The Future of Hi-Tech Auto Theft

NicknamesAreStupid writes "Over the past twenty years, car theft has declined as new models incorporated electronic security methods that thwarted simple hot-wiring. The tide may now be turning, as cars become the next Windows PC. The Center for Automobile Embedded Systems Security has posted an interesting paper from UCSD and UW that describes how modern cars can be cracked (PDF). Unlike the old days of window jimmies, these exploits range from attacks through the CD or iPod port to cellular attacks that take inventory of thousands of cars and offer roaming thieves Yelp-like choices ('our favorite is mint green with leather') with unlocked doors and running engines."

Comments

Yes,

[Moheeheeko]

Yes I would download a car.

Re:Yes,

[Anonymous Coward]

I would only download the cracked DRM-free version.

Re:Yes,

[Hoi Polloi]

Wait until 3D printer copies of your car start appearing. "Hey, he has the same bumper sticker and fast food wrappers in the front seat..."

Re:Yes,

[forkfail]

What happens if the app store decides to disable your car, though?

Re:Yes,

[Idbar]

Any link to a Koenigsegg torrent?

Re:Yes,

[Anonymous Coward]

Wait - that's copyright infringement. Cue the CARMAA - CAR Manufacturers and Assemblers Association - police to go on a rampage suing people.

Re:Yes,

[N0Man74]

Yes, in the future, when 3D printers improve by leaps and bounds and when the Music and Movie industries have won and it will become illegal to hum copyrighted works in the elevator, we will see Public Service Advertisements that say...

"You wouldn't steal a song would you!? Don't steal that car! Downloading a car is illegal!"

Re:Yes,

[onceice]

For brief phrase North Face Clearance ,

what will they do with stolen cars?

[alen]

one of the reasons auto theft declined is police busted and closed chop shops that took and resold the parts. and you can now buy cheap off brand parts for any car as well. not like anyone stole cars back in the day for personal use

Re:what will they do with stolen cars?

[Anonymous Coward]

Joyriding must be a foreign concept to you then...

Re:what will they do with stolen cars?

[hedwards]

That's one, but around here it's increasingly common for cars to be stolen and then returned hours later after having completed a drug run in the stolen vehicle.

Beyond that bait cars and lojacks as well as other countermeasures make it a lot more likely that car thieves will be caught before they can profit from their crime.

Re:what will they do with stolen cars?

[AlienSexist]

My understanding is that there is a very hot market for stolen whole cars in Asia, Mexico, and Central & South America. Driven across the border to Mexico for further distribution, sometimes by ship. Pickup trucks in particular are being taken for this purpose. You're right though. Most often cars are not stolen, only broken into for their contents or disassembled for valuable parts. Catalytic converter thefts have been very high because they contain various mixtures of platinum, palladium, rhodium and prices for those precious metals were very high. Just like there's been a huge rash in national copper thefts.

Re:what will they do with stolen cars?

[Anonymous Coward]

Here in Texas, car theft is up because there is one type of vehicle highly sought after: Larger pickups, SUVs, and 4x4s in general. These are promptly taken to the border to smash through the excuse of a fence and to ferry weapons to Mexico, and narcotics/illegals back to the US. A good diesel 4x4 is prized down there because it can easily outrun police vehicles over the terrain. They also are taken to Mexico to be up-armored.

The trick I do with keeping the vehicle from being "borrowed" is the classic kill switch. However, I use two. One is for the fuel pump, the other one turns on and off the RFID antenna. This way, someone trying to clone a PATS key might get my key's serial number, but when they try to jam a clone in the vehicle, it will just give them the middle finger.

Re:what will they do with stolen cars?

[cayenne8]

. Catalytic converter thefts have been very high because they contain various mixtures of platinum, palladium, rhodium and prices for those precious metals were very high.

Hmm...now, I'd not have a problem with them taking my catalytic converter off the car (leave me the car)...with less air restriction, I'd likely have more performance!!

And, not like I live where they do sniff tests on inspections....I've never lived where they do that..sounds like a PITA.

Re:what will they do with stolen cars?

[tomboalogo]

Up here (Canada) there was a rash of catalytic thefts in a train station parking lot. They'd cut them out while owners were at work. Not what you need at the end of a hard day!

Re:what will they do with stolen cars?

[Anonymous Coward]

Actually, you'd be surprised at the # of cars stolen just because the person needed to get from point a to point b. Happens all the time.

Re:what will they do with stolen cars?

[Anonymous Coward]

one of the reasons auto theft declined is police busted and closed chop shops that took and resold the parts. and you can now buy cheap off brand parts for any car as well. not like anyone stole cars back in the day for personal use

A lot of auto theft is high end cars that are immediately put into a shipping container & sent overseas. Many other countries care far less about auto theft.

Re:what will they do with stolen cars?

[CyberTech]

. Catalytic converter thefts have been very high because they contain various mixtures of platinum, palladium, rhodium and prices for those precious metals were very high.

Hmm...now, I'd not have a problem with them taking my catalytic converter off the car (leave me the car)...with less air restriction, I'd likely have more performance!!

And, not like I live where they do sniff tests on inspections....I've never lived where they do that..sounds like a PITA.

If your car is like mine was, they wouldn't need to do sniff tests. They'd hear you coming. My catalytic converter was cut out of my 4Runner while in the parking lot at work. I left work at around 4pm, started it up, and nearly shit a brick. It was the loudest vehicle I'd ever heard, I thought it was broken, lol!

Brought a friend out to listen while i started it, he's peering around, and says... "wtf, where's your cc?" Just a pile of metal shavings :)

Re:what will they do with stolen cars?

[Anonymous Coward]

that's the dumbest thing to brag about on a public forum. They use internets too, y'know.

Re:what will they do with stolen cars?

[clm1970]

Yep. I had an older but still running Toyota pickup. I sold it to a couple of guys who were taking it to Guatemala. Make them come to the bank first so they could certify the bills were not fake as they insisted on paying in cash. DA's office said no known scam going around like that but it was a little freaky to say the least.

Re:what will they do with stolen cars?

[Anonymous Coward]

Joyriding isn't stealing. At least not in the UK. Theft (aka stealing) requires an intention to permanently deprive, which joyriding lacks. Joyriding is why the offence of taking without consent (aka TWOCing) was introduced.

Re:what will they do with stolen cars?

[cayenne8]

If your car is like mine was, they wouldn't need to do sniff tests. They'd hear you coming. My catalytic converter was cut out of my 4Runner while in the parking lot at work. I left work at around 4pm, started it up, and nearly shit a brick. It was the loudest vehicle I'd ever heard, I thought it was broken, lol!

Well, I guess I was thinking ahead...and just figuring to weld in a straight pipe in its place.

I guess a larger question of mine is..how do they manage to do this in public? I mean...someone in a parking lot under a jacked up car with a blowtorch to cut the thing out...would likely raise alarms anywhere I could think of....

I mean..is there no security in your work parking lot? Or at least..other people usually around? I just have a problem thinking of where my car would ever be parked where someone could come in, an cut my exhaust system apart to get pieces of it...I'd seriously never heard of this till this thread.

Re:what will they do with stolen cars?

[Shakrai]

That's one, but around here it's increasingly common for cars to be stolen and then returned hours later after having completed a drug run in the stolen vehicle.

The last time I parked my car in a New York City dirt lot it was returned to me with 30 extra miles on odometer. It was also washed, detailed and had a full tank of gas. I don't want to think about what they did with my car but at least they were polite about it....

Re:what will they do with stolen cars?

[johnny cashed]

4runner is a truck, no need for a jack. They make pipe cutters with multiple wheels on a chain and a vise-grip like handle. It allows for plumbers to do repairs in tight spaces. Quiet, quick. Or just turn up your stereo while your buddy uses a cordless sawzall (TM).

Re:what will they do with stolen cars?

[Mashiki]

Here in Canada, auto theft is roughly the same. Most cars aren't chopped and sold. Anything from '09-99, they're devinned, and resold with a remarked vin from a wreck. Strip-vinning has long since gone out of style because it's a hassle, every part on cars made in the last 5 years or so has the VIN on it. From the windows, and bumpers, to the air and A/C compressor, down to the taillamp and wiring harness. So it did it's job. Their favorite targets are mostly cars/trucks/suv's in the '02-08 range where VINs were only stamped on engine/body frames. And where salvages are easy to find. So fair warning, see a deal, get it checked. And double check that dash VIN against the body, frame and engine. Otherwise, your vehicle is forfeit nearly everywhere to the owner, and you're out your money.

The new thing is to simply either pull up and drive away with the vehicle using a stolen tow, or they pay a tow driver on the side to dump a vehicle somewhere. And then strip out the computer and replace it with a new one along with a new keyset. These are then sold overseas, mostly in russia, china and the middle east.

Re:what will they do with stolen cars?

[GameboyRMH]

There's a truck in Texas with a kill switch, oh noes!

Re:what will they do with stolen cars?

[scharkalvin]

That reminds me of an episode of the "Top Cat" cartoon where the guys made money parking cars and renting them out for the day.

Re:what will they do with stolen cars?

[Anonymous Coward]

The don't even need to take them over the border to ship them. I remember back in the 90s a longshoreman had his ride stolen. A couple weeks later he saw it on the docks being loaded onto a ship. The authorities were able to react before the ship left US waters and a major auto theft ring was broken.

Re:what will they do with stolen cars?

[Anonymous Coward]

Nah, nothing freaky about it. I drive a '91 Toyota pickup and I am constantly getting offers for it, usually from Guatemalans. For some reason they really love those Toyota pickups.

As for the insistence on paying cash... it's pretty common for people who are not here legally to avoid banks.

Re:what will they do with stolen cars?

[sgt scrub]

roflmao

Re:what will they do with stolen cars?

[Garybaldy]

We used to have a joyriding crime here in the US. however our politicians wanting more people in jail and fewer people qualified to get jobs. Decided joyriding should be reclassified as grand theft auto and be a felony.

Re:what will they do with stolen cars?

[Garybaldy]

Odd i have had two coworkers have vehicles stolen outside the Georgia Dome in the last year.

Re:what will they do with stolen cars?

[couchslug]

It's mostly the "busting" part. Cheap sheet metal and cheap plastic bumper covers abound, but many other parts are still painfully expensive.

The dealer I worked for would routinely buy complete wrecks at auction for parts and make a nice profit!

Re:what will they do with stolen cars?

[couchslug]

That's why it should be legal and encouraged to use lethal force to protect property. Good people don't steal.

Pulling the fuel pump fuse or ECU fuse and replacing with a dummy works well too, and is invisible unless the thief pulls that fuse.

My bud had several steering columns ruined on his wrecker over the years, but it was never stolen. Columns are free when you do salvage and he got very quick at swapping them out!

Re:what will they do with stolen cars?

[frosty_tsm]

We used to have a joyriding crime here in the US. however our politicians wanting more people in jail and fewer people qualified to get jobs. Decided joyriding should be reclassified as grand theft auto and be a felony.

I'm sorry but some high/drunk/stupid 22 year old who steals my car to drive all over the county, who may be driving recklessly (and might get into an accident) and who is depriving me of my property (which even without an accident is still damaged) deserves prison time. This isn't "oh no, someone parked in my parking spot." This is "some just took my way to get to work or my ability to get food."

You used to be able to shoot someone if they tried to steal your horse. I'm not advocating violence, but this isn't exactly a crime our ancestors took lightly.

Re:what will they do with stolen cars?

[Garybaldy]

I understand. This is the US. We want every criminal put away for life or executed no mater how serious/minor. Just in our blood. Well US blood anyway.

I was just replying that we used to have similar laws.

Re:what will they do with stolen cars?

[CyberTech]

Correct. They used a cordless tool to do it. There is video.. the only car that parked next to the truck all day only stopped for 90 seconds. That's all the time it took :)

Re:what will they do with stolen cars?

[Grishnakh]

Wrong. Personal use is a big reason for stealing cars here in Arizona; Mexicans coyotes steal them and use them for transporting illegal immigrants through the desert all the time. However, they generally steal large pickup trucks and the like for obvious practicality reasons, not small cars. I've had two different coworkers get their big trucks stolen in the past 10 years.

Re:what will they do with stolen cars?

[Grishnakh]

I haven't heard of this lately, but I heard of a rash of this type of thing back around 2008. CC thieves typically struck SUVs and pickups, since it's easy to get under them when they're parked (with my car, by contrast, you have to jack it up unless you're a small child). The way they do it is simple: a cordless sawzall (reciprocating saw). You don't need a blowtorch to cut an exhaust pipe; a sawzall will zip through one in seconds.

Security in work parking lots? Are you kidding? I used to work at Intel here in Arizona, where they have security driving around in golf carts occasionally, and Securitas personnel at every public entrance. There's cameras everywhere. One of my coworkers left to go home one day and his big truck was missing. Security was no help, other than helping him file a police report.

Back in the 1990s, I interned at a large government contractor, where Secret and Top Secret classified material was handled. The building I worked in at one point was in the middle of a ghetto in downtown Newport News. The parking lot was surrounded by barbed-wire fences, though the gates were left open in the daytime. It wasn't unheard of for cars to be stolen, and they had a lot of problems with neighborhood youths vandalizing the cars.

The security at workplaces isn't for employee vehicles, it's for the company's property and information, and that's it. They have security to limit access to the building, and make sure people don't walk off with any secrets. They don't give a shit if someone steals your car.

Re:what will they do with stolen cars?

[Grishnakh]

Yep, I'm sure the thieves will easily find this guy's truck and steal it with this information. It's not like there's a lot of trucks in Texas.

Re:what will they do with stolen cars?

[torkus]

No no no...we want every criminal put away for life or until rehabilitated* no matter how minor the crime. We ALSO want NO criminals executed no matter how serious the crime. Texas may disagree occasionally but typically there's plenty of outcry against capital punishment.

With this high tech theft, maybe someone will be able to deprive you of income derived from your car while still leaving the car intact in your garage. You should be entitled to $1biiiiiillion dooolars in compensation based on current trends.

*rehabilitated to be defined as a properly trained criminal that is either dumb enough to get caught immediately or smart enough not to get caught the next time

Re:what will they do with stolen cars?

[tehcyder]

You used to be able to shoot someone if they tried to steal your horse.

Back in the good old days you could be hanged for stealing a loaf of bread. Thanks to political correctness gone mad, if you try to stop someone shoplifting you're likely to be put in prison yourself, as though a damn good thrashing ever did me any harm.

Re:what will they do with stolen cars?

[tehcyder]

That's one, but around here it's increasingly common for cars to be stolen and then returned hours later after having completed a drug run in the stolen vehicle.

The last time I parked my car in a New York City dirt lot it was returned to me with 30 extra miles on odometer. It was also washed, detailed and had a full tank of gas. I don't want to think about what they did with my car but at least they were polite about it....

If someone borrows your car to commit a brutal and bloody gangland slaying, of course they're going to clean away the evidence before returning it. The full tank of gas is a weird one though, maybe they'd intended to set fire to it but forgot.

Re:what will they do with stolen cars?

[tehcyder]

That's why it should be legal and encouraged to use lethal force to protect property. Good people don't steal.

Where I live, human life is valued above property. You can only use lethal force in self defence. I suppose that you'd call it European socialism.

Re:what will they do with stolen cars?

[swalve]

The full tank of gas is a payoff to the owner to keep his mouth shut.

Re:what will they do with stolen cars?

[Raenex]

What the hell is wrong with you apologists? Do you know how expensive and important a car is for most people? What kind of excuse can you make for people to take the property of others, whether it's "for fun" or otherwise?

Re:what will they do with stolen cars?

[rocket rancher]

You used to be able to shoot someone if they tried to steal your horse. I'm not advocating violence, but this isn't exactly a crime our ancestors took lightly.

Well, in the civilized state of Arizona, you still can. In fact, you face less legal hassle if you cap a thief in the act, than you would if you capped somebody who was trying to kill you.

Re:what will they do with stolen cars?

[rocket rancher]

one of the reasons auto theft declined is police busted and closed chop shops that took and resold the parts. and you can now buy cheap off brand parts for any car as well. not like anyone stole cars back in the day for personal use

Hmmm. I don't think reselling parts is why vehicles get stolen. At least, not in Arizona. Or any state that borders on Mexico right now, I would guess. Stolen vehicles are basically untraceable, so when Mexico's drug lords need to move contraband, or kidnap/murder/rape someone, they steal a vehicle to do it. Large trucks and SUVs are routinely stolen from our secured parking lots where I work (about one a month) while the Porches, 'Vettes, and Ferraris seem to be relatively immune. Even my Ducati, which could be easily tossed into the bed of a pickup truck by two people in about two seconds has been ignored, while the Hummers and Escalades I park next to keep disappearing.

Re:what will they do with stolen cars?

[Christian Henry]

The full tank of gas is a payoff to the owner to keep his mouth shut.

Worked beautifully, I see. :-)

Re:what will they do with stolen cars?

[Garybaldy]

Really flame bait. FUCKING PRICKS

Re:what will they do with stolen cars?

[Garybaldy]

Like i said people like you want criminals put away for life. No matter how serious or minor the crime. It does not mater that our system does not work. that we have more people in jail both in numbers and as a percentage of any country that keeps records. That we have one of the highest recidivism rates of any country on the planet.

So i guess i am an apologist. I am sorry our system is so fucked up.

Re:what will they do with stolen cars?

[Raenex]

I don't want them in jail for life, but I don't think "joyriding" is a minor offense and that it should be treated the same as stealing a car, and yes a felony. Don't steal shit, especially expensive shit that's the personal property of others.

Re:what will they do with stolen cars?

[Garybaldy]

I understand the value of a car. Instead of having the guilty person pay restitution for any damages. We prevent them from getting a decent job the rest of thier life. That is what felonies really mean.

Instead of them being able to turn their life around. We punish them with burger flipping for life. A misdemeanor at least allows them to turn their life around. Felonies used to be reserved for violent crimes. Now its used for amy politicians need to look tough on crime. Because he is to lazy to do what needs to be done.

Re:what will they do with stolen cars?

[Raenex]

Fair enough, that's a good point -- if it works in practice. Ultimately I want solutions that work the best.

Re:what will they do with stolen cars?

[Anonymous Coward]

No, no, you have it all backward. My car is very important and valuable piece of machinery. Car thieves are just worthless pieces of human shit.

If I have the choice between watching some piece of scum drive off with my car, or putting a bullet or two in hot pursuit, I'll choose the latter. And yes, it's legal in my state to use lethal force if necessary to stop someone who's making off with your property.

Windows PC?

[Anonymous Coward]

What a stupid fucking statement about Windows PC. What is that even supposed to mean? How is a modern car comparable to a computer running Windows? What version of Windows are we talking about here?

Re:Windows PC?

[Anonymous Coward]

Ford's SYNC was built originally by Microsoft so I would guess it's running WinCE underneath. I sure hope it's not a stripped down Win7 or such.

Re:Windows PC?

[alen]

wonder if it has active directory connectivity? that would be so cool to add my car to the company's AD forest

Re:Windows PC?

[kiwimate]

It's a stupid flamebait analogy. The summary goes like this

* Windows PCs are as secure as a piece of tissue paper (LOL, for teh win!)
* Cars with their increasingly computerized systems are now becoming vulnerable to hacking.
* Windows PCs are vulnerable to hacking.

Re:Windows PC?

[SQLGuru]

The concept is that electronicly secured cars become wide-spread and common. It was why Windows PCs were attacked with viruses first. Now that Mac is more common, you see more attacks against them. It's why you see malicious Android apps. Soon, you'll start seeing malicious car apps......

It's all about wide spread opportunity. You need a lower percentage of successful attacks as the number of targets increases.

Re:Windows PC?

[Capt.DrumkenBum]

Do that and when you leave the company, suddenly you can't start your car. :)

Re:Windows PC?

[Anonymous Coward]

We had car analogies for computers, now we have computer analogies for cars.

Re:Windows PC?

[garyebickford]

IIRC Ford at least has a cooperative agreement with Microsoft and has shown cars with (among other things) automatic updating of your music into your car, so yes it might well be running some form of Windows. The increasingly prevalent and probably I-fear-soon-to-be-required OnStar or equivalent is basically a cellular modem connection, which can do almost everything to the car but steer.

And the average car has had more computing power than most desktop PCs for ten years or so. I read somewhere several years ago that the 2000 Cadillac had five Pentium-class CPUs. When you step on the gas, all you are doing is telling the car you want to go faster. When you start your car, you may notice that all the dashboard dials (speedo, etc.) will all go through a calibration cycle where the pointy arrow swings all the way from off to max. That's the CPU that drives the controls getting itself situated.

All in all, the car folks have done a pretty good job of making everything virtual, while maintaining the same user interface as a fiction so few people notice any difference.

Re:Windows PC?

[DarkOx]

Sounds nice that way HR can tell you IT department they have to enforce the GPO that does not let anyone go over 65MPH.

Can't wait.

Re:Windows PC?

[grcumb]

What a stupid fucking statement about Windows PC. What is that even supposed to mean? How is a modern car comparable to a computer running Windows? What version of Windows are we talking about here?

Funny you should ask....

Dude, this is Slashdot. No car post is complete without a Windows analogy.

Re:Windows PC?

[vtcodger]

I know it's a radical suggestion, but you could try reading the linked pdf. It's really quite interesting.

IIRC Windows got sniped at because manufacturer's diagnostic software runs on Windows. So, all that needs to happen is that a compromised vehicle gets hooked up in the dealer's shop. The car then compromises Windows which then cheerfully reflashes the ECUs in every car it is subsequently hooked up to.

If it will make you feel better, Unix also got criticized because some ECUs ship with live Telnet interfaces and tools like vi, nc, ftp, etc available.

why is the CD player on the same network?

[Trepidity]

It's not clear to me why the CD player should even be on the same network as the engine-related microcontrollers.

Re:why is the CD player on the same network?

[Anonymous Coward]

Because car designers are not network engineers.

Re:why is the CD player on the same network?

[Anonymous Coward]

Sometimes the electronics to control certain parts of the car are in the stereo to keep you from upgrading the stereo. Ford, for example, uses strange oval shapes to keep you from replacing their crappy stereo. Chevrolet in the case of my old Monte Carlo put the door chime and some of the interior light controls in the stereo. The work-around Best Buy did in my car was to move the original stereo to the glove compartment and leave it connected to everything but the speakers. In my wife's Lexus, the car wouldn't even start without the radio. I gave-up on upgrade the stereo in it. Car makers these days go to great lengths to make sure you do not get good sound in your car and buy any upgrades from them.

Re:why is the CD player on the same network?

[Anonymous Coward]

Microsoft Sync......

Re:why is the CD player on the same network?

[Anonymous Coward]

FTFA:

Modern automobiles are controlled by a heterogeneous
combination of digital components. These components,
Electronic Control Units (ECUs), oversee a broad range
of functionality, including the drivetrain, brakes, lighting,
and entertainment. Indeed, very few operations are not
mediated by computer control in a modern vehicle (with
the parking brake and steering being the last holdouts,
though semi-automatic parallel parking capabilities are
available in some vehicles and full steer-by-wire has been
demonstrated in several concept cars). Charette estimates
that a modern luxury vehicle includes up to 70 distinct
ECUs including tens of millions of lines of code [5]. In
turn, ECUs are interconnected by common wired net-
works, usually a variant of the Controller Area Network
(CAN) [12] or FlexRay bus [8]. This interconnection
permits complex safety and convenience features such as
pre-tensioning of seat-belts when a crash is predicted and
automatically varying radio volume as a function of speed.

Re:why is the CD player on the same network?

[PPH]

Because that's how they upload firmware to your ECU.

When you purchased the $5000 'high performance package', they just flipped a configuration bit in a controller to use a different set of curves. Everyone has the same engine. They just change the badge on the back of the car.

Re:why is the CD player on the same network?

[427_ci_505]

Depends on the car. The Corvette, for example, has three variants on the engine, each variant costing a different amount of money.

Re:why is the CD player on the same network?

[peragrin]

I personally love having to stop my car turn it off, and then restart it just to fix my radio.

I really wish msft woulld get away from intergrated hardware/software they suck at it.

Re:why is the CD player on the same network?

[Anonymous Coward]

adjust volume to compensate for engine noise

Re:why is the CD player on the same network?

[Ouchie]

The reason why the Car Stereo is on the same network is because too many people were buying cars with no stereo or the basic stereo then going to after market shops where they could get a much better stereo for the same amount of money. Manufacturers decided that to reduce this they would just make the car stereo a required part for the whole system to work. It gives you a good reason to pay $1200 for the stereo upgrade which we know isn't worth $600.

Re:why is the CD player on the same network?

[Anonymous Coward]

You have a great point about Chevrolet. I install stereos for a living, and Corvettes have some very creative protections against replacing the stereos. GM really wants you to have to suffer with the absolutely horrible Bose stock stereo. GM uses non-standard line out voltages in the Corvette so you can't connect the head unit to a real amplifier. Also, they place the amplifiers in the door which doesn't leave you with enough room to put even a tiny Alpine amp in the door even if you ignore the air flow problems. A real amp will fit under the seat but only if you have one of the few Vettes without power seats. In addition they use proprietary thin woofers in the doors which, of course due to physics, sound horrible. The speakers are a weird and complicated size so you have to fabricate mounting brackets. Also the speakers are a nonstandard impedance so you can't drive them with a standard car amp. Even with all of that work, GM decides to take the door and key chimes away from you if you replace the headunit.

What all of that means is if you want to upgrade or repair any single component, you must replace the entire system.

Re:why is the CD player on the same network?

[Lumpy]

nope.

It's on the bus to listen for vehicle speed so the active volume can go up and down. Advanced one spit out channel and RDS data for the HUD. there is zero possibility to send out a "lock up the breaks" command from the car stereo into the CANBUS unless you rewrite the stereo's firmware first. and that is not gonna happen, There are a LOT of guys looking to hack GM and Ford satnav systems to get past the damn CANBUS VIN lock. They have had ZERO success in the past 5 years.

Re:why is the CD player on the same network?

[PseudonymousBraveguy]

Well, it is usually on a different (layer 2) network, but usually there is a gateway routing messages between the two. Why? Because the CD player is embedded in the entertainment system, and that system displays information from the engine (e.g. current mileage), or you may be able to configure your engine via the entertainment system (like switching your engine and gearbox to "sport" mode). However, the gateway does not blindy route any message to any network, there is usually a fixed configuration which message should be routed to which network.

Nevertheless, most development in the field is centered around safety, and not focused at security, so I'm not that surprised that vehicular networks are hackable.

Re:why is the CD player on the same network?

[h4rr4r]

It's a vette, why does it even have a stereo?

Re:why is the CD player on the same network?

[DarkOx]

Because that is how they implement the "Music gets louder, when the engine is turning more revs and making noise" feature.

Consumers want wizbang features like stereo's that auto adjust volume, they don't care about security. They might not even really care about safety. Oh they'll demand safety "features" like 60 different airbags, but the idea that a software bug or interconnect problem introduced as a result of the needless complexity in some vehicles could cause their breaks to malfunction just is not real to them. Well its not real to them until they or someone they know slams into something.

Re:why is the CD player on the same network?

[Lumpy]

Really? I seem to find it different.

Just helped a friend with his 2010 Vette 2 months ago, dingy thingy replacements are available at scosche for less than $25.00 so all your chimes are retained. Steering wheel controls are also easily adapted with a $79.00 box.

speaker upgrades are worthless as the Vette with premium sound that has the amps on the backs of the speakers sound better than any of the aftermarket stuff, speaker placement in the vette is crap anyways, $300 each drivers will not sound any better in that car, but it's easy to do with adapter plates from..... Scosche, that place again.

as for a "real amp" almost nobody puts in a 10,000 watt Rockford Phosgate anymore. replace the head unit with the new kenwood stanav one, hooked into the existing wiring for the speakers and simply removed the speakers and disconnected the "premium sound" amps.

All done. Anyone that has done car stereos in the past 2 years knows this, you dont have to " replace the entire system" not by a long shot.

Re:why is the CD player on the same network?

[Fahrvergnuugen]

Because the CD player connects to the steering wheel controls which connects to the ECU to set cruise control for your drive by wire throttle plate.

Re:why is the CD player on the same network?

[BitZtream]

So that the emergency bell/check engine ding on your engine plays through your speakers when you're blasting the radio too loud to hear it otherwise.

Thats just an example that came to me off the top of my head as I've seen it happen. I'm sure there are plenty more.

Re:why is the CD player on the same network?

[BitZtream]

They aren't 'put in the stereo to intentionally make it harder' as you imply, but when you disconnect the stereo's internal bus, you do fuck up a portion of the cars' network.

GM really doesn't give a fuck if you put in a different stereo after you bought the car ... YOU ALREADY PAID FOR THE STEREO IN THE CAR.

Replacing the stereo is also rather trivial, you just need an interface kit that will interface your stereo with the cars data bus. These interface kits are well known (Best buy sells the damn things) and fit pretty much any car on the planet and make it work with any kind of stereo from old school analog systems to fully modernized systems with blutooth phone audio relays and text output to the display.

Its not the car makers that don't know what they are doing in your case, its you and best buy.

Re:why is the CD player on the same network?

[BitZtream]

Wow, you are one of the worst 'stereo installers' I have ever fucking met.

You do realize there is an interface kit for every GM vehicle on the planet that will make it 'normal' or 'industry standard', right? Give you standard line outs, standard speaker outs, will still make sure that you get all your interface sounds piped through your speakers like door chimes and warning bells, blinker clicks, ect ...

Whats great is you're talking about them using weird speakers shapes in places where ... NORMAL SHAPES WON'T FIT.

What all of this means is that you don't actually know what you're talking about.

GM only has 2 or 3 interface busses for the dash electronics in their cars and there are interfaces for all of them. Get a clue about your job.

Re:why is the CD player on the same network?

[tompaulco]

adjust volume to compensate for engine noise
But this introduces an unnecessary step and an assumption. The system guesses how loud the road noise is by using the current engine RPM. Then the radio system gets loader based on that guess.
Instead, they could completely isolate the stereo from the rest of the vehicles systems, and use a microphone to MEASURE the ambient noise and raise the volume by the precise amount necessary. I had a car stereo that did this in 1989. There is no reason in this day and age to make a guess at engine noise from the car's data rather than directly measuring it.

Re:why is the CD player on the same network?

[garyebickford]

To entertain the arm candy.

Re:why is the CD player on the same network?

[BitZtream]

Uhm, this isn't Windows, thats not how it works.

The 'high performance' package from an ECU perspective is almost certainly nothing more than torque curve modifications to 'not hold the engine back' at certain RPM ranges that would make it hard for a dipshit off the street to drive. My car is one of those cars.

The other $4550 worth of the cost however typically goes to suspension or actual engine upgrades.

Unlike software were including extra, but disabled functionality has essentially no cost, in cars the more powerful engine has several costs. It costs more to manufacture itself, it requires different drive line components for supporting it and all sorts of things. In short, they don't do what you're referring too because its not cost effective to sell the bigger more powerful engine at a reduced price with an ecu tweak to ton it down. Its still far cheaper to put in a smaller engine.

Being that they work on 10 week cycles when producing cars, its not like they have to keep all sizes of engine in stock. This 10 week cycle we make big engine cars, next cycle medium, and the one after that is cleanup cycle or whatever.

If you think everyone has same engine you've never looked under the hood. All the corvette performance changes involve different engines with physically different configurations.

Re:why is the CD player on the same network?

[Anonymous Coward]

To give you something to listen to when you're waiting for the tow truck.

Re:why is the CD player on the same network?

[AJH16]

Ironically, to try and keep your stereo from being stolen. Good stereos used to be stolen a lot so they started tieing them to the VIN which is supplied by the ECM. Unfortunately, they have now started figuring out ways to use that connection to hack in to the ECM. Oops..!

Re:why is the CD player on the same network?

[Archangel Michael]

OR

Better yet, use the Microphone to pick up the Ambient noise, and generate a counter wave / noise cancellation in the stereo output to create a sound proof bubble around the cabin, making the ride even quieter than naturally occurring.

Re:why is the CD player on the same network?

[Anonymous Coward]

> YOU ALREADY PAID FOR THE STEREO IN THE CAR.

True, but do you realize how much money GM makes on replacement or upgraded components? The replacement head unit for my Chevy was nearly $1,000. I would have never considered paying that except that my insurance company paid for it since it was damaged in an accident and that I would have had to replace the entire system because of the non-standard line level out voltage and speaker sizes.

Another example, my father spent nearly $1,600 on a CD changer for his Suburban. He, obviously, would have preferred buying a high quality aftermarket unit except for the fact that GM intentionally made the changer incompatible with every other head unit on the plant.

Re:why is the CD player on the same network?

[kimvette]

Every marque with the BOSE system will have the same problem for line-out voltage and impedance issues. For those systems all you need is a line-out converter.

Amplifier installation? Unless you're installing a monstrous amp, installing an amplifier in a Corvette is simple.

Speaker installs? Okay, slightly more difficult, but no more difficult than any other sportscar.

System sounds? Not a problem - multiple solutions exist for that. Just be glad the head unit in that car doesn't act as the hub for the CAN bus. The Corvette is far from the most complicated or challenging auto sound vehicle.

Re:why is the CD player on the same network?

[Anonymous Coward]

> GM only has 2 or 3 interface busses for the dash electronics in their cars

No. The Corvettes have a different line out voltage from any other GM vehicle. Resistor networks you can by for ~$125 (the last time I looked) do a decent job, but you end-up with a lot more engine noise than if you put in a standard head unit.

Re:why is the CD player on the same network?

[godel_56]

The reason why the Car Stereo is on the same network is because too many people were buying cars with no stereo or the basic stereo then going to after market shops where they could get a much better stereo for the same amount of money. Manufacturers decided that to reduce this they would just make the car stereo a required part for the whole system to work. It gives you a good reason to pay $1200 for the stereo upgrade which we know isn't worth $600.

Similar to printer manufacturers and ink jet cartridges.

Re:why is the CD player on the same network?

[mijxyphoid]

nope.

It's on the bus to listen for vehicle speed so the active volume can go up and down. Advanced one spit out channel and RDS data for the HUD. there is zero possibility to send out a "lock up the breaks" command from the car stereo into the CANBUS unless you rewrite the stereo's firmware first. and that is not gonna happen, There are a LOT of guys looking to hack GM and Ford satnav systems to get past the damn CANBUS VIN lock. They have had ZERO success in the past 5 years.

Ive been working on this for the past couple of months, and I have had success.
(Search for VE Commodore HVAC Radio Hacking on google).

Simply grap a SOP Clip, and an EEPROM programmer.
The VIN number is stored as plain text on the Radio, Cluster, BCM, and a few other modules....

The main reason why Manufacturers have been integrating the radio in to the vehicle, is because the radio is no longer just a radio, its an info/tainment center.
HVAC controls, Sat-Nav, Park Assist, Reverse camera, radio, Bluetooth Audio connectivity, Video in Motion prevention, etc....

On GM vehicles, there are two separate buses, the high speed GM LAN, which is used for critical stuff such as engine, transmission, brakes, stability management, etc....
Then there is the low speed BUS which is used for stuff like HVAC, Radio, Instrument Cluster, Body Electronics, etc.

What the article is trying to point out is that FORD for example, uses wifi to program its Ford SYNC (Windows CE) system at the factory.
Whether a wifi module is plugged in on the line, and removed later is anyones guess. However, all the Low speed (Non critical stuff) is usually accessible via the low speed can bus, such as locking/unlocking doors, and remote starting of the car (via the Body Electronics Modules) etc.....

Re:why is the CD player on the same network?

[Anonymous Coward]

There are some very good reasons. In many current luxury cars, if you get in an accident bad enough to pop the airbags, the main computer will unlock the doors, roll down the windows, shift into neutral or park, shut down the engine, turn off the stereo, activate the emergency flashers, cut main power as if you had turned off the key in an older car, call 911 if you have OnStar or similar, etc., etc. If the stereo, windows, flashers, etc. aren't on the same bus as the main computer, none of this can happen.

In more sedate circumstances, let's say your engine computer needs a firmware update. It would probably save a boatload of money if the dealer could shove a special CD in with the firmware image into the CD player and POOF. If you save enough money, it doesn't matter if it makes the car slightly more vulnerable to theft. The savings will cover the lawsuits from the couple of people with enough means to bring a suit against the manufacturer.

Re:why is the CD player on the same network?

[Anonymous Coward]

Hi, just curious: what's your recommendations for a new-model Volvo that has the stereo built into the HVAC control system? There's a more expensive optional stereo available, but it seems to only be available in a package with their horrible in-dash nav system, and extremely expensive too. Thanks in advance for any reply.

Re:why is the CD player on the same network?

[Grishnakh]

Doesn't work. The acoustics of a car cabin are rather complicated, and you don't know where a person's head will be. You'd end up with one person hearing less noise and one hearing double or triple the volume. There have, I believe, been some cars that have used active noise cancellation, but only for very low-frequency sounds, because the wavelength is very long. You can't use it for higher frequencies because of the short wavelength. You can, however, do a lot better if you build this technology into headphones, since the distance between your ear and the speaker is pretty much fixed in that case, but it's illegal to drive while wearing headphones.

Re:why is the CD player on the same network?

[Anonymous Coward]

> "lock up the breaks"

WTF?

Re:why is the CD player on the same network?

[Anonymous Coward]

Even with all of that work, GM decides to take the door and key chimes away from you if you replace the headunit.

I'd have thought getting rid of the incessant bong, bong, bong, bong, bong noises would have been considered a benefit.

Re:why is the CD player on the same network?

[tehcyder]

Yay! Another computer analogy for cars. I love this thread, it's messing with some of the basic tenets of reality.

Re:why is the CD player on the same network?

[Anonymous Coward]

GM does give a fuck. Opels interfaces their radios with a remote display mounted in the middle of the dashboard - there's no display on the radio itself. I brought an Opel Corsa with an aftermarket radio fitted by the previous owner. The remote display didn't work - but there is an interface kit. It doesn't work, why? The remote display asks the radio for its serial number and if it doesn't match, it refuses to wrok - flashing up "Security protected". When replacing the radio, you have to replace the display as well. Why bother? I've had 2 break-ins through the window in 2 years and each time, the radio was left alone, while my $10 sunglasses was nicked....

Re:why is the CD player on the same network?

[swalve]

Agreed. The ECU might be the same with just a different config code burned into it, but the motor is different in every car I know of.

Re:why is the CD player on the same network?

[StefanSavage]

nope.

there is zero possibility to send out a "lock up the breaks" command from the car stereo into the CANBUS unless you rewrite the stereo's firmware first. and that is not gonna happen,

I'd admit it is surprising, but you're wrong on this one. This is in fact one of the things we are able to do.

- Stefan

Re:why is the CD player on the same network?

[Airline_Sickness_Bag]

It's a Vette, not an Audi

Re:why is the CD player on the same network?

[vtcodger]

The obvious answer -- and one selected by many millions of Americans -- is never to buy a GM vehicle. GM sold me a really badly designed and crafted vehicle 50 years ago, and I resolved never to buy another car from them. Based on occasional rentals and friend's experiences with GM's cars, it's one of the wiser decisions I've made in life.

Figured this would have happen sooner

[AlienSexist]

With the capability for devices to do remote start, or ONSTAR to do things like remotely unlock your doors, as well as wireless keyfobs. I figured we'd already have people with devices that can fake these signals to gain access to and start automobiles. Much like how there exist DIY RFID readers where you can just walk through a crowd and read all their passport RFIDs and so on.. CD, iPod, Bluetooth, and Cellular attacks. That's clever too.

Re:Figured this would have happen sooner

[Lashat]

The reason this has not happened sooner is that remote start and auto-unlock are not the only features of OnStar. Key-fob/rfid cloning exists and is not prohibitively difficult. Remote engine kill makes initial get-away more difficult outside of a very small window of time. While vehicle tracking can find the vehicle after it has disappeared from the owners line of sight. Plus, exposes the chop shop location to the authorities.

Until it is possible to cheaply, easily, and quickly block/disable both GPS and cell signals to/from the vehicle after the theif comprimises the it, this high barrier to auto-theft will remain.

Criminals are VERY quick to change their m.o. in the face of tougher security. With many police forces adopting "no reponse with out confirmation" to burlgar alarms. It is much easier to burgle commercial and residential property.

Along the same vein: Watch an episode of "bait car". (one is all you really need) Where the police leave a car in a opportunistic way for a would-be theif to capitalize on the seemingly abandoned car.

Re:Figured this would have happen sooner

[CanHasDIY]

The reason this has not happened sooner is that remote start and auto-unlock are not the only features of OnStar. Key-fob/rfid cloning exists and is not prohibitively difficult. Remote engine kill makes initial get-away more difficult outside of a very small window of time. While vehicle tracking can find the vehicle after it has disappeared from the owners line of sight. Plus, exposes the chop shop location to the authorities.

Disagree; On-Star's remote capabilities are easily circumvented in most vehicles by removing the relay that powers the CMDA modem. Also taking into consideration that On-Star is a GM-specific product, and GM is not the sole auto maker in the world, the concept that their tracking capabilities are the main reason car theft is in decline is dubious at best.

Personally, I would more likely attribute the decline to a deepening cost vs benefit ratio; a lot of folks have no compunction about breaking a $300-400 computer/smartphone/whatever in the process of reverse engineering it, since worst come to worst, they can most likely replace the device in a paycheck or two; however, most hackers I know are a bit wary of taking on a automobile that A) costs as much or more than most people's annual salary, and B) also happens to be their only means of transportation.

Re:Figured this would have happen sooner

[Cramer]

OnStar is a GM brand. I'm told the Toyota/Lexus Enform/Safety-Connect system is run by OnStar. (on verizon's network.)

If you're going to boost a car thusly equiped, you'd be wise to remove or disable the thing FIRST. When manufacturers get wise and link the module into the anti-theft logic -- meaning the car won't work without it -- simply disable the radio/antenna. Not being able to start your car because it cannot see T-Mobile's network (for example) would never be accepted by customers.

Re:Figured this would have happen sooner

[Lashat]

I guess that our definition of "easy" is different. Most OnStar boxes that I have seen reside behind truck/cargo area panels. These require a decent amount of effort to remove or even destroy to rip out. Once you have access to the box then you can just pull out the antenna or cut the modem wire.

However, this does NOT disable the GPS tracking ability.

Easy to me would be a portable and concelable jammer of cell and GPS signals.

The key to most successful auto-theft is to look like the owner getting into the car, start it and get out of the area. NOT digging around in the trunk/cargo area looking suspicious.

As far as my dubious concepts, here are two links for support.
GPS leads to chop shop. (there were many of these if you search)
http://www.canada.com/edmontonjournal/news/story.html?id=68129266-9628-4bdf-a7f8-52265fdaa318

FBI report states that technology has lead to a decline in auto-theft
http://news.consumerreports.org/cars/2011/09/fbi-reports-a-decline-in-auto-theft-in-2010.html

Your personal attribution of the deepening cost vs benefit ratio somewhat applies. If you examine the cause of that "deepening" wouldn't it be all of the technological factors that previously discussed?

Re:Figured this would have happen sooner

[CanHasDIY]

OnStar is a GM brand. I'm told the Toyota/Lexus Enform/Safety-Connect system is run by OnStar. (on verizon's network.)

Duly noted.

If you're going to boost a car thusly equiped, you'd be wise to remove or disable the thing FIRST. When manufacturers get wise and link the module into the anti-theft logic -- meaning the car won't work without it -- simply disable the radio/antenna.

For the record (and the benefit of my fellow paranoids), you can actually request this equipment be disabled for you by the dealer prior to purchase, or by the owner if they know where to look. Of course, this is a moot point for those who actually intend to pay for and use the service, but personally I would never subscribe to a service that can arbitrarily disable my vehicle without my permission... among other, privacy related issues.

Not being able to start your car because it cannot see T-Mobile's network (for example) would never be accepted by customers.

Yea... I remember saying something similar when GPS devices started becoming ubiquitous in cell phones... 'surely no one will accept a phone with a built in tracking device!'

Ah, the naivety of youth..

Re:Figured this would have happen sooner

[CanHasDIY]

I guess that our definition of "easy" is different. Most OnStar boxes that I have seen reside behind truck/cargo area panels. These require a decent amount of effort to remove or even destroy to rip out. Once you have access to the box then you can just pull out the antenna or cut the modem wire.

However, this does NOT disable the GPS tracking ability.

Much easier to just remove the relays which power the On-Star/GPS devices, which are often housed on an easily accessed panel under the hood or dashboard. Instructions for disabling the aforementioned systems are prolific on the 'nets, or you could just ask your friendly neighborhood auto tech to disable them for you.

Fortunately, we don't (yet, hopefully) live in a world where the secret government places hidden trackers/disablers in every car sold in the country.

Easy to me would be a portable and concelable jammer of cell and GPS signals.

Except that you might as well stick a big "I'M BREAKING THE LAW" flag in the window. Cell jammers are illegal and highly noticeable ('hey, why is there a dead spot surrounding that Tahoe over there?'); disabling non-safety systems on a car is not.

Your personal attribution of the deepening cost vs benefit ratio somewhat applies. If you examine the cause of that "deepening" wouldn't it be all of the technological factors that previously discussed?

To some degree, yes, just as the economic flux of the past 40 years has played its part in driving costs up and keeping wages flat.

Re:Figured this would have happen sooner

[Cramer]

Heh. The key there... a cellphone is a tracking device. Granted, tower triangulation isn't going to tell what seat you're in.

yo.

[grub]

So the other day I was on the bus and I saw this hot woman driving a car. I pulled out the iPhone, SSH'd into home and ran nmap on her license plate.

LOL, stupid woman didn't notice her gas cap was left off from the last fill but nmap caught it. Used nc to push 'fire.jpg' into her tank and she blew up.

True story, fucker.

Re:yo.

[Anonymous Coward]

You should have gone with a Dr. Bob story, those things are a hoot and a half.

Re:yo.

[The Grim Reefer]

So the other day I was on the bus and I saw this hot woman driving a car. I pulled out the iPhone, SSH'd into home and ran nmap on her license plate. LOL, stupid woman didn't notice her gas cap was left off from the last fill but nmap caught it. Used nc to push 'fire.jpg' into her tank and she blew up. True story, fucker.

So are you saying she was "hot" prior to blowing up, or are you being literal and meant afterward? Just wondering.

Re:yo.

[antdude]

Why would you want to blow up a hot woman? :(

Re:yo.

[Anonymous Coward]

So the other day I was on the bus and I saw this hot woman driving a car. I pulled out the iPhone, SSH'd into home and ran nmap on her license plate.

LOL, stupid woman didn't notice her gas cap was left off from the last fill but nmap caught it. Used nc to push 'fire.jpg' into her tank and she blew up.

True story, fucker.

And this is why iPhones suck. With my N900, I can nmap directly from the phone.

Re:yo.

[Anonymous Coward]

Please mod down, this is not even remotely funny. Just disgusting.

Re:yo.

[Anonymous Coward]

I would, but why waste mod points on a disgusting unfunny AC like you?

Re:yo.

[SleazyRidr]

Seriously, wtf is grub on?

Re:yo.

[Anonymous Coward]

Seriously, wtf is grub on?

Windows probably... that'd explain why he's losing it.

It's the troof bro'

Car security has been plummeting for ages

[Riceballsan]

In many many ways we've been opening more security holes in our cars as time progressed, the wireless unlockers. Even if we pretend that wireless isn't heaven to sniff and spoof. People leave their keys out in all sorts of public places, not everyone locks them up at the gym, most people leave them unattended at a waterpark or beach etc... before wireless that was reasonable, no-one is going to steal my keys because there are 500 cars in the parking lot, nobody can try each one. now with wireless, if you steal someones keys, you can just walk around the lot and push a button to make it beep and find out where the car is.

Re:Car security has been plummeting for ages

[drinkypoo]

Yeah, this is what I came here to comment on... you can go to dealextreme and buy a couple of unlocking tools, and anyone can get it. Probably not too much harder to find more contemporary tools.

Re:Car security has been plummeting for ages

[Anonymous Coward]

It works for Microsoft.

Microsoft has this business model, they make a buggy OS, and instead of fixing the problems, they sell you security solutions and "bettter" or newer OS's to counter the problem.

Why shouldn't the car manufacturers do the same?

I mean, look at the cars today, most of them last 5 years, 10 if you're really good to them, but after that, you won't find spare parts, and the maintenance costs will go up sky high.

Anyway, as long as they don't use this imbecilic idea on self-driving cars, I really don't care.

Re:Car security has been plummeting for ages

[AJH16]

I never understood why they don't implement more secure wireless keyfobs, or maybe some do. It is easy to make it so wireless isn't heaven to sniff and spoof. Simply make a time driven rotating key based on a shared AES key. Make the lock and unlock code different and you effectively have a secure, spoof proof system. When I get out of my car, I only transmit lock so you can't unlock even during the available window that the code is good for. Similarly, when I return to my car, I'm in it for the period of time that the unlock is good for so it does you no good. You could even use the insertion of the key in the car to allow for the clock to be kept in very close sync with a growing tolerance if it has been a while since the car was used.

Re:Car security has been plummeting for ages

[Anonymous Coward]

I was under the impression from my car manual (2010 dodge avenger) that the remotes are on a PRNG rolling code and it will accept any of the next 25 codes in sequence but if you press your remote too many times out of range or use the wrong remote it won't respond and you'll have to re-pair.

Re:Car security has been plummeting for ages

[toddestan]

Even with 25 tries, you should be able to cover a decently-sized parking lot.

Re:Car security has been plummeting for ages

[tomboalogo]

"I never understood why they don't implement more secure wireless keyfobs,"

Because you've never worked in the automotive electronics industry (I do). It ain't pretty!!

Wrong demographic

[prichardson]

I seriously doubt this will have much effect on car thievery. A jimmy and hotwiring are things pretty much anyone can do. On the other hand, hacking a car's PC is not a skill generally held by people who have an actual desire to steal cars. I expect a few very expensive cars will be stolen via high-tech means, but I wouldn't expect this to cause a noticeable change on cat theft rates for non luxury cars.

Re:Wrong demographic

[DMUTPeregrine]

I think you're (somewhat) wrong. Initially it won't mean much, but just like pre-packaged malware suites for credit card fraud (ZeuS being the biggest example) point-and-drool interfaces for car theft will be made eventually.

Re:Wrong demographic

[427_ci_505]

Even non luxury cars come with things like bluetooth nowadays. The attack vectors are present.

Re:Wrong demographic

[heckler95]

The first guy to hack a car's PC needs to be skilled. Turn that into a black-market android app and all of a sudden the middle-school dropout who had trouble learning how to jimmy or hotwire can steal a car with the swipe of a touchscreen. It's just a matter of time.

Re:Wrong demographic

[Lumpy]

no it's not.

there is ZERO connection from the BT to the car's operational CANBUS.

Re:Wrong demographic

[tomboalogo]

"A jimmy and hotwiring are things pretty much anyone can do."

Ummm this hasn't worked for a while no matter what you saw Jason Bourne do on TV.

Re:Wrong demographic

[prichardson]

I'm not saying that the attack vector isn't present, I'm just saying it's not worth it. Someone with the skills to steal a car that way isn't going to bother to make $5000 (at most) selling a stolen car for parts when they could make that in a week at a legitimate job (that they can get with the skills required to steal said car in said fashion).

Now, stealing a crazy-expensive car is another matter entirely.

Re:Wrong demographic

[CanHasDIY]

Ignoring, for a moment, that most-if-not-all automotive computer systems are proprietary and thus will vary from manufacturer to manufacturer, I think it's more an issue of funding. If cars cost what computers do, this issue would have come to a head years ago.

Considering cost, it seems to me that hacking of automobile computer systems will, for now, be the exclusive domain of researcher organizations and vast criminal empires... to that end, imagine the havoc that could be wrought if, say, the Zeta's got a hold of one of ICE's Suburbans and managed to reverse engineer it's systems...

Re:Wrong demographic

[Anonymous Coward]

Criminals don't always think so logically, otherwise they probably wouldn't be criminals in the first place.

I always wonder about the people who are constantly begging at an intersection near me. I think "If you are capable of coming out here every day for the entire day hustling cars you could probably hold down a job that paid more."

Re:Wrong demographic

[Anonymous Coward]

No, YOU'RE wrong. Every ECU in the vehicle is somehow connected to all other ECU's, either via the CAN or LIN busses, or via an RF link (think TPM sensors). Even in vehicles that have separate CAN busses for the interior and the powertrain, the body control module (or equivalent) will gateway messages from one bus to another, so you can operate the vehicle. There is practically ZERO hard-wire electrical connections within a modern vehicle. Even your power window motors aren't connected directly to your window switches -- that would be a waste of heavy copper conductors, and add weight to a vehicle that is trying to wring every last MPG out of itself.

Once someone demonstrates a vulnerability and writes a script for it, any 'script kiddie' will be able to break into the CAN bus. Once there, a script could issue just about any valid command (unlock driver's door comes to mind), since the CAN bus is neither encryped nor authenticated. Most CAN-bus connected modules can be made to spoof their CAN bus ID, thus masquerading as any other module on the bus.

Please RTFA. It will plainly state the various successful attack vectors used.

Re:Wrong demographic

[Anonymous Coward]

no.....not until theres an app for it...then what??

Re:Wrong demographic

[gl4ss]

no it's not.

there is ZERO connection from the BT to the car's operational CANBUS.

when the entertainment unit is made integral part of the onboard computer systems then uh.. yeah, there is direct connection. why would a car company do that? well, two reasons: to make it more of a bitch to go with aftermarket 40 bucks radios so you'll have to buy their most expensive in car entertainment package when you buy the car and the second reason is simply cutting costs and reducing the number of cpu's on the car.

Re:Wrong demographic

[Cramer]

Well, COULD do... back in the 80's. Starting a car by touching the right two wires in the igition harness ended around 1989 with the last of the carbureted cars. (I'm told that was a Subaru Justy.) A carbureted car could be started that way. Cars with electronic ignitions have more wires. And modern ones have anti-theft devices.

Re:Wrong demographic

[harl]

You're missing the point.

They don't have to. Does every criminal have to take apart a car door and figure out how to make a slim jim before they can start stealing cars?

One group will discover an exploit and make tools to automate the process. They will then spread them so people without skills to discover the exploit can exploit the exploit.

I don't have the skills to break DVD encryption but I can get the tools to do it in 5 minutes.

Re:Wrong demographic

[Jeng]

to that end, imagine the havoc that could be wrought if, say, the Zeta's got a hold of one of ICE's Suburbans and managed to reverse engineer it's systems

All though it would be handy for the Zeta's to be able to disable the ignition at will of an ICE Suburban, I think the greater threat would just be the Zeta's using a system to see where radio transmission are coming from.

If ICE never sees the Zeta's then ICE will probably never know that the Zeta's have the capability, but if you knock out the ICE's vehicles they will react to that immediately and make sure that vector no longer works.

Best defense, no be there.

Re:Wrong demographic

[phoenix321]

Remember Stuxnet.

Covert assasination anyone?

Implant a well-disguised piece of trojan code inside an ECU of opportunity.

Have it triggered at a specific speed, at local nighttime. Disable brakes, lights, airbags and stomp on the accelerator. If any crash is detected, quickly recover the firmware to an original, untampered backup that was stored away somewhere beforehand.

Crash investigators will find nothing but "reckless speeding" to be the cause.

Re:Wrong demographic

[lucifuge31337]

Well, COULD do... back in the 80's. Starting a car by touching the right two wires in the igition harness ended around 1989 with the last of the carbureted cars. (I'm told that was a Subaru Justy.) A carbureted car could be started that way. Cars with electronic ignitions have more wires. And modern ones have anti-theft devices.

God dammit I hate when people on /. talk about cars. You are just one of the many who are so wrong you are even embarrassing ME .

Re:Wrong demographic

[Lumpy]

Says the man that knows NOTHING about car electronics.

CANBUS is a series of messages. you cant send "start the car" into bluetooth and have it seen on the CANBUS as a valid message as it will be wrapped in a "audio system" preamble and container.

come back when you have a clue as to what you are talking about.

Re:Wrong demographic

[tomhudson]

... which is why you used a dent puller (or a big screwdriver and a hammer) to just remove the key barrel and insert a screwdriver, and turn the switch on.

Or if you had the misfortune of driving certain Chryslers, the pin at the bottom of the barrel that turns the contact pad would snap off in normal use, and you could just remove the whole barrel by hand, no tools required (happened to me at a gas station - I filled up, went to turn the ignition on, and it spun around and around and around with no effect. Had to pull out the barrel and use a screwdriver to turn the contact pads to the right position).

Re:Wrong demographic

[GameboyRMH]

Wrong, most EFI cars can be started the same way, there's nothing about EFI itself that makes it different.

Re:Wrong demographic

[Cramer]

You won't believe it until you see it with your own eyes -- in person. (you're doing exactly what the ignition switch does, just without the key... turn the ignition on, pulse the starter.)

Re:Wrong demographic

[lucifuge31337]

You won't believe it until you see it with your own eyes -- in person. (you're doing exactly what the ignition switch does, just without the key... turn the ignition on, pulse the starter.)

And how does that make the car start? Never mind, I'll answer for you: it doesn't.

It has never been that simple, despite how many movies you have seen. Cars don't do anything without power to the ignition, ECU, and preferably the accessories. Yes, that means you need to wrap a bunch of wires together first to power them before the magical movie "hot wire" does anything more than spin the starter and uselessly crank the motor. Yes, even cars with carbs. Even car without ECUs and with mechanical fuel pumps. The only exception to this rule are some older mechanically injected diesels which you weren't likely to find even in the 80s unless you were trying to steal Mack R models.

Re:Wrong demographic

[Cramer]

lol. A screw driver hammered into the side of the column is a dead giveaway. I had the switch housing (clamshell crimped together, really crappy) come apart in my old ford tempo. A few hours with a bag a zip ties...

It was even easier with even older cars that had the switch on the dash. Reach under the dash, one yank, and Bob's your uncle! *whistles innocently*

Re:Wrong demographic

[tomhudson]

You don't have to LEAVE the screwdriver in the lock - once you turn it past the point where the pin breaks and the car starts, you can remove it. From then on, you can start the car with a nail file, a popsicle stick, or if it's REALLY cold, a Tootsie Roll.

Re:Wrong demographic

[Anonymous Coward]

I always wonder about the people who are constantly begging at an intersection near me. I think "If you are capable of coming out here every day for the entire day hustling cars you could probably hold down a job that paid more."

Try showing up for that real job at noon reeking of malt liquor...

Re:Wrong demographic

[colinrichardday]

The old "we can't redirect that convoy because then the Germans would know that we broke Enigma" gambit.

Re:Wrong demographic

[Anonymous Coward]

It's relatively rare for people to steal expensive cars. The people in the "business" of stealing cars want to steal a car that there's lots of demand for aftermarket parts.. that means Honda Accords, Ford Taurus, etc.

Re:Wrong demographic

[waives]

I have started my 1999 Corolla by yanking a connector out from behind the steering wheel and bridging things with paper clips. Wasn't able to figure out how to get the steering lock to release though.

Re:Wrong demographic

[lucifuge31337]

I have started my 1999 Corolla by yanking a connector out from behind the steering wheel and bridging things with paper clips. Wasn't able to figure out how to get the steering lock to release though.

I have no idea what this post is supposed to mean. Are you trying to say your 1999 Corolla needs only two wires bridged to start and run? If so, it's the only one in existence.

Re:Wrong demographic

[waives]

You're making hotwiring a car out to be some extremely complicated thing. It's not, I was able to figure it out from scratch in 15 minutes of boredom, I'm pretty sure an accomplished car thief could do it in a matter of seconds.

Re:Wrong demographic

[lucifuge31337]

You're making hotwiring a car out to be some extremely complicated thing. It's not, I was able to figure it out from scratch in 15 minutes of boredom, I'm pretty sure an accomplished car thief could do it in a matter of seconds.

I think your reading comprehension is probably pretty poor if that was you take-away. I was arguing the simple fact that you don't just "spark two wires together" like in the movies and like the poster I responded two stated.

I work on auto electronics as a side job. This includes wiring race cars from scratch. I've got a better than average idea of how an automotive electrical system works. So, please, do try to argue facts with me if you want to keep this up. I can do it from rote memory while you google away at it.

Re:Wrong demographic

[Anonymous Coward]

Yes the cliche moment of twisting two wires together in a movie is oversimplification, but not by much. It is the last piece of the puzzle though, and I'm willing to bet pros use alligator clips or the like anyway. (There's a lot of amps in the ignition circuit... wouldn't want to touch that) So maybe there's two sets of wires, maybe a dozen. Still materially it's not that hard to "hot wire" a car. Last week I just bypassed my failed fuel pump relay with a paper clip, the relay having an IC circuit and a double sided mini circuit board. If I had been in a wreck potentially the fuel pump would have kept pumping fuel into a theoretical fire, but it ran fine for the week that it took to source the proper part.

Screwdriver works a lot of the time, and I'm speaking from experience - but on my own cars only of course. No winking either, straight up.

I like the idea of 2 kill switches, a public one (for lending the car out ) and a private one (so that a "friend" can't take your car down the road - don't laugh it happened to me) Would be good for teenagers too. You could just pull the main ignition coil wire off slightly and that will disable it as well. Here comes the reverse car analogy: computer security is something you practice not something you acquire. Bam!!

Sorry for posting AC, my tin foil hat is in the shop.

Re:Wrong demographic

[lucifuge31337]

(There's a lot of amps in the ignition circuit... wouldn't want to touch that)

Seriously /. posters. Just stop it. This really is embarrassing to everyone.

Re:Wrong demographic

[Anonymous Coward]

OK, there can be - I know there's a usually a relay but I wouldn't bet on it. You don't know what someone else has potentially done to the thing, I for one am not inclined to want to touch two wires together not knowing, my point is that gloves or alligator clips would be the way to go. Sorry - I'm willing to bet I have more experience in hacking raw electrical stuff, and I've had houshold 120 go through me, I've felt stray current in marine settings maybe i'm more careful by experience. I still wouldn't want to touch it, even if it is the small juice and not the large juice. You want to develop a respect for the amount of electricity in a car battery? Bridge the two terminals with a wrench, you'll see. I've heard stories of the thing melting. Please don't actually do it without a shit-ton of safety equipment (saftey glasses, 10 foor long pole, no route to ground for your body etc. etc.)

Simply put, yes you are correct that just wiring two wires together does not make a "hotwire" it can be 4 it can be more, but it's not materially or an order of magnitude more difficult than you say to do it - so what if it's a dozen? Still not much harder than 2. And yes one can use paperclips to "bridge things" in a corolla or even a volvo especially in a socket arrangement that is common for car connectors. I've done it an several cars, actually last week in fact on my own volvo so you sir are partially accurate, but mostly misleading. (an idiot)

Re:Wrong demographic

[Anonymous Coward]

Bullshit. Done it with a '79 datsun, a screwdriver, and the solenoid.

Re:Wrong demographic

[lucifuge31337]

Yes, figuring which and how to bridge 4 or more wires is absolutely just as easy as sparking 2 together like in the movies. I'm obviously being totally misleading.

Also, you have plenty of time to figure this out with your multi meter in a nice well lit area while you are stealing a car. And the ignition switches are really easy to get to on things made after the 70s.

That stuff was totally easy. What was I thinking?

Re:Wrong demographic

[waives]

You're picking nits: ok, you don't spark two wires together, you spark 3-4 pairs of wires together. Not much difference.
Since I know for a fact that it's possible to start my car this way because I've done it, why don't you give your theories on why it's impossible?


And on the off chance you're not full of shit, can you tell me how I'd go about clearing the steering lock?

Re:Wrong demographic

[lucifuge31337]

Bullshit. Done it with a '79 datsun, a screwdriver, and the solenoid.

A 79 Datsun doesn't need power to an ignition coil? Did you forget to mention the part about it having a mechanically injected diesel motor in it?

This is really, really basic shit. No spark=no run. No voltage to the ignition coil=no spark. You can crank the starter all fucking day and the motor won't run.

Re:Wrong demographic

[lucifuge31337]

You're picking nits: ok, you don't spark two wires together, you spark 3-4 pairs of wires together. Not much difference. Since I know for a fact that it's possible to start my car this way because I've done it, why don't you give your theories on why it's impossible? And on the off chance you're not full of shit, can you tell me how I'd go about clearing the steering lock?

I seriously doubt you've done it, or you'd know that you aren't "sparking 3-4 pairs of wires together". You are bridging 12v (which you'll find somewhere in the harness) to the ignition, whatever other separated required systems are on the switch depends on the car, and possibly the accessories (but not necessary). Then you are "sparking" the starter solenoid "s" terminal lead to the bundle or some other 12v source.

And you "clear" the steering lock with a slide hammer. And then jam a flat head screwdriver into what is left and fuck the hot wiring, because you can just turn the ignition switch with the screwdriver. No wiring necessary.

Re:Wrong demographic

[couchslug]

All you have to do to steal a car is pull up to it with a snatch truck, grab it with a wheel lift, and drive off down the street. You can disengage the parking brake later if you don't mind tire smoke for a bit.

Repo'ing cars isn't like on TV, and it was educational. Bystanders don't give a shit about a tow truck. Repo drivers know how to disable alarms etc. It's part of recovery.

Re:Wrong demographic

[tomboalogo]

Last time I checked it was 2012.......

In a modern car,first you have to fake the key CRYPTOGRAPHICALLY talking to the immobilizer in the steering column. Or you can try to fake the immobilizer CRYPTOGRAPHICALLY talking to the ECU over the CANbus. Go ahead twist wires until you're blue in the face, I'll wait............

Re:Wrong demographic

[Anonymous Coward]

> Covert assasination anyone?

Nowadays the zionists (themselves sitting on a stockpile of 220+ nukes at Dimona) like to assasinate iranian nuclear scientists with magnetically attached, side-attack car bombs. Mossad hires ethnically non-persian opposition / resistance groups within Iran and tasks them to ride motorcycles and attach the bombs to the targeted cars on the go. The latests (5+th) victim of this scheme was Mostafa Ahmadi Rosan, the Natanz plant director (3 days ago).

Looks like Iran cannot import alu-bodied cars (like Audi A2 or Ferrari 360 and up). Maybe they could cover the skin of gov't cars with Zimmerite, a wavy-surfaced plaster, that was applied to the outside of Tiger tanks, to repel magnetically attached limpet mines, which some self-sacrifical soviet guard units used to blow up nazi armour in WW2.

Re:Wrong demographic

[Jeng]

Close, more like, we could avoid their tanks on a continuous basis and they would never be the wiser, or we could blow up a couple tanks once.

I don't quite get it

[kav2k]

We need a car analogy here.

Re:I don't quite get it

[DarkOx]

Sure its like if you had a car and left in a parking lot. Now suppose this car of yours had wireless unlock that did not use strong encryption, or any kinds of DH mutual authentication, rolling code, or time based scheme. Then suppose some guy with some relative simply radio equipment waited for you to unlock it. He can could then use a simply replay attack to unlock it and steal any shit you had in there.

Does that help.

Sometimes hi-tech is not the best solution....

[Anonymous Coward]

I live in a country with high levels of criminality.

And the truth here is: You could have a fancy high-tech anti-theft system. But that is going to give you a broken glass or something similar.

The best counter-measure that you can use here is leave the car open with nothing of value or personal belongs inside, and remove a cable from the ignition system.

If a thief cannot start the car in less than 5 minutes, they ussualy try to find a more easy target. Sometimes a simple switch hidden in the car it's better than a $5000 anti-theft system.

Re:Sometimes hi-tech is not the best solution....

[hedwards]

Which is why police love lojacks, often times they not only get the car back, but they catch the thief red handed.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Were in Vancouver when a theft ring wants a car they just show up with a flatbed and take it away. It doesn't even arouse suspicion.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Well, here is the same, but in our case if a theft ring wants your car they just show up with a .22 on your window... If you are lucky they allow you to leave. If not... well you will probably end on the news.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

I have a friend of mine with a Jeep Wrangler. The glove box is left open, there is no radio, and there is obviously nothing in the vehicle. Still, thieves will hop in, and upon finding nothing to steal, will vandalize things, be if defecating on the seats or whatnot. So, having nothing to steal won't help things.

The ONLY thing I've found which actually helps against car theft is a car alarm that I had custom installed. Upon going off (and so far, I've never had a false alarm), it spews pink fog into the vehicle's interior while flashing strobe lights and having a distinct siren. I've had my truck broken into, but usually the break-in is pretty quick, and few thieves will be trying to crack into a strongbox welded to the frame while the vehicle is billowing fog. (In parking garages, it disperses quickly, but the fog machine can make the interior opaque in 3-5 seconds.)

Re:Sometimes hi-tech is not the best solution....

[CanHasDIY]

Well, here is the same, but in our case if a theft ring wants your car they just show up with a .22 on your window...

You must not live in a right-to-carry state, if thieves are carjacking folks with pea-shooters...

'Round these parts, that's the fastest way to get your ass blown off by someone with a real gun.

Re:Sometimes hi-tech is not the best solution....

[istartedi]

On the Internet, nobody knows you're not a badass with a .44 at the ready under the driver's seat. (suppressed laughter). Yes we do. (open laughter).

Re:Sometimes hi-tech is not the best solution....

[betterunixthanunix]

If you do not think a .22 is a worthy gun, then why not come down to the range and hold up my targets while I shoot mine?

A .22 is plenty deadly, and I would not bet my life on rimfire cartridges not being less reliable than centerfire. If someone already has a gun pointed at you from a foot away, you are not going to get your gun out of the holster before they shoot you, and that is regardless of what caliber they are packing.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Sure tough guy. And as you're slowly reaching for your gun with your fat Cheetos fingers, HE ALREADY FUCKING SHOT YOU WITH THE ONE POINTED AT YOUR DIPSHIT HEAD!!!!!11110!

Re:Sometimes hi-tech is not the best solution....

[k6mfw]

Lo-Jack freq is 173.075 if you want to DF one of these guys.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Wrong.

A .22 is almost an ideal murder weapon. It has the energy to get into your skull. But not enough to get back out in most cases.

Bounces around and makes a nice mess of your thinking bits. Fairly quiet as well too.

At 3 foot away a .22 SHORT can kill you.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

you are not going to get your gun out of the holster before they shoot you

what if it's already part of the car?

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Aww, beat me to it.

Sure, you can have a big gun that will atomize their entire skull for all it matters. All the attacker needs however is to have the drop on you. Your arms move downwards even slightly? Well, you may still have a skull, but there's going to be a nice, neat hole in the front of it, and you may have difficulties after that drawing your own elephant-exploding pistol.

Having a big gun is fine and all if you need to overcompensate the hell out of yourself, but when it comes down to it, being threatened with even the smallest of guns is going to make 99.999% of people do exactly as their told, no ifs ands or buts. The remaining .001% have that aforementioend neat, small hole in their forehead.

Re:Sometimes hi-tech is not the best solution....

[GameboyRMH]

The only anti-theft system I'd consider putting on a car is a DIY lojack. Basically like a smartphone you can reverse-SSH into and get the GPS coordinates from, and provide a web interface for law enforcement if the car is stolen. The only downside is that your full travel history could be pulled up by the telco...I can't think of a simple way to detect if the car is started by hot-wiring. But any car I own will be either not worth stealing or too strange and complex to steal.

Re:Sometimes hi-tech is not the best solution....

[Whorhay]

I'd agree that going for a gun when someone already has one directed at you is silly. But that doesn't mean you can't fight back very effectively, especially if they are within arms reach.

Somewhere I saw a video of a guy disarming an armed assailant. From the time he decided to disarm the guy it took 12 thousandths of a second for him to do it. I'd like to see what percentage of street thugs have a reaction speed quicker than that. People can move very quickly when motivated, even an overweight person with a knife can close 20 feet of seperation before the person he's charging can draw and fire reliably.

So yes going for your gun is stupid but make no mistake, beating another persons reaction time is not hard.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

I have one of the best possible theft prevention systems on my truck, it's downright ugly. On top of that, it's pretty scary to drive, the last time I had it on the freeway the steering partially fell apart and I nearly lost it. So if someone is crazy enough to steal my rust bucket they won't likely get very far before they abandon it.

I was surprised that in the six years I rode my motorcycle it never got stolen, it was a nice 600cc and not all that common. Two guys could have thrown it in the back of a pickup or van and gotten away with it. If it's strapped into a truck it will look like someone moving the bike, if it's in a van it won't even be seen.

Re:Sometimes hi-tech is not the best solution....

[colinrichardday]

How well does a .22 penetrate car windows/doors?

Re:Sometimes hi-tech is not the best solution....

[Beryllium Sphere(tm)]

Getting into a gunfight over an insured car is not good security thinking.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

All you need to do then is replace the pink fog with chloroform or some other knockout gas...

Re:Sometimes hi-tech is not the best solution....

[couchslug]

Of course not. Ordinary repo work.

Re:Sometimes hi-tech is not the best solution....

[hedwards]

Honestly, you should just get a lojack, chances are that the insurance company will pick up the tab on it, and unlike a smarthphone there's a sensor for it on just about every cop car out there.

Personally, I'm not sure that I'd get one, but if one is concerned with recovering ones car it's one of the few options that actually works. The one you're suggesting is unlikely to actually work if it comes to it.

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

You morons are really betting a fucking car worth 1k to 100k vs. your life? "Hmm, I can take this annoying money loss (which I might get back) vs. the chance to get a .22 in my face have my friends/kids/wife/parents attend my funeral"... seriously?

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Yay, let's all kill each other for the things we want!

USA is the evidence that intelligence is not a genetic trait.

Re:Sometimes hi-tech is not the best solution....

[SpooForBrains]

http://www.youtube.com/watch?v=jTOqLtI4Aro

Re:Sometimes hi-tech is not the best solution....

[SpooForBrains]

also: http://www.youtube.com/watch?v=hxQVUV0oa_0

The film absorbs one shot. Doubt it would take two (they don't demonstrate). I imagine unprotected glass wouldn't withstand one shot.

and: http://www.youtube.com/watch?v=Sq_3STLnSe0&feature=related

Re:Sometimes hi-tech is not the best solution....

[Anonymous Coward]

Yeah,.22 is my preferred round for jacking. If Jackie goes for a piece and I have to pop a rimfire cap in his grill, they're not drawing or following. If he dies that's business, but it's a little less likely with the .22 so less chance of a murder rap. Most of all, people are less likely to call the po-po if it goes off because it sounds like a firecracker. My .357mag, even with .38 specials, will get the phones ringing quick.

Re:Sometimes hi-tech is not the best solution....

[Whorhay]

The car is purely incidental. What you are gambling is a civil society versus one where a person can threaten physical violence to take anothers property at will. Whether it's my car, watch or wallet, you can bet I'll resist if I think it is reasonably possible I'll succede. I'm a male of larger than average size, I have some wrestling and martial arts experience along with plenty of gun handling. In a fight I'll do what is necessary to survive and I'll be doing it right up front rather than doing it by degrees.

When someone sticks a gun in your face and threatens you they have obviously not decided to kill you yet. So long as you don't mull over the decision too long and telegraph your intent obviously, you can easily deflect their weapon and execute your own attack before they can react. So the real question is whether or not you can attack and follow through well enough to survive. Not everyone can or is willing to and expecting them too would be silly, but those of us that can, should.

Bait car?

[NetNinja]

Ever watch bait car? They steal cars left and right!

The future of...

[Anonymous Coward]

The future of full coverage car insurance...

If someone wants your car, they will take it somehow.

Get full coverage.

Immobolizers

[whitedsepdivine]

Most cars except for Benz, are really easy to bypass there immobolizations. You just have to open the car's ECU and rip out the immobolization chip. You just get a check engine light on after the chip has been removed.

Re:Immobolizers

[BitZtream]

Welp, considering on my car that would require removing large portions under hood as well as, and heres the kicker ... opening a hermetically sealed aluminum box without damaging the sensitive components inside, some of which are designed to fail in case its opened that way.

I highly doubt I could (even with training/practice) GET the ECU out of my car and cracked up in 30 minutes. If you take 30 minutes to steal a car, you're caught.

Re:Immobolizers

[whitedsepdivine]

I guess it really depends on the car, and your knowledge. Alot of cars, you rip up the carpet or remove a panel and the ecu is right there. Then it is as easy as opening a computer case.

Additionally if you new what the car was before hand by looking at the VIN, you could have an already cracked ECU ready to plug in.

Re:Immobolizers

[Cramer]

On the cars I know, that's a lot more work than you might think. Audi/VW/etc. put the ECU where it isn't easy to reach. (unlike Datsun bolting them to the floor under the driver seat.) Once you do get to it, they're often filled with epoxy -- "weather proofing". Honda, on the other hand, easy to get to, easy to chip -- but I think that's intentional to make the cars favorable to hobby/tinkerers.

(Heh, our LeMons "race" car -- honda civic -- has two ECUs. One seriously hacked up for racing, and it's original OBD-II ecu for when it gets inspected. :-))

MagnaVolt

[sycodon]

I'll stick with my trusty MagnaVolt System.

Re:MagnaVolt

[DigiShaman]

Back in the late 90s, I remembering having a conversation with a car audio guy. He had a rather brilliant (if not deadly) idea. Run two exposed wires in parallel along the inside of the driver side door handle connected to the probes of a hidden taser (stun gun). When the would-be thief attempts to open the door, he get's a nasty little shock.

Only one problem with the idea. A semi-closed fist will clench harder when exposed to electricity. At least for AC current, not sure about DC however.

Re:MagnaVolt

[Anonymous Coward]

Depends on polarity I think

Re:MagnaVolt

[kmoser]

Or a Trunk Monkey.

Re:MagnaVolt

[RockDoctor]

Is a Taser (loose sense) an AC source or a DC source? Considering how relatively easy it is to step up an AC voltage to high values (four off-the-shelf audio transformers would do the electrical work, but the windings might arc-over too easily), I'd bet that it's AC. Just possible that it'll be rectified, but I can't think of a good reason to do so.

Re:MagnaVolt

[AssholeMcGee]

Simply method for older cars, I had a hidden switch to cut the ignition system off, you can do this to 90's cars even some cars today, you could also attach a switch to the starter instead of the ignition. They go to start the car and get no starter motor or they cannot get it to fire over. Depending on how fast they want to steal the car or the time the fell they have. They will move on to another car, or figure you have a cut off switch and try to find it. Cannot tell you where I hid my switch but I found my car broken into and the ignition switch (or steering column) busted a few times.

Re:MagnaVolt

[flyingfsck]

A hidden toggle switch and ignition coil and spark plug under the seat with some wires threaded into the seat works wonders. This was a rather common thing done by engineering students in the 1980s in my school...

Re:MagnaVolt

[tomboalogo]

the only car security system I'd have!!

Re:MagnaVolt

[GrumpySteen]

Depends on the model. They all deliver a varying AC Voltage, but some models, like the X26, add pulses of DC as well. The waveform also varies and isn't a simple sine wave.

Re:MagnaVolt

[wickedskaman]

So you live in Detroit... or Baghdad?

Re:MagnaVolt

[RockDoctor]

Ah, the amount of dedication devoted to improving machinery of death and torture! what a wonderful investment of money, brains and time. I'll bet the people who develop these tools are endlessly proud of their work. [/sarcasm]

Re:MagnaVolt

[AssholeMcGee]

Buick Grand National, rare car, so it is a target for theft

Re:MagnaVolt

[GrumpySteen]

While I'm disgusted by the all too frequent abuses of power that Tasers involved in, I have to admit that Tasers are much less lethal than gunshots so they are a step in the right direction.

We're never going to eliminate violence between humans (though it'd be nice if we did), so I'd much rather see society spending time and money spent developing weapons that are less lethal than see the focus shift to developing weapons that are more lethal.

Re:MagnaVolt

[Anonymous Coward]

Other way around. DC will continue until the potassium/sodium ion exchange is complete. AC will switch off every 1/60th or 1/50th a second.

iPod port attack + iCloud =

[AlienSexist]

Your car has been uploaded to iCloud and the criminal can now access it from anywhere!

Plenty of room to improve car security

[Anonymous Coward]

Seems like the obvious next step in vehicle security is to be more pro-active in the defenses, i.e., reliance on tracking systems to show where the car is, built-in webcam to take pictures of people approaching and occupying the car (yeah, he can wear a mask, but that makes him obvious to onlookers), etc. Your car should be pretty safe if, in addtion to jimmying the doorlock (by electronic means or otherwise), the thief needs to disassemble the engine block and pull out the module that is transmitting the car's GPS coordinates. Hard to do casually in an open area.

Re:Plenty of room to improve car security

[c0lo]

Seems like the obvious next step in vehicle security is to be more pro-active in the defenses, i.e., reliance on tracking systems to show where the car is, built-in webcam to take pictures of people approaching and occupying the car (yeah, he can wear a mask, but that makes him obvious to onlookers), etc. Your car should be pretty safe if, in addtion to jimmying the doorlock (by electronic means or otherwise), the thief needs to disassemble the engine block and pull out the module that is transmitting the car's GPS coordinates. Hard to do casually in an open area.

Doh... MS Security Essentials - it's free. ;)

IF they are in the car....

[Lumpy]

They already own the car.

Dont worry about a thief stealing the car by using the CD player. All of these articles are pure FUD. they cant do a "Shadowrun" style unlock and start from standing outside the car and using their Uber haxor toolkit.

Re:IF they are in the car....

[Anonymous Coward]

You obviously didn't RTFA. The most damning attack was when they got to the point of being able to play an MP3 recording of a dial-up modem session from an iPOD over a telephone handset they had dialed into the vehicle's cellular interface. There were then able to command the vehicle's doors to unlock.

Re:IF they are in the car....

[shilly]

I guess the economic incentives are there for someone to package this knowledge and sell on to car thieves, or to run a ring of them, but honestly, it still seems pretty damned unlikely.

Won't stop...

[Anonymous Coward]

I have a Nissan with an Intelligent Key, so I can walk up to the car, push a button on the door handle, and the door unlocks. This is theoretically vulnerable to a relay station attack, where Mallory can put a radio in the next cubicle over and his accomplice stands outside with another radio, this "simulating" my key.

I doubt this would happen. If my car is even stolen, it will be by one of the following methods:

- Taking the physical key, whether by force (robbery/carjacking) or TWOC. TWOC is highly unlikely, since I keep my keys in my pocket, and at home, I have no roommate or teenage child to decide to take my car. My wife obviously has permission to drive my car.

- Towing. This would be quite easy, as people tend to ignore wreckers, assuming the car owner has requested towing, or that the car is parked illegally. This would most likely happen away from home, as I have a garage at home. This is also not very common.

I live in Tallahassee, FL, which was recently ranked the USA's 8th most dangerous city. LoJack isn't available here, but if it was, I'd most likely get it for both our cars, especially since it's a one-time cost.

Now, the Nissan Intelligent Key has one interesting quirk that I hope to never find out about. Assume a typical carjacking where the perp approaches my car with a gun and makes me get out, while he gets in and drives away. The Intelligent Key is in my pocket, so assuming the carjacker does not kidnap me or search my pockets, the first time he turns the ignition switch to off, he will be unable to restart the car without the key.

I used to have a car with the ultimate anti-theft device, and when my car is no longer worth maintaining, I will most likely get another one: a standard transmission. My current anti-theft device is that my car is a non-luxury mid-size, 5 years old, with 52,000 miles on the odometer, making it less appealing. Most effective if I park near an almost-new luxury SUV.

Re:Won't stop...

[Anonymous Coward]

Yeah, people won't bat an eye at a car being towed in Tallahassee. It's amazing people are able to go out on a weekend in this town without being towed every single time. Fucking crime syndicate is what those tow company assholes are. You know they give those "No parking" lot owners a kickback for every car that is towed.

I eventually just got a Thirsty Moose card at Bullwinkles for the free parking. And they didn't tow if you got too drunk and took a cab home. The whole never pay a cover and drinking free didn't hurt.

I've been living here ten years now though and haven't heard of anyone getting their car stolen.

Ghost Dog

[Massacrifice]

They have a movie about his. If you havent seen it, rent/download Ghost Dog : The way of the samurai. One of my best. Main guy steals Lexus with electro device he built himself.

http://www.imdb.com/title/tt0165798/

Re:Ghost Dog

[Anonymous Coward]

Awesome movie! Also one of my all-time favorites.

In the movie, the device has only one button, a red blinking LED and beepy sounds coming from it. Pressing the button would magically unlock the doors, and later, when inside the car, the engine can be started by pressing and holding the button again. You see the main character stealing a Lexus and a Mercedes with it. Not very convincing. The device represents Ghost Dog's surreal ability to perform magical things, like Felix The Cat, of which a cartoon clip is shown at some point in the movie.

I couldn't believe my eyes when I say one of those real car-stealing devices. They actually look very much alike, except that there is an LCD screen and arrow keys for selecting car brand and type (and believe it or not, but almost every car in the world is in it).

Re:Ghost Dog

[Anonymous Coward]

That movie sucked.

Re:Ghost Dog

[Massacrifice]

Stick with Armageddon, then.

Low hanging fruit

[Anonymous Coward]

I've heard that a huge percentage of cars are stolen because there are places where people leave the engine running.

Then of course there's the whole iDevice left on the front seat problem. They don't get the car; but they still get something.

Really though, can we just dispense with the whole car alarm thing? Nobody cares. In fact, I'd like to smash the windows of cars that do it, including my own.

There are *real* alarms you can trigger silently when the car is stolen. Those rock. That should be standard; but only subject to activation from your key fob or by sending a text somewhere with a PIN that you determine. User-activated GPS location: good. Government tracking: bad.

In Europe

[Anonymous Coward]

Here in Europe high tech theft is done as follows:

Door is opened through the usual manners. (Window broken or various known vulnerabilities that are also used by road services when you leave your keys in the car.)
(Alarm may sound.)

A special device is put into the OBDB connector that does some magic to reset the ECU. (Overwrites certain values in EEPROM/FLASH. It has a nice interface to select make and model of target car.)
The alarm is now silenced and all known "carcodes" are lost.

You can now start the car with any fitting key. There is no need for transponder anymore.
Generally there are only a few (20) possible key combinations and you can by sets of those.

You now just need to reprogram the car again with another VIN, and change the chasis number.
Generally a VIN of a scrapcar is used.

The car will never be found...

brakes.sys has caused a system error

[Joe_Dragon]

To reboot the car trun key to off (soft switch)

If that does not work open hood and unhook battery

Re: brakes.sys has caused a system error

[TubeSteak]

If that does not work open hood and unhook battery

Then drive to the dealership so they can reset your stereo/satnav

just what we need more tech to lock to dealer

[Joe_Dragon]

Get ready to say good buy to any non dealer car repair place. And if they want to be real dicks about dealer oil changes at 3000 miles.

Alarm

[Anonymous Coward]

I always wondered about the legality of installing a pepper spray car alarm system. Is it considered a bobby trap?

Re:Alarm

[c0lo]

I always wondered about the legality of installing a pepper spray car alarm system. Is it considered a bobby trap?

No, it's a boobs trap.

Car theft via towing

[Firethorn]

Another thing about towing - people might assume the car is being repossessed. The 'not very common' thing might not be common, but it's a fairly well known method, as you don't have to break jack to do it. More appropriate when it comes to top end vehicles.

Personally, I'm tempted to install a hidden kill-switch.

Pleaze!

[Anonymous Coward]

I can has Porsches?

Re:Pleaze!

[c0lo]

Nope... but Lord (and Janis) willing, you might have a Mercedes.

If they don't do a half ass job

[Anonymous Coward]

of making the next car a Windows PC, I have no problem, I will simply back it up onto my Windows Phone and Microsoft cloud whenever and wherever I park it. If it gets stolen, I will simply restore it.

The amount of crime is directly proportional to...

[Anonymous Coward]

... the length of prison sentences...

So there is an EASY way to prevent car theft: imprison the perpetrators for decades, for so long that they either realise they have to give up crime, or spend the rest of their lives in prison, and thus can't reproduce.

Criminals create criminals through reproduction. This isn't rocket science.

'Poverty' does not cause crime, criminals do.

Old Skool solution

[El_Oscuro]

After my father's 1963 Chevy was stolen, he installed a car kill switch kit. You can get them for modern cars too. Since you put the switch where ever you want, it would take a thief time to find it, and they won't be bothered. You can sometimes get a lower insurance rate too.

Re:Old Skool solution

[jackbird]

Ah, yes, the joy of puzzled phone calls from mechanics who you forgot to tell (or who didn't remember) that the car won't start without the rear defroster turned on.

Re:The amount of crime is directly proportional to

[colinrichardday]

Wouldn't that make the amount of crime inversely proportional to the length of prison sentences?

IT is not future it is the past

[Anonymous Coward]

When you replace a lock with a remote control you certainly know what you are doing!

People have a false concept about security. even people in Slashdot!

Physical keys can be copied by taking a photo far far away.

Locks can be broken, but still it still can serve our security purpose. Electronic counterpart ? When an encryption method is broken, does it still can possibly serve as a security purpose? Why security systems were designed with single encryption method in mind? Why not more than one encryption methods ?

Any truth to this?

[ArchieBunker]

I've heard this mentioned other places. It was said by one person and kept repeating.

Can anyone locate a proof of concept attack using a special burned cd? Sure everything is connected but I don't think its possible.

Re:Any truth to this?

[StefanSavage]

Page 7 of the linked paper.

- Stefan

bluetooth dongles on OBD-II

[nazsco]

always wondered. you can pretty much drive by some OBD-II ports... bmw can be started even by my old obd-I.

and lots of people buy those bluetooth dongles just so they can have an extra tachometer on their iphones on the dash.

may not be so usefull for stealing the car... as i doubt it has power when the car is off... but may very well be the case, i don't know. But imagine sending the acelerate signal on the highway to everyone around you that has such device

Re:The amount of crime is directly proportional to

[Anonymous Coward]

Here is a supply demand problem, you take out the supply of available thieves down to the few that don't get caught, and the going rate for the service will go up so that people will take the risk of boosting a car when the going rate gets to a certain theshold so that a) they can pay for good legal representation b) the reward is worth the risk

You think I'm wrong? Go visit vegas, those hotels aren't built because people generally win at the casinos, but the general public still perceive the reward to be greater than the risk.

Since there is a lot a value in cars there is a lot of room to move in the amount of money that is available to pay for the jacking.
Also, genetics is not the only factor in determining a criminal, circumstances WILL play a part, so while yes these sorts of things run in families, not always. Besides the criminal gene must have some sort of survival benefit or it wouldn't exist, take that away and what do you have? Docile sheep.

I am not advocating stealing cars, it is pretty f'ing low, I just think the OP analysis is short sighted and off the mark. America has more people in prison than anybody, and yet our crime rates are pretty high too - I don't think the argument holds water.

Disabling some alarm systems...

[aaronb1138]

Certain model Fords from the late 90's had the alarm (PATS) system in a separate module in the trunk. If you could jimmy the trunk open, all you needed to do was disconnect one harness.

This eliminated the need for the transponder key and disabled the alarm completely. Hot wiring the car from there is rather conventional and trivial.

Wasn't till the 2000s that they at least had the thought to add a bit in the ECU ROM or a bit switch (don't recall which) that told the ECU to require the security module.

A few other car makers had similar easy to defeat modular systems, but I'm not sure about years and makes from that time.

Re:The amount of crime is directly proportional to

[colinrichardday]

I wasn't really trying to debate criminology. I was just questining OP's use of "directly".

A very good article.

[sr180]

This is one of the best articles place on Slashdot in a long time. Its a pity that very few of the above posters have actually read it.

Firstly, it details the methods of accessing the car. Surprisingly, the CD was most effective. They found vulnerabilities in parsing MP3's and WMA's. They reverse engineered the firmware, - found a buffer overflow and exploited it. From there, they then exploited the Dealer tools used to analyse vehicle faults.

So, infect and mp3 and upload it via sharing. That infects cars, which then infect their dealer tools. The infected dealer tools can then reprogram ecu's and other devices on the cars themselves.
This is only the start. They then proceed to find more in depth vulnerabilities and propose possible wholesale models of theft that become possible. For anyone with an interest in hacking (and true hacking, not just script kiddy stuff) then have a good read of this article...

Re:A very good article.

[shilly]

Really? You thought it was good? I thought it was a bit far-fetched, tbh. It's not that it was describing impossible threats, just that they were somewhat implausible. For example, they described the CD threat in action as follows:
"Consequently, an adversary might deliver malicious input by encoding it onto a CD or as a song file and using social engineering to convince the user to play it.
Alternatively, she might compromise the user’s phone or iPod out of band and install software onto it that attacks the car’s media system when connected."

What are the possible circumstances when person A is going to do something nasty to person B by:
i) befriending them
ii) learning enough tech to be able to encode a piece of malicious code and embed it in a WMA or other file on a CD
iii) giving them a CD and convincing them to play it in their car
iv) having an attack work that is sufficiently distant in mode and in time that person B doesn't recognise that it was person A who did it
?

I guess spies / covert agents might want to do this. But in day-to-day life, surely the vast majority of people with malintent will pick a simpler attack?

Re:A very good article.

[tomboalogo]

I'll betcha if you went in a parking lot and put CD's on windshields 90% of the dumbasses would jam it in the stereo without a second thought.

Re:A very good article.

[shilly]

But you don't need to use a CD to steal a car....

Security devices in the car not so good

[fmaresca]

I wish my latests cars were not so security thigh, most notably not codded and/or RFID key.

Security devices only levels up the barrier for the lifters to get a car, forcing them to take cars when the driver is in the vehicle.
In the good old days they could lift a car with a jumper cable to the ignition coil and get away in two minutes, now they need to take it from you at gun point, between two or more thefts and most of the time getting away with you in the car for a couple of miles or even take the opportunity for an ATM raid.

I much prefer the old way, really.

couchdouche "SPANKED" (& he ran like a beyotch

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2603836&cid=38588550

couchdouche "spanked" (& he ran like a beyotch

[Anonymous Coward]

http://it.slashdot.org/comments.pl?sid=2603836&cid=38588550

This won't stop professional thieves

[macshome]

Security systems, fancy locks, or anything else doesn't deter pros. They just drive up with a flatbed or tow truck, scoop the car up, and drive away.