Hacking Automotive Systems

alphadogg writes "University researchers have taken a close look at the computer systems used to run today's cars and discovered new ways to hack into them, sometimes with frightening results. In a paper set to be presented at a security conference in Oakland, California, next week, the researchers say that by connecting to a standard diagnostic computer port included in late-model cars, they were able to do some nasty things, such as turning off the brakes, changing the speedometer reading, blasting hot air or music on the radio, and locking passengers in the car. The point of the research isn't to scare a nation of drivers, already made nervous by stories of software glitches, faulty brakes, and massive automotive recalls. It's to warn the car industry that it needs to keep security in mind as it develops more sophisticated automotive computer systems. Other experts describe the real-world risk of any of the described attacks as low." Here is the researchers' site, and an image that could stand as a summary of the work.

Comments

Cccess to unlocked car = can damage it, duh

[noidentity]

Someone with access to your unlocked car can cause it to malfunction by messing with its systems, story at 11!

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

Sir, I came to the comments with one single thing in mind... and I'd have to leave frustrated:
No jokes about Toyota? Seriously? I think you guys need more coffee!

Re:Cccess to unlocked car = can damage it, duh

[ebombme]

This isn't Fark. It's /. On a side note... I can't wait to hack my new car.

Re:Cccess to unlocked car = can damage it, duh

[clone53421]

Then it’s a good thing that they’ve already thought of that, I guess.

He and co-researcher Tadayoshi Kohno of the University of Washington, describe the real-world risk of any of the attacks they've worked out as extremely low. An attacker would have to have sophisticated programming abilities and also be able to physically mount some sort of computer on the victim's car to gain access to the embedded systems. But as they look at all of the wireless and Internet-enabled systems the auto industry is dreaming up for tomorrow's cars, they see some serious areas for concern.

Re:Cccess to unlocked car = can damage it, duh

[somersault]

An attacker would have to have sophisticated programming abilities

Sophisticated programming abilities my ass. It's just editing a bunch of variables in tables AFAIK. You can find stuff like VAGCOM (Volkswagen Audi Group ECU editing software) online, and it only costs a couple of hundred quid for the necessary hardware.

and also be able to physically mount some sort of computer on the victim's car to gain access to the embedded system

Yeah, because nobody these days can afford a laptop.

Aside from that, I think this is pointless scaremongering. First, you'd need to have someone that literally wants to kill you which I doubt is very common. Second, you'd need to leave your car unlocked or they'd have to disable the alarm. It would be much cheaper just to physically sabotage a car. And if you are worried about someone cutting your brakes, pump them a few times before moving off to check them. Police drivers are trained to do this as part of their routine when operating a vehicle. With a fully fly-by-wire system then perhaps it could be possible to set the brakes to disable themselves over a certain threshold speed of course..

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

Because the wireless/internet/entertainment system would be physically connected and networked to the ECU. Yeah, real likely.

Re:Cccess to unlocked car = can damage it, duh

[clone53421]

Sophisticated programming abilities my ass ... because nobody these days can afford a laptop ...

Well, yeah... I agree. Only one person really has to do the hard work and then distribute it around in all the right circles such that a rather difficult hack is really just a matter of connecting the right computer to the car.

The key to their concern, though, was the wireless systems that are being introduced. OnStar, wi-fi hotspots, GPS receivers that also download current traffic updates, etc... if the car companies are designing those as insecurely as they designed the systems that these guys reprogrammed, then there is legitimate cause for concern. However I’d certainly hope they’d design the wireless systems to be more secure than a port that required physical access.

Re:Cccess to unlocked car = can damage it, duh

[D'Sphitz]

My question is, why is it possible to "turn off the brakes" with software at all?

Re:Cccess to unlocked car = can damage it, duh

[hesiod]

I would guess it's related to the Anti-lock Brake System, which needs to calculate how much force should be applied and how rapidly.

Re:Cccess to unlocked car = can damage it, duh

[rob13572468]

agreed: this is not new considering this sort of work has been done for at least ten years now..in fact here is my pwn the instrument cluster shot (except i did this 5 years ago...) http://www.lotustalk.com/forums/f129/canbus-re-analysis-10866/#post172691 or this: http://www.youtube.com/user/catch9966#p/u/68/-7Xb0G4JS48 like i said, this is not news at all and there is no real need for security on the vehicle network with the exception of controlling engine/tranmission access (which allmodern networked vehicles have)...

Re:Cccess to unlocked car = can damage it, duh

[DriedClexler]

An attacker would have to ... be able to physically mount some sort of computer on the victim's car

Yeah, and if I could physically mount your wife, I could inject her with all sorts of viruses, maybe even spawn a child process!

So, is "security hole" the next euphemism for vagina?

Re:Cccess to unlocked car = can damage it, duh

[MikeDirnt69]

Hardware, not Software pal

Re:Cccess to unlocked car = can damage it, duh

[clone53421]

In hindsight I probably should’ve bolded the last sentence.

Re:Cccess to unlocked car = can damage it, duh

[tburkhol]

Unfortunately, "not a realistic threat" won't be the part people remember, any more than it was the part that got into the /. headline. "Your car's computer is not secure" is the fearful phrase, and enhanced security seems likely to be one more way for the manufacturers to lock independent mechanics out of the system.

Re:Cccess to unlocked car = can damage it, duh

[DriedClexler]

Yes, I read that part, I understand the point -- it's not a problem now, but could be if carmakers aren't careful with wireless features. I was just trying to be funny. And failing, I guess...

Re:Cccess to unlocked car = can damage it, duh

[clone53421]

I find that things are generally funnier if they contain a kernel of truth... so you were off to a rather poor start when you said “if I could physically mount your wife”.

Re:Cccess to unlocked car = can damage it, duh

[fractoid]

If it's your car, then it's easy enough to install the required hardware. I like the idea of installing a remote GPRS throttle switch. "Steal my car, will ya? Well FUCK YOU! EAT CONCRETE WALL!" *hits 'accelerate forever' button*

Re:Cccess to unlocked car = can damage it, duh

[DriedClexler]

? It doesn't contain a kernel of truth that if I could physically mount your wife, I could inject viruses and spawn child processes?

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

As a car modder, who has been doing this kind of stuff (not malicious) since the early 1990s, wow welcome to the future guys.

Just an example: When my throttle position is above 90% depressed, my A/C compressor disengages(or rather the A/C Clutch engages), giving me that little bit of horsepower and theoretically saving my compressor from 7500 RPM (engine speed, not compressor speed) redline. I did this in an afternoon using only software.

The ECU has a lot of control over the car, especially in drive by wire cars... My car happens to have a cable accelerator, and I vastly prefer that because of throttle response time (a physical link is better most of the time than a software one, assuming both are properly maintained).

If they were really trying to be malicious without being deadly, you could change the air/fuel ratio to be really lean and burn up the valve train the first time they hit the gas pedal, there is no physical override for that, not like brake pedals (which if you turn it off it merely removes the power assist and only prevents you from stopping the car if you aren't strong enough to push the pedal down.)

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

As a car modder, who has been doing this kind of stuff (not malicious) since the early 1990s, wow welcome to the future guys.

Just an example: When my throttle position is above 90% depressed, my A/C compressor disengages(or rather the A/C Clutch engages), giving me that little bit of horsepower and theoretically saving my compressor from 7500 RPM (engine speed, not compressor speed) redline. I did this in an afternoon using only software.

The ECU has a lot of control over the car, especially in drive by wire cars... My car happens to have a cable accelerator, and I vastly prefer that because of throttle response time (a physical link is better most of the time than a software one, assuming both are properly maintained).

If they were really trying to be malicious without being deadly, you could change the air/fuel ratio to be really lean and burn up the valve train the first time they hit the gas pedal, there is no physical override for that, not like brake pedals (which if you turn it off it merely removes the power assist and only prevents you from stopping the car if you aren't strong enough to push the pedal down.)
 

 

Re:Cccess to unlocked car = can damage it, duh

[Mysticalfruit]

It's not a far stretch to envision that future car systems would be able to pull down firmware updates so a car company could save face by just not telling anybody about a problem and silently fixing it in the field (They already do this at dealerships FYI...)

Now imagine someone hijacks the system and sends their own update.

Considering that in cars like the Tourage the key doesn't actually shut the car off, it merely tells the computer that you'd like to shut off the power...
Jaguar has had drive by wire systems for a while now where there actually isn't any physical linkage between the wheel and the tires.

Use your imagination and the hilarity that could ensue...

Re:Cccess to unlocked car = can damage it, duh

[JWSmythe]

    The ABS system detects a wheel lock situation. It will release the brakes on the stopped wheel momentarily. If you were to override this behavior, you could stick all the wheels into the released position, therefor making them not work.

    Normally the ABS system is failsafe. If it fails, your brakes work as normal hydraulic brakes, without the benefit of automatically actuating the brakes to eliminate a slide.

    The opposite would seem to be harder to do. Except for a handful of cars that can actuate the brakes to avoid a skid, I don't believe they have any mechanism (other than the fleshy one in the drivers seat) that can apply pressure to the brake pedal.

    In reading over the PDF on their site, their vehicle was capable of electronically applying the brakes to individual wheels, "sets" of wheels (I'll assume front or rear), or all wheels.

    I've only done work with OBD-II, not CAN, and the interface devices I've used were exclusively read-only, so I never had an opportunity to play with this kind of manipulation. I did intend on putting a computer in my car to do various things. Most of them would be telemetry, which is fine for the read-only interface. I would have liked to set valet mode, where I wouldn't allow the engine over 2000 RPM or 25mph (which ever is lowest).
   

Re:Cccess to unlocked car = can damage it, duh

[nonsequitor]

Actually on some models the side view mirrors are controlled by CAN (Controller Area Network) bus, and all the above mentioned systems can be accessed without opening the door. Sophisticated car theives were the first to discover this.

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

The 90% throttle cutout or wide open throttle cutout with some cars is to stop the compressor to reduce accessory engine load so you can get more power to the wheels when you need it most (it assumes if you are at 90%+ throttle, you must really need wheel power now). If it was to prevent over speeding the compressor, it would shut off at with engine rpm, not throttle position. On most cars, several other things happen at that point as well like possibly ignoring the o2 sensor feedback, advance the timing, stopping the EGR function, using an alternate set of fuel maps, trans shift pressure etc.. All in the name of "We need as much power as possible now!"

Re:Cccess to unlocked car = can damage it, duh

[AltairDusk]

Actually in many modern vehicles the entertainment system IS on the same CAN-BUS network as the ECU and other components. I have a 2005 Dodge pickup where this is the case, I installed an upgraded touchscreen MyGIG OEM radio I picked up for dirt cheap which though it was not offered for my year is able to work since I have the same speed CAN-BUS. However the radio expects to get a clock signal from the ECU which is not something my year is programmed for so there is no way to get the clock on the radio working.

Re:Cccess to unlocked car = can damage it, duh

[rpresser]

The joke is that your doubtful hypothetical rests on the even more doubtful hypothetical that the slashdot reader to whom it is addressed actually has a wife.

Re:Cccess to unlocked car = can damage it, duh

[th0mas_g]

You can find stuff like VAGCOM (Volkswagen Audi Group ECU editing software) online, and it only costs a couple of hundred quid for the necessary hardware.

Remember: VAGCOM, INC. for all your vaginal communications needs! We offer a first-class answering cervix...

Re:Cccess to unlocked car = can damage it, duh

[jc42]

Unfortunately, "not a realistic threat" won't be the part people remember, any more than it was the part that got into the /. headline. "Your car's computer is not secure" is the fearful phrase, ...

Yeah, and we know from a couple of decades with the public Internet that the world is full of people who get a kick out of connecting to a random computer system and vandalizing it. Not to mention the people who want to take over and add your machine to a botnet. And we might also mention again the rootkit that Sony was recently caught delivering on a CD. This is a prototype for what competitive auto makers well might be working on doing to their competitors' machines, to make them look bad.

Consider also that various recent makes of cars have had a "feature" of reporting back to the manufacturer. This is described as helping service the car when you take it in to the dealer. But it's an admission that the car is on a wireless network, and accessible from the outside at all times.

One obvious conjecture might be that the recent Toyota problems have been because of something like this. Do the affected models have wireless connectivity? And even if they don't, such things will happen in the near future.

Re:Cccess to unlocked car = can damage it, duh

[CAIMLAS]

They're kinda over-hyping their abilities (and the required effort) to do this, aren't they?

You can buy an OBDII scanner and the requisite (clicky Windows) software to do this for around $60. The most difficult part of altering the operation parameters of a vehicle is finding the port to gain access.

Re:Cccess to unlocked car = can damage it, duh

[oman_]

As a professional car hacker who's spent years reverse engineering automotive embedded systems and writing the software you speak of I take offense to your statement!

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

I'm a gay man, you insensitive clod.

OTOH, you are welcome to try to 'physically mount' my wife.

Re:Cccess to unlocked car = can damage it, duh

[sumdumass]

I wonder if someone could use the data port to turn the car alarm off.

I can see it now, Nice dressed crack head with a cheap ass stolen laptop under his arm, walks up to a car, breaks the window out, gets in, connects the laptop to the diagnostic port and turns the alarm off, starts the car, everyone on time square thinks he owns the car or something and ignores him more then they usually would while he steals everything possible.

Re:Cccess to unlocked car = can damage it, duh

[Anonymous Coward]

Then it’s a good thing that they’ve already thought of that, I guess.

He and co-researcher Tadayoshi Kohno of the University of Washington, describe the real-world risk of any of the attacks they've worked out as extremely low. An attacker would have to have sophisticated programming abilities and also be able to physically mount some sort of computer on the victim's car to gain access to the embedded systems. But as they look at all of the wireless and Internet-enabled systems the auto industry is dreaming up for tomorrow's cars, they see some serious areas for concern.

He has a very good point. To use BMW as an example (and why I'm posting anon), they're currently moving plans to use an ethernet network to connect all the components to each other since everything is getting so complex. Unless they put some checks and/or partition the network, all you would need to do is splice one wire and you could gain access to the whole system. Considering how everything will be networked, there's no limit to what data you could collect or damage you could do overriding settings.

Re:Cccess to unlocked car = can damage it, duh

[harrykar]

An attacker would have to ... be able to physically mount some sort of computer on the victim's car

Yeah, and if I could physically mount your wife, I could inject her with all sorts of viruses, maybe even spawn a child process!

So, is "security hole" the next euphemism for vagina?

the last is out of question ROFTL

Re:Cccess to unlocked car = can damage it, duh

[lsatenstein]

A new threat is the rfi key chip or remote control lock-unlock for vehicles.

Our local paper reported on a group of people placing their car and receivers in mall parking locks to record the remote key lock signals, and subsequently using them, to remotely open the targeted vehicle in order to steal contents from the latter. Avoid using the remote control car-lock feature.

Re:Cccess to unlocked car = can damage it, duh

[BoneyM]

Jaguar has had drive by wire systems for a while now where there actually isn't any physical linkage between the wheel and the tires.

Between the *wheel* and the *tires* - surely there's something there :) If you mean no connection between the "hand wheel" and the "road wheels+tires", then I seriously doubt it. Citation?

So what?

[franz]

Computer or no computer, if I climbed under your car in the parking lot, I could cut the brake lines.

Re:So what?

[thijsh]

There are some real-world scenario's where this can be used... A cut break-line will be detected by professionals, just like explosives, and every car is inspected prior to leaving with a VIP. So cutting the break line on the presidents limo probably won't get an attacker anywhere. But if the attacker could load software that stalls the engine or cuts the brakes at a predefined time (and place) the attackers can kidnap or kill the VIP without any advance indication that the car has been compromised.

FTA: "In one attack that the researchers call 'Self-destruct' they launch a 60 second countdown on the driver's dashboard that's accompanied by a clicking noise, and then finally warning honks in the final seconds. As the time hits zero, the car's engine is killed and the doors are locked. This attack takes less than 200 lines of code -- most of it devoted to keeping time during the countdown."

Remove the clicking and countdown and no-one will know the car is sabotaged until it's too late. When I would be in charge of securing the president or other VIPs during transport I would want to be able to know if the vehicle has undetectable security flaws like this... The problem is that you don't even know if the software might have been compromised in the months/years that the car has been in service.

Re:So what?

[germansausage]

Wrong method, it leaves obvious evidence. Clip some vicegrips on the flex hoses going to the front wheel cylinders. You've just eliminated 60% of the cars braking power. The pedal feels normal, or even a bit firmer than usual. Do it right and the vicegrips will come off when the car hits whatever it hits when the brakes (mostly) fail.

Re:So what?

[khchung]

Computer or no computer, if I climbed under your car in the parking lot, I could cut the brake lines.

But can you make it so that the brake lines is cut sometime later *WHEN* you want it to?

Stick a phone/PDA/etc into the port, and you can cut the brake lines when you see the target car just as it approaches a red light or intersection.

This is /.! Can't you guys imagine the possible ways to exploit a digital interface vs a mechanical one?

Re:So what?

[RealRav]

Yes but if I attached a cell phone with GPS tracking to your car I can cut the brakes at just the right time. Muhahaha!

Re:So what?

[fl!ptop]

if I climbed under your car in the parking lot, I could cut the brake lines

This is true, however your target would notice their brakes didn't work before pulling out of the parking space, when they pressed them to put the car into gear. Even if the car had a standard transmission, your target wouldn't get far in the parking lot before realizing something was wrong.

Getting the brakes to fail at any time after the car is in motion would be impressive.

Re:So what?

[Comboman]

Getting the brakes to fail at any time after the car is in motion would be impressive.

Pretty easy actually; you put a slow leak in the brake fluid line instead of just cutting it. Of course, my knowledge of automotive sabotage is based totally on MacGyver reruns rather than actual experience, YMMV.

Re:So what?

[geekoid]

Way to miss the point.

If you have complete access to a car, yu can find a way to screw with it.

If I was in charge of automobile security,I'd get the source.

Re:So what?

[geekoid]

Fine, A tine explosive the sets after the vehicle hits 55 mph.

Re:So what?

[thijsh]

Way to miss the point indeed. If an issue such as this is not taken seriously no-one in charge of automobile security will ever know to get the source.
And besides; if you have exactly one minute would you be able to screw with the car without any professional finding a trace of it on a thorough inspection? The point is that most physical flaws (and attack vectors) are known and will be found, but this software flaw is new so no-one expects it or checks for it... Messing with a car only has a point from an attackers point of view if it is not detected until it's too late.

Re:So what?

[nospam007]

With this, you could disable the brake just before the dangerous place and not alert him already on the parking lot.

Re:So what?

[thijsh]

Getting the brakes to fail at any time after the car is in motion would be impressive.

Using this hack an attacker could probably let the brakes fail the moment you go over 100mph, as well as disabling steering-assist and traction control, and maybe even floor the gas pedal...
This is the ultimate 'digital brake line cut' turning the vehicle into a crippled metal cage of death hurling to whatever is in front of it with (most likely) lethal consequence.

Re:So what?

[Lumpy]

1/16th inch drill plus tape. No problem. your brakes will work great for the first 5-10 times you use it. drill 2 holes one high one low. once you press the brakes to pop off the tape the brake fluid will start leaking out. they will work great for the times you need to get to the highway.

Cut the cable to the E-brake as well though.

Re:So what?

[Sulphur]

I had a brake line cut.

The effect was not that of North by Northwest, but the proportioning valve left me with three working brakes and a loss of brake fluid with each use of the brakes.

The guys at the brake shop asked me where I was getting work done.

Re:So what?

[Interoperable]

I think the attack relied on an attack computer being connected to the diagnostic port of the car's computer during the drive. Even if it was small, it would be trivial to detect in an inspection. I don't think the issue of re-programming the cars software was discussed in the article.

Re:So what?

[Mister Whirly]

If the security people can find cut break lines, what make you think they would miss the computer plugged into the diagnostic port? The one sending and reviving radio waves all over the place that are very detectable? Something tells me that VIPs already knew about the possibility of this vector of atttack and either check the diagnostics port already as part of their security sweep of the car, or have the diagnostic port armored or even removed to prevent tampering. The point being made was that physical access - to a car or computer - quickly can be game over. But with a car they physical evidence would probably be easier to detect.

Re:So what?

[TheLink]

> But can you make it so that the brake lines is cut sometime later *WHEN* you want it to?

Of course, I actually thought about this "problem" when I was a kid. Not that I actually did it of course.

Just clip something to the brake lines that cuts them (most cars nowadays should have two independent hydraulic brake circuits) when you say so, or in X minutes, or the engine sounds like it has hit a certain RPM.

Each device could be attached to the brake line this way:

          brake line
----------------------
cutter gripper cutter
      rest of device

That way when the cutter cuts the brake line, the whole device will drop away from the car, making it harder to trace.

Alternatively you could just have the device puncture a few holes in the brake line and then release the gripper.

Works best if the target likes driving fast down hills :).

Re:So what?

[Anonymous Coward]

I must admit I got curious to know how did you learned that.

Re:So what?

[jackbird]

Think 'open hood,' 'attach doohickey,' 'wait 30 sec. while it flashes the new firmware,' 'remove doohickey'. Bonus points if you can compromise the motor pool's code reader while the VIP limo is nowhere nearby, and the trustworthy mechanic is the one inadvertently doing the flashing during routine scheduled maintenance.

Re:So what?

[thijsh]

That's exactly how it's done, and coincidentally also the plot for the upcoming Hollywood movie "Hacking to Kill" where Steven Seagal jumps onto the moving out-of-control-VIP-car and rips the computer (with engine and all) out of the car with his teeth... It's the only way to be sure. :)

Re:So what?

[thijsh]

When they know how to use the hardware it should be trivial to flash the internal software... But there are enough posts describing this already.

Re:So what?

[Anonymous Coward]

Cut the line, and glue it back with superglue.

The cut creates a weak spot in the line, and is undetectable from the drivers seat. Unfortunately, it would be a random time that the line would fail...

Crimping the line(s) creates a weak spot, but also would create a restriction that would not allow the brakes to release, causing the car to lock the affected brakes. Unless the driver is heavy on the brakes, the restriction would cause the back pressure to build, slowing the car due to the brakes locking.

Re:So what?

[JediTrainer]

I thought those types of explosives were only armed when you hit 50 or so. They blow up when your speed drops below 50.

Think I saw a documentary on that once... name escapes me. Velocity? Momentum? Something like that. I think I saw it during a bus trip.

Re:So what?

[DriedClexler]

Getting the brakes to fail at any time after the car is in motion would be impressive.

Yes, I agree Toyota's Priuses are impressive ... but not for this reason.

Re:So what?

[__aamhyo4754]

There are some real-world scenario's where this can be used... A cut break-line will be detected by professionals, just like explosives, and every car is inspected prior to leaving with a VIP. So cutting the break line on the presidents limo probably won't get an attacker anywhere. But if the attacker could load software that stalls the engine or cuts the brakes at a predefined time (and place) the attackers can kidnap or kill the VIP without any advance indication that the car has been compromised.

They won't be able to stop to get their car inspected and consequently the car will be shot up by a guard assuming it's a suicide bomber -- and you've played right into their plan...

Re:So what?

[camperdave]

It was The Bus That Couldn't Slow down

Re:So what?

[charliemopps11]

yea, but you'd notice that as soon as you tried to pull out of the driveway. I'd invision an Ipohone hooked up, programming it to use its GPS and accelerometers then a simple bit of code that went like: If Speed > 60MPH and Incline > 20 degrees forward Then Lock Doors Disable windows Disable breaks Accelerate Radio volume = 100% Heat = 100% Car Alarm on Traction control off end if This would sit waiting for the right conditions for weeks and pretty much guarantee the death of the Driver when it triggered.

Re:So what?

[vtcodger]

On most cars, the Red BRAKE light on the dash panel will probably come on after a while due to low brake fluid in the master cylinder. OTOH, for many drivers, many times, the BRAKE alert is hidden behind the overgrown spokes on the steering wheel that are there for styling and air bag storage reasons.

Re:So what?

[dkleinsc]

Because it makes this scenario much more likely?

Re:So what?

[daremonai]

Sandra Bullock should have learned from that one to stay away from guys who do vehicle mods.

Re:So what?

[wrencherd]

I think the problem here is assuming that technology only advances on one side of the equation; if terrorists know how to reprogram the car through the on-board computer(-s), then it is also likely that the secret service would have some means of re-reprogramming those same computers just as the VP, VIP, PM, MP or PP was being loaded into an otherwise "secure" vehicle.

And what used to pass for innocuous auto maintenance would no longer innocuous, but that would only be true . . .

[Rips off lifemask] . . . if you choose to accept this mission . . .

Dum dum da-dum dum,
Dum dum da-dum dum.
Deeda-dah deeda-dah deeda-dah, da-da-dah, etc.

Re:So what?

[fl!ptop]

you put a slow leak in the brake fluid line instead of just cutting it

The target will still notice something is wrong right away. With a slow leak, it's like opening the bleeder valve. The pedal will go to the floor (slowly, perhaps) and they may work for a time until the fluid is completely gone. If you're like me, you'll tend to pump the brake when it seems like there's no pedal, which will hasten the fluid loss even more. We're talking lots of hydraulic pressure here, so even a pin hole will make the pedal feel "different."

Re:So what?

[MachDelta]

If you ever replace a brake caliper or drum cylinder, you'll want to pinch off the brake line hose with some kind of locking clamp. It keeps the lines from dripping all over the place while they're disconnected, and it also prevents too much air from entering the system (bleeding brakes by hand isn't fun).

Now if you ever try to drive a car with said clamps still attached (as people have accidentally done), you'll quickly find that your "new" brakes don't work so well when they lines are pinched off. :)

Re:So what?

[Sethumme]

I saw the early release. Not very good. Seagal movies are only believable when he's a cook.

Re:So what?

[Anonymous Coward]

thats what pin holes are for.

Re:So what?

[Anonymous Coward]

Actually, we're talking OBD-II, so think "open driver's-side door", etc...

Re:So what?

[Comboman]

No, something happens when you get to 88 MPH. Although that may have been a different documentary, Return to Tomorrow? Withdraw to the Subsequent Time? Something like that.

Re:So what?

[Anonymous Coward]

Seagal movies are only believable when he's a cook.

I don't remember much other than the girl jumping out of the cake.

Re:So what?

[lewiscr]

Yeah, but then the hacker would get sued for violating Toyota patents.

Re:So what?

[hesaigo999ca]

LMAO!!!!

Re:So what?

[JWSmythe]

    Good point.

    Everyone says "cut the brakes", but that's too easy, and detectable.

    A pound of C4 in the gas tank, with a remote detonator would cause more damage, and it would be completely undetectable. Of course, the time required to slide a boxcutter across the brake line is significantly less than it would take to remove and reinstall the fuel pump (the only place to access the inside of the fuel tank).

    It's not actually necessary to cut a brake line. You can just loosen the bleeder and it will have the same effect.

    I had this effectively happen on my car, but with the clutch. I had the clutch master go, so I replaced it and had to bleed the whole system. Apparently at 11pm by flashlight, I didn't tighten the bleeder as tight as it should have been. 4 months later, while I was driving to a friends place the clutch became squishy. When I turned around to go home, I made it about a mile before the clutch had failed completely. It's not always fun to bleed the clutch in an parts store parking lot, but it can be done. :)

    A cut brake line is pretty obvious, when the brakes don't work right. That can usually be felt before the car is ever put into drive. The front and rear brakes are usually segregated, so cutting just say the front lines will still allow the vehicle to stop. The emergency/hand brake is usually a physical connection, as opposed to the hydraulic brake system for the normal driving brakes. To disable a vehicle from stopping, you'd have to damage all three systems.

    I once fixed a car for someone, who's brakes didn't work "quite right". It turned out the car was flood damaged before they bought it. By the time they brought it to me, three of the brake calipers were frozen and wouldn't engage the brakes at all. The fourth was working, but the pads had worn out since they were the only thing stopping the car. The full repair was replacing all three calipers, pads on all four wheels, flushing the brake system, and 6 wheel lugs (they were rusted in place and broke when I was taking it apart). Their response was "oh, it stops better now."

    Most of the viable damage you can do to a car from under it will render it nonoperational, rather than dangerous.

    Having the source code to the computer really isn't necessary. Without a selective trigger, the odds of malicious code doing damage to the correct target are very slim. VIP vehicles do a lot of driving, frequently without the VIP inside.

Re:So what?

[Anonymous Coward]

So it's basically equal to a 2009 Toyota?

Re:So what?

[JWSmythe]

    That'd be a cooler trick. The connector is usually under the dash on the drivers side. :)

    Actually, hooking a code reader to the diagnostic port is fairly standard, and no one questions it. I happen to have a standalone code reader, and any time someone says that their SES light is on, I plug it in and tell them the code. I spent $100 on it and have used it quite a bit. It's better than paying a shop $100 every time to read it for me, and then getting raped even worse on parts and labor.

    No one ever questions what I'm doing when I plug the diagnostic tool in. I could be reprogramming the computer, except folks I do work for know that I wouldn't do that to them without permission. Well, that and I don't have a programmer. :)

Re:So what?

[JWSmythe]

    Actually, that's frequently done for lower class circle track racing. You simply crimp the right side brakes, and no, you don't leave the vice grips on. Once the steel lines are crimped, they stay that way.

    Circle track drivers adjust their cars significantly to turn left. They use larger tires on the right side, lower the suspension on the left, and significantly adjust the alignment. Everything is done so it handles better on left hand turns. It's funny watching them drive through the pits, trying to drive in a straight line. They don't do that very well at all. :)

    When racing, the front and rear straightaways aren't taken straight, they're taken as a long curve so they are way outside and dive in to the apex and then back out. When you tap the brakes for the turns, you want it to pull left.

 

Re:So what?

[JWSmythe]

If your intention is serious damage, that's not the best idea. That's why people intent on inflicting damage simply wire the vibrate motor of a cell phone to an electronic detonator. Nothing says lovin' like blowing the car 30 feet into the air.

Re:So what?

[Bing Tsher E]

I'd invision an Ipohone hooked up, programming it to use its GPS and accelerometers then a simple bit of code...

Unfortunately, your program would be lost in a sea of Fart Apps in the App Store.

Re:So what?

[DrVomact]

This is true, however your target would notice their brakes didn't work before pulling out of the parking space, when they pressed them to put the car into gear. Even if the car had a standard transmission, your target wouldn't get far in the parking lot before realizing something was wrong.

Depends. I once had a near-death experience due to brakes that were pre-failed from the moment I started the car. I was tired from a long day at work, and—as usual—the parking lot was nearly empty, so I didn't have to back up or anything. I just started the pile o' junk that was currently the best transportation I could afford, hit the gas and headed straight for the exit that led to a busy main road with lots of fast-moving cars. I braked as I came to the exit, to wait for a chance to get out. The first clue I had about my brakeless status was that the brake pedal went to the floor without resistance. At this moment, my car was still moving forward (momentum is a terrible thing, almost as much trouble as gravity) to co-occupy a location in space with another heavy metal object traveling at 60 MPH or so orthogonally to my vehicle's sedate but apparently inevitable trajectory.

Luckily, I had an "emergency brake" that did not function via hydraulics, but worked by yanking on wires. Other people call this a "parking brake", for reasons I've never been able to figure out. Anyway, I yanked on the emergency brake for all I was worth...and brought the car to a halt with its nose just far enough into the road to make people honk at me. But not collide, thank God.

I'd like to say that I shot the people who cut my brake line, but actually I'm not important enough to assassinate. I simply had a crap car that had slowly bled out its hydraulic fluid over the course of the long day, and that didn't have one of the new-fangled (in 1982) double (or "crossover") hydraulic systems that prevent losing all your fluid in one go.

So well...what was my point...yeah it's possible to die if you don't have any brakes from the moment you start your car—as long as there's no reason to stop before you enter heavy traffic. And do remember that your "parking brake" can be handy in emergencies.

Re:So what?

[germansausage]

I was trying to find leak in my brake system. My friend who is a mechanic told me to pinch off first the front brakes and then the backs. If the pedal is still soft with the fronts shut off, the leak is in the back or vise versa. He also warned me not to drive it like that and what would happen if I did. For the record, both rear wheel cylinders were leaking. I replaced them and the car was good as new.

Re:So what?

[CAIMLAS]

You can stall a modern vehicle with a microwave gun:

Given this (fairly widely known) vulnerability, I'd suspect that the Presidential Motorcade is EMP shielded (with a Faraday cage, or what have you). I know Air Force One is, so why not the (highly customized) motorcade?

I suspect the Faraday would inhibit the use of remote detonation devices as well (which is, essentially, what this device would be). And I don't doubt they sweep the vehicle for tell-tale signals or receivers.

Re:So what?

[CAIMLAS]

where Steven Seagal jumps onto the moving out-of-control-VIP-car

With or without his wheelchair? Either way, that's impressive!

Re:So what?

[Anonymous Coward]

Give them a toyota?

Yeah...

[Pojut]

...no matter how insecure they are, until hackers find a way to wirelessly connect to my car that doesn't have a wireless connection, I'm not going to worry.

Now if you'll excuse me, I have to make sure some crazy ex-girlfriend doesn't have something stuffed in my OBDII port. "Your mom's OBDII port is stuffed!" Dammit! Almost made it without the mom joke...

Re:Yeah...

[gardyloo]

Almost made it without the mom joke...

      That's what she said.

Re:Yeah...

[Pojut]

That's what she said.

She says a lot of things...that ungrateful biznatch...

Re:Yeah...

[Anonymous Coward]

Just wait for the car makers to decide that climbing into a car to attach to a wired diagnostic port is old school and add wireless access. This feature will be great, because when you drive onto the dealer's lot they can already start diagnosing your car!

BTW, don't the OnStar type systems connect to the ECU?

Re:Yeah...

[iamhassi]

If you're worried your ex is stuffing things in your obdII port I can see why you call her crazy

Re:Yeah...

[Anonymous Coward]

I know there are people in government with plans to send and receive information to car computer systems. This is when it gets scary. Until then, I prefer being able to go in and hack my own computer performance values.

I'm not worried about those hacks

[wiredog]

We all know that once someone has physical access to your system it's theirs. But can they do this via OnStar or other remote access systems?

Re:I'm not worried about those hacks

[BarryJacobsen]

We all know that once someone has physical access to your system it's theirs. But can they do this via OnStar or other remote access systems?

If they can, I'm rushing out to get OnStar - that'd be a lawsuit waiting to happen!

Re:I'm not worried about those hacks

[Keruo]

Most car stereos have bluetooth. The stereo system is connected to other systems in car.
Granted that statement is WILDLY far fetched but in theory, badly designed system could leak access through it.

Re:I'm not worried about those hacks

[zmaragdus]

OnStar themselves can do several things like disable your engine, track your car, open the doors, etc. I would expect that it's theoretically possible (though unlikely) that a person could hack into your car via that method. It would certainly be quite a feat of hacking, but I believe it is possible.

Re:I'm not worried about those hacks

[drinkypoo]

Granted that statement is WILDLY far fetched but in theory, badly designed system could leak access through it.

It's actually not that farfetched; these days, a car stereo is a little computer. I mean, that's been true at least since the development of the digital FM radio, but now they have to speak complex protocols, and that means complex software. If your stereo is hooked up to a complex bus in your car, then likely there is a path to your ECU.

Of course, it's generally trivial to disable car alarms, and it's also trivial to attach a small wireless module to the OBD-II port, so the possibility of such attacks is actually quite high, even though the probability is low: It's not going to happen on drive-by, but it would be easy enough to do to someone else's car. The problem with doing something like this is that it's not necessarily to take it out of a twisted lump of metal later so you don't get caught.

Re:I'm not worried about those hacks

[2obvious4u]

I don't know if they can access the full functionality of the OBDII port, but they can stop your car. That is enough for me to never buy one of their cars.

Re:I'm not worried about those hacks

[khchung]

We all know that once someone has physical access to your system it's theirs. But can they do this via OnStar or other remote access systems?

How hard would it be to stick and hide a remote controlled smartphone/PDA/custom receiver under the car that connects to the port on the car? Instant remote control to everything that can be controlled from the port.

Re:I'm not worried about those hacks

[ledow]

People have physical access to the outside of my car, it doesn't mean they can change my speedo, mileometer, fuel mixture, etc. quickly and without me realising that something has happened. They certainly can't do it just by plugging a box into the port even if they *do* break into my car... because my car is mechanical and doesn't run with this sort of shit (Note: I can and have removed the entire ECU box from a car in the past - it runs, but slowly and less efficiently and may not pass an emissions test, but it still works in a driveable condition - very modern cars literally do not work without them so they are "essential" and thus should work as bloody advertised).

All of these things were done over an ODB cable to a standardised port on every car. On every decent model of car, they should be read-only information about the car's engine. The port is standardised, commonplace, accessible from the driver's seat (by law in the EU), hidden, and (with these models) accepts almost any device / commands without question. It's standard practice to connect an OBD box to modern cars if they have an indicator light up (in fact, it's usually the ONLY way to clear such a light). My car has one. I'm pretty damn sure that you can't modify my mileage or speedo via that route, though, or my fuel mixture, or stop my brakes working. About the worst you might be able to do is clear a warning light. This is because the OBD is designed properly, doesn't allow things it doesn't and it helped by the fact that my speedo is a needle connected to a magnetic induction coil produce by a spinning cable spun at a ratio of the speed of the wheels, and my mileometer is a tick-over-style mechanical one. The Prius-scare should have shown people what happens when you take away control of a vehicle from a driver and put it in the hand of a computer - it was discussed that virtual-ignition-systems, virtual-gearing-systems, etc. are just dangerous and provide no advantage to anyone.

Nobody is saying these things are not do-able on any car with physical work, we're asking why the hell they are modifiable over such a cable in such a "simple" way that someone could literally sell a box on eBay that, when connected to a car, can fraudulently adjust mileage, turn on hot air vents, TURN OFF THE BRAKES (FFS!), and basically cause it to crash and explode whenever you want. That's *NOT* what the OBD standard is for - it's for diagnostics and diagnostic indicators. Why the hell can I adjust the hot air vent through that cable?

The problem is that there is absolutely no NEED for the speedo to be "writable" over a diagnostics cable, or anything else for that matter. The only "writable" things should be to clear diagnostic lights, which will inevitably pop up again if the problem is "real". So you can't just switch off the ABS light on a car and then sell it as having working ABS... OBD logs and records such actions in the car itself and will redisplay those indicators if there is a real problem still.

Why the hell would you *ever* want to be able to modify information like that? Why should a mechanic ever be able to adjust the mileage on the car? It's stupid, not-thought-through and terrible design. Next up is being able to open the doors of any car that has Bluetooth OBD, or changing the VIN numbers or whatever. It's just ridiculous. Even if the car is computer controlled, there are some places where access control of sorts should prevent certain actions.

Re:I'm not worried about those hacks

[Pojut]

or changing the VIN numbers or whatever

NOOO!!!! You were doing so well, with such an awesome post...and you had to pull the ol' Vehicle Identification Number Number bit, didn't you? DIDN'T YOU?!?!?!?!

p.s. Cars only have one VIN. It isn't just in the ECU, it's also stamped on the original engine, the transmission, the frame, and on a plate on the dashboard (at least in the US)

Re:I'm not worried about those hacks

[Anonymous Coward]

The problem is that there is absolutely no NEED for the speedo to be "writable" over a diagnostics cable

What if you change your tire size?

Re:I'm not worried about those hacks

[maxume]

If it is otherwise a good deal, you can just yank the antenna.

Re:I'm not worried about those hacks

[ledow]

Duh - and all the storage locations for that particular piece of information are destroyable. None, however, are *changeable* without trace except for possibly, in the future, some stupid ECU that allows write access to places it shouldn't. Like the devices mentioned in the article, which let you do stupid crap that you shouldn't be allowed to. The article doesn't mention VIN's at all, I was just providing another example of an inflated, possible, future direction that idiotic car manufacturers might make ("But the ECU VIN is XXXXXXXXXXXXX, so it must be the car!").

P.S. Stamping a new VIN plate on metal isn't that difficult, nor is fabricating those stupid plastic dashboard plates. Making modern car's electronics return a different VIN has, up until now, been almost impossible. My old car radio knew the VIN / Number plate of the car it was in, and refused to turn on in any other car. Writable VIN's on the ECU just made that worthless.

I'm not saying it's possible, or can't be countered by other, more practical means, by modifying a VIN via software is something that should never be possible - like changing the unique serial number on any security chip. I now wouldn't like to bet that it *WASN'T* possible on the car these researcher's tested.

Re:I'm not worried about those hacks

[Anonymous Coward]

The problem is that there is absolutely no NEED for the speedo to be "writable" over a diagnostics cable, or anything else for that matter.

This is extremely useful if you change tire sizes to adjust the speedometer to actually be accurate based on the new diameter of the wheels.

Re:I'm not worried about those hacks

[Lumpy]

Audio and a2dp only.. good luck hacking that interface Uber Hax0r.

Re:I'm not worried about those hacks

[Lumpy]

call me when you get the special embossed rivets and a way to cast a new Vin number into an engine block.

Re:I'm not worried about those hacks

[dubbreak]

In this case they are talking about the OBD-II port, a physical port inside the vehicle (often in the driver's foot well). You can get a OBD-II connectors that are bluetooth (thought that would be short range) and wifi connectors (such as the OT-2). So as far as you can connect via wifi you could send commands onto the shared command bus.

This "hack" really isn't surprising at all. There are plenty of vehicles you can flash or change settings via the OBD port (such as Subarus). Scan tools only use read commands on the port, but the port itself doesn't stop you from issuing other commands on it and even if there were some chip checking what commands were issued you'd just have to tap into the shared bus elsewhere.

Re:I'm not worried about those hacks

[somersault]

Note: I can and have removed the entire ECU box from a car in the past - it runs, but slowly and less efficiently and may not pass an emissions test, but it still works in a driveable condition

Why would you ever want a slower, less efficient car? :s

Re:I'm not worried about those hacks

[Demonantis]

Couldn't they just be disgruntled and work for Onstar. I get chills thinking why these abilities are required and wondering just how much authentication is in place to enable them.

Re:I'm not worried about those hacks

[balbus000]

But how will you know if someone has had physical access to your car? Opening a car door isn't that difficult, and I'm sure AAA aren't the only ones with the good tools to do it quickly.

Re:I'm not worried about those hacks

[lowrydr310]

The problem is that there is absolutely no NEED for the speedo to be "writable" over a diagnostics cable, or anything else for that matter.

I agree with most of what you said, except for the speedometer part. Often times the speedometer is linked to the number of rotations of the wheels. When people change tire sizes or gear ratios (not very common, but it does happen) it's good to have the ability to adjust the speedometer accordingly. If not, you not only get an inaccurate speed indication but an inaccurate odometer reading.

I don't think it should be something that can be done via the OBDII port, however the ability should exist somewhere. For my particular vehicle, there's an aftermarket device that accomplishes this by modifying the signal, which is very helpful for the off-roading crowd who frequently modify their stock vehicles with oversize tires and different gear ratios.

Re:I'm not worried about those hacks

[Anonymous Coward]

You obviously do NOT have a grasp on the OBDII systems at all. By connecting through the OBD port, Dealers are able to update your computers firmware, reprogram fuel maps, control transmission shift points, read sensor data, and definately YES change the indicated speed. Most modern vehicles speed sensor is fed directly to the ECU where it reads the speed pulses to control transmission shift points, cruise control, ABS systems, SRS systems and then from there feeds the signal to your speedometer. The reason this is adjustable is 2 fold. First, it allows easy adjustment between MPH and KPH, it also allows for easy adjustment for changing of tire/wheel sizes among vehicles. This is most relavant in trucks when switching to a larger tire size.

Modern systems also have more then one data bus, they have the OBD system, then a Can bus that controls things like lighting, window modules, sunroof, radio, factory alarm systems and in car entertainment/navigation. Not all vehicles have the same amount of control, but on most of the "higher end" vehicles, its pretty crazy what can be changed.

Just take a look at even basic GM cars. Something like a Cobalt or even an Impala, The FACTORY radio controls the following: Headlamp delay, keyless entry unlock/lock, Fog lamps, rest of the Oil change light, Dome lamp timer and so much more.

While most people are fighting for more open control of the car computers to keep independent shops from being locked out and unable to repair cars, this fear mongering article tries to go against that indicating systems need to be locked down even further.

Removal of Mechanical control from a vehicle is just retarded, there is very little to be gained by going to electric steering, Throttle by wire, fully electronically controlled transmissions, and disconnecting the hydrolic brake systems from the physical pedal to a computer controlled system. We add complexity, additional points for failure, it makes it more difficult to diagnose problems, and takes away all safety fail safes as evident by Toyotas poorly programed TBW systems that have made the news.

Progress is good, but not at the cost of safety.

Re:I'm not worried about those hacks

[RJFerret]

I hate to say this, because I love your post's sentiment, but I wouldn't mind being able to change the ratio of my speedometer according to tire size alterations.

Similarly, some cars have issues with ABS or traction control with different tires, it would be lovely to not be restricted in choices by being able to adjust things to accommodate that.

Thankfully my car doesn't have that issue, but I dread moving to a current tech car because of that.

However there are also legal ramifications, as US Federal code requires speedometers to read 0-5 mph high, being able to adjust them would certainly affect court cases.

Re:I'm not worried about those hacks

[Anonymous Coward]

Yeaaahhhh. You have never seen the auto shop that has a car hooked up and they can completely control the car with there computer. Probably not change the ODO as that would be too much of a temptation for most. But they can run the car's systems through diagnostics test with out going on a road. Face it, modern cars are computer driven and the classical interface is there for us humans.

Re:I'm not worried about those hacks

[karnal]

Just like no one can counterfeit money? Really... if there's a will, there's a way.

Re:I'm not worried about those hacks

[vtcodger]

***People have physical access to the outside of my car, it doesn't mean they can change my speedo, mileometer, fuel mixture, etc. quickly and without me realising that something has happened. ...***

You have things pretty much right for 1996 to early 2000s OBD2. But the clever engineers in Detroit have decided that your car needs a local network. And recent cars have one. The brakes, engine, radio, door locks, etc are likely to be on it. CAN has been added to the OBD2 port so that your code scanner can interrogate the ECU to find out why the Check Engine light is on -- or to monitor the O2 sensors -- or ... Guess what, a scanner/sniffer attached to the OBD readout port under your dash can tap that network. It can read packets. It can send packets.

But the network doesn't run all over the car and isn't accessible to anyone with a Swiss Army knife and a couple of wires with alligator clips? Of course the network runs all over the car. What's the point of a network that doesn't network? I can't personally attest that James Bond or some other movie hero can grab the network wires and hook up HIS scanner sniffer just about anywhere cable harnesses are visible. But that'd be my bet.

And it's probably only a matter of time I suppose before some screwup manages a remote controlled door lock that can be used to send packets to and receive packets from the engine/brakes and everything else electronic on your shiny new vehicle. Gee, if they automate the steering and starting, maybe you'll be able to steal cars and drive them off by remote control.

But the engineers in Detroit are too clever to let that happen? Riiiiiight. Of course they are too clever to let that happen ... Of course ...

Re:I'm not worried about those hacks

[phantomcircuit]

It's a pretty safe bet that OnStar is vulnerable to some kind of attack.

Re:I'm not worried about those hacks

[ncttrnl]

You haven't worked on a late model car before. You can turn systems on an off to troubleshoot them. Before, you could do this mechanically. Now, you have to use a computer. Setting the speedometer is pretty common when a tire size is changed. Setting the odometer can usually only be done once each time you replace the instrument cluster. All I know, as someone that still likes to turn their own wrenches, is that I don't want more security on the only way I can still work on my own car. If they lock me out of the diagnostics port, I won't buy the car.

Re:I'm not worried about those hacks

[Anonymous Coward]

I modified the speedometer in my truck to have it still read correctly after I put on larger tires, you can do the same if you change the gear ratios. I also modified the fuel/air curves to make the engine run more efficiently after I put on headers and a cold air intake, increasing my MPG by 2.

Years ago, when I first purchased the vehicle the dealer did a crank relearn procedure which rewrote the PCMs timing to correct a periodic misfire issue.

There are very good reasons to have the ability to do more than just clear lights.

And regarding you comment that drive by wire is bad....I once had a 1970 F100 that got a stuck throttle linkage and ended up going into wide open throttle for no reason one day. Mechanical linkages are no more or less safe the electrical ones.

Re:I'm not worried about those hacks

[Anonymous Coward]

The problem is that there is absolutely no NEED for the speedo to be "writable" over a diagnostics cable, or anything else for that matter.

Any time you change tire diameter you have to adjust the speedometer to account for that or your speedometer will be off. There are many reasons similar to that for other parameters to be modifiable.

Re:I'm not worried about those hacks

[D Ninja]

People have physical access to the outside of my car, it doesn't mean they can change my speedo

I'm confused why physical access to your car would make someone want to touch your skimpy bathing suit...much less change you out of one.

Re:I'm not worried about those hacks

[Idiomatick]

Low chance of that getting hacked maybe... BUT totally likely that OnStar would fuck up and accidentally shut off all moving cars on the road. Or lock them. Even a disgruntled employee could do it.... https://www.infosecisland.com/blogview/3389-Big-Brother-Has-the-Power-to-Turn-Off-Your-Car.html

Re:I'm not worried about those hacks

[mx_mx_mx]

Just imagine this:

But officer, my speedometer shows I didn't break the speed limit...

Re:I'm not worried about those hacks

[Anonymous Coward]

...helped by the fact that my speedo is a needle connected to a magnetic induction coil produce by a spinning cable spun at a ratio of the speed of the wheels, and my mileometer is a tick-over-style mechanical one.

Are you sure about that? (actually you probably are, but I'm still springboarding off of it). My Jeep has a perfectly mechanical looking gauge panel with mechanical needles for speed, rpm, temperature, oil pressure, gas, and voltage. Turn the ignition on, off, on, off, on, off, then on again and the illusion is revealed as each gauge gets set to 100%, 75%, 50%, 25%, then 0 in turn as a panel diagnostic gets run. They may be mechanical needles, but they're all computer controlled.

Re:I'm not worried about those hacks

[Anonymous Coward]

I thought about this. Yanking the antenna won't work unless you properly shield the port/radio from the ~2Ghz band. The radio will likely boost output power to compensate for the weak signal it is receiving. If you pass by a cell phone tower (they are planted along highways) the radio may work without needing to boost the power.

What you need to do is find the shielded box the RF amplifier is stored in and remove the first transistor on the output stage; tying the signal to ground with a SMT resistor instead (probably ~50 Ohms). After putting everything back together, test by calling for a car unlock while parked under a cell-phone tower.

The beauty of disabling the transmitter is that you can still use the receiver. Cell-phone GPS may still work. It is counter-intuitive, but OnStar can not send a shut-down command to the car if it does not first advertise its location.

Re:I'm not worried about those hacks

[Mashiki]

Seriously, that's the biggest problem in Ontario(cdn), stripped VIN's from junkers onto another car. With the riveting to match. Not only that, there have been a few cases where the VIN on the engines have been ground and re-stamped as well. Body frames, usually they'll just grind them off. These of course are vehicals all having been stolen, and they're trying to be sold out of country.

But, it's also become big business in the province ala this:
Thief buys junker from wrecker($300-1k cost)
Goes out steals matching vehicle ($0 cost)
Lists vehicle in paper/auto trader/whatever for $10k or whatever
Individual gets vin runs normal check, sees that it's a wrecker
Bells and lights go off in persons head, thief replies it's an excellent repair(buddy, of a friend who does repairs/etc)
Sells vehicle, net profit $9600ish.

Yeah, it's shitty. It's also a pain.

Re:I'm not worried about those hacks

[Kompressor]

Bingo!
Every modern Jeep that runs on larger than stock tires either has had the speedometer output modified electronically, or is displaying an incorrect speed. You can buy a handheld programmer that plugs in and allows adjustment for wheel size, differential gearing, etc.

The same probably applies to every jacked up 42" tire rig-rocket pickup on the road.

PS, how can you tell that I live in an oil bearing province? :-D

Re:I'm not worried about those hacks

[VisceralLogic]

Why the hell would you *ever* want to be able to modify information like that? Why should a mechanic ever be able to adjust the mileage on the car? It's stupid, not-thought-through and terrible design. Next up is being able to open the doors of any car that has Bluetooth OBD, or changing the VIN numbers or whatever. It's just ridiculous. Even if the car is computer controlled, there are some places where access control of sorts should prevent certain actions.

It's not just used for evil hacking, but also for good hacking. I had my car reprogrammed through the OBD-II port, to give me about 50% more torque. So it's certainly well known that certain cars can have their ECUs reprogrammed through the OBD-II port.

Re:I'm not worried about those hacks

[Pentium100]

One of the reasons I like my 1982 car is that it has zero computers and no OBD or other nonsense. The electronics in the tape deck are probably more complex than in the car.

Re:I'm not worried about those hacks

[profplump]

Somewhat harder than it would be to hide a remote controlled smartphone under the car that connects to the brake line and drains the fluid on command -- to get to the computer port you at least have to open the door.

Re:I'm not worried about those hacks

[Grishnakh]

Removal of Mechanical control from a vehicle is just retarded, there is very little to be gained by going to electric steering,

Actually, you gain about 5% in fuel efficiency by moving to electric steering. Electric steering is also simpler to install at the factory, so it saves money on labor (instead of an engine-mounted pump and a bunch of hydraulic lines running through the engine bay, everything's on the steering rack or column, and you just have to plug in some connectors). Electric steering, if done right, also gives you better steering feel, since you can give greater assist at parking-lot speeds and little or no assist at highway speeds where you don't need assist anyway. That's the main reason the Honda NSX went to EPS so early.

However, you don't need to go to fully electric steering; existing hydraulic steering systems can be converted using EHPS pumps, where basically a small electric motor pumps the hydraulic fluid, instead of the engine. This way, you can vary the motor speed with the road speed, instead of having a fixed ratio determined by the engine speed. Several current Mazdas use this.

and disconnecting the hydrolic brake systems from the physical pedal to a computer controlled system.

I don't know of any cars that do this. It'd be a safety hazard.

Re:I'm not worried about those hacks

[Anonymous Coward]

I can't see any reason to adjust the speedometer for a different size tire... or to adjust whatever ECU settings need adjusted if a turbo is added...

I can't forsee ever needing an easy way to update the software in the ECU or other computer systems in the vehicle either, after all, software is perfect by the time it gets to release...

More to lose than to gain

[llZENll]

It would seem to me we have a lot more to lose by auto manufacturers implement software security than to gain. Its hard enough as it is for repair shops to work on engines and electronics without adding security, which would make repairs even more proprietary and expensive. With almost nothing to gain, if someone wants to disable your brakes they can (gasp) damage your brake line without even opening your car door! Mess with your tires, exhaust, gas, etc. There are many more ways to mess with your car externally than via the software port. And yet somehow the earth keeps rotating.

Re:More to lose than to gain

[Pojut]

Its hard enough as it is for repair shops to work on engines and electronics without adding security, which would make repairs even more proprietary and expensive.

No offense intended, so please don't take this as such. Mods, please mod offtopic:

You haven't worked in a shop before, have you? Whether you have a cheap OBDII scanner or a full-blown diagnostic tool, so long as the car uses OBDII, you can pull codes from it and subsequently replace the fouled O2 sensor, know which cylinder had a misfire, etc. The full-blown diagnostic tools are useful for crazy-hard problems to solve, but your average scanner bought at Autozone is sufficient enough for the vast majority of code-related problems you would encounter.

Also, I got news for you: electrical problems have been a bitch to deal with for literally decades. There isn't really anything that could make them more frustrating to deal with...they are already at that point due to the nature of electricity and the amount of wiring in a car.

If you take your vehicle in because your check engine light is on and you need the diagnostic code pulled, and the shop tells you it's difficult...take your car to another shop. Sure, there are some brands (BMW, for example) that have propriety connectors, but for most of the cars out on the road, their ECU can be accessed using the same tool.

Re:More to lose than to gain

[Anonymous Coward]

"Its hard enough as it is for repair shops to work on engines and electronics without adding security, which would make repairs even more proprietary and expensive."

Sadly, car manufacturers seem to it as in their interest to actively make those repairs more expensive. They make additional revenue by licensing access to detailed diagnostic codes only to certified shops. Independent mechanics, and those shops that simply can't afford the fees charged by the auto manufacturers, find themselves shut out, because they can't interpret the codes.

Re:More to lose than to gain

[Pojut]

www.obd-codes.com is your friend.

Re:More to lose than to gain

[flabbergast]

Also, I got news for you: electrical problems have been a bitch to deal with for literally decades.
Yeah, Lucas is called "The Prince of Darkness" for a reason. =D Not that Lucas, the other Lucas.

Re:More to lose than to gain

[Anonymous Coward]

You haven't worked in a shop before, have you? Whether you have a cheap OBDII scanner [amazon.com] or a full-blown diagnostic tool [snapon.com], so long as the car uses OBDII, you can pull codes from it and subsequently replace the fouled O2 sensor, know which cylinder had a misfire, etc. The full-blown diagnostic tools are useful for crazy-hard problems to solve, but your average scanner bought at Autozone is sufficient enough for the vast majority of code-related problems you would encounter.

And you've obviously never worked with many cars that use proprietary pins on the OBDII port, which are not supported by standard scanners, in order to perform rather mundane analysis and resets. Case in point, the 2nd generation Range Rovers use an OBDII port with proprietary pin connections that are not supported on anything but the proprietary Range Rover analysis tool, in order to read out faults in the air suspension system, and worse yet, reset the ECU once the fault is corrected. The problems with the RR air suspension are not crazy-difficult to analyze, as I can figure out just about any air suspension problem WITHOUT a scanner, within minutes. (Again, case in point: finding out that your rear left air suspension is leaky, does not require a computer. As a matter of fact, the reading on the scanner will only tell you there is a pressure issue on the rear left suspension. Whether it is the actual suspension, the tubing, or a leak in the O-ring and grommet at the valve block is up to the mechanic to figure out.) And I'm not a professional mechanic, just a RR owner. BUT, I'm pretty much screwed if I want my air suspension to actually WORK again after the repair is made, due to the fact that the ECU refuses to activate the pump until the fault has been reset in the ECU, which requires the proprietary tool. (FWIW, there IS a third party tool now, that can be bought relatively cheap, which was the result of a lot of reverse engineering performed by a hobbyist that was sick and tired of needing to go to an authorized dealer, and be charged $70 or so just to get a button pressed.)

BMW is not, by any definition, a "rare case" of manufacturers using proprietary pins in order to comply with OBDII while making sure that compliance means practically nothing without the proprietary scanner/analyzer. BMW does it. Mercedes-Benz does it. Audi does it, and Land Rover does it. I'm pretty sure a lot of other common Euro cars do it as well. These manufacturers do have a point that the additional codes are added value over the bare minimum OBDII readings. However, not only do they use non-standard pins (which, for the record, are allowed in the OBDII standard) but they also keep the read and write codes secret as to make sure no other manufacturer of equipment can read the code or reset it after the repair has been completed. The added value part is a cover for making sure the majority of all owners go to an authorized dealer to get repairs done.

I'm willing to bet that you've never worked in a shop either, or at least not one that needs to deal with European vehicles. Proprietary ECU lock-up is a very real problem for non-dealer mechanics, hobbyists, and owners in general.

Re:More to lose than to gain

[Attila Dimedici]

There are a significant number of OBD codes that are undefined in the standard. Auto manufacturers use these codes for things that are not covered under the standard and only release the meaning of those codes to mechanics working for one oftheir dealers. If an auto manufacturer were to add security, you can be sure they would only release the access information to their own dealers (unless the government intervened to prevent them from doing so).

Re:More to lose than to gain

[Pojut]

I'm willing to bet that you've never worked in a shop either, or at least not one that needs to deal with European vehicles. Proprietary ECU lock-up is a very real problem for non-dealer mechanics, hobbyists, and owners in general.

Actually, I did, for nearly four years before I had to quit due to injury...and I had all of the tools necessary to read those codes. The equipment is out there...you just have to be willing to put out the cash for it.

Unless something huge has changed in the five years since I stopped working in a shop, we were able to pull codes from European cars with no problem.

Re:More to lose than to gain

[geekoid]

YOu don't need to secure the post. Just keep a MD5 of the original on a reference book and compare.

This is a warning for things to come. As more and more cars get wireless access, like OnStar, security can be a real issue.

The automotive industry has a real advantage in that tha can look at th computer industry and see that security is a real concern and implement good procedures and policies.

Re:More to lose than to gain

[geekoid]

Every car also has proprietary codes that can be difficult to ascertain the meaning of.

Electrical problem in new cars a easy to fix.

Re:More to lose than to gain

[couchslug]

IAAM (I Am A Mechanic) too.

Current OBD systems aren't guaranteed to be the future standard, and if the makers can use the excuse of "security" to restrict access to an increasing number of functions (including "functions yet unborn" they can ensure a revenue stream.

Trusting auto makers to ensure easy system access is like trusting Sony to look after your PlayStation.

Re:More to lose than to gain

[Anonymous Coward]

First off, my apologies to labeling you as never worked in a shop. I stand corrected.

Unless something huge has changed in the five years since I stopped working in a shop, we were able to pull codes from European cars with no problem.

Yes, you can buy the tools. But how do you justify buying a $30,000 TestBook system (yes, that is how much it cost, and that is what it was called) that, for the most part, is only useful for resetting EAS Fault codes? That didn't happen over the last 5 years, it happened in late 1995. But this is just for the Land Rover line. Say you need to deal with BMW? Or M-B? You need more units. Even if a small independent repair shop bought all these tools (easily adding up to over $100,000 in addition to all the standard tools necessary to do repairs), they would need to recoup the costs. Land Rover authorized dealers only need to deal with ONE analyzer, so they can afford it. That's the whole point. For BMW and M-B, third party analyzers are available, but not upon the debut of the new model. And with every new model released almost these days, you either need to update the analyzer, or get a new one.

So... you were lucky that you never needed to reset a code to get something working again. That is not the norm. The whole point is to make sure that it is almost unattainable for most mechanics, while marginally avoiding regulators that would want to pound the manufacturers into obedience.

Re:More to lose than to gain

[Lumpy]

If the shop is not using a Snap-On solus to scan your car, leave right there. Those take 6 seconds to use and get a lot of data. If they charge to scan and keep the charge after fixing it, they are scumbags. Many will charge to keep a nimrod from wasting their time. but if they scan and fix it and they charge you for scanning, the shop is ran by scammers.

Re:More to lose than to gain

[Pojut]

Yes, you can buy the tools. But how do you justify buying a $30,000 TestBook system (yes, that is how much it cost, and that is what it was called) that, for the most part, is only useful for resetting EAS Fault codes? That didn't happen over the last 5 years, it happened in late 1995. But this is just for the Land Rover line. Say you need to deal with BMW? Or M-B? You need more units. Even if a small independent repair shop bought all these tools (easily adding up to over $100,000 in addition to all the standard tools necessary to do repairs), they would need to recoup the costs. Land Rover authorized dealers only need to deal with ONE analyzer, so they can afford it. That's the whole point. For BMW and M-B, third party analyzers are available, but not upon the debut of the new model. And with every new model released almost these days, you either need to update the analyzer, or get a new one.

So... you were lucky that you never needed to reset a code to get something working again. That is not the norm. The whole point is to make sure that it is almost unattainable for most mechanics, while marginally avoiding regulators that would want to pound the manufacturers into obedience.

Doy. My turn to apologize. We had tools to read codes and reset them off things like Beemers, Rovers, etc...but yes, there were a few times where we encountered codes which required us to refer the customer to a dealer. This didn't happen often, as people didn't tend to bring european cars to us for heavy diagnosis (generally just brake and exhaust work, sometimes the occasional clutch replacement...Japanese and American cars were brought to us for just about any reason you can imagine, from engine swaps to transmission rebuilds to even main wire harness replacements.)

We were both wrong:-)

Re:More to lose than to gain

[brufleth]

There are different types of devices but what shops use are usually just reading maintenance message logs. Some devices can make some adjustment or even schedule changes. It takes another type of device to load an entirely new software into NVM provided someone has the know how and tools to generate the software. I'm not saying you are wrong in anything you've stated at all. I'm just trying to point out to people that doing the things that many people here are talking about isn't as trivial as the description makes it seem.

Re:More to lose than to gain

[gboss]

Hearing all of this makes me absolutely love and appreciate the work that Uwe Ross does over at Ross Tech for making VAG ECUs so accessible to the hobbyist/independent shop for a reasonable amount of money.

Re:More to lose than to gain

[Pojut]

I fully support anyone making it easier, whether it be for the hobbyist, professional mechanic, or just Joe Blow changing his own oil.

We had an offroad friend that put up the investment to rent the machinery necessary to manufacture frames for mid-to-late 70's FJ-40 landcruisers, since it's so difficult to find them. He also manufactured a self-designed solid axle swap kit (utilizing a Dana 44) for second and third-gen 4Runners. You needed solid welding skills to install it, but he still had all the parts made for you...if you could weld, it was a matter of chopping out the IFS and welding in the new parts. Fit perfectly.

Made a nice little profit before deciding it was taking up too much of his time...but literally hundreds of FJ-40 and 4Runner offroading enthusiasts benefitted from the contributions he made in his spare time.

Re:More to lose than to gain

[hairykrishna]

There are software packages and appropriate cables available to let you deal with OBD on a laptop for peanuts. From what I've seen it's superior even to what the main dealers tend to have. I agree that, if anything, modern OBD makes it far easier to troubleshoot electric issues. I've been chasing a misfire on my early 80's Porsche 928 for weeks now!

Re:More to lose than to gain

[Anonymous Coward]

maybe you haven't worked in a shop

Cars don't always throw a code, then these kind of things can be very hard to diagnose. What if in your happy security world the transmission suddenly decides not to trust the engine because you have a plug wire going bad. The extra security just needlessly complicates things which is the OP point.

Re:More to lose than to gain

[Anonymous Coward]

>>Mods, please mod offtopic

As you wish.... you DID mean your post, right :)

Re:More to lose than to gain

[Tokolosh]

I am suspicious that this is aimed at "right to repair" legislation (http://www.eff.org/deeplinks/2009/05/right-repair-law-pro) and is pretty much justification for DRM to protect car manufacturers and their supplier and dealer symbiotes.

Re:More to lose than to gain

[Anonymous Coward]

They could do security through a OBD tool that scans ECU EPROM data and creates a hash table. If yours matches the manufacturer hash, you get the green light, if not - some data fields have been tampered with and you may need a reflash. I'm surprised dealerships aren't doing such a thing already to detect tampering that can affect warrantys on newer cars as it is right now. (Such a system may also be quite handy to check if all ECU-related service bulletin updates are installed, so why wouldn't they use it?)

So they're asking for DRM?

[Anonymous Coward]

I'd rather leave my port accessible- someday I may want to write some software. If someone has physically broken into my car and put something on my port, then that's my problem. Don't force DRM on us.

I love how we as geeks sometimes want it both ways. "Keep it secure! Add encryption". "Wait wait! That's DRM, I want it gone!"

Re:So they're asking for DRM?

[Anonymous Coward]

What's the problem with having it both secure and extensible? DRM is a problem because the authority over the system is held by someone else, not the owner. Give the owner the smart card which signs the code and everything's peachy.

Re:So they're asking for DRM?

[world_citizen]

I don't see any advantage when it would be encrypted or DRM would be used.
As a garage needs to do tests they'll be able to change values. If you get the keys credentials from a garage one can do the same.

It should just be impossible either change values for certain devices like brakes when the car is running or they should be reset when a diagnostic device is detached.

Re:So they're asking for DRM?

[js_sebastian]

I love how we as geeks sometimes want it both ways. "Keep it secure! Add encryption". "Wait wait! That's DRM, I want it gone!"

It's not really that hard at all. Encryption is neither good nor bad, it's all about who has the keys. How about: you need a password to log into your cars automotive system. Default password is "admin". If you change your password, mechanic will not be able to repare your car unless you give him your password.

Re:So they're asking for DRM?

[westlake]

I'd rather leave my port accessible- someday I may want to write some software.

Then it becomes a problem for everyone else on the road.

But do you really want to void the warranty on your $26,000 Prius? Or see your hack introduced as Exhibit A in a vehicular manslaughter case?

Re:So they're asking for DRM?

[Hurricane78]

Sorry, but you just had a big error in your logic.

There is a difference between keeping things secure with encryption, and DRM. Do you know what that difference is?
I give you a hint: Control!
Who does have the control over the secure systems.
DRM: Your enemies.
Not DRM: You.

That’s why the TPM module (from TCPA) is only bad, when you don’t have 100% control over it, and/or you’re not the only one. A TPM that works for YOU is actually your best friend to protect you from crackers and DRMers taking over control.

Re:So they're asking for DRM?

[Anonymous Coward]

Ummm... the distinction is that the "owner" of the widget has control of "encryption" whereas the "seller" has control over "DRM".... those two things are wildly different and there's absolutely no "having it both ways" involved.

Re:So they're asking for DRM?

[Anonymous Coward]

I posted the original AC comment-- now that I think about it- maybe it's a bit of a false dichotomy. Thinking about it some more, maybe the solution is to encrypt the bus with a key printed on a sticker in the owners manual and resettable by a mechanic. Your electronic ignition keys perhaps validate this encryption key and issue a warning or won't start if the system has been tampered with?

This isn't a bad thing

[acoustix]

I want to be able to connect diagnostic equipment to my car so that I know what's going on. I don't trust a mechanic to tell me what's wrong and how much it will cost. I like being able to do most of the work myself when possible.

Re:This isn't a bad thing

[je ne sais quoi]

Precisely. This is the most important thing that could come out of this work. Currently, it's the law that some of the diagnostic codes that are necessary to identify problems with a vehicle are publicly known. However, automobile manufacturers have more precise codes that you can only learn from the dealer's machine. Bringing it to the dealer of course means you pay out the nose. My Dad just went through this, the check engine light came on on his wife's car, so he days trying to figure out what the problem was (even taking it to the Trak Auto where they scanned the publicly available codes for free for him). Eventually though, he had to take it to the dealer to identify the problem.

It's a bum deal, the automobile manufacturers don't want the owners of the vehicles working on their cars any more. I'm not sure if it's because they realized that they could make more money for the dealers if they made it difficult, or if it's just that making the car easy to work on is not a priority any more. Regardless, hacking the car will be a good thing if we can make those codes publicly available.

Re:This isn't a bad thing

[Anonymous Coward]

My friend's a mechanic and he has a little handheld computer reader that seems to do just what you're asking.

I apologize not knowing the make/model of the computer but I'm sure if you google something along the lines of "car computer reader" you'll come up with plenty of 3rd party options.

Re:This isn't a bad thing

[je ne sais quoi]

After I wrote that I found this web-site that explains how to use the device and what's going on. I still think that the dealer has some codes that are not OBDII certified that they use though. Incidentally, according to that web-site I linked to, the code machine is $200, but in this thread the person says the dealer is charging them $100 just to read the codes. Wow, expensive.

Re:This isn't a bad thing

[Pojut]

There are a bunch of different devices you can use to check OBD II codes. I generally point hobby mechanics and people that do their own maintenance to use something like this. An OBD II code is an OBD II code is an OBD II code...if you are just trying to pull the code and then clear the light without doing any other on-board diagnostics, you shouldn't spend more than $50 on a scanner. If you do, you just bought something that does more than you need.

As has been the case for a while, Snap-On still sells the ultimate scanner. Most professionals wouldn't even have a need for this monster...but holy crap, when you need something like it, there is nothing else on the market that works better.

Re:This isn't a bad thing

[Pojut]

but in this thread the person says the dealer is charging them $100 just to read the codes. Wow, expensive.

When I worked in a shop, we did the same thing...we would charge people $85 to read the code. However, if the person decided to have their car fixed according to what had caused the code to trip in the first place, we would take that $85 off the cost of their final bill, effectively giving them the code scan for free. If they didn't want to get the work done because they were a tight-ass, you bet we charged them to do it (we would sometimes waive the fee if it was obvious the person just didn't have the money...wanting us to pull the code for your and not being able to afford the fix are two very different situations.)

Shops charge obscene amounts of money to scan your car because it causes them to step away from cars that they are actually making money on. You know that phrase time is money? No where is it more true than with a car shop. If you want your code read for free, go to an Autozone...we're there to identify what is wrong with your vehicle and fix it.

Re:This isn't a bad thing

[je ne sais quoi]

Thanks for the suggestion, my Dad's birthday is coming up maybe I'll get him the cheaper one. :) I'm going to have to go through this soon myself though, right now I drive an 1987 4Runner with 191k miles on it and I don't really need the codes (passes emissions each year with no problems). It's starting to become unreliable so I have to buy a new car which means I'll be needing to learn about the codes.

Re:This isn't a bad thing

[Anonymous Coward]

Even in some cars like my Neon you can pull off codes by flipping the ignition key 3 times and then you can see them display one by one in the mileage counter. Second, there's already a vast market of PCM ODBII tools like DiabloSport so you can reflash your car computer and modify your fuel, ignition, rpm limit, fans etc..

Re:This isn't a bad thing

[Anonymous Coward]

With all due disrespect, fuck you. You're exactly the kind of person that nobody wants to deal with when they go to a car shop. You're there to provide a service for a reasonable cost. It takes you all of what, 5 minutes to pull codes? How is that worth $85? It isn't, simple as that. You admit to gouging people because you're unhappy they won't spend hundreds dollars more to do more simple, overpriced work.

Re:This isn't a bad thing

[clone53421]

...and the service he wants to provide is expressly described as not just pulling codes for people who are too stingy to have the work done there as well. It’s his subtle way of saying “go somewhere else”. Oh wait... he wasn’t even that subtle about it:

If you want your code read for free, go to an Autozone

He’ll dick around with your car’s computer for you, but he doesn’t want to. In fact, he really only wants to do it as necessary to actually fix the vehicle, which if you don’t want him to fix, he doesn’t want to dick with.

Re:This isn't a bad thing

[bws111]

Manufacturers use the proprietary codes because having more codes obviously gives more information. More information means quicker and more accurate repairs. Quicker and more accurate repairs means lower warranty costs, which can allow for longer warranty periods, which leads to beating the competition for sales. Since the cars are basically doing their own FA, the codes can also be reported back to the manufacturer so they know where improvements are needed. They keep the codes secret because publishing them means your competitors also see what you are doing to enable you to extend your warranties, so they can do the same thing, which negates the whole point of doing it in the first place. Because the number of people who are influenced to buy a car based on warranty period far outweigh the number of people who would chose a car based on availability of codes, there is no real pressure on them to release the codes. This is especially true when the perception of a long warranty is 'that means they don't expect problems', whereas the release of the codes is taken as 'they do expect problems'.

Re:This isn't a bad thing

[Idiomatick]

Make it read only?

Re:This isn't a bad thing

[Anonymous Coward]

Then buy a VW and a VAG-COM. I can scan any system on my jetta with full explanation and online forums, and hack the hell out of it.

Re:This isn't a bad thing

[Trogre]

No, no no!

Unless you are a major automotive manufacturer, then it is no longer "your" car, and with these new security systems all your diagnostic equipment is useless.

Re:This isn't a bad thing

[toddestan]

Several auto parts stores in my area will loan you the machine to read the code for no cost. They generally ask to hold your driver's license while you have the device - the intent is that you'll go out in the parking lot use it, and come right back. They found that people generally come back in and buy the parts they need once they know what's going on, so it's quite profitable for them to do this. The only snag is some of the codes are propriety so if you can't find it on Google sometimes only the dealer can tell you what they mean.

Manual Override

[happy_place]

Why not provide manual overrides for things like door locks and windows. Even CD drives have that little pinhole reset so you can manually pop the sucker open. It just seems ridiculous to automate everything in a device that is always going to be mechanical in nature.

Re:Manual Override

[ickleberry]

Or just get one of the few modern cars still left that doesn't come with all these unnecessary automated sales gimmicks like the Ariel Atom

Re:Manual Override

[khchung]

Why not provide manual overrides for things like door locks and windows.

Simple - cost and liability.

I doubt a mechanical override for the window can be as simple/lightweight as the CD pinhole. An additional manual overrides (i.e. == mechanical) means

1. more parts (== more cost)
2. a heavier car (== use more gas)
3. more chance of failure (== more liability)
4. more control mechanism (e.g. child locking for the windows for the mechanical switch also!), ==> even more parts and more failure modes (== even more liability)
5. door lock override = 1 more pathway for car thief to open the door.

How many people will be willing to pay more for a car with less mileage, more problems, and easier to steal just because they worry the control system will fail?

And if you don't trust the control system to control your doors, why would you trust it to control your engine?

Re:Manual Override

[L4t3r4lu5]

There is no vehicular emergency which can't be escaped from by properly applying a hammer to a window.

Don't leave home without one, kids.

Re:Manual Override

[happy_place]

Were this simply a matter of trust, then no big deal, but this is about weird hacker exploits. When you attach a computer to a simple device, you enable an assortment of unforseen additional functionality... stuff the designers never intended.

Re:Manual Override

[Anonymous Coward]

Even so, many cars on the market today have "mechanical overrides" for the door, of a sort. Usually you can lock/unlock a door by pulling a special pin, others have the door unlock mechanically when you pull the handle, although normally only for the front seats, for obvious reasons.

Re:Manual Override

[ushering05401]

Far superior to a hammer: http://www.copsplus.com/prodnum4497.php

Also, more handy if you catch someone tampering with your onboard computer... base of the skull punch-through carries more fatality points than hammer to temple.

Re:Manual Override

[Cornwallis]

Why not provide manual overrides for things like door locks and windows. Even CD drives have that little pinhole reset so you can manually pop the sucker open.

Because if there was a pinhole in the window rain could get in?

Re:Manual Override

[Thelasko]

Why not provide manual overrides for things like door locks and windows.

Jaguar has such an override for their electronic transmission.

Re:Manual Override

[WillDraven]

Well, at least not any where being able to unlock the doors or turn the window motor would be any help.

Re:Manual Override

[geekoid]

The override doesn't always work:

http://youtube.com/watch?v=9RbekDSI1FM&feature=related

Re:Manual Override

[couchslug]

"Why not provide manual overrides for things like door locks and windows."

Here ya go!

http://www.lifehammer.com/

Re:Manual Override

[clone53421]

http://www.google.com/search?hl=en&q=toyota+sticking+accelerator&aq=f&aqi=g10&aql=&oq=&gs_rfai=

Well, if you want to exit your vehicle while it’s moving at 95 MPH be my guest...

Re:Manual Override

[clone53421]

Actually, I suspect Bernoulli's principle would keep you pretty dry so long as the hole was fairly small and not on a forward-facing location.

Re:Manual Override

[Culture20]

There is no vehicular emergency which can't be escaped from by properly applying a hammer to a window.

Unless the glass is bulletproof. Of course, on those cars, you might have explosive bolts on the doors...

Re:Manual Override

[clone53421]

That’s because they added an electronically-activated physical override for the manual override to keep you from manually opening the drive while the CD is being written and possibly exposing yourself to dangerously high levels of laser radiation!

Yeah, I’ve had drives that wouldn’t open before... I think shutting the whole thing down and rebooting reset it.

Re:Manual Override

[tlhIngan]

Why not provide manual overrides for things like door locks and windows. Even CD drives have that little pinhole reset so you can manually pop the sucker open. It just seems ridiculous to automate everything in a device that is always going to be mechanical in nature.

They should be overridable, actually. The computer tells the *switch* what it wants to do, and it acts like the switch was activated by the user. (The more traditional way for things is the switches all tie back to the computer, and the computer does the action. But locks, windows and brakes need failsafes, so the best the computer can do is suggest to the control what it should do, and it's up to the control to resolve computer and human conflict.

For locks, the little thing that moves activates the lock, and it's possible to override the solenoid behind it. If there's no thing that moves, then the computer controls the electronic lock switch, and that's overriden by pushing it. Windows are similar, with the computer telling the window switch up or down.

Things like thr transmission and throttle are controlled completely by computer - the lever/pedal just goes to a switch/pot and the computer manages the shifting and engine control. But those aren't vital systems since if the computer goes nuts, the brakes are a failsafe (and the computer can't override that - at best, it can "push" the brakes for you by moving the pedal).

It's a far better system - automatic transmissions of old had complex hydraulic fluid valves that governed shifting, and a mis-drilled hole can cause all sorts of havoc. I think there was a recall due to a hole in the valve plates being 1/8" inches off.

As for the article - it makes sense since the computer controls everything, and "hotrod programmers" use the OBDII port to update ane parameters that give you more horsepower, etc.

Re:Manual Override

[MattBurke]

It's a security feature which has been around for many years called deadlocking - essentially disconnecting the door handles and sometimes locks, inside and out. The idea is that a thief who cannot work the central locking will have to climb in through a smashed window - they can't merely reach in and unlock the door from the inside

Re:Manual Override

[BitZtream]

You have a car without manual door locks in it? I'm pretty sure thats illegal in the states for obvious safety reasons. I've seen plenty without manual window controls but thats a little different since you should be able to open the door and you can certainly break the window with the headrest on your seat. (Pull it out and use the metal posts that hold it in the seat back)

Re:Manual Override

[Anonymous Coward]

Speaking of which, makes you wonder how cars worked before embedded systems came along and, if the mechanical design's clever enough, we probably still wouldn't need embedded systems!

They were able to

[gardyloo]

blast hot air out of the radio? That's one wicked hack!

Re:They were able to

[gardyloo]

Ah. Rush Limbaugh. That would be the parsimonious explanation.

Re:They were able to

[jellomizer]

That Fred Savage, He is one versatile actor.

Re:They were able to

[Anonymous Coward]

Command Syntax of the ultimate computer languge: DoWhatIWant() DoItFaster(Function), eg. DoItFaster(DoWhatIWant() missing ")"

incoming

[cntThnkofAname]

Que up those "in soviet Russia..." jokes

Re:incoming

[Hognoxious]

Que up those "in soviet Russia..." jokes

Can't find it. Do you have the ISBN?

Re:incoming

[Anonymous Coward]

In Soviet Russia, cue misspells you!

The only concern...

[fuzzyfuzzyfungus]

Is if any of these attacks are persistent/capable of lurking onboard waiting for some predefined trigger, without a device remaining connected to the diagnostics port.

While corporatist DRM apologists might disagree, the ability to do all sorts of crazy stuff by connecting to your local diagnostics port is what we call a "feature". If anything, we don't have enough control here, and much of the control we do have is inadequately documented "Oh, sure, it's ODBC, in that it is more or less electrically compatible. Good luck with those proprietary codes, and please see your dealer for regularly scheduled service!"

On the other hand, something that allows anybody with 30 seconds of physical access to flash crash_at_60.haxxx permanently into the ECU is what we would call a "major design flaw".

Re:The only concern...

[BLKMGK]

There are some performance flashes that can be done in a demo mode that go back to normal performance after XX hours of driving but other than that I've never heard of a timed or triggered kind of thing being done. That would take extra ordinary access to the code and most flashes just modify tables for lookups. Even that is tough since the damned firmware is encrypted by most every automaker! Making this worse would really piss me off, these guys are not understanding what they are talking about IMO. Yes, the systems are integrated on a CAN BUS, they did it for a good reason, stop bitching! The last thing we need is OBD being trashed for "security" so no one can fix the cars...

Re:The only concern...

[drinkypoo]

You'd have to reflash the PCM (ECU is an OBD-I term; this kind of stuff is only possible with OBD-II, which actually mandates the term "PCM" — if you want to be accurate, stop calling it an ECU in this context) entirely. I imagine that this sort of functionality is available on all modern cars; possibly not all OBD-II cars, but probably anything new enough to have CAN. Most OBD-II cars on the road do not use CAN anywhere, though today a car might have three or four CAN buses; PCM to OBD-II DLC (diagnostic link connector), PCM to transmission computer, PCM to BCM (body control module) and possibly even BCM to stereo. And other models exist but I personally think buying a car with a CAN bus shared between more than two components is asking for a foot in your ass.

I happen to like my mechanical diesels, which achieve efficiencies very near to modern systems. It's only too bad International-Navistar lacked the foresight to implement the engine as a full-mechanical design, as Mercedes did; your battery can explode and the engine keeps running until you shut it off, because the shutoff is a vacuum switch on the back of the ignition lock. I've had my alternator fail completely and my battery down to about 4V in my 300SD, still made it to work. Nobody will be tampering with my DLC :D

Re:The only concern...

[mrchaotica]

I happen to like my mechanical diesels, which achieve efficiencies very near to modern systems.

The only problem is that the mechanical diesels don't achieve emissions very near to modern systems.

Of course, I have the same attitude you do (that the older cars are better), except I complain about failure-prone and biodiesel-incompatible diesel particulate filters while praising my rotary-injection TDI.

Re:The only concern...

[drinkypoo]

The only problem is that the mechanical diesels don't achieve emissions very near to modern systems.

That's true. But since the solution is worse than the problem on short trips (injecting fuel to burn junk from the filter harms mileage, fuel production causes pollution, try driving by a refinery sometime, it makes me feel like I'm dying slowly) I'm kind of torn on the solution. Biodiesel solves all but the acid rain problem :) However, by keeping my 1982 MBZ on the road and not buying a new car every decade, I'm saving a hell of a lot more energy and pollution than I would by replacing it. This is even more true for my over-8,000 pound diesel pickup, which I try not to take on long trips anyway.

Re:The only concern...

[Thelasko]

The only problem is that the mechanical diesels don't achieve emissions very near to modern systems.

As a diesel performance engineer, I can verify that statement. Electronic controls were implemented to meet emissions requirements.

Didn't even know that was possible!

[chickenrob]

>>blasting hot air or music on the radio Music, I can see, but hot air blasting out of the radio??

Re:Didn't even know that was possible!

[Cro Magnon]

Obviously, you've never listened to Sean Hannidy.

radio

[dxkelly]

I want to know how they made the radio blow hot air.

Re:radio

[andrewbaldwin]

I want to know how they made the radio blow hot air.

Simple!

Just tune it to the local talk radio channel covering politics/religion/sport**...

** select / delete according to your views

Re:radio

[chord.wav]

Go read some books, and come back with a proper question, newbie! Sheez I hate these "How do I hack a hotmail account?" noobs when they don't even know what TCP/IP is.

Re:radio

[Anonymous Coward]

I want to know how they made the radio blow hot air.

Listening to Rush Limbaugh

There's a CSI episode in this

[nedlohs]

The bad guy thought he'd committed the perfect crime, little did he know that someone on the CSI team would have hunch to check the firmware in the car and find the nefarious code snippet.

Re:There's a CSI episode in this

[Anonymous Coward]

saw that one. good episode.

Re:There's a CSI episode in this

[Anonymous Coward]

I assume they pulled his fingerprints off that snippet too. I'd have worn gloves and a hairnet and eat at a Taco Bell right before implementation.

Re:There's a CSI episode in this

[nedlohs]

Actually now that I think about it, it was an NCIS episode: http://www.imdb.com/title/tt0903471/ though when the car tries to kill you it's not just a hunch I guess...

Hans Reiser is going to be....

[Anonymous Coward]

.... so pissed when he reads this.

This just reaffirms...

[DarkKnightRadick]

...my decision to make my next vehicle a 1968 VW Beetle.

Re:This just reaffirms...

[2obvious4u]

bugapaluza!

Re:This just reaffirms...

[Anonymous Coward]

I am going to build a vw thing. All carbed and points. No digital anything. Not even a clock. It will still run even if an EMP goes off.

Re:This just reaffirms...

[netsavior]

68 was an ok year, but I would go with a 69, unless you can find a late 68. In late 68 and 69 on the independent rear suspension transaxle was added. The swing axle was dangerous, as it causes camber changes when you go over a bump, and it was less fun to drive in my opinion. Of course if you get a much earlier model it will be swing, and I would keep it that way, but if you want a 68, be sure to get the *right* 68.

Re:This just reaffirms...

[Cosgrach]

Actually, a 1969 VW Squareback is the best, fuel injected, handles great, and is more solid than the beetle. As for myself, I just purchased a 1973 Toyota Land Cruiser - it's so basic it did not even have a stock radio.

Re:This just reaffirms...

[Anonymous Coward]

Swing axle was not dangerous mister Nader. Asshats who can't drive or think a stock swing axle volkswagen is a slalom car don't belong in the driver's seat of one. My '68 based (yes, swing axle) speedster, on the other hand, handles better than most modern vehicles but it's got 4wheel disc brakes, suspension limiters, modern shocks, and 50 series tires. No wheel tuck, low center of gravity - purpose built car. Purpose of a vw beetle- cheap, reliable, slow transportation. Just use the original traction control system- your hands, feet, brain, and seat of the pants. Worked for many years. People these days don't drive cars, they just ride in them. Also, just fyi: '68 swing axle is a one off in axle length/track. i.e. all earlier ones were also swing axle but in different lengths.

Re:This just reaffirms...

[netsavior]

sure, I mean someone who is going to properly balance the suspension, keep stock weight and properly selected shocks on the back, etc etc isn't going to have wheel tuck... but someone who is used to driving a modern car or a first time hobbyist isn't going to fare well in a swing axle, unless they drive it with white gloves.

I always recommend IRS because it is easier to make/keep it safe.

In any modern VW shop, the weakest motor you can buy for cheap will probably have 30-40% more hores-power than was stock in a swing beetle, because rebuilding a dualport 1600 is cheaper than finding a case from the 3 year run of 1500s and building up an engine nobody wants.

The weakness of the swing is, in my opinion more significant in modern times than it was when they were new because 1)Drivers are different
2)Traffic is different
3)The engines are different ("better" than stock is default for a daily driver VW)

Anyone who knew what they were talking about (like you) would sneer and get a swing anyway (if that is what you wanted) but a newcomer would heed my advice and it would be good advice for him.

Re:This just reaffirms...

[twmcneil]

I've got a 71 Torino. It literally has hundreds of feet of rubber vacuum lines controlling things like spark advance, heat, A/C, shaker baffle and headlight doors. Lines that crack, get cut, slip off and are just a general nuisance. I'll take and open OBDII port any day.

Re:This just reaffirms...

[DarkKnightRadick]

To each their own.

Re:This just reaffirms...

[DarkKnightRadick]

Yeah, but the Thing is UGLY. I'm fairly certain a VW Beetle (of the 1968 model year) has no digital anything, either. Or any real electronics to speak of aside from a radio and some crappy speakers.

Re:This just reaffirms...

[DarkKnightRadick]

and I find this thread to be very informative. I want to thank you both for your opinions and suggestions. (: It'll actually be my second Beetle but the first one I get to keep (I wound up selling my first one after six months because JC Whitney took 8 months to get me their catalog so I could order an engine rebuild kit, was so angry too when it arrived in the mail).

Re:This just reaffirms...

[DarkKnightRadick]

Thanks for the link! *bookmarked*

Re:This just reaffirms...

[DarkKnightRadick]

While I am concerned with all of that, what I need is a slow, reliable car. I have a tendency to speed and until I can get that in check I need a car that won't go as fast as I want to go (I've topped out at 115 in a diesel 5-cylinder).

Now that IS stock. whoa.

Re:This just reaffirms...

[Hillgiant]

setmode=carnerd

The most modern car that can survive EMP, is the 1992 turbo (not TDI) diesel golf/jetta. Mechanical fuel pump. The only wires in the car go to the starter, running lights, and glow plugs. IIRC, it does have a digital clock, but if you have experienced an EMP, you are unlikely to be over-concerned with the exact time.

Re:This just reaffirms...

[Anonymous Coward]

THANKS A LOT NETSAVIOR, now i will get a 78 chevy

Re:This just reaffirms...

[Anonymous Coward]

Hey, that's the exact car I have. I love my Beetle

Re:This just reaffirms...

[netsavior]

please please don't buy anything but vanity items at JCWhitney. They don't know shit, and their "sizing" is wrong, and their parts often look the same but vastly jump around in quality from year to year. California Import Parts is much better Even Mid America is much better

Re:This just reaffirms...

[DarkKnightRadick]

Please dear God may you be older than I am. :p

Re:This just reaffirms...

[DarkKnightRadick]

oh, ok. Will definitely keep that in mind. Thanks!

Re:This just reaffirms...

[netsavior]

also, the time has come for you to join The Samba The forums still move at a pretty good clip, and if there is something worth knowing, there are 10 people who know it.

We are welcoming to newcomers, and the (free)classifieds are decent if a bit less populated than they used to be.

Re:This just reaffirms...

[DarkKnightRadick]

Again, thanks. (:

G-dammit!

[BLKMGK]

The auto industry ALREADY encrypts the daylights out of most of their code! Which makes modifying it for performance reasons a PITA. I have to pay some guy a pile of cash to "flash" my current ECU because only a few guys have managed to figure out the code for it unlike with other cars. Duh, it's a computer and it controls things so yes it can be messed with.But the auto industry already encrypts it and makes this difficult. So long as the auto dealers are able to modify things like speedometers and other things this will always be a "threat" so stop running around like Chicken Little. Sheesh! What they should turn off the OBD-II standard codes so no one but a dealer can diagnose and make minor changes to cars? See how SEMA will like that and all of the independent garages and shade tree mechanics. then they will bitch that it's too locked down. Make up your minds and stop being so short sighted...

Re:G-dammit!

[Windows Breaker G4]

Yup! This! Mod parent up. Also this isn't really news, I mean this is what on star does and they just do it though obd2. Also the amount of stuff you can do varies car to car. Some are a lot more integrated then others. Gm and luxury brands are probably among the worst offenders.

Get Off My Lawn

[Anonymous Coward]

Being an owner, driver, maintainer, and repairer of two classic (pre-1975) non-computerized cars, I'm really getting a kick out of this thread.

"Disable the brakes"

[dotgain]

I find this very hard to believe. Disable the ABS system maybe, but the brake system is designed to work above all else - if a computer can disable the brakes that suggests a malfunction can too.

Re:"Disable the brakes"

[Lumpy]

No it's a bad design. like the toyota prius. if it freaks out it will only use the regren function. Its why many will have melted rotors and brake pads because the computer will not allow full brake pressure when standing on the pedal because it wants ot be eco friendly.

Mostly because the engineers are stupid. Leave the mechanical connection to the brakes. put in a wider close gap and add in regenerative as the first 1/3rd of the pedal is pushed before the pads touch. It's engineering 101. and any 1st year undergrad would do this.

Ah, the Rootbacca defence

[Rogerborg]

Why did my client accelerate to 90mph? I put it to you, ladies and gentlemen of this supposed jury, that he did not. No, it was Evil Hackzorz, doubtless acting on the orders of the Saucer People, or perhaps the Mole Men. This is technically possible - for all you know - so you must have a reasonable doubt that my client was responsible.

Appearing in a celebrity traffic trial near you in 3... 2...

I DONT WANT FSCKING DRM ON MY CAR!!!!

[halfdan the black]

I want to be able to access the computer that I OWN in the CAR THAT I OWN to be able to modify it, reprogram the fuel maps, so forth. Its hard enough right now to be able to access modern engine control systems, just what I need, a bunch of chicken little, fscking "security experts" claiming that cars are "insecure", raising all kinds of alarm, then the car makers react, start putting all kinds of deliberate DRM on the computer systems, and it becomes absolutely fscking impossible to modify your own car.

If I want to modify the computer on MY CAR, THAT IS MY RIGHT, NOT A SECURITY ISSUE!!!!!

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[ledow]

Sorry, but I think we'd all much rather have a car where the ABS (or, indeed, the brake-pedal) can't be disabled entirely, where brakes can't be activate entirely by software, where you can't play with mileometer just by sticking a box on the OBD port, or where the car cannot lock everybody inside if it crashes (the software, not the car!).

It's not a question of software freedom - it's a question of not having that capability automated in the first damn place. In every car I've ever owned, when I press the brake the wheels are slowed by huge hydraulic pressure whether or not the ECU / ABS is working. Sure, I wouldn't do without the ABS either but if it stops working, I can still bring the car safely to a halt. What we're discussing here are cars with computers that *DO* have control over what the brake pedal does - from nothing no matter how hard you press it, to full brakes no matter how you release it - and not the driver.

Some of the other things mentioned on the researcher's FAQ include the bonnet(hood)-latch behind software controlled. One software crash = one real crash. That's a sort of DRM you *don't* want anyway - where your entire ability to use the product is under the control of a computer that could crash at any minute, with serious consequences. Especially not when you're doing 70 mph.

It's the design that's stupid, not OBD, ECU's or being able to tune your car using it if you really want to. They are separate issues. Why, why, why on earth would anyone *EVER* want to legitimately activate a mode on their car where the brake function no longer corresponds to the brake pedal position?

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[geekoid]

You need software to have ABS.
Thus it's vulnerable in some way.

To answer you question:
\To deal with their Ex-Wife~

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[AndersOSU]

Why, why, why on earth would anyone *EVER* want to legitimately activate a mode on their car where the brake function no longer corresponds to the brake pedal position?

ABS.

Modern car's know when they're skidding, and pulse the brakes to regain traction. There may be ways to be clever with "I'm skidding" signal to effectively disable the brakes.

Want another one? Regenerative braking.

This was the problem the Prius was having. If you brake with the throttle open you can ruin the car. The system was designed to cut throttle power before engaging the brake, and IIRC the flaw was the brakes wouldn't engage if, for some reason, the computer couldn't close the throttle. This was obviously a design flaw, but it is a legitimate reason you might want to run the brake signal through a computer.

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[ledow]

ABS is a function that I covered in my original rant. If the computer goes bang, the worst that happens on my car, most cars and ideally *all* cars with ABS is that a warning light comes on and it takes slightly longer to brake (no worse than *not* having ABS at all). There is *no* need to be able to disable and/or enable that feature, or any feature of the braking, through any interface at all. If ABS messes up, you can still brake and warning lights appear to let you know you should get it fixed. That's all that's required. And all the mechanic needs is a way to put out that warning light when they've fixed the problem (but the car is welcome to engage it again if it detects a problem, even immediately after it's been "fixed"). Why on Earth do you need a "disable brakes" function to even EXIST, no matter what the emergency? We're not talking about turning off ABS, the researchers were able to turn off THE BRAKES.

Regenerative braking systems that "ruin the car" if you brake while throttling need a complete redesign. How stupid to have to have a device that cuts one in order to allow the other? Of course, they are mutually-exclusive functions but, as with the Prius, the failure mode is inherently dangerous because it will fail to counteract if one "sticks open" because it's trying to enforce mutual-exclusion. And when your pedal jams down, you can't brake, which is the only vital function of a car. The opposite isn't true that if the brake jams down, you need to be able to accelerate away.

So where in that mess is it necessary to have any sort of enable/disable function of any of the braking system at all or be able to play with any of its parameters? And where is it necessary for that to be accessible over a cable AT ALL or be modifiable at all by the user, or even a third-party garage? It's crap. And the braking signal can run through whatever computers it wants - I damn well want flashy lights and warnings when something is wrong and, like ABS, a computer can check things a lot faster and more accurately than I can. But when that braking signal CONTROLS the brakes, rather than assists them, you have to go find the designer and shoot them.

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[huge colin]

Sure, I wouldn't do without the ABS either but if it stops working, I can still bring the car safely to a halt.

Except for the failure mode where bad data from the wheel sensors (or a software/firmware problem) causes the system to think that the wheels are locked, and thus opens a valve in the valve block, removing your braking ability. This happened to a guy I know, and he drove off an embankment because he was dumb enough to have trusted a vehicle with ABS.

ABS is a terrible, terrible idea.

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[clone53421]

You miss the point. The entire function of the ABS is to momentarily disengage the brakes to prevent a skid. The ABS sends a signal saying “we’re about to skid! release the brakes!” Now, yes, if the ABS fails, it fails safe... normally. If the ABS or its sensors can be hacked, however, you might be able to lock the system into a constant state of “we’re about to skid! release the brakes!”, preventing braking altogether.

In any case, the function of ABS is to reduce braking power, not increase it. The reason for this is complex and requires basic knowledge of physics, at least with regards to static and kinetic friction. In a nutshell: braking hard is good, but braking too hard is very, very bad. The ABS prevents you from braking “too hard” – by releasing the brakes if you try!

--
Basic physics to follow. (It may help to refer to this diagram. Yes, I had too much time on my hands.)

Recall that I said it involves two kinds of friction: static and kinetic. Static friction is between two points that are not moving relative to each other. Because your tire is turning at the same rate as its movement across the pavement, a point on the outside of your tire is not moving relative to the road while it is in contact with the road. I.e., if you are not skidding, static friction applies. Static friction (while the wheels are in solid contact with the pavement and are not sliding) is much stronger than kinetic friction (which applies the instant the wheels being to slide).

You have a maximum force, Fmax, which is the product of the vehicle’s weight and a coefficient (multiplier) of static friction (which depends on both the surface material of the road and the condition of the tread on the tires). When you apply the brakes (or accelerate, for that matter), a shear (skid) force is applied at the point of contact between the rubber and the road. This force can be up to, but not over Fmax – that is the maximum force that your tires can withstand while still gripping the road’s surface. The force of you braking is met by the equal-and-opposite force between the tires and the road, all the way up to Fmax.

As soon as the shear force between the tires and the road surpasses the Fmax that the tires can withstand, the force of you braking overcomes the ability of the tires to provide an equal-and-opposite force to keep you from skidding. Because there are no longer equal-and-opposite forces, you are skidding and enter what is called kinetic friction. In kinetic friction, your vehicle’s weight is multiplied by a different (and much lower) coefficient of friction (multiplier) – the coefficient of kinetic friction, giving you the force of the kinetic friction. This force is subtracted from the force of your velocity (the force of you braking is fully irrelevant at this point, as your wheels are locked and your brakes are locked), slowing you only ever so slightly.

In other words, it takes you much longer to stop under kinetic friction (wheels locked, skidding) than it does under static friction while braking at just below Fmax. The purpose of the ABS is to prevent you from braking any harder than Fmax... by releasing the brakes if it detects an impending skid.

In fact, however, you can actually stop faster if you do not have an ABS, or if it is disabled, as long as you keep your braking force just under Fmax (i.e. you don’t skid). The ABS has a fairly large safety zone built-in; it will disengage your brakes (causing the pulsating or vibrating feel in the pedal) at lower braking forces than you could actually safely apply, which lowers your braking ability in that situation. Because you are able to tell better than the computer whether or not you are about to skid, you can actually stop better without the ABS t

Re:I DONT WANT FSCKING DRM ON MY CAR!!!!

[clone53421]

I got the directions of the friction and braking arrows mixed up on the upper-left hand diagram. For some reason I was thinking that the brakes were a backward force. It’s actually the car’s momentum as a forward force, and friction as a backward force.

Firmware update?

[Big Nemo '60]

From TFA:

"Another discovery: although industry standards say that onboard systems are supposed to be protected against unauthorized firmware updates, the researchers found that they could change the firmware on some systems without any sort of authentication."

1. some onboard systems are not compliant to standards, in what they are vulnerable to firmware tampering.

2. tampering with the firmware could be a more complex but very insidious form of sabotage (and it would not require to leave something connected to the ODBII port).

Now excuse me, I am going to find where the ODBII port on my car is located. Just to be on the safe side. ;-)

The only electronic thing in my car...

[Gordonjcp]

... is the clock. I already know that doesn't work.

I did have a problem with the throttle sticking, but that was because the little spring that pulls it shut had stretched and fallen off.

Dear researchers

[BitZtream]

Please to be shutting the fuck up and panicing people.

I WANT my car to allow me to do those things. Thats why I have an ODB-II dongle hooked up between my car and the PC thats in it ... so I can control my cars features the way I want.

Being that the ODB port is generally directly under the drivers side dash, its rather hard for someone to plug into it without it being noticed. If they've plugged into it, they've got physical access to your car, which means they can do a lot more damage than fucking up your heater and blasting you with hot air.

You said you didn't want to spread fear and panic, and you're lying, thats exactly your goal, and to use that to get attention for yourself.

This isn't anything new, its been this way for at least 10 years if not longer (I haven't tried anything on older models) maybe all the way back into the ODB-I days and probably well before that when some cars had interfaces of their own standard.

Re:Dear researchers

[Anonymous Coward]

You leave a PC connected to the ODB-II port? Do a lot of people do that? This gives me an idea for my next computer virus.

Re:Dear researchers

[chrb]

Being that the ODB port is generally directly under the drivers side dash, its rather hard for someone to plug into it without it being noticed.

Yeah, but the network that port is attached to is physically wired throughout the car. Hypothetically you might be able to get access to it via sensors on the gas tank, exhaust, sunroof, doors etc.

Re:Dear researchers

[rickb928]

OBDI was superceded in 1995-96 by OBDII. I know, I have an OBDI vehicle, and pulling codes requires hooking up a test light and counting flashes - lots of fun. Take that over to Pep Boys and they roll their eyes and explain they don't have an OBDI 'scanner'.

Yes, they are available, but fairly rare. I use the light just fine.

And OBDI was more proprietary, so codes vary among manufacturers.

All of this reinforces my desire for a nice CRX, an SI or HF, probably, VTEC not essential, just bone stock with a full interior. Even my '95 presents challenges, and my wife's '98 Saab is way more trouble than it's worth sometimes.

ps- How hard could it be to whip up an OBD dongle to slip in and really mess with someone's car? An Arduino would be one way to do it, just some wiring to tuck under the dash. Just be sure to wipe your prints off of it...

Oh, and OBD codes are not the be-all end-all of diagnostics. If you get an O2 sensor code, 'too lean' for example, this can be caused by a clogged fuel filter... Yes, it can, at highway speed. Even with codes, you need to be a logical diagnostician, and some of us were born without the logic gene.

Re:Dear researchers

[jafac]

I suppose the thing to do would be to add a physical locking mechanism to cover the port; with THE CAR'S key. So the owner can get in there.

I don't know, a real sophisticated gremlin could tap into the cable behind the connector, go to a cell-connected, ssd-equipped netbook, (with a 12v adapter off the car battery FTW), stuff it all up under the dashboard, and do all kinds of dastardly things over a long period of time.

Re:Dear researchers

[huge colin]

Mm... no. OBD stands for "On-Board Diagnostics", i.e. a standard by which diagnostic information can be read. It is not and should not be used as a mechanism by which the functioning of systems within the car can be changed.

Alarmist talk will get you locked out

[Dr_Marvin_Monroe]

Lets keep the alarmist talk down to a minimum here. As a few people have pointed out, the auto industry response will simply be to DRM you out of your own car. I'd expect that the government would want a part of the action, so expect a DMCA for autos too... They'll push you right into the loving arms of the factory service shops who will now be the only "authorized" repair option.

Re:Alarmist talk will get you locked out

[BitZtream]

ODB-II (And I to a lesser extent before it was superceded) exists for that exact reason.

Every manufacture used to do their own random proprietary crap. Governments who wanted to access the computer for emmisions controls started requiring them to standardize so they didn't have to buy new crap and codes every time the manfucature decided to change things just to make it so you have to buy stuff from them.

The government basically stepped in and stopped the DRM up front, which is why these ports are actually useful in the first place.

Re:Alarmist talk will get you locked out

[Tokolosh]

http://www.eff.org/deeplinks/2009/05/right-repair-law-pro

Sensationalism at it's finest.

[Lumpy]

I've been "HACKING" car computers for a decade now. and a lot of other people have as well. Most hot-rodders from import tuners to vette performance guys have been hacking ECM's. Many of the honda hackers even go as far as opening up the ECM and desoldering chips to hack them. Changing the ignition timing table, fuel tables, Disable the Rev limiter, Disable Passkey for engine swaps (I do this with the GM 3800sc and it's ecm from the Buicks) add features, change a Standard ECM program to a program that understand boost for a turbo install... etc.....

Heck a friend of mine is hacking the computer that controls the new power steering system in cars so we can retrofit power steering to vehicles that dont have it.

I guess us car ECM hackers are the new "EVIL DOERS"

Re:Sensationalism at it's finest.

[Anonymous Coward]

Ditto, I was on the DIY-EFI & GMECM mailing lists over 10 years ago as well... Those were the days. ;)

Re:Sensationalism at it's finest.

[geekoid]

That was a long way to go to attempt to look like the cool kids at the auto show.

Re:Sensationalism at it's finest.

[Lumpy]

It's still doable. Most of the information is available on websites OUTSIDE the USA to protect the authors from being sent to jail for 60 years. I've got the info on decoding the GM canbus communications so I can actually change the shift points on the Transmission in the new 6 speed automatics. Tweaking the performance mode and being able to add an economy mode has made a difference.

All that has happened is that all the people that are the best and brightest in automotive are fleeing the country, or hiding behind pseudonym and publishing to a website outside the usa.

One thing super impressive is the guys that are getting the 7730 ECM from the 90's to do things that the current ones are not. That hacking is legal because that ECM was not crippled with raging retardation and stupidity on the car makers part.

Automotive computer hacking...

[pongo000]

...has been around since OBD-1 days, as far back as 1984. OBD-2 programming systems are available for anything from 1994 through 2010. There are even scanners that allow you to enter the PIDs of your choice (obtained from monitoring the data line while performing operations with a scantool).

Since newer vehicles control nearly everything via CANbus, it's no surprise that someone has taken the time to monitor the bus and inject various commands. This sort of hacking has been around for over 20 years (despite auto manufacturers' attempts to protect their hardware with security keys and seeds). I don't see them "solving" this "problem" anytime soon...unless they come up with a way to make a "secure" bus (perhaps using fiber optics).

Re:Automotive computer hacking...

[couchslug]

"unless they come up with a way to make a "secure" bus (perhaps using fiber optics)."

Don't give them any ideas for more expensive, delicate parts. :)

Here come the spy stories

[valadaar]

How long until we see a major thriller use this as more technobable? And of course, they will use wireless technology by hacking into the cellphone the victim has foolishly left plugged in, allowing access to the car's operating system via the 12-volt power supply. The horror!

Exactly: I *WANT* to hack my car!

[mrchaotica]

These sorts of security "flaws" also allow people to change the fuel injection mappings to increase horsepower, or enable extra electrical features not included from the factory, or do any number of other neat things. I want my car's computer to be more accessible, not less!

Re:Exactly: I *WANT* to hack my car!

[tepples]

These sorts of security "flaws" also allow people to change the fuel injection mappings to increase horsepower

They also allow people to modify a car such that it puts out a criminal amount of emissions.

Benefits of hacking

[m0s3m8n]

As a VW owner, I can attest to the benefits of "hacking". How about adding 50 HP (and lots of torque) with a software upgrade.

shift in mentality

[Max_W]

Now imagine that a car is shipped with a virus in the firmware. And at the same moment of time millions of cars on highways suddenly become unmanageable.

This article reminds again that computers more and more run our civilization. We are to begin to regard an unlawful interference into computer systems as a very serious life-threatening crime.

A certain shift in mentality is required. We shall not be amused by "black hat", "white hat", or other "hacking" subculture phenomena, but view malicious code writers as what they are, - vicious, or even murderous criminals.

Future police officers and judges should be trained at schools to understand ideas and intents in the programming code.

I can imagine a judge, specializing, say, in C++ domain, or PHP&MySQL domain, Java, etc. To lock up a criminal for good a police officer and judge are at least to understand the code which this criminal wrote. Otherwise they cannot be sure.

And they -soak you- for the hardware, too

[david.emery]

ABS warning light came on in my 2000 Nissan Frontier. They traced the fault to the ABS control module, and the replacement part is $1000!!! That's an appalling amount of money for a couple bucks worth of silicon!

I'm coming to the conclusion that there needs to be industrial or even government standards for computer security, and there ought to be an investigation on the price of (safety related) repair parts.

Re:And they -soak you- for the hardware, too

[geekoid]

You are not paying for the silicon.
You are paying for the development and limited manufacturing.
and the fact you will die without it~

Re:And they -soak you- for the hardware, too

[couchslug]

"and there ought to be an investigation on the price of (safety related) repair parts."

Good luck with that. Know that the only economic way to repair older vehicles is to have enough salvage parts to play "swaptronics". (BTDT at a used car lot.) Vehicles are often "totaled" after a crash that fires the airbags due to cost, but these can be swiftly replaced along with sensors from a donor vehicle.

The next, obvious stage in vendor lock is to lock "safety" parts to a particular chassis and require reprogramming to use them. Easy to do.

Re:And they -soak you- for the hardware, too

[david.emery]

Actually, the total estimate from the repair shop was $1600, $1k for the part. The labor included some sort of reprogramming/adaptation.

And with respect to the R&D costs, why should those be born by the repair part? Isn't that factored into the costs of the vehicle? You know that's the exact same argument used by government contractors for the allocation of R&D and overhead costs over repair parts that yields $1000 hammers and $100 screws.

Re:And they -soak you- for the hardware, too

[PipsqueakOnAP133]

Because the scale of making car parts is dwarfed by the scale of making things that people buy more often in life like microwaves, cell phones, an GPUs?

If companies didn't do good R&D, made crap, and then sold it to you for manufacturing and shipping cost, they'd obviously go out of business.
I mean, look at GM; they're doing poorly even without selling parts at cost.

I guess "researchers" have not met any modders?

[netsavior]

As a car modder, who has been doing this kind of stuff (not malicious) since the early 1990s, wow welcome to the future guys.

Just an example: When my throttle position is above 90% depressed, my A/C compressor disengages(or rather the A/C Clutch engages), giving me that little bit of horsepower and theoretically saving my compressor from 7500 RPM (engine speed, not compressor speed) redline. I did this in an afternoon using only software.

The ECU has a lot of control over the car, especially in drive by wire cars... My car happens to have a cable accelerator, and I vastly prefer that because of throttle response time (a physical link is better most of the time than a software one, assuming both are properly maintained).

If they were really trying to be malicious without being deadly, you could change the air/fuel ratio to be really lean and burn up the valve train the first time they hit the gas pedal, there is no physical override for that, not like brake pedals (which if you turn it off it merely removes the power assist and only prevents you from stopping the car if you aren't strong enough to push the pedal down.)

Re:I guess "researchers" have not met any modders?

[Anonymous Coward]

Just an example: When my throttle position is above 90% depressed, my A/C compressor disengages(or rather the A/C Clutch engages), giving me that little bit of horsepower and theoretically saving my compressor from 7500 RPM (engine speed, not compressor speed) redline. I did this in an afternoon using only software.

Clever. BMW has been doing the A/C compressor shutoff trick via the TPS for years. My old '84 3 series did it, and so does my late '90s M3.

Re:I guess "researchers" have not met any modders?

[toxonix]

Every new car I've driven in the last two years has a fully electronic throttle. I can't stand the things. If I blip the throttle to downshift, nothing happens. The computer ignores little throttle blips. You have to hold the throttle down much longer to get it to rev, and then the non-linear variable throttle curves make it difficult to hit the right engine speed. This is all dumbed down for your average human potato, which is no fun for everyone else. An F1 car is completely electronic, yet the throttle response is accurate and instantaneous. The mechanics can play songs on the engines by running through a sequence of throttle positions. Do you still have to send the ECU in to be de-soldered and re-soldered with a new EPROM? I believe there are aftermarket ECUS for BMW,Audi, Mercedes which provide almost complete control of the electronics systems for tuning. They have remotes for setting different levels of tune so that your valet driver can't get the thing into race mode or rev the engine beyond 2500 rpm etc. As for the electronic control of brakes, just switching off the power assist is not really the danger. The computer can pulse the ABS solenoids, making it impossible to brake at all. When this happens the brake pedal is useless even standing on it with both feet. I had an Audi which developed a problem like this due to bad wheel speed sensors. The sensors sometimes told the computer that the car was sliding when it slowed to around 10mph under light braking. The solenoids start pulsing and you better have plenty of stopping room, because it basically feels like you suddenly hit an ice patch. I don't recommend that particular vehicle to anyone. Configurable tuning chips are the way to go, but it would be nice if I could just hook up a PC and configure the factory ECU.

Re:I guess "researchers" have not met any modders?

[adeft]

not only would it be very sneaky to maliciously mod the car's air/fuel, but upon a shop's inspection of the ECU, it would probably be determined that the car was "tuned" therefore voiding the warranty.

Re:I guess "researchers" have not met any modders?

[netsavior]

it would be nice if I could just hook up a PC and configure the factory ECU.

Man, subarus have been so unbelievably hacked it is awesome.

Cobb Tuning has a product that lets you flash your factory ECU with whatever you want. I use their (possibly) defunct product "StreetTuner" which is basically the same thing except in real-time... All through the ODBII port

How can I ...

[PPH]

... hack the dashboard display to tell all the LLBs to get the f**k out of the left lane?

Re:How can I ...

[Theoboley]

I Second this comment. Then when/if they do move, have it change to a middle finger.

Re:How can I ...

[geekoid]

If you are behind an LLB, and someone is behind you, do you move out of the left lane?

Re:How can I ...

[PPH]

If you are behind an LLB, and someone is behind you, do you move out of the left lane?

Yes. Because I've got to pass them on the right.

And then, If I suspect that the person behind me wants to pass me, I pull back in front of the LLB, so people can pass me on the right. Eventually I get back in the RH lane once the sloth is out of range and proper lane discipline needs to be restored. And that pisses of the LLBs who are playing cop wannabees to no end. :-)

True story about crashing an automotive computer

[terrahertz]

I once had the occasion to rent a car and drive it around on a fine Sunday afternoon. The afternoon was so fine, so inspiring to my pedal-mashing sensibilities, that on a whim I decided to take the car as close to airborne as I could over a rather steep hill.

I ended up catching a little too much air, and bottomed-out the car pretty hard. Upon landing with a loud crunchy thud, all the dash lights went out, the power steering died, and I had to wrestle the car off the road in quite a hurry.

Sitting there, miles from home, on the day of the week when it would be hardest to get a tow and make other transportation arrangements, and worried about what I had done to the car (I was sure it was really messed up based on the noise and the behavior), I was a bit panicked for a second there. After a moment's reflection, I decided "what the hell" and turned the key in the ignition to see what would or wouldn't happen.

And the damn thing started right up, with nary a complaint or anomaly. I deduced that the shock of bottoming-out must have crashed the computer and killed all the electronics, and the good old "reboot and see what happens" actually worked!

No excuse for vendor lock!

[couchslug]

Access to ALL functions of automotive computer systems facilitates support when factory support ends and aftermarket support takes over.

This should have been approached from a MECHANICS POV, not that of a frightened rabbit. Vehicle computer systems should be easy to access, instead of vendor-locked so others can't see (and potentially correct or improve) factory settings.

Pre-computer vehicles were easy to troubleshoot and maintain precisely because systems were simple to access/repair/modify. Newer systems have greater capability, but restricting access to dealers who won't be supporting the vehicle after it's about ten years old (and charge a shitload of money before that, because they can) is not helpful to the consumer.

Obligatory personal computer analogy:

How about all PCs be sold potted in fiber-reinforced epoxy so "saboteurs" can't monkey with them?

Who are these guys?

[Grand Facade]

I want to tune my Neon!

There`s a way around it...

[XB-70]

Any moron that designs software that has control between the brake pedal and the brake caliper should be taken out and shot. These are not fly-by-wire F22-Raptors we`re talking about - these are road vehicles.

They will be purchased by idiots who want to save money by not paying the goons at the dealer to maintain the vehicle.

Any software design that does not factor in human nature is bound to cause terrible tragedy. It`s a wonder that it hasn`t happened sooner.

Isn't the fix really simple?

[SmallFurryCreature]

Put the controller and its access in the dashboard and seal it. If you want to access it, you got to break the seal. If the seal is broken, then you know somebody accessed it. Make the seals identifiable and unique and you can track who did it and at least see if someone messed with it because the seal has changed.

This works good enough for the utility companies who use this method to make their meters tamper proof. No DRM needed, you can still access the hardware if you need to, just that everybody who needs to know, knows it.

Adobe

[Anonymous Coward]

I demand to be able to run flash, its my creative right to install whatever software I want on a computer I OWN...!!!

Mcafee 9.0

[Anonymous Coward]

with obd2 support lol. Next spyware will turn our dash into a billboard!

hmmm

[nomadic]

First line of security: not doing anything that would get someone so murderously angry at you that they'd CUT YOUR BRAKES.

You missed another point - aftermarket installers

[name_already_taken]

OBD II is all well and good for basic emissions/driveability/MIL diagnostics, but adding security to the other functions, such as the door locks, windows, etc. could basically kill the aftermarket alarm/remote start business.

On many (if not most) cars these days, many of the basic functions such as door locks are controlled via a CAN bus (a 2-wire twisted pair network) and more and more functions are migrating to network control rather than having dedicated wiring. In my car, everything other than the lights and the radio is run over CAN (even the seat adjustments and the rear window defogger).

Take, for example, installing an aftermarket stereo: Many new cars don't have a wire that supplies 12V when you turn the key on to turn on the radio, the radio is always powered and listens to the CAN bus for the command from the car's BCM (body control module) to turn itself on. On these cars, a separate aftermarket module has to be installed to turn the radio on (or the installer has to dig around in the car to find something else that only turns on with the key, like a power outlet). There are also aftermarket modules that can translate the CAN bus commands from the car's factory steering wheel controls to control an aftermarket stereo.

Adding a layer of security (presumably encryption or authentication) could cripple these abilities with aftermarket equipment.

Don't believe me, well take the example of remote start on my current car a 1999 (yes, 12 model years old now) Mercedes Benz. I have installed 3 remote start systems on various cars (a Subaru, a Honda, and a Mazda) which were what I'd call conventionally-wired cars, having accessible wires to turn the ignition and engine computer on and start the car. Easy. Cost, under $100 for all the parts including extra relays to turn on accessories and such.

On my '99 M-B, the engine computer will not allow the engine to run unless it can maintain a constant 2-way conversation over a separate CAN bus between itself and the EIS. What's the EIS? It's the Electronic Ignition Switch. Here's where things get complicated. M-B cars don't use conventional keys any more, the use a "SmartKey", which is an electronic key fob thing that inserts like a key, but has an infrared emitter-receiver in the end. The EIS supplies power to the SmartKey via an inductive coil around the key opening. The EIS and the SmartKey then engage via infrared in a continuous encrypted conversation which authorized the EIS to tell the engine computer to let the engine run. Because you need to have the SmartKey in place, it has been impossible to install a remote start system.

Recently, a remote start system became available for my car (sold new 12 model years ago, remember), which will simulate the EIS' conversation with the SmartKey and allow the factory remote's Panic alarm button to be repurposed to start the car (the SmartKey is also the remote, but don't worry about that, it's actually two devices in one package). Cost: $1000. That's over ten times the cost of a remote start system for a regular car. And it took 12 years to develop.

All because of a single encrypted function. Admittedly, a really well designed one that makes the car impossible to hotwire, but you can see what problems might face the aftermarket if things like door lock controls became encrypted.

All in all, this research exercise is just stupid. Of course you can make a complicated system do silly things if you have physical access to it. I don't see the point of adding encryption to it when the aftermarket will have to figure out how to bypass it eventually anyway.

Off topic, but in case anyone's interested, you can have up to 24 SmartKeys issued for an M-B vehicle, but I think only eight can be active at one time. The service information talks about having three ranks of eight keys. Once you need to replace the key for the 24th time, you need to replace the EIS, the engine computer and a couple of other items. SmartKeys can only be ordered at a dealer and you h

'The Net' wasn't so far fetched...

[realsilly]

Oh noes, does this mean that we all have to start believing that the movie 'The Net' was credible?

Nah!!!!! ;)

Want your cake and eat it too!

[UnifiedTechs]

Didn't we just blast Toyota for having a completely closed system, that only 1 laptop in the US could access.... but now we blast everyone else for having an open system because it can be hacked?

Given physical access to any system it can be hacked.

Re:Want your cake and eat it too!

[BitZtream]

Toyota's system is just like every other car on the planet in this respect. Its not closed from external access, its closed in that you don't get to see the source to the controllers ... like every other car in existence.

Toyota is the same as everyone else in this respect.

Copy of the paper

[chrb]

The paper

That link really should have been in the summary....

Access vs Safety

[Type44Q]

The problem isn't accessibility; as complicated as cars are getting, we simply need access to our cars' systems. The problem here is that the controls for mission-critical functionality (such as brakes and locks) don't have fail-safe mechanical backups that we can access manually!

Car Hacking

[Anonymous Coward]

VW/Audi is already doing this to an extent, encrypting access to settings such as Lambda Values/ fuel air mixtures etc...to change these on the latest (2.0TSI) vdubs requires removing the ECU - not a task to be taken lightly...however on earlier models (VW GTI MKV and back, companies like APR were doing this directly through the OBDII port. Currently I have RO access to engine functions for graphing and diagnostics purposes and I can change the behaviour of most of my "convenience" electronics (DRL behaviour, Fog, Adaptable Xenons, Interior Lighting, Alarms, Service Interval warnings etc.)
I left the serious ECU tuning to APR as does VW for their special one offs and show cars...

DRM?

[chrb]

The researcher's basic issue is that the network protocol for digital components in automobiles has few security features. Imagine a computer network in some safety critical environment - say, a manufacturing facility where servers provide monitoring and control functions. These servers are linked by a network switch that allows a single compromised device to sniff and spoof all traffic. Furthermore, imagine that there is no ssh, no login password etc. A single compromised server could be used to effectively do anything that is possible from any other server. Now, this is undoubtedly the way that many server rooms operate, but more security conscious sites will install firewalls between servers, filter command packets, have servers use encryption and authentication, so that serverA knows that it really is taking commands from serverB. That is essentially what the researchers are arguing - that as more and more microcontrollers are connected to the onboard diagnostics network, then it would be useful for that network to include some security features. How long will it be before there are wireless interfaces to the network? Do OnStar and similar systems just provide a link to the onboard diagnostic network? If so, then that could be exploited remotely. Is the OnStar protocol limited to cutting the engine? Or would it also allow you to accelerate and disable the brakes?

Another reason that the comparison with DRM may be invalid - your computer can't be used to kill you, no matter how hacked its software is. People are naturally more concerned when a hack of the device could result in casualties, regardless of whether the hack requires physical access. Would you trust any old PC technician to service your PC if the results could kill you?

Whether you would call a complete network of devices that encrypt and authenticate communications any two peers a "DRM" system is debatable. There is certainly a similarity to, say, printer manufacturers locking out foreign ink systems, but in this case the argument could certainly be made that a Toyota braking system should never be blindly accepting commands from anything other than a Toyota brake pedal, etc. Should the engine blindly accept acceleration commands from the gas tank sensors? Surely it makes sense to lock it down and not allow this?

Hacking parts

[intravino]

Check out this website for obd2 connectors or obd2 cables to help you hack your car: http://www.carplugs.com/

Erm....

[Anonymous Coward]

Say again ?

Re:Erm....

[JWSmythe]

    That's a read-only interface. The only write capability it has is to send a request to clear existing trouble codes.

    From what I gathered from the article, they were using a similar device to read engine information, but they were directly injecting data to the bus.

MOD PARENT DOWN: IGNORANT

[Anonymous Coward]

Hey, reject. Yes, I'm talking to you. If you can't get your ignorant, pea-sized, fluff-ball of a brain to conceive of any potential for abuse for a potentially lethal (not just for the driver/passengers of the car, but anyone else in public) hijack and disablement of critical systems that leaves no immediately visible evidence (i.e. maybe it's a PDA stuffed in a spot beside the computer under the hood....and yes, someone can open your hood without pulling the lever inside the cabin). If someone cuts a brake line, as you so ingeniously fathomed, A) you'll likely see the pool of fluid, AND B) YOU'LL HAVE NO BRAKES IMMEDIATELY. Not rocket science to figure out.

This hack of the on-board computer can cause a selective/intermittent failure with NO EVIDENCE of tampering at all (if the hacking device can be recovered before investigators arrive).

God. Think about what you are going to say before you say it.

Oblig. car analogy

[adamofgreyskull]

OK, since this is /., here's the obligatory car analogy. It's like if someone had complete physical access to your car, they could do anything to it. They could cut the brake line. They could install a small charge attached discreetly to the brake line that could be triggered when desired. They could make a hole in the brake line, insert a plug attached to a piece of wire, the other end of which was attached to the ground beneath the car, with enough wire for the car to make it outside. Or the other end of the wire could be attached to the axle/wheel, so it gradually wrapped round and round it. They could make a slow leak in the line, but that would be very unpredictable and they might not make it out of the lot. I'm sure a professional mechanic/hitman/spy could come up with more ideas, but as you can see, getting physical access to a car to tamper with the brakes is a lot like getting physical access to a car to tamper with the brakes, you can pretty much do anything you like.

OBDII via wireless? Here ya go!

[King_TJ]

http://www.carpartslights.com/elm327-bluetooth-obdii-obd2-scanner-vagcom-can-elm-327-p-28.html

(Now you know what to look for at least, when checking to see what the crazy ex-g/f might have put in there....)

Filing patent for ODBII Port Locking Cover Now...

[Anonymous Coward]

Step 1. Collect underpants

Step 2. Play up a 1 in a million risk that the public does not understand. "You could die in a slow painful death in terrible crash and the terrorists will win! Think of the children We can save you for only 6 easy payments of $19.95"

Step 3. Profit!!

odometer hack?

[smellsofbikes]

One interesting byproduct of this, that would be financially and legally quite significant, would be if they have found how to change the odometer. Resetting the odometer to a lower number would have a large, direct effect on the resale value of the car, so I expect that if this can be done, automated kits to do so will start showing up in the back pages of sleazy magazines. This is illegal, but so are eavesdropping and cable decoder kits (under most circumstances) that are sold in those same magazines.

My ex-girlfriend's car kept losing the screws that held the speedometer movement in the instrument panel, and it was impossible to get in there and screw them back in because the whole panel was sealed to prevent people getting to the mechanical odometer. These days, with electronic odometers that display on LCD's, they've moved the security into software so they don't have to epoxy the whole system into a solid mass, which is nice.

Where I come from, PCM is pulse-code modulation

[tepples]

You'd have to reflash the PCM (ECU is an OBD-I term; this kind of stuff is only possible with OBD-II, which actually mandates the term "PCM" -- if you want to be accurate, stop calling it an ECU in this context) entirely.

People call it an ECU because PCM is taken. Can you cite a reliable source that OBD-II mandates "PCM"?

Nobody will be tampering with my DLC

Which is exactly how the video game publishers like it because DLC is taken too.

Re:Where I come from, PCM is pulse-code modulation

[drinkypoo]

People call it an ECU because PCM is taken. Can you cite a reliable source that OBD-II mandates "PCM"?

The spec costs money, but you're welcome to go buy it. I might be able to find you a copy of my transcript though, demonstrating that I received an "A" in automotive electronics at Yuba College, a six-unit course that prepares the student for ASE examination. I didn't get the cert though, because at the time I couldn't afford to take the exam. And in any case, I don't really want to do that stuff for a living, I was there for personal enrichment.

Which is exactly how the video game publishers like it because DLC is taken too.

Acronym overloading is, unfortunately, a fact of life. Now pass me that stack of European currency units.

Hot air!

[OFnow]

"blasting hot air or music on the radio" would be really great, I'm looking forward to a video of hot air coming out of the radio.

re: ECM hacking

[King_TJ]

Actually, a whole bunch of us REALLY wish one of you experts at ECM hacking would figure out the Delphi branded ECU found in the Hyundai Genesis Coupe 3.8 V6!

It's a great little sports car at a reasonable price-point, but so far, it seems like its engine is held back from its full potential because the ECU can't be directly reprogrammed.
(Apparently, some folks in Korea have already cracked its ECU and done some custom tuning so they could add things like superchargers or turbos ... but here in the USA, we can't seem to get our hands on any of that info. I suspect part of it is purposeful on their part. I think the Korean tuning community rather enjoys keeping a lead over people in the USA for as long as possible, so they can keep taunting us with YouTube videos of their accomplishments, etc.)

A company called Road Race Motorsports released a couple different "piggyback" boxes that claimed to add as much as 20HP or so by plugging-in between the ECU connector and one of the sensors on the car -- but everyone on the car forums testing them out has seen negligible results, and sometimes dyno tests show power LOSSES with these things. As best as we can determine, the boxes are functioning like they're supposed to, but modifying the data coming from just one sensor (such as the mass airflow sensor) isn't enough to really trick the ECU into advancing timing or changing air/fuel ratios. Apparently, it sees unchanged readings from other sensors on the car and assumes the input is flawed, and starts disregarding it or acting on it in unexpected ways.

re-use is greener than buying a new car

[Anonymous Coward]

Keeping an old "clunker" in good running condition for continued use is greener than junking it, recycling it, and manufacturing a new hybrid.

Benefit: no buggy embedded systems to ruin your day or potentially kill you. And they are easier to work on.

The point is not to scare drivers?

[Hurricane78]

The point of the research isn't to scare a nation of drivers, already made nervous by stories of software glitches, faulty brakes, and massive automotive recalls.

No? Really?

and discovered new ways to hack into them, sometimes with frightening results.

Riiight...

I think the US has a real problem with the scaremongering. You get FUD thrown around left and right. Everything is “oh teh horrorz!!!1one”. “Terrorists”, “hackers”, “catastrophes”, “glitches”, “conspiracies”, “threats” by the dozen a day... it doesn’t end.

I think the only real threat is forgotten on the way: People making you do what they want, by scaremongering you in the right way.

We've done it on race cars for years

[slacklinejoe]

A lot of us car nuts have been hacking our car computers for years. There's systems that go light years beyond the factory systems. 10 years ago, I was able to use my Palm Pilot II to modify my fuel trims while driving, monitor horsepower and adjust an electronically controlled boost controller for my turbo. That was all on a 1990 Talon AWD so it didn't even had ODBII yet. My new model actually fully replaced the EEPROM chips in the ECU and has bluetooth capabilities to be controlled from my smartphone, controls the doorlocks, radio, moonroof etc. In theory, it would be a trival bluetooth hack to not only cause the engine to stop but to detonate the engine (destroy - not actually cause an explosion) by pulling the fuel trims too lean. The bluetooth module was a snap on vampire chip with a tiny lead to a receiver. The whole system looked 100% factory and was tiny. It would be a trival system to integrate a remote kill and unless they were specifically looking for a technology related problem, investigators would likely never realize that it had been installed.

Do you know how fast you were going?

[Anonymous Coward]

Why, no, occifer, but I think my kid was in here hacking the speedometer....

Re: ECM hacking

[Anonymous Coward]

Depending on how radical you want to get, often the fix is to adapt a known / programmable computer to your car. There are many companies who sell kits to do this. "MegaSquirt" was one of the first I had heard of; now several sell for example a GM PCM with harness to fit your car, or sometimes a connector adapter if enough sensor signals are similar. I forget the company names, but a websearch will provide them. Not a solution but hopefully a different angle and fuel for thought...

Coming Soon

[ThatsNotPudding]

Norton Security for OBDC II!!

Um, how about firing the airbags?

[jafac]

My Jetta's VCDS software and port (as well as the printed Bentley shop manual) come with big fat user warnings about taking precautions against accidentally setting off the airbags. In fact, with multi-stage systems, if you're sitting in the front-seat, not buckled, maybe with a laptop on your lap, maybe scooted forward a tad, not resting back, you could probably end up with some serious ow-age.

(I know this, because my controller module has failed; and I'm debating whether to just remove it and live without airbags, or if I should have it re-flashed and deal with the risk of accidental discharge in the reinstallation process.)

Turning off the breaks?

[kalirion]

But.... I have it on very good authority from many slashdot posters that breaks are hydrolic and no electronic issue could possibly affect them. Were they [gasp] WRONG?????

Re:Turning off the breaks?

[Anonymous Coward]

Why can't anyone on slashdot spell brakes?

Shenanigans.

[Burning1]

I'm going to call shenanigans on this post. There has never been a vehicle where you could remove the ECU and expect it to run.

A little history... The introduction of computers to vehicles has happened in many stages.

The first stage was the introduction of electronic ignition computers in the late 70s. These systems replaced the vacuum ignition advance on older cars. The signal from the distributor literally ran through the ignition computer. Removing the computer means that there is no connection between engine timing and plug coil. With the ignition computer removed, you have no spark, and the engine cannot start.

The next major step forward was the introduction of electronic fuel injection. This computer was responsible for controlling the fuel injectors. No ECU, means no fuel in the cylinders, which means no running vehicle. Power for the injectors literally comes via the ECU. Without the ECU, the injectors are literally unplugged.

Later vehicles used more computers in more components of the vehicle, to the point that a computer controls the brakes on my motorcycle.

But, there was no time where you could remove an ECU and expect the vehicle to still run.*

* Yes, it is possible to disconnect a lot of the sensors on an electronically fuel injected vehicle, and it will still run. But the ECU must still be in place.

Seriously Slashdot... You call yourself geeks, and you fall for this kind of stuff? Shame.

Re:Shenanigans.

[Anonymous Coward]

"Seriously Slashdot... You call yourself geeks, and you fall for this kind of stuff? Shame."

Shame on you

You are speculating and drawing conclusions from self-proclaimed points you don't seem to know much about. Take an 1980ish GM almost anything with a V8. They are equiped with an ECU controlling the carb, spark timing, and torque converter lock-up. I know the carb and trans work without the ECU, I've seen it. The large cap HEI distributor was pretty simple and based on its 1970's predecessor.which needed no ECU. My guess (since I haven't actually seen this in action) is that the pickup coil, module, and coil function independently and the car would run and drive (like shit) which is what the grandparent claims.

Re:Shenanigans.

[Anonymous Coward]

My 1986 mazda b2000 pickup had an ECU. All it did was control the emissions control devices on the feedback-style carb. You could (and I have) removed it and still drive the truck. The ignition was the old school distributor style, and it was carburated. The carb had all sorts of feedback devices and electrical connections for emissions control, but remove the control for that stuff and you still had a basic carb that the truck could run off of. So it depends on HOW you define ECU.

Now addressing some other points - changing how the speedo reads is useful when say changing tire sizes or your wheels. You could do it with old speedos by changing the gear at the transmission (speedo gear). YOu can do it electronically now.

Writing to the computer is useful if you want to tune the car for maximum performance or economy. Ive done both.

In most cars you cant directly access the mileage - in a lot of vehicles thats on an entirely different computer (in GM its the BCM, which you cant change). I agree though, any designer that makes items like that changeable by software isnt doing anyone a favor. Although its really easy to change the mileage in that old-style clicker (interlocked wheels) odometer. I did it when I changed my cluster in the above mentioned truck to match the odometer on the old gauge cluster.

Re:Shenanigans.

[Burning1]

Most of the old electronic ignition engines still used a distributor, but were reliant on the ignition computer for timing. Really, I can't imagine anyway to have electronic timing advance without making the engine dependent on the timing computer.

Re:Shenanigans.

[Burning1]

Fair enough, but I'd argue that the computer you're describing isn't an ECU any more than an ignition computer could be described as an ECU.

Interesting that they have a separate computer for the odometer... Most of my maintenance these days is on motorcycles, where there is generally just one computer and the instrument cluster. It doesn't leave a lot of places to hide the mileage counter.

Re:Shenanigans.

[Anonymous Coward]

Hmm... I have a 1984 Toyota 4-runner which has a carb, not efi. It is a California model that has a computer for emissions control. I can remove that device and the truck will still run well, at least at idle. Timing is set with a timing light and turn of the distributor, so it doesn't control timing either.

I agree that most ECUs cannot be removed, but I must disagree with "There has never been a vehicle where you could remove the ECU and expect it to run."

Re:Shenanigans.

[Burning1]

Again, I'd point out that it isn't really a 'Engine Control Unit' unless it actually controls the engine.

Re:Shenanigans.

[Burning1]

Although I'll grant that it isn't really shenanigans if the OP confused an 'Electronic Control Unit' with an 'Engine Control Unit.'

What kind of car were they using?

[MoxFulder]

Frankly, I'd *like* a hackable car... something that I can tinker with and mod and adjust.

Can anyone tell based on the photos in the article what model it is? Looks like a Japanese sedan of some kind... not sure exactly what. Does anyone recognize the dashboard display?

Re:What kind of car were they using?

[Anonymous Coward]

I'm pretty sure it's a GM vehicle

Re:What kind of car were they using?

[MoxFulder]

Hmmm... any more details on this?

Re:What kind of car were they using?

[Anonymous Coward]

2006+ Chevy Impala. You can clearly see the Impala symbol on the dash, the tiny GM nameplate near the fender, and a Google Image search will confirm the exterior/interior. That footnote on page 4 about not wanting to reveal the make/model is senseless, given the unnecessary photos they included.

Re:What kind of car were they using?

[MoxFulder]

Thank you! Good to know :)

Maybe the footnote is just some cover-your-ass legal BS, with the photos tacitly intended to identify the vehicle?

Some Good News

[Anonymous Coward]

At least the current "Black Boxes" require physical connections to interface with the system. I've heard that several government agencies (EPA, Police) have been trying to get a few less than pleasant capabilities put in the standards for the next version of these devices (OBD-III). The most pertinent is wireless access, the primary stated purpose of which is for random emissions testing. Emissions enforcement drives through a parking lot querying all the cars if they have had any error codes in regards to emissions and all the cars who say "Yes" get tickets sent to their owners. I've also heard one of the more invasive "Road Use Tax" implementations would have the car not only store its mileage but GPS records so the owner could be taxed not only by distance but which roads they were on, and of course knowing where your car had been every minute of every day would be a "Happy" side effect. The icing on the cake is I believe at least one police department has requested a kill switch be put into the standard where they can use an electronic "gun" fired at a vehicle to kill its engine, hopefully it has NO chance of actually being implemented but that they even suggested it is somewhat disturbing.

Call me old fashioned...

[Anonymous Coward]

But this is one of the many reasons everything I drive has no computers. I'll stick to simple proven technology that just plain works.

Re:You missed another point - aftermarket installe

[Gazoogleheimer]

A remarkable number of car manufacturers use pretty nasty obfuscation in their OBDII/CAN systems outside of the basic emissions checks. I have a Volvo from 1998, and even though you couldn't cut my brakes or shift my transmission electronically, I need an $8000 box and an $8000/year subscription service to actually toy with the full diagnostic system.

Forget that

[GameboyRMH]

Breaking news! Hacking tools called "physical access," "time" and "effort" can be used together to bypass ALL forms of security on EVERYTHING IN EXISTENCE, leaving you vulnerable not only to cyber-criminals, but terrorists and pedophiles as well! WIll no-one close this gaping security hole!?!? Does the car industry have no regard for our safety!?!?

I mean seriously, a car's ECU is airgapped from the outside world and has decent physical security. This is not news, and the automotive industry should ignore it for the stupid fluff that it is.

Re:Forget that

[jc42]

I mean seriously, a car's ECU is airgapped from the outside world and has decent physical security.

Maybe it's time to start harrassing people to use the term "airgap" with the implication that it means "secure". That's so 1990s. Nowadays, "airgap" means "wireless accesss".

And by "access", we now mean "access from the outside".

Are there any laptops, netbooks, tablets, or handhelds these days that don't have wireless access as a standard feature? If so, such models are rapidly disappearing. And "airgap" now means that anyone within range can talk to your device without any sort of physical connection. This includes many (perhaps most) new model cars.

Re:You missed another point - aftermarket installe

[Pentium100]

Take, for example, installing an aftermarket stereo: Many new cars don't have a wire that supplies 12V when you turn the key on to turn on the radio, the radio is always powered and listens to the CAN bus for the command from the car's BCM (body control module) to turn itself on.

I think that this is not a big deal. The radio in my car is permanently connected to +12V and I can turn it on and listen to music with the engine off and the key in my pocket. As long as the car supplies power and the speakers are analog I think that this could be done to any car...

Nice photos, there.

[Anonymous Coward]

Reading the comments on 3 different sites, it seems no one actually read the paper. Hey, here's a footnote on page 4:

We believe the risks identified in this paper arise from the architecture of the modern automobile and not simply from design decisions made by any single manufacturer. For this reason, we have chosen not to identify the particular make and model used in our tests. We believe that other automobile manufacturers and models with similar features may have similar security properties.

I really shouldn't have to tell you this, since you're security researchers and all, but those photos of a 2006+ Chevy Impala with your test harness? The ones you put in the paper? Yeah, they kind of identify the particular make and model used in your tests. Congratulations, GM.

Perhaps block diagrams would've been more appropriate?

Carshark Software

[Anonymous Coward]

Is the Carshark Software available on the net?
I've been looking for a good CAN monitor.

Re:You missed another point - aftermarket installe

[adolf]

Hmm.

Remote start on my E36 BMW just required a magic box (consisting literally of a relay, a coil, and a box) into which a spare key was placed. The remote starter activates the relay in this box, which switched the coil near the ignition switch out of circuit, and replaced it with the one wrapped around the spare key inside the box.

Worked like a champ. I think I only had $90 in the whole kit, including the remote start, the spare key, and the magic box. I kept the key whole and buried the magic box and extra key deep inside the dashboard for security, though I could've easily cut off the metal portion of the key so that only the RFID-ish bits was with the car.

Is there some reason why you couldn't have gotten a spare M-B key, and done the same thing with IR instead of RF?

Re:You missed another point - aftermarket installe

[multipartmixed]

You should be able to install a remote starter on an EIS-equipped Benz by just hiding a spare EIS key somewhere inside the console and tweaking the wiring approrpriately, no? That's the solution used by a lot of ignition interlock systems.

Here's a neat factoid - CAN bus isn't just twisted-pair anyhow, Benz is rolling out fiber for the high-speed CAN bus these days.

I was pretty surprised the first time I bumped into CAN bus; I was at party talking to a couple of guys swapping network troubleshoot techniques. At first, I thought they were fellow nerds, turns out they worked down at the local mercedes dealership. Had some really interesting conversations with them and hit the books. CAN is almost as old as ethernet, it's an IEEE spec, originally developed by... Bosch, IIRC. It's a totally real un-routed packetized micro LAN. Neat stuff!

Re:You missed another point - aftermarket installe

[toddestan]

If I had to guess, it's because the the Mercedes system requires a constant communication to have the engine run. So there's no way to switch over to the real key without the engine stopping. I suppose he could just use the hidden key to drive around with, but that would defeat any kind of security the remote start has, so once the car has been remote started anyone could hop into it and drive off.

On more conventional cars (this is all relative, of course) the handshaking only takes place when the engine is started. Even if the car constantly checks for the key, you would still need another physical key to put into the ignition to defeat the steering wheel lock and the interlock on the gearshift (assuming the car is an auto). The remote start module can also sense this so it would then know to not kill the engine if the brake is pressed (another safety/security feature).

You've got a problem if your car is stolen

[name_already_taken]

Hmm.

Remote start on my E36 BMW just required a magic box (consisting literally of a relay, a coil, and a box) into which a spare key was placed. The remote starter activates the relay in this box, which switched the coil near the ignition switch out of circuit, and replaced it with the one wrapped around the spare key inside the box.

Worked like a champ. I think I only had $90 in the whole kit, including the remote start, the spare key, and the magic box. I kept the key whole and buried the magic box and extra key deep inside the dashboard for security, though I could've easily cut off the metal portion of the key so that only the RFID-ish bits was with the car.

You should open that box back up and destroy the metal key blade. If your car is ever stolen, the presence of that intact key will allow your insurance company to get out of covering the loss. It's pretty well known amongst professional installers.

Is there some reason why you couldn't have gotten a spare M-B key, and done the same thing with IR instead of RF?

To do so with the M-B EIS, you'd need to hack the EIS, ie. physically open and alter it. Extremely risky, and a replacement EIS is at least $400 and has to be programmed by M-B to operate in the specific car (in Germany! There's a facility in New Jersey that programs SmartKeys for the US market, btw.).

It would be pretty complicated even if you had access to the insides of the EIS. The EIS detects the presence of the key immediately upon insertion (the steering column unlocks as soon as you put the key in, even if you don't turn it.) So, you'd have to deal with two levels of activation.

The other problem, as toddestan notes, is that once you've tricked the EIS into talking to the hidden spare key for the remote start, the car be can stolen much easier - the steering will be unlocked and there's nothing to stop anyone shifting out of park (I'd steal this type of car by winching it onto a flatbed tow truck, which you've made possibly by unlocking the shifter even if the brake pedal interlock shuts off the remote start), and since there's a real key present, insurance won't cover the loss if the car is recovered (according to my auto insurance claims adjuster friend the insurance companies tend to investigate into how high dollar cars were stolen if they're recovered).

I installed a bypass module in the Honda (a 2004 Civic) which had an RF transponder key, although this was a code-learning bus-based bypass that tapped into the data signal from the ignition lock key reader. It only needed to authenticate they transponder code when the ignition was initially turned on to get the engine to run; there was no ongoing authentication. I have one of the cheap key-in-a-box bypass modules that I bought by mistake, but it's so primitive that I couldn't bring myself to use it, especially since it actually costs more than the bus-type bypass because there's the additional cost of an extra transponder key.

I'd also note that the E36 BMW is an older model that went out of production right around the same time that M-B went from mechanical blade keys to SmartKeys. What's BMW using now for a key? I'm guessing it's a SmartKey with a different name?

Re:You've got a problem if your car is stolen

[adolf]

Feh. Nobody's going to steal this car. It's old (1995!), high-mileage (176k!), low end (just a 325i), and difficult to steal for anyone but a knowledgeable professional (who does not know that there is a key buried in the dash).

And it isn't a high-dollar car. I gave $6,500 for it, about five years ago. People generally steal cars because they're convenient or have valuable parts. This has neither convenience nor value.

So, no: I was never worried about leaving the key in the car, since a thief with his brain turned on would never gotten that far anyway.

And I won't argue with you about insurance adjusters. They're all crooks. Even your friend: He's a crook, too.

That all said: As toddestan GUESSES , it might be the case that the M-B needs constant infrared communication with the key.

To which, as an engineer, I call bullshit. Unless there's some manner of external power available to the key, it's NOT going to be able to keep up a constant stream of infrared communication for any meaningful length of time. Otherwise, M-B owners everywhere would be all uptight about their cars NOT FUCKING WORKING after the battery goes dead in the key.

So, in retort to that guess, I guess that I'd guess myself that he's full of shit.

(Note, however, that I don't own a M-B, never have, have no intention to ever own one, and therefore have not researched their security at all.)

Which, of course, leaves my question: Why not just leave the key (or the electronic portion of it) someplace, and let that be that?

(Note, also: It's easy to flatbed a car even if the steering if locked, fucked, or otherwise off-cantor.)

interesting

[name_already_taken]

You should be able to install a remote starter on an EIS-equipped Benz by just hiding a spare EIS key somewhere inside the console and tweaking the wiring approrpriately, no? That's the solution used by a lot of ignition interlock systems.

Nope. See above post. They carefully designed the SmartKey system to prevent any kind of operation of the vehicle without an authorized key in the EIS.

Here's a neat factoid - CAN bus isn't just twisted-pair anyhow, Benz is rolling out fiber for the high-speed CAN bus these days.

That's odd, there are twisted pairs in the car. In particular I noticed a twisted pair going to the C connector on the factory stereo, and according to the WIS (M-B service database), those pins are used for CAN for the steering wheel controls and radio data to the instrument cluster. Even more oddly, those features were not available on my car that year, even though it's wired for them and they're in the wiring diagrams.

I thought they were just using fiber for MOST (and formerly D2B) - they're mainly entertainment system buses. It could eliminate some of the weird problems like when CAN wires get wet though. I probably won't get a newer M-B for a couple of years. I'm saving up for an S.

I have an ELM327 adapter for OBDII, supposedly it can talk and listen on the CAN bus to any of the car's modules (if connected to the correct bus). I'll probably not get around to messing with it though.

Scary

[Anonymous Coward]

I was employed at a German car manufacturer. I know they were taking the risk somewhat seriously. What is often forgotten is that you can flash the firmware of many chips in the car (their top model has about 90, afair) via CAN bus. That is the bus that you can access somewhat easily from the outside, for instance via hooking up to the tire pressure sensor or the outside mirrors.
Also, no communication on the different networks is encrypted; apparently you can flash unsigned firmware without problems. A faulty web browser can't cause the engine to shut off, but it can certainly blare volume at max and roll down the windows. Or recalibrate the temperature sensor, which in turn influences ESP.
So, fun stuff. One of the reasons we don't see many attacks is that everything seems to be highly proprietary.

wasted study money

[Anonymous Coward]

I can't believe this was a study. Go ask any technition and they could have told you the same thing, and if you really want to have fun playing with jumper wires is a blast. Like wiring someones horn to thier turn signal or more sinister you could trigger the air bag sensors and then wire the airbag squib to the brake on/off switch (air bag go boom we step on brake)