6 ms·

>Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? >I'm sure some engineers objected

>Somehow that is a solved problem with internet and all other open security architecture. Why isn't it solved on these cars? >I'm sure some engineers objected that "this is fundamentally insecure!" but got turned down from someone doing the budgets. You're missing a couple of key points here: 1) This is not a network attack, so the internet is largely irrelevant. 2) This is similar to having an attacker sit down at the physical computer they're attacking (a much harder problem). 3) Legislation in Europe forces car manufacturers to use an insecure design. Anti-competition legislation in Europe dictates that the manufacturer cannot stand in the way of the transfer of secret keys. This means that the entire security communication must occur between the on-board computer and the OBD-II tool. Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack. In the US, many car manufacturers take a different approach. The security key is provided by the manufacturer, not the on-board computer, so you can't simply walk up and re-program a key. I don't know if this is true of all manufacturers though.

lusr 14y ago
What's wrong a simple "Okay sir, before you can drive away with your new car you need to pick a password. And before anybody can service the car they'll need your password so please don't forget it, but if you do you can always provide proof of ownership to your nearest dealer and they'll help you reset your password."? That way non-franchise garages can still do repairs, as well.
- Anderkent 14y ago
  They'd have to provide the 'password restore' functionality to non-franchise garages as well, I guess. Otherwise they could do this except without the password: 'Okay sir, here's your key. Anybody can service the car, but they'll need the key. If you lose it, provide proof of ownership to nearest dealer and they'll make you a new one'.
  - lusr 14y ago
    Good point; a physical key is just as good as a password and has the benefit that people will treat it properly.
- bradleyland 14y ago
  That's a great idea, but IANAL, so I can't say if it passes muster for EU anti-anti-competition laws. I'm going to go out on a limb and venture two guesses: 1) Any mechanism that requires manufacturer intervention is going to draw the eye of these legislators, which would likely mean some means of resetting that password for third-parties, which significantly diminishes the security utility. 2) If you've ever worked with consumers and "passwords", you know that they don't remember them. I think this bolsters support for regulations that require the reset procedure to be accessible by third-parties.
- biot 14y ago
  Thieves will help themselves to reset the password too, and they naturally waive the proof of ownership clause.
stcredzero 14y ago
1) This is not a network attack, so the internet is largely irrelevant. Security protocols that can be used on two points on the Internet can also be used between two pieces of hardware, like a programmer/diagnostic tool and an embedded computer.
- bradleyland 14y ago
  I don't disagree with that, but it's still irrelevant in the context of this particular attack, because there's no main-in-the-middle component required. Yes, you must secure the transport, and the same applies for even basic serial communications, but that's not what's happening here at all. This is an exploit of the implementation constraints at a legislate level. Engineers look at this problem and see the engineering problem, but it's cynical (albeit warranted) to believe that the engineers at BMW didn't see the same problems. I bet they are well aware of this vulnerability, but they're unable to do anything about it. There's a valuable lesson to be learned. It ties in to the old adage: be careful what you wish for, you might just get it. There's a lot of rumbling about new privacy legislation in the US, but the entire concept makes me really nervous. What are the chances that legislators understand the internet well enough to craft effective legislation? Not good, I'm afraid.
  - stcredzero 14y ago
    > I don't disagree with that, but it's still irrelevant in the context of this particular attack, because there's no main-in-the-middle component required. Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. > What are the chances that legislators understand the internet well enough to craft effective legislation? Not good, I'm afraid. From what I've seen, the average level of security knowledge in the startup community is woefully inadequate -- with almost everybody believing they are above average.
    - bradleyland 14y ago
      > Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. It does follow. There is no basis for the belief that the transport channel isn't secure! For all we know, it's well-encrypted. Yes, MITM is a concern with all communications that are intended to be secure. Granted. Established. Not an argument. But, it's not relevant to this attack. Even using the best crypto available won't save you if the client barfs the security keys to unauthenticated clients upon request. The challenges here are in the authentication and authorization layer, not the transport layer. But there are non-technical constraints at play. Backing up a bit, this even better illustrates the root of the problem. The way the law is written, you can never build a secure system, because the law mandates that the computer in your car trust all clients. Any system that does not secure the channel between an identified client and server is not secure. Hence, when all clients are permitted, the system is not secure by specification.
blahedo 14y ago
> In the US, many car manufacturers take a different approach. The security key is provided by the manufacturer, not the on-board computer, so you can't simply walk up and re-program a key. And the consequence is that a replacement key costs $150. No joke.
- eldenbishop 14y ago
  Try 500$. BMW owner. This was my quote from the Dealer when I thought I lost my key.
CamperBob2 14y ago
4) Nobody said they had to use the OBDII port for this. 4a) Nobody said that OBDII ports had to work while the alarm is armed.
- biot 14y ago
  Regarding 4a: if you lose your key (and thus you have lost the ability to disarm the alarm) the entire vehicle is bricked?
  - CamperBob2 14y ago
    No, you just get the dealer to plug something into the (possibly proprietary) port that's used by the alarm system. The assumption that this kind of thing needs to be done via the OBD-II port is wacky from the get-go. It may have been easier for some lazy system integrators at BMW to do it that way, but it certainly wasn't necessary, or apparently advisable.
    - biot 14y ago
      I'm not seeing how that will deter thieves. Instead of plugging into the ODB port they will just plug into the alarm system's port. Even if it's proprietary, they'll employ/bribe/coerce an official technician to figure out whatever Rube Goldberg sequence of events that are required to re-enable the vehicle.
      - CamperBob2 14y ago
        Presumably there would be more opportunities for secure handshaking with a proprietary port. It doesn't need to involve security by obscurity -- it just needs not to be barkingly stupid. The best practices in auto security are probably reflected by whatever the leading Japanese brands are doing these days. Traditionally Hondas have been the biggest theft targets, but a glance at the list of most-stolen cars in America ( http://editorial.autos.msn.com/article.aspx?cp-documentid=434545 http://editorial.autos.msn.com/article.aspx?cp-documentid=43... ) suggests that they've more or less solved the problem, as of the mid-1990s. I seriously doubt there's that much need for further innovation.
Too 14y ago
> Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack. Make the key changing process VERY slow, as in 24h+. If you really really lost your key you wouldn't mind leaving the car 24h at a mechanic but a thief would have a much harder time hiding a car that long. At least compared to 2mins at a dark parking lot.

lusr 14y ago

What's wrong a simple "Okay sir, before you can drive away with your new car you need to pick a password. And before anybody can service the car they'll need your password so please don't forget it, but if you do you can always provide proof of ownership to your nearest dealer and they'll help you reset your password."? That way non-franchise garages can still do repairs, as well.

Anderkent 14y ago
They'd have to provide the 'password restore' functionality to non-franchise garages as well, I guess. Otherwise they could do this except without the password: 'Okay sir, here's your key. Anybody can service the car, but they'll need the key. If you lose it, provide proof of ownership to nearest dealer and they'll make you a new one'.
- lusr 14y ago
  Good point; a physical key is just as good as a password and has the benefit that people will treat it properly.
bradleyland 14y ago
That's a great idea, but IANAL, so I can't say if it passes muster for EU anti-anti-competition laws. I'm going to go out on a limb and venture two guesses: 1) Any mechanism that requires manufacturer intervention is going to draw the eye of these legislators, which would likely mean some means of resetting that password for third-parties, which significantly diminishes the security utility. 2) If you've ever worked with consumers and "passwords", you know that they don't remember them. I think this bolsters support for regulations that require the reset procedure to be accessible by third-parties.
biot 14y ago
Thieves will help themselves to reset the password too, and they naturally waive the proof of ownership clause.

stcredzero 14y ago

1) This is not a network attack, so the internet is largely irrelevant. Security protocols that can be used on two points on the Internet can also be used between two pieces of hardware, like a programmer/diagnostic tool and an embedded computer.

bradleyland 14y ago
I don't disagree with that, but it's still irrelevant in the context of this particular attack, because there's no main-in-the-middle component required. Yes, you must secure the transport, and the same applies for even basic serial communications, but that's not what's happening here at all. This is an exploit of the implementation constraints at a legislate level. Engineers look at this problem and see the engineering problem, but it's cynical (albeit warranted) to believe that the engineers at BMW didn't see the same problems. I bet they are well aware of this vulnerability, but they're unable to do anything about it. There's a valuable lesson to be learned. It ties in to the old adage: be careful what you wish for, you might just get it. There's a lot of rumbling about new privacy legislation in the US, but the entire concept makes me really nervous. What are the chances that legislators understand the internet well enough to craft effective legislation? Not good, I'm afraid.
- stcredzero 14y ago
  > I don't disagree with that, but it's still irrelevant in the context of this particular attack, because there's no main-in-the-middle component required. Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. > What are the chances that legislators understand the internet well enough to craft effective legislation? Not good, I'm afraid. From what I've seen, the average level of security knowledge in the startup community is woefully inadequate -- with almost everybody believing they are above average.
  - bradleyland 14y ago
    > Non-sequitur. If you can interpose the man in the middle, then most protocols are broken. It does follow. There is no basis for the belief that the transport channel isn't secure! For all we know, it's well-encrypted. Yes, MITM is a concern with all communications that are intended to be secure. Granted. Established. Not an argument. But, it's not relevant to this attack. Even using the best crypto available won't save you if the client barfs the security keys to unauthenticated clients upon request. The challenges here are in the authentication and authorization layer, not the transport layer. But there are non-technical constraints at play. Backing up a bit, this even better illustrates the root of the problem. The way the law is written, you can never build a secure system, because the law mandates that the computer in your car trust all clients. Any system that does not secure the channel between an identified client and server is not secure. Hence, when all clients are permitted, the system is not secure by specification.

blahedo 14y ago

> In the US, many car manufacturers take a different approach. The security key is provided by the manufacturer, not the on-board computer, so you can't simply walk up and re-program a key. And the consequence is that a replacement key costs $150. No joke.

eldenbishop 14y ago
Try 500$. BMW owner. This was my quote from the Dealer when I thought I lost my key.

CamperBob2 14y ago

4) Nobody said they had to use the OBDII port for this. 4a) Nobody said that OBDII ports had to work while the alarm is armed.

biot 14y ago
Regarding 4a: if you lose your key (and thus you have lost the ability to disarm the alarm) the entire vehicle is bricked?
- CamperBob2 14y ago
  No, you just get the dealer to plug something into the (possibly proprietary) port that's used by the alarm system. The assumption that this kind of thing needs to be done via the OBD-II port is wacky from the get-go. It may have been easier for some lazy system integrators at BMW to do it that way, but it certainly wasn't necessary, or apparently advisable.
  - biot 14y ago
    I'm not seeing how that will deter thieves. Instead of plugging into the ODB port they will just plug into the alarm system's port. Even if it's proprietary, they'll employ/bribe/coerce an official technician to figure out whatever Rube Goldberg sequence of events that are required to re-enable the vehicle.
    - CamperBob2 14y ago
      Presumably there would be more opportunities for secure handshaking with a proprietary port. It doesn't need to involve security by obscurity -- it just needs not to be barkingly stupid. The best practices in auto security are probably reflected by whatever the leading Japanese brands are doing these days. Traditionally Hondas have been the biggest theft targets, but a glance at the list of most-stolen cars in America ( http://editorial.autos.msn.com/article.aspx?cp-documentid=434545 http://editorial.autos.msn.com/article.aspx?cp-documentid=43... ) suggests that they've more or less solved the problem, as of the mid-1990s. I seriously doubt there's that much need for further innovation.

Too 14y ago

> Other than a physical lockout on the OBD-II port, I can't think of a good defense against this attack. Make the key changing process VERY slow, as in 24h+. If you really really lost your key you wouldn't mind leaving the car 24h at a mechanic but a thief would have a much harder time hiding a car that long. At least compared to 2mins at a dark parking lot.