that for a car, but it is basically how the Permissive Action Links on nuclear weapons work (variable length wires for the explosive lenses on the primary; if you don't have the exact timing information to set them off at the right time, the weapon will be subcritical.)
  - __alexs 14y ago
    > To really do this correctly, you need to have cryptographic challenges between a key and an ECU, Nonsense. The problem isn't cloning the key, the problem is that you are reprogramming the lock to accept this new key you happen to have with you. No amount of crypto is going to save you when your verifier is full of holes. You can't even use signing to only accept approved programming devices since OBD regulations enforce it's openness. > all communications over an open bus Now this is an interesting point. The bus that the OBD is connected to controls a whole bunch of devices all over the car. It's possible that no access to the inside of the car was required to execute this attack. Looking at the video it doesn't seem like they really stoop inside the car to grab anything actually so perhaps there's a way to get at the CAN bus via the presumably electronic wing-mirror?
    - rdl 14y ago
      1) The cryptographic challenges are a necessary but not sufficient part of building a secure car access control system. All the active components in a car are horrible from a security perspective, usually huge libraries from third-party manufacturers, and all kind of duct-taped together. So bad that a malformed audio cd in the entertainment system could actually totally pwn the car, including driving controls. 2) There are wireless extensions to OBD-II to run tire pressure monitors. You can do a no-touch OBD-II hack. Presented at USENIX last year. Tesla is really the only manufacturer who is likely to do better, since they build a lot of stuff in-house vs. buying badly documented components. I would love to audit the Model S (especially if in doing so I got an earlier delivery position).

by __alexs 14y ago

deleted 14y ago

[deleted]

jrabone 14y ago
See http://www.e90post.com/forums/showthread.php?t=670339 http://www.e90post.com/forums/showthread.php?t=670339 and http://www.e90post.com/forums/showthread.php?t=713085 http://www.e90post.com/forums/showthread.php?t=713085 - there are people who will do this in the UK.

lbotos 14y ago

I think there is a legal requirement that the ODB-2 port needs to be in a standard location. (Driver's Side, Under dashboard)

CamperBob2 14y ago

If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in. What in the world was wrong with plain old car keys -- especially with an added RFID security chip in the key handle or fob?

rdl 14y ago
Regular car keys are a pain in a lot of ways, and not all that secure, either. To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a faraday cage and driving off to attack at his leisure, but that's hard to defend against (there, you probably have a continuous heartbeat signal and respond on loss of the signal, or just pay someone with a gun to guard your car...) You should be able to put vehicle ignition control and access control logic inside a tamper-responding processor and secure it, even with all communications over an open bus. If you were going to be super paranoid, your vehicle would have vehicle-specific timing information built into the engine which was difficult to deduce from analyzing it after removing the ECU, so just swapping in a "skeleton key" ECU wouldn't work. No one is likely to do that for a car, but it is basically how the Permissive Action Links on nuclear weapons work (variable length wires for the explosive lenses on the primary; if you don't have the exact timing information to set them off at the right time, the weapon will be subcritical.)
- __alexs 14y ago
  > To really do this correctly, you need to have cryptographic challenges between a key and an ECU, Nonsense. The problem isn't cloning the key, the problem is that you are reprogramming the lock to accept this new key you happen to have with you. No amount of crypto is going to save you when your verifier is full of holes. You can't even use signing to only accept approved programming devices since OBD regulations enforce it's openness. > all communications over an open bus Now this is an interesting point. The bus that the OBD is connected to controls a whole bunch of devices all over the car. It's possible that no access to the inside of the car was required to execute this attack. Looking at the video it doesn't seem like they really stoop inside the car to grab anything actually so perhaps there's a way to get at the CAN bus via the presumably electronic wing-mirror?
  - rdl 14y ago
    1) The cryptographic challenges are a necessary but not sufficient part of building a secure car access control system. All the active components in a car are horrible from a security perspective, usually huge libraries from third-party manufacturers, and all kind of duct-taped together. So bad that a malformed audio cd in the entertainment system could actually totally pwn the car, including driving controls. 2) There are wireless extensions to OBD-II to run tire pressure monitors. You can do a no-touch OBD-II hack. Presented at USENIX last year. Tesla is really the only manufacturer who is likely to do better, since they build a lot of stuff in-house vs. buying badly documented components. I would love to audit the Model S (especially if in doing so I got an earlier delivery position).