4 ms·

Um, it's a GBP 40K car; I don't care.

by jrabone 14y ago

__alexs 14y ago
OBD-II is used on loads of vehicles. If the regulation didn't mandate that this was an open protocol in 10 years every $500 beater is going to be a write off as soon as you lose the keys.
- jrabone 14y ago
  Well, if that means an end to keyless / smart fob systems, I'm all for it; they are nothing but trouble in my opinion. Right now, I think the OBD port should be read-only unless a registered key is present, and recoding the ECU to accept a new key should require more than just physical access. People don't expect to be able to recode their front door to accept a new blank key - why should a car be different?
  - jvdongen 14y ago
    A skilled locksmith or someone with a serious interest in locks will have no problem [1] to open your front door without any damage using a lock pick tool [2]. If there's no need for said lock to survive, a selection of power tools make it even easier. [edit] Which is not to say that cars should be easy to pry open of course ... [1] in most cases, high-end specialized locks can be an exception. [2] see http://www.lockpicks.com/ http://www.lockpicks.com/ for examples.
    - jrabone 14y ago
      That's not the point; I don't expect to be able to walk up to your front door with a random Yale key, jam it in and out a few times and have your lock reconfigured to accept my key instead of yours. That's what's happening here - it's not as sophisticated as a lock pick attack, nor as brute force as smashing the dashboard and shorting the appropriate wires. It's a blind spot in the system that shouldn't exist if the car was locked. The OBD port simply shouldn't be physically connected if the doors are locked. A relay on the CAN bus pins trigged from the central locking might be a start.
      - deleted 14y ago
        [deleted]
      - __alexs 14y ago
        There's no evidence the OBD port was actually used in this attack. The programmer could have been directly connected to an easily accessible CAN connected component such as the wing mirrors.
        jrabone 14y ago
        There has been evidence in the UK that this is how the thieves are doing it (people finding their cars with the drivers window smashed and the OBD cover lying on the floor). See http://www.e90post.com/forums/showthread.php?t=670339 http://www.e90post.com/forums/showthread.php?t=670339 - at least one of the guys posted there is police.
        vecinu 14y ago
        Which gentleman is a police officer?
EliRivers 14y ago
I appreciate that you like to participate on the internet by speaking out loud and typing what you hear yourself say; once you've done that, you can go back and remove the "um" from the start.

Um, it's a GBP 40K car; I don't care.

by jrabone 14y ago

Um, it's a GBP 40K car; I don't care.

OBD-II is used on loads of vehicles. If the regulation didn't mandate that this was an open protocol in 10 years every $500 beater is going to be a write off as soon as you lose the keys.

jrabone 14y ago
Well, if that means an end to keyless / smart fob systems, I'm all for it; they are nothing but trouble in my opinion. Right now, I think the OBD port should be read-only unless a registered key is present, and recoding the ECU to accept a new key should require more than just physical access. People don't expect to be able to recode their front door to accept a new blank key - why should a car be different?
- jvdongen 14y ago
  A skilled locksmith or someone with a serious interest in locks will have no problem [1] to open your front door without any damage using a lock pick tool [2]. If there's no need for said lock to survive, a selection of power tools make it even easier. [edit] Which is not to say that cars should be easy to pry open of course ... [1] in most cases, high-end specialized locks can be an exception. [2] see http://www.lockpicks.com/ http://www.lockpicks.com/ for examples.
  - jrabone 14y ago
    That's not the point; I don't expect to be able to walk up to your front door with a random Yale key, jam it in and out a few times and have your lock reconfigured to accept my key instead of yours. That's what's happening here - it's not as sophisticated as a lock pick attack, nor as brute force as smashing the dashboard and shorting the appropriate wires. It's a blind spot in the system that shouldn't exist if the car was locked. The OBD port simply shouldn't be physically connected if the doors are locked. A relay on the CAN bus pins trigged from the central locking might be a start.
    - deleted 14y ago
      [deleted]
    - __alexs 14y ago
      There's no evidence the OBD port was actually used in this attack. The programmer could have been directly connected to an easily accessible CAN connected component such as the wing mirrors.
      - jrabone 14y ago
        There has been evidence in the UK that this is how the thieves are doing it (people finding their cars with the drivers window smashed and the OBD cover lying on the floor). See http://www.e90post.com/forums/showthread.php?t=670339 http://www.e90post.com/forums/showthread.php?t=670339 - at least one of the guys posted there is police.
        vecinu 14y ago
        Which gentleman is a police officer?

EliRivers 14y ago

I appreciate that you like to participate on the internet by speaking out loud and typing what you hear yourself say; once you've done that, you can go back and remove the "um" from the start.