12 ms·
Scientist banned from revealing codes used to start luxury cars
- cube13 13y agoI don't get it. Why not publish the method used the crack it without the codes? That's the important research here, and what should be public to further crypto knowledge. The actual codes are worthless for that.
- nicholassmith 13y agoFrom the article it does sound like Volkswagen asked them to redact the codes and they said no, whether they asked for further redactions is unclear. If it was a simple case of asking them not to publish the unlock codes and they said no, that sounds a bit odd, you don't need the codes to show there's a flaw in the system.
- Amadou 13y agoI don't understand the part about the info being available on the net for years already. I'm sure the reporters garbled that since they probably have zero domain knowledge, but it sure implied that anyone with criminal intent probably already has what they need to unlock those cars.
- mcpherrinm 13y agoI interpreted that statement as meaning the software that the cars run is available online. And that software is what the researchers examined. Not the results of this research.
- Amadou 13y agoOk, so that stuff about putting the chips under a microscope probably meant they were just extracting the secret keys. Suggesting that there is just a small number of master keys across the entire line of cars instead of a unique set of keys for each car.
- AnthonyMouse 13y ago>If it was a simple case of asking them not to publish the unlock codes and they said no, that sounds a bit odd, you don't need the codes to show there's a flaw in the system. It's not odd when you consider the need of researchers to allow other researchers to reproduce their results for peer review.
- cpncrunch 13y agoYou don't need the codes to replicate the results. The codes just let you bypass spending the $50k to replicate the experiment.
- AnthonyMouse 13y agoIn other words not providing the codes would increase the cost of replicating the experiment by $50,000 for each team of researchers who chooses to replicate it. Is that really what you want scientists spending their research funding on?
- cpncrunch 13y agoThe point is, you're not actually replicating it if you don't follow all the stages of the experiment. You are (probably) just stealing cars.
- AnthonyMouse 13y ago> The point is, you're not actually replicating it if you don't follow all the stages of the experiment. Disassembling the chip isn't part of the experiment, it's a precursor. You don't have to build your own particle accelerator just to replicate a subsequent experiment that was originally conceived based on data from the large hadron collider.
- marshray 13y agoMost crypto bugs seem to end up being a case where any useful description of the vulnerability is sufficient for a competent attacker to reproduce the problem. In other words, if it came down to just the "codes" (i.e., secret keys) making the difference of whether or not the system was secure in general, then the crypto would probably be strong.
- jlgaddis 13y agoThis is a "UK injunction" to prevent the scientists from publishing their paper "in Washington DC in August". How does that work? It seems quite "not right" to me that my own government could legally prohibit me from doing something in another country (jurisdiction).
- DanBC 13y agoI agree that it's weird & bad when applied to publishing information. The information will leak somehow. It makes a bit more sense when applied to things like child abuse - US citizens who travel abroad and pay to have sex with someone under the age of 18 can be tried in the US. (https://en.wikipedia.org/wiki/Child_sex_tourism#Tourists_from_the_United_States https://en.wikipedia.org/wiki/Child_sex_tourism#Tourists_fro...)
- Amadou 13y agoUgh, that's literally a case of, "think of the children." If what they did was illegal in the country they did it in, then they should be punished there - making it straightforward to extradite them back for trial would be reasonable (assuming it isn't already(. And if it isn't illegal there, well it ought to be. It also sounds like it would be legal for them to marry a 17 year old (as it is in many states in the US) but pay that 17 year old for sex and 30 years in prison.
- jlgaddis 13y agoI am all for protecting children so I hope this doesn't come out wrong but there are way too many "think of the children" laws on the books (and it's only going to continue). Similar to your example, in the state where I live (Indiana) it would be legal for me (a 34-year-old man) to have sex 10 times a day with a 16-year-old kid but it would be a felony punishable by years in prison if I took a naked picture of the same kid. (I don't have any desire to do either one, of course, I just think that's an illustrative example.)
- driverdan 13y agoI can't speak for the UK but in the USA our laws technically apply no matter where a citizen is. US law trumps foreign laws and you could be prosecuted when you return.
- ams6110 13y agoI'd be interested to know if this is another case of a software vendor "inventing their own crypto" and making a hash of it. Maybe it will open some eyes in industry that you need to hire experts for that sort of thing, or at least demand external expert auditing of the software.
- DanBC 13y agoThis is an attack against Megamos. Here's some more information, but I'd welcome some experts chiming in. (https://www.escar.info/fileadmin/Datastore/2010_escar_Vortraege/09_Immobilizer-Security_escar2010.pdf https://www.escar.info/fileadmin/Datastore/2010_escar_Vortra...) (http://securityevaluators.com/content/case-studies/tiris/index.jsp http://securityevaluators.com/content/case-studies/tiris/ind...)
- mindstab 13y agoUm isn't this the explanation for the rash of high tech car robberies we've been witnessing ALREADY? This seems old news to the thieves. This is really just preventing the owners of the cars from reading in the paper that their car is freely stealable. It is regardless of weather the owners know it or now tho. Shameful now they'll move to try and blame these guys when they probably botched the security in the first place.
- acqq 13y agoDo you think it's good when every thief-kiddie gets an easy recipe to open most of the cars soon after some academics used some advanced high tech to analyze the physical structure of the chip and reverse engineer the circuits? Leaving "bad guys" having to repeat the feat until they can use the weakness should buy some time for everybody.
- rwmj 13y agoNo, I think it's good when manufacturers recall the cars and fix their exploitable entry systems.
- acqq 13y agoThe level of exploitability changes immensely if the codes are published, since it was far from trivial to get them: the capability to analyze the silicon chips is far from everywhere. Not giving codes buys some time to all the owners of all the cars, probably counting millions.
- AnthonyMouse 13y agoThe problem is that unless you publish the vulnerability and prove to the public that it exists, the manufacturers have little incentive to spend money on a recall and the vulnerability continues to spread in the criminal community. Publishing the vulnerability also allows other white hats to propose a possible work around that owners could implement before dealers have a permanent fix, e.g. physically removing part of the management interface from the vehicle, or just to know not to park such vehicles in high crime areas in unsecured parking lots because the car could be more easily stolen.
- revelation 13y agoThis thread perfectly demonstrates why injunctions on free speech are evil. We could be reading their paper now instead of contemplating what this piece of low-effort journalism could have possibly meant. The rash of high tech car robberies, I think, used the OBD port to reprogram the car to recognize their fake key. Like a dealer would. So they didn't break the actual crypto, as is claimed here. The software that is referenced here could be the software VW distributes to dealerships to reprogram the car when a customer lost their key. So thats certainly one possible way to find out how the crypto system works, by the interaction of the software with the car. The article also mentions decaping the actual ICs that do the crypto. Thats a very time intensive way to find out how a crypto system works, but it may be the only one when you are dealing with fixed master keys and propietary algorithms. If the keys alluded to here are actually master keys, burned into every car, then they should certainly be published along with the other results, since they are an integral part of the system.
- ds9 13y agoSuppressions of freedom of speech are evil, but not only because they prevent us gaining knowledge. It also punishes innocent activities to protect others against fourth parties - an obvious injustice. "Finding in Volkswagen's favour, Mr Justice Birss said he recognised the importance of the right for academics to publish, but it would mean 'that car crime will be facilitated'." If "crime would be facilitated" is to be the criterion of suppressing communications, there can be no digital security and no freedom of speech.
- marshray 13y agoOh for the days when Western governments had to invoke the threat of terrorism with weapons of mass destruction in order to suppress academic speech.
- vacri 13y agoIf I found out your bank account details, would you be happy for me to publish them?
- 13y ago
- jgrahamc 13y agoMore interesting than the specific codes would be to understand the security of the algorithm used. For example, if the secret code in the Megamos system is changed but the algorithm is not is it susceptible to reverse engineering from listening to the challenge/response when the key is activated.
- jrockway 13y agoWhen I get off a plane, the first thing I do is check if the country I'm deplaning in has prior restraint and mandatory Internet censorship. If it does, I know I'm in the third world.
- mathetic 13y agoSo you consider UK as a third world country?
- shabble 13y agoI think second world[2] might be more accurate, although really the distinction is more about economic policy than freedom. [2] https://en.wikipedia.org/wiki/Second_World https://en.wikipedia.org/wiki/Second_World
- cLeEOGPw 13y agoI think it is the opposite - if it doesn't have censorship it can be considered third world country. Because poor countries can not afford firewalls and people reading blogs and comments.
- moocowduckquack 13y agoThey should try and publish it with the cambridge lot who write the light blue touchpaper blog. http://www.lightbluetouchpaper.org/ http://www.lightbluetouchpaper.org/ They ran into a similar situation with the banks and answered with one of the best academic slap downs I have ever read. http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf
- mietek 13y agoFantastic response. This is the preceding request: http://www.cl.cam.ac.uk/~rja14/Papers/20101221110342233.pdf http://www.cl.cam.ac.uk/~rja14/Papers/20101221110342233.pdf
- wildmXranat 13y agoIndeed. Thanks for posting the original request as well.
- fnordfnordfnord 13y agoThat is glorious.
- mathetic 13y agoCambridge CompSci here, Dr. Anderson, apart from his academic work, is known to be a very powerful and influential scholar in Cambridge. He also orchestrated a campaign against university so that the scholars can own their intellectual property rather than the university and was very successful in his campaign. So it is no surprise that his response to such a phony request is glorious.
- amirmc 13y agoI'm not sure that's accurate. There are a bunch of rules etc about 'IP' in general. I've no doubt Ross was involved in the process but 'orchestrating a campaign' seems a bit grandiose. http://www.admin.cam.ac.uk/offices/research/research/ipr.aspx http://www.admin.cam.ac.uk/offices/research/research/ipr.asp...
- nonchalance 13y agoIs it better for them to publish the codes or to sell them to some thieves? I'd imagine the latter is worse ...
- Qantourisc 13y agoOr thieves coming to you to get the keys ...
- rustynails77 13y agoThe car makers seem to be under the impression that only 1 person would be able to crack the code.
- femto 13y agoOne way to read this article is as a call for a chip slicing method for the masses. It would seem quite a tractable problem for a keen hobbyist. Build a robot, something like a 3D printer in reverse, to alternately remove thin layers from a chip and image the newly exposed layer, until the chip is gone. Use a program to assemble the images into a 3D representation and extract the circuit. In fact, such a project would be a relatively simple way to start gaining the knowledge required for the reverse process, of building a chip.
- subsystem 13y agoLow-Cost Chip Microprobing [29c3] https://www.youtube.com/watch?v=b_MsQRpwRlw https://www.youtube.com/watch?v=b_MsQRpwRlw
- derefr 13y agoThat actually sounds, for a change, like something that would benefit from centralization: I would imagine instead a mail-order service (like 23andme) where you could drop a chip in a tube and get a 3D model + estimated VHDL emailed to you.
- femto 13y agoIt's not quite that consumer friendly, but there are companies that provide a service like this [1]. I gather it is not cheap. Does anyone know what the rough cost is? [1] http://www.chipworks.com/en/technical-competitive-analysis/reverse-engineering-services/ic-circuit-extraction http://www.chipworks.com/en/technical-competitive-analysis/r...
- voltagex_ 13y agoThe 3dbrew guys are looking for $2300USD (I think) to have some chips inside the Nintendo 3DS decapped. Byuu published some wonderful articles (including some figures) on having the SNES coprocessors decapped so they could be successfully emulated for the first time in over a decade. http://web.archive.org/web/20130121234850/http://byuu.org/articles/emulation/snes-coprocessors http://web.archive.org/web/20130121234850/http://byuu.org/ar...
- deleted 13y ago[deleted]
- qq66 13y agoThis is why you publish first, in whatever raw form you have. Cats don't go back into bags.
- cpncrunch 13y agoAnd then perhaps get sued into oblivion.
- rdl 13y agoAs an Audi owner, I wonder if I have standing to sue VAG for not allowing this to be published and thus fixed.
- smsm42 13y agoNow that the cat (or at least the fact that the cat exists) is out of the bag, I wonder how long before owners of stolen autos start suing automakers for negligence and false advertising that led to their cars being stolen?
- Ecio78 13y agoUhm, due to the value of these cars I think that "sophisticated criminal gang" could think about kidnapping one of these scientists and force them to reveal their research.. :/
- coldarchon 13y agohttp://xkcd.com/538/ http://xkcd.com/538/ actually they are as good as dead while they cry about free speech ..
- peterkelly 13y agoThese guys could make a lot of money selling the info directly to people who would make use of it to steal cars on mass. Would the high court prefer that, or a legitimate academic publication that allows us all to learn the lessons from this vulnerability? I should add of course, that in the spirit of responsible disclosure, that this should only be done after the car manufacturers have had adequate time to fix the problem.
- aneth4 13y agoI am surprised not to find a single response supporting restraint from publishing these codes. Is this community really that foolish? First, of course if there is a flaw, it should be studied and fixed inasmuch as possible. Reasonable people can debate whether it's appropriate to publish methods and flaws, though the free speech question is more murky here. However publishing the actual keys - as opposed to the methods - is madness. Let's consider parallel situations not involving protecting rich peoples' luxury posessions, which seems to be clouding everyone's judgement here. Some examples where an encryption key is discovered or reverse engineered, and a scientist wants to publish them: - a key which can shut down every ventilator - a key which can remotely control the throttle on high speed train - a key which can explode a nuclear warhead - the key to your bitcoin stash - the google master ssl private certificate There are an infinite number of such examples. I'm shocked and disappointed that the HN community finds publishing keys, as opposed to systematic flaws, acceptable. Presumably the cognitive dissonance arises from a distaste for rich people. However even if this mostly results in mere car theft, it could also easily result in the innocent being harmed. Free speech, even under the US first amendment, rather clearly does not apply to publishing private encryption keys, particularly ones that can cause grave harm. Shame on the HN community. What if the headline were: Scientist banned from revealing codes used to control school bus brakes
- cpncrunch 13y agoI completely agree. The prevailing opinion on HN seems to be 'free speech at all costs'. You do NOT need to publish the codes to allow others to replicate this research. Publishing the codes simply allows you to bypass spending the $50k to replicate this research and break into any car with little effort.
- deleted 13y ago[deleted]
- count 13y agoYou shouldn't be so quick to cast aspersions against the community, and when the vast majority of people agree with something, take a second to question why that might be. There is, in fact, a flaw. It's a very significant flaw, and has been studied, etc. for years (in the article it mentions, since 2009!). Volkswagen has done nothing to address the flaw in the past few years. In many cases, without publishing the keys to make it PAINFULLY obvious to everyone that the vulnerability exists, large companies can spread disinformation and influence public perception that the vulnerability is minimal or doesn't really exist outside of a special case/etc. In this case, VW is very obviously not planning on updating things, fixing the vulnerability, or addressing things. The vulnerability and the codes have been available on the internet for YEARS without a proper response from VW or a bulletin or other addressing of the issue (and obviously no 'fix' either). This is one of the key points of the 'responsible disclosure' debate: many companies DONT CARE unless they have to, and will just sit on things indefinitely. With all this publicity, I bet VW addresses this pretty significant vulnerability sooner rather than never now. Do you disagree with free speech being used to publish de-css or the blu-ray decryption keys? If your security depends entirely on a single key being not discovered and re-used (because you have no way of changing it, for example), you really have a horrible security model. If you're selling that security to people, and it's really not effective at all for it's purpose, then how much different is that from false advertising or even fraud (given that you KNOW that it's not effective, or has already been easily subverted).
- cameron_hayne 13y agoNot sure, but I suspect that the Guardian article should have said "code" not "codes". I.e. I think perhaps the ban was on including the algorithm in the scientific paper.
- piratebroadcast 13y agoMotherfuckers lying, gettin' me pissed.
- rlpb 13y agoNobody else seems to have noted that this is an interim injunction, not a permanent ban. It seems like legal enforcement of responsible disclosure to me, giving manufacturers an opportunity to fix the problem. I don't see a problem with this per se, in cases where there would be severe harm (like significant crime) without such a ban, provided that the ban is time limited to the minimum time required to fix the problem in the wild. This means, IMHO, that the injunction should come with a requirement that the manufacturer fix vulnerable systems quickly, even if that costs them quite a bit. If this is done, then I don't see this as a bad thing. "The manufacturer's security is so bad that they had to get a court order to stop people from explaining how while they fixed it" is a pretty good incentive, I think.
- eksith 13y agoRemember when the AACS crypto key was leaked a few years back and everyone was getting cease & desist letters? People began taking it down, Digg was scrubbed, no one paid any attention to it whatsoever. It totally worked and every one forgot about the key, 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 and went about their business as usual. ...Oh wait.