Slashdot Mirror
English High Court Bans Publication of 0-Day Threat To Auto Immobilizers
An anonymous reader writes "The High Court — England's highest civil court — has temporarily banned the publication of a scientific paper that would reveal the details of a zero day vulnerability in vehicle immobilisers and, crucially, give details of how to crack the system. Motor manufacturers argued that revealing the details of the crack would allow criminals to steal cars. Could this presage the courts getting involved in what gets posted on your local Bugzilla? It certainly means that software giants who dislike security researchers publishing the full facts on vulnerabilities might want to consider a full legal route."
It sure is a good thing that England controls the entire Internet and that no one anywhere will be able to publish this information now.
I'm an American. I love this country and the freedoms that we used to have.
We know the exploit exists... Now we just need to find it! Again.
too bad we don't use these zero days to take down the shitty system...
I taught this one died 10 years ago...
Tomorrow is another day...
So how is anyone, courts included, meant to unpublish something? Unless a security researcher is saying "in X days I'll release the details on vulnerability Y" how would you even know to get a court injunction against said person? Once the cat is out of the bag, that's it.
Of course, I can then see the "logical" progression that all vulnerability disclosure must be outlawed - think of the children!
i would much prefer that they can be released to the public and subsequently FIXED than have a researcher sell it to criminals or use it himself to steal cars.
The vulnerability will surely never be exploited now, because it's simply not possible that anyone else is smart enough to figure it out. Even if they do, no thief would ever use it to steal a car right?
Seriously, how do people this stupid become judges?
It's standard practice, when publishing about security flaws, to alert the producer of the products affected before doing so openly, only publishing when a) the hole is patched, or b) if they are ignoring the issue and refusing (or at least taking too long) to fix it.
If they have not given the manufacturer a reasonable amount of time to fix the problem, I can understand why they're being censored - it's unnecessarily dangerous. However, if this is simply the manufacturer trying even harder to pretend the problem doesn't exist, I would of course object strenuously, and support publishing the hole because that will not only force them to get a fix out ASAP, but will punish them for taking so long.
And, while TFA doesn't say either way on the issue, I would expect the latter, not the former.
Banning hackers from releasing information.
This has ALWAYS worked!
Do not announce !! SPiLL !! SPiLL !! SPiLL !!
Muw haha haha !!
My car doesn't have power windows, or keyless entry or even remote start.
They may be able to impact my cassette player?
How will I know if I can't read the article?
to ban auto companies from not fixing bugs/vulnerabilities that are made public?
It must be the doings of that damn bastard tripartite commission !!
We are the Trilateral Commission, and we caution you
not to get our name wrong again.
Take a look at this year's Black Hat presentations. These are just the ones on vulnerabilities in embedded systems.
Even *if* they could suppress the details of how it's done across britain, do they not understand that the idea that it is possible, is enough for smart people to figure it out independently of this research?
Why don't they order it to be fixed rather than trying to prevent the information about it to be suppressed "somehow"?
Why don't they take it to another level and have a system implemented for identifying and solving problems like this - something like the air safety board when they investigate accidents? An automakers software / hardware safety council?
This is because of black hat, this changes nothing and if anything makes the really bad hackers the ones with out a sol move faster to put a exploit in the wild who of us thinks there will be a story next week about cars being stollen and driven into water as a call to action by anomaus or lolsec?
Generally temporary injunctions like this are just until there is a full hearing. Volkswagen will probably have a fix in place by then, but the main purpose is to avoid doing irreversible damage until there can be a full hearing on the facts.
A temporary injunction is common in many types of cases and in no way indicates the court's opinion on the substantive issues. It's simply a recognition that they can't unpublish the information, so they need to wait until a decision is made before they publish. The same is often done with property disputes such as divorces. A temporary injunction orders both parties not to sell or otherwise dispose of the property until a decision is made as to ownership.
Ps - I don't care for the injunction. I would have preferred that the court hint at whether they think the case has merit, then let the researcher decide whether to release the information immediately, risking a successful suit for damages. The injunction, as a prior restraint on speech, is censorship. Still, it's best not to exaggerate the effect of the or intent of the injunction.
Under English law 'a reasonable time' is usually 14 days. So unless the court put a date on it, the injunction will expire quite soon.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
All that does is raise the price of the exploit on the market. Oh by the way, is this 'exploit' the same thing as the repo man's kill switch?
“He’s not deformed, he’s just drunk!”
It should be standard that you notify the company before releasing the flaw publicly, and it should also be standard that after some waiting period the bug should go public. Well, standard per product ... different products have different release cycles, I could see some wanting 2 months while others want 1 year. But it should be public information, that product X you should notify them first then you're allowed to report the bug publicly after n months. That waiting period should be part of the product specs.
So tell the auto makers then wait 24 hours then tell everyone. Then it's one day.
So, we don't need Knight Rider's KITT microlock brakes anymore? Cool. Those were pretty cumbersome 1980s technology to deal with, anyway.
Kriston
Yepp, the court fell for the oldest and most blatantely false argument of the full disclosure opponent.
The court assumes that bad guys don't already have this knowledge. From decades of experience in IT security we can conclude with near certainty that they do. What this provides is limited, short-term protection against those would-be thieves who don't, yet. Also, a false sense of security.
What would've happened if this had been published: The public would know, car manufacturers would (have to) scramble for a fix.
What will happen now: Nothing. The next model will be fixed, your current one will maybe get an update at the next maintainance cycle, but don't count on it.
The next years will be a great time to be a car thief.
Assorted stuff I do sometimes: Lemuria.org
You're free to sell or otherwise not own overly complex gear you have no ability to properly secure or operate.
Hi, I already ran into such a problem, some cars have those infrared immobiliser "keys" and to hack those is something any 3 year old with a learning remote control and some time can do.
A similar unit with 433 MHz mod could be used so this has been public knowledge from a long time.
Did you know that under UK law, possession of a universal remote thus modified is actually classed as "going equipped" outside of a private residence. I think there have been like 4 prosecutions but none of them made the papers because it wasn't deemed interesting enough to publish.
For in his mind, he dreams himself your master.
And on the Eighth Day, Man created God.
Have a recent BMW? There is a known vulnerability where you can copy an actual key inside the car, using the data in the car's computer and the car's own transponder. BMW has not fixed this and won't fix it. The vulnerability is that BMW relied on being the only source of blank, programmable keys and having all the programming equipment in house. Once someone reversed the key system (the car itself contains unprotected, unencrypted key strings), they found out what electronics to put in the key and made blank keys and software to program them using the keys found in the car's computer. This is a massive problem that was out for probably at least a year before there was enough public attention to the enormous theft of BMWs with that system. I think that the number of BMWs stolen had quadrupled in that period. Right now, since BMW won't fix it, getting a BMW that suffers from this vulnerability is prohibitively expensive to insure, making their second hand value very low. It may be that insurers now require 3rd party alarm systems to be installed or something, I don't know, but the vendor didn't fix it and basically left their customers without a solution.
Right now, there's no indication that VW can and will fix this problem once it gets out. I highly doubt they will recall all vehicles and replace the parts that are vulnerable with a system that has the flaw removed. For all we know, that could cost thousands per vehicle and apply to all VAG cars from the last 10 years. That could be over 100M cars, worst case. Then again, if it'd only apply to a certain model and year and it is an affordable fix, they may actually do it, but I wouldn't count on them fixing anything.
I was promised a flying car. Where is my flying car?
Any car that uses the megamos RFID chip to identify the key, will be vulnerable. To fix this, the manufacturer will have to replace all keys and the receiver and reprogram all computers in the cars infected. VAG here has a problem with most recent Volkswagens, Audis, SEATs, Skodas, Bentleys, Lamborghini's and Porsches. Other manufacturers that rely on this system are probably affected too. Chances that VAG will proactively call back all these vehicles are extremely slim. A temporary injunction serves no purpose, unless VAG can prove without a doubt that they can and will fix this within a very short time frame. Mind you, designing a new system, testing it for security, mass producing it and recalling all cars will probably take well over a year before they can even start recalling and cost tens of billions to implement for VAG.
I was promised a flying car. Where is my flying car?
New cars come with immobilizers, exploits, remote death controls (at least in the Mercedes C250 Coupe), OnStar surveillance, and black boxes to testify against you - why the fuck would anyone buy a car made after the mid-90s? You can get a totally tricked-out and rebuilt early-90s Honda Civic that gets awesome gas mileage for way less than a new car. You can get a mind-blowing totally tricked-out and rebuilt early-90s Toyota or Nissan truck for.. well, not a whole lot less than a new one (but that's just because most of them still have 100K left on them). I'm sticking with cars that aren't my enemy, thanks.
Then such censorship cannot be done.
What kind of law would allow a court to do this? I can't find any mention in TFA.
Also, can we get a copy of the court's decision document?
This is not something they can just simply patch because the crypto is inside the car key's hardware which is not updatable.
Also it should be noted that not only VW is affected, but all car manufacturers which use the Megamos transponder.
However, they must at least put up a legal fight or they will later become liable for not trying to protect their customers. They might not be able to stop the publication, but they have to at least try (despite the negative publicity) to prevent further lawsuits.
By the way, whoever suggested that the researchers should just release their findings without contacting the affected parties first: That is a surefire way to get sued with reasonable chances of success for actively aiding in the theft of vehicles.
This is the same VW that have failed to diagnose my faulty immobilizer 3 times now, is it? If I knew the exploit then at least I could disable the blasted thing myself and get moving again when it plays up!
Or maybe I'm being hacked remotely and don't know it...
~Tim
--
Rushing on down to the circle of the turn
Because most people are generally honest, law abiding citizens. The heat has to be turned up quite a bit more before your average Joe becomes a homicidal maniac bent on revenge against a tyrannical establishment. Of course once that happens, it's irreversible.
Seven puppies were harmed during the making of this post.
The best quote from Alpha Centauri (old video game).
If you force someone to NOT-PUBLISH something, because they announced, and you are not happy with it, what will happen is...
Next time they will publish it un-announced...
Have a nice day.
uh... this is much ado about nothing... I can pick up universal cloners/programmers for the immobiliser for about 100.00 on dhgate that do megamos crypto as well as texas 4C and others, reversing one of these devices firmware will quickly yield the necessary algorithms needed to break car immobilizers depending on the above crypto. As the chinese ALREADY have this algorithms(needed to build such a device) EVERYONE has this info now... I dont see what the big deal is about a simple student paper revealing a rather mundane mistake the manufacturers of goods that use crypto commonly make.. ie they trust that they can do it securely with in house talent, NOT!
what rubes to complain now that some student reveal their dirty britches...
Just publish there, or other anonymous ways that cant be taken down.
Laws and judgments like this should not be followed as they are anti-freedom.
---- Booth was a patriot ----
My car has an ingenious anti-theft device. I'm sure most thieves will not be able to overcome it in order to start my car.
Its a knob labeled "Choke" on the dashboard.
Have gnu, will travel.
First the UK "adult" content filters were put in place. What they should do now is ban security sites, subversive anti-government sites, news sites that tell the full story, etc.
VW doesn't get the Streisand effect, eh? When engineering fails use the (violence implied by the) law? Reverse engineering is not only protected, but essential to survival. Security by obscurity is a comedy plot not an assurance policy.
Well, an injunction that's only good for X days might be a good incentive to fix the issue before X days is up...
that means criminals are idiots and would never resort to doing research so just keep everyone stupid on all subjects and no holes need to be plugged. Every time i open my eyes and it's only 6am i smell doom at the horizon.
Free speech was meant to be free for all... how can anyone grow up in a nanny state ?