3 ms·

I think it's pretty ridiculous to connect motor vehicle gateways, even indirectly, to a network. The Toyotas which can be started with canbus packets can also

by kw71 12y ago

I think it's pretty ridiculous to connect motor vehicle gateways, even indirectly, to a network. The Toyotas which can be started with canbus packets can also be shutdown. The diagnostic test routines are not something that I want a troublemaker or enemy to send to my car at any time. There is no way for the carmakers to secure the applications that use these vehicle networks. Most of them are large enterprises with thousands of sites and some contractors are global enterprises too. Not only do service tools (diagnosis/firmware) get widely leaked, but manufacturing and development tools too: huge enterprises will get their vpn's hacked and their employees will be subject to laptop theft. Since the industry cannot keep a secret, it will never be able to provide security.

TazeTSchnitzel 12y ago
The way to secure it would be one-way communications, right? Design a system with separate data-collection and data-transmission components, and a completely read-only one-way data channel between them.
- mrpippy 12y ago
  Right, and/or just make the connection to the vehicle bus read-only in hardware. i.e. leave the CAN controller's TX line disconnected. I can't see a reason why a device like this would need to transmit on CAN.
  - tonyarkles 12y ago
    Polling for specific data possibly? I don't personally know what data typically exists on CAN if you monitor it passively, but it seems reasonable that you might need to ask devices on the network for the data you're looking for.
    - kw71 12y ago
      This. The legislated application layer which must be present requires that the control module be addressed and specific data requested. While you might have experience with a modern car that broadcasts some of the data interested by the dongle, this is not universal. Where this happens it may be on a different network segment than what you access physically on the OBD2 connector. There may or may not be a gateway between networks in the car, and it may or may not need to be activated, which is not part of the universal application mandated by CARB/EPA. In addition the dongle may be interested in some information that may not be broadcast. For instance the instrument cluster should receive periodic updates about the current road speed. However it's less likely that something I'd be interested in if I were an actuary is broadcast: the throttle position! While the universal CARB/EPA application cannot generally command control modules, this dongle has access to the PHY and could send packets that correspond the manufacturer-specific applications that could be dangerous while a motor vehicle is in operation. With the UART based and PWM protocols that preceded CAN, there were some nuances with the manufacturer-specific protocols on those PHYs that did not line up with the CARB/EPA mandate, so the more generic gateways will not be able to construct these kinds of messages. Now, everything is plain CAN, there is nothing strange about it like "tickle the auxillary line with the destination address at 5 bps to wake up that module." Any CAN node will do.

by kw71 12y ago

TazeTSchnitzel 12y ago

The way to secure it would be one-way communications, right? Design a system with separate data-collection and data-transmission components, and a completely read-only one-way data channel between them.

mrpippy 12y ago
Right, and/or just make the connection to the vehicle bus read-only in hardware. i.e. leave the CAN controller's TX line disconnected. I can't see a reason why a device like this would need to transmit on CAN.
- tonyarkles 12y ago
  Polling for specific data possibly? I don't personally know what data typically exists on CAN if you monitor it passively, but it seems reasonable that you might need to ask devices on the network for the data you're looking for.
  - kw71 12y ago
    This. The legislated application layer which must be present requires that the control module be addressed and specific data requested. While you might have experience with a modern car that broadcasts some of the data interested by the dongle, this is not universal. Where this happens it may be on a different network segment than what you access physically on the OBD2 connector. There may or may not be a gateway between networks in the car, and it may or may not need to be activated, which is not part of the universal application mandated by CARB/EPA. In addition the dongle may be interested in some information that may not be broadcast. For instance the instrument cluster should receive periodic updates about the current road speed. However it's less likely that something I'd be interested in if I were an actuary is broadcast: the throttle position! While the universal CARB/EPA application cannot generally command control modules, this dongle has access to the PHY and could send packets that correspond the manufacturer-specific applications that could be dangerous while a motor vehicle is in operation. With the UART based and PWM protocols that preceded CAN, there were some nuances with the manufacturer-specific protocols on those PHYs that did not line up with the CARB/EPA mandate, so the more generic gateways will not be able to construct these kinds of messages. Now, everything is plain CAN, there is nothing strange about it like "tickle the auxillary line with the destination address at 5 bps to wake up that module." Any CAN node will do.