7 ms·

According to PistonHeads, this isn't limited to BMWs alone: A quick internet trawl reveals it's not just BMWs that are vulnerable. Devices similar to that used

According to PistonHeads, this isn't limited to BMWs alone: A quick internet trawl reveals it's not just BMWs that are vulnerable. Devices similar to that used on BMWs are also available for Opel, Renault, Mercedes, Volkswagen, Toyota and Petrol-engined Porsche Cayennes. The reason this form of theft is currently so rife - and admittedly this issue is not limited to BMWs - is that European competition rules require diagnostic and security reprogramming devices to be available to non-franchised garages. As we understand it, this effectively means that car companies cannot restrict access to or use of OBD ports. http://pistonheads.com/gassing/topic.asp?h=0&f=23&t=1167974&mid=83226&nmt=RE%3A+Video%3A+Key+fob+reprogrammers+steal+BMW+in+3+mins http://pistonheads.com/gassing/topic.asp?h=0&f=23&t=...

josteink 14y ago
Translated into not-evading-responsibility-esque: The fact that the communication protocol used is openly known, much like all internet communications, means that an attack is easy to craft. Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? This sounds like either NIH combined with piss poor security engineering done in the name of looking fancy, result of financial constraints or both. I'm sure some engineers objected that "this is fundamentally insecure!" but got turned down from someone doing the budgets.
- mootothemax 14y ago
  Somehow that is a solved problem with internet and all other open security architecture. Just to play devil's advocate, I'm not sure that's entirely true; would you say that every computer user on the entire planet is 100% secured? The vast malware landscape would very much disagree. I think that it is harder with cars, if only because they have to have an open gate to the heart of their system. Plug in, turn on laptop, access! Apparently that's enshrined in both EU and US law, so not very easy to overcome in the near future. I do agree with the heart of your message though: this is the year 2012, and whilst as a non-security bod it's easy for me to say, these things really shouldn't be happening.
- DougBTX 14y ago
  It isn't solved for computer networks, this is exactly the same as the current debate about secure boot. Secure boot is an open standard, but we've not agreed about who can hold the keys: http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot Here, the EU has effectively said that someone with physical access to the car can generate their own keys (since anyone can pretend to be a mechanic, and all mechanics are allowed to generate keys), and the car manufacturers are saying that they should have the root keys, so that only approved dealers can create new ones. Much like Microsoft saying to ARM tablet manufacturers that they have to allow only Microsoft's keys in ARM tablets, blocking end users from installing their self-signed OS. tl;dr: the problem is not protocols, it is key management.
  - josteink 14y ago
    It isn't solved for computer networks, this is exactly the same as the current debate about secure boot. I would disagree. To me this sounds like a perfect scenario for asymmetric encryption, which would solve this in a secure fashion. Obviously someone should have a secure repository for official keys issued, so that duplicates can be made, upon request, upon owners' authorization. It might be bothersome and cumbersome, but the point is it should be a possible process, even for third party mechanical shops. And for me the car-manufacturer sounds like a natural holder of this repo. On the other hand, if you have access to the car and the key, it should be open enough to allow you to (re-)program it with your own keys if you like. As far as I can see, that should satisfy everyone involved, while maintaining a secure architecture.
    - deleted 14y ago
      [deleted]
    - DougBTX 14y ago
      this sounds like a perfect scenario for asymmetric encryption I suspect that they are already using asymmetric encryption, with some sort of mechanism to allow third party mechanics (and thieves pretending to be mechanics) to sign new fobs. the point is it should be a possible process, even for third party mechanical shops. Yes, agreed. The issue seems to be how much faith you put in the manufacturers to play ball. If they have to incur a cost to manage keys, that might lead to legislation around putting limits on the amount they can charge for access. It seems like a rabbit hole full of problems to leave them in charge. What happens when someone who has lost the keys to their second hand car goes to a third party mechanic to unlock the computer in their car built by a manufacturer who has gone out of business? it should be open enough to allow you to (re-)program it with your own keys With this strategy, the solution the the above question is to hope that the user added their own key/certificate to the car in advance. I suspect that the people who would do that would intersect strongly with those who are meticulous with keeping a spare key in a secure place anyway, so it would only help a minority of people. Some of the other ideas, like time locks or falling back to a physical key to create new fobs, sound like they may do a better job of ensuring user freedom. Those solutions might apply to secure boot too, but it still seems unsolved in practice.
- bradleyland 14y ago
  >Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? >I'm sure some engineers objected that "this is fundamentally insecure!" but got turned down from someone doing the budgets. You're missing a couple of key points here: 1) This is not a network attack, so the internet is largely irrelevant. 2) This is similar to having an attacker sit down at the physical computer they're attacking (a much harder problem). 3) Legislation in Europe forces car manufacturers to use an insecure design. Anti-competition legislation in Europe dictates that the manufacturer cannot stand in the way of the transfer of secret keys. This means that the entire security communication must occur between the on-board computer and the OBD-II tool. Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack. In the US, many car manufacturers take a different approach. The security key is provided by the manufacturer, not the on-board computer, so you can't simply walk up and re-program a key. I don't know if this is true of all manufacturers though.
  - lusr 14y ago
    What's wrong a simple "Okay sir, before you can drive away with your new car you need to pick a password. And before anybody can service the car they'll need your password so please don't forget it, but if you do you can always provide proof of ownership to your nearest dealer and they'll help you reset your password."? That way non-franchise garages can still do repairs, as well.
    - Anderkent 14y ago
      They'd have to provide the 'password restore' functionality to non-franchise garages as well, I guess. Otherwise they could do this except without the password: 'Okay sir, here's your key. Anybody can service the car, but they'll need the key. If you lose it, provide proof of ownership to nearest dealer and they'll make you a new one'.
      - lusr 14y ago
        Good point; a physical key is just as good as a password and has the benefit that people will treat it properly.
DougBTX 14y ago
This is where it gets dangerous. We've swapped physical keys for electronic keys, but we've mandated that the root electronic keys get kept in the car. Everyone wants the keys to be kept outside the car. The future of personal freedom will be decided based on whether our fix is to give the keys to the car owner to keep in their home, so that they can unlock their car if they loose their fob (or allow a mechanic of their choosing to generate a new fob), or whether to give the keys to the car manufacturers, so that only approved dealers (and criminals who hack into the dealers' electronic networks) will be able to generate new fobs.

josteink 14y ago

Translated into not-evading-responsibility-esque: The fact that the communication protocol used is openly known, much like all internet communications, means that an attack is easy to craft. Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? This sounds like either NIH combined with piss poor security engineering done in the name of looking fancy, result of financial constraints or both. I'm sure some engineers objected that "this is fundamentally insecure!" but got turned down from someone doing the budgets.

mootothemax 14y ago
Somehow that is a solved problem with internet and all other open security architecture. Just to play devil's advocate, I'm not sure that's entirely true; would you say that every computer user on the entire planet is 100% secured? The vast malware landscape would very much disagree. I think that it is harder with cars, if only because they have to have an open gate to the heart of their system. Plug in, turn on laptop, access! Apparently that's enshrined in both EU and US law, so not very easy to overcome in the near future. I do agree with the heart of your message though: this is the year 2012, and whilst as a non-security bod it's easy for me to say, these things really shouldn't be happening.
DougBTX 14y ago
It isn't solved for computer networks, this is exactly the same as the current debate about secure boot. Secure boot is an open standard, but we've not agreed about who can hold the keys: http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot Here, the EU has effectively said that someone with physical access to the car can generate their own keys (since anyone can pretend to be a mechanic, and all mechanics are allowed to generate keys), and the car manufacturers are saying that they should have the root keys, so that only approved dealers can create new ones. Much like Microsoft saying to ARM tablet manufacturers that they have to allow only Microsoft's keys in ARM tablets, blocking end users from installing their self-signed OS. tl;dr: the problem is not protocols, it is key management.
- josteink 14y ago
  It isn't solved for computer networks, this is exactly the same as the current debate about secure boot. I would disagree. To me this sounds like a perfect scenario for asymmetric encryption, which would solve this in a secure fashion. Obviously someone should have a secure repository for official keys issued, so that duplicates can be made, upon request, upon owners' authorization. It might be bothersome and cumbersome, but the point is it should be a possible process, even for third party mechanical shops. And for me the car-manufacturer sounds like a natural holder of this repo. On the other hand, if you have access to the car and the key, it should be open enough to allow you to (re-)program it with your own keys if you like. As far as I can see, that should satisfy everyone involved, while maintaining a secure architecture.
  - deleted 14y ago
    [deleted]
  - DougBTX 14y ago
    this sounds like a perfect scenario for asymmetric encryption I suspect that they are already using asymmetric encryption, with some sort of mechanism to allow third party mechanics (and thieves pretending to be mechanics) to sign new fobs. the point is it should be a possible process, even for third party mechanical shops. Yes, agreed. The issue seems to be how much faith you put in the manufacturers to play ball. If they have to incur a cost to manage keys, that might lead to legislation around putting limits on the amount they can charge for access. It seems like a rabbit hole full of problems to leave them in charge. What happens when someone who has lost the keys to their second hand car goes to a third party mechanic to unlock the computer in their car built by a manufacturer who has gone out of business? it should be open enough to allow you to (re-)program it with your own keys With this strategy, the solution the the above question is to hope that the user added their own key/certificate to the car in advance. I suspect that the people who would do that would intersect strongly with those who are meticulous with keeping a spare key in a secure place anyway, so it would only help a minority of people. Some of the other ideas, like time locks or falling back to a physical key to create new fobs, sound like they may do a better job of ensuring user freedom. Those solutions might apply to secure boot too, but it still seems unsolved in practice.
bradleyland 14y ago
>Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? >I'm sure some engineers objected that "this is fundamentally insecure!" but got turned down from someone doing the budgets. You're missing a couple of key points here: 1) This is not a network attack, so the internet is largely irrelevant. 2) This is similar to having an attacker sit down at the physical computer they're attacking (a much harder problem). 3) Legislation in Europe forces car manufacturers to use an insecure design. Anti-competition legislation in Europe dictates that the manufacturer cannot stand in the way of the transfer of secret keys. This means that the entire security communication must occur between the on-board computer and the OBD-II tool. Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack. In the US, many car manufacturers take a different approach. The security key is provided by the manufacturer, not the on-board computer, so you can't simply walk up and re-program a key. I don't know if this is true of all manufacturers though.
- lusr 14y ago
  What's wrong a simple "Okay sir, before you can drive away with your new car you need to pick a password. And before anybody can service the car they'll need your password so please don't forget it, but if you do you can always provide proof of ownership to your nearest dealer and they'll help you reset your password."? That way non-franchise garages can still do repairs, as well.
  - Anderkent 14y ago
    They'd have to provide the 'password restore' functionality to non-franchise garages as well, I guess. Otherwise they could do this except without the password: 'Okay sir, here's your key. Anybody can service the car, but they'll need the key. If you lose it, provide proof of ownership to nearest dealer and they'll make you a new one'.
    - lusr 14y ago
      Good point; a physical key is just as good as a password and has the benefit that people will treat it properly.

DougBTX 14y ago

This is where it gets dangerous. We've swapped physical keys for electronic keys, but we've mandated that the root electronic keys get kept in the car. Everyone wants the keys to be kept outside the car. The future of personal freedom will be decided based on whether our fix is to give the keys to the car owner to keep in their home, so that they can unlock their car if they loose their fob (or allow a mechanic of their choosing to generate a new fob), or whether to give the keys to the car manufacturers, so that only approved dealers (and criminals who hack into the dealers' electronic networks) will be able to generate new fobs.