How To Hack a BMW: Details On the Security Flaw That Affected 2.2 Million Cars

0x2A (548071) writes BMW recently fixed a security hole in their ConnectedDrive software, which left 2.2 million cars open to remote attacks. Security expert Dieter Spaar reverse engineered the system and found some serious flaws [note: if you'd prefer English to German, try this translation], including using the same symmetric keys in all vehicles, not encrypting messages between the car and the BMW backend or using the outdated DES.

Comments

Definition of "Remote Attack"

[Anonymous Coward]

Somehow I don't think the definition of "remote attack" is "disassemble the computer, attach all kinds of expensive hardware to analyze communications and firmware, hack into the firmware to retrieve the encryption keys, so only then you can use a base station emulator to trick the car into thinking your remote machine is a BMW firmware server."

The "remote attack" requires physical access, specialized skills, and intense hardware interaction. It is not something that some Romanian skript kiddie can pull off from their mom's basement.

Re: Definition of "Remote Attack"

[StevieWonderBoy]

6,000 cars were stolen this way in London last year. You are wrong. They are selling kits on the ebay that allow you to clone keys.

Re: Definition of "Remote Attack"

[Anonymous Coward]

I recall this whole BMW research started when BMWs were getting stolen off the drives of their owners with what appeared to be a box
This video perhaps?:
https://www.youtube.com/watch?v=HxVO5OVaCkA

But this was a long time ago, 2012... and BMW still has major security flaws?!

Re: Definition of "Remote Attack"

[drinkypoo]

And it's not just BMW, it's for all kinds of makes and models. Hell, you can go to Dealextreme and buy many unlocking tools, just by searching for unlocking tools. And I'm not talking about the kit of stamped spring steel pieces, either.

Re: Definition of "Remote Attack"

[AmiMoJo]

One of the most common attacks is actually the simplest. The thief waits in the car park with a jammer. Most cars use 433MHz in Europe, penalty 915 in the US. The victim walks away and presses the lock button on their key fob and doesn't notice that the car didn't actually respond. Once inside the thief can use the OBD-II port to steal the car.

I prefer keyless entry as you press a button on the car to lock it, and even if jammed it will always lock.

Re: Definition of "Remote Attack"

[_merlin]

You only need physical access to the Commbox from to a single car to extract encryption keys that can be used to steal many cars. That's the flaw. The cellular base station emulators are readily available.

Re:Definition of "Remote Attack"

[Ol Olsoc]

Somehow I don't think

You could have stopped right there. FTFY

Re: Definition of "Remote Attack"

[Noah Haders]

Like that time I gave the Libyans a shoddy bomb casing full of used pinball machine parts?

Re: Definition of "Remote Attack"

[Anonymous Coward]

My car honks when you hit the remote lock button. If I don't hear the honk, I know the car isn't locked. Are people just not paying attention or something to walk away just thinking to themselves ' I pressed the button, everything is safe with the world, go me. lalalalal walk off'

Re: Definition of "Remote Attack"

[drinkypoo]

My car honks when you hit the remote lock button

In VAG cars, and possibly many others, that honk is an option which can be changed by twiddling an option code which can be looked up in the dealer's service data (which comes on DVD.)

Re: Definition of "Remote Attack"

[Anonymous Coward]

What I want to know is: Since this is a 'trend' a lot of car manufacturers are headed to, in another couple years where am I going to be able to buy a car that doesn't have all this crap in it? CAN bus is ok to a degree, but I don't want (or need) a bluetooth/wi-fi enabled integrated digital everything car. Give me the old 'needle' speedometer, flipping number manual odometer, etc - I don't want a 'digital display' where everything breaks at once if it dies, I don't need or want my stereo integrating into the drive train, and it doesn't need to tell me the temperature, weather, gps, and all that stuff - I know when it's hot or cold out, sunny or rainy/snowy, and I can read a map. I want *less* technology, not more.

Re: Definition of "Remote Attack"

[tipo159]

In VAG cars, and possibly many others, that honk is an option which can be changed by twiddling an option code which can be looked up in the dealer's service data (which comes on DVD.)

What's your point? Most alarms give an indication that the system is armed and most people that I know look for that indication as they walk away. If the horn doesn't sound or the lights don't flash when I arm the alarm, I check to see why not.

Re:Definition of "Remote Attack"

[Golden_Rider]

Somehow I don't think the definition of "remote attack" is "disassemble the computer, attach all kinds of expensive hardware to analyze communications and firmware, hack into the firmware to retrieve the encryption keys, so only then you can use a base station emulator to trick the car into thinking your remote machine is a BMW firmware server."

The "remote attack" requires physical access, specialized skills, and intense hardware interaction. It is not something that some Romanian skript kiddie can pull off from their mom's basement.

The "disassemble the computer" part was only for the initial analysis of how the whole system works. Only one person needs to do this and can then sell the information. With the information from that one single disassembled box, it is possible to remote attack (without physical access other than standing within a couple hundred feet) any other BMW car with the same "connected drive" feature. That is (as described in the article), walk around with the cellular network emulator to trick vulnerable cars to connect to your cellular network, identify vulnerable cars via IMEI, figure out the VIN via the helpful error message the car sends out, activate remote services on the car (if not already active) via a faked message and then you can send the "open doors" command to the car. All of which can be done without physical access to the car other than standing near it, which you would need to do anyway if you want to take advantage of the open door.

So - yes, skript kiddies (or, well, any car thieves) surely can do this, since I am sure that the assembled hardware necessary together with a small instruction manual "how to open any BMW" is available on the internet somewhere.

Re: Definition of "Remote Attack"

[drinkypoo]

What's your point? Most alarms give an indication that the system is armed

But they don't all, and even some of the ones which do by default have been changed by the dealer at customer request. That's the point. Was not complicated.

Re: Definition of "Remote Attack"

[davester666]

You won't be able to. Because you aren't paying enough up front for the vehicle, the manufacturer also needs ongoing revenue for as long as the car is being driven. They will get this money by selling your driving habits and vehicle problems to whomever will give them money.

Hell, the federal gov't will happily go along with this because they want to be able to track your movements in real-time. Because you are a terrorist.

Re: Definition of "Remote Attack"

[tlhIngan]

What I want to know is: Since this is a 'trend' a lot of car manufacturers are headed to, in another couple years where am I going to be able to buy a car that doesn't have all this crap in it? CAN bus is ok to a degree, but I don't want (or need) a bluetooth/wi-fi enabled integrated digital everything car. Give me the old 'needle' speedometer, flipping number manual odometer, etc - I don't want a 'digital display' where everything breaks at once if it dies, I don't need or want my stereo integrating into the drive train, and it doesn't need to tell me the temperature, weather, gps, and all that stuff - I know when it's hot or cold out, sunny or rainy/snowy, and I can read a map. I want *less* technology, not more.

Import brands from lesser known countries. Or higher end vehicles. Or learn to love classic cars.

The thing is, your needle speedometer hasn't been wired up to the wheels in 20 years or so now - they're all electronic with a servo giving your the needle position. That's basically true for everything you see on the dash - it's all electronically driven and controlled and the only things you feed it are a CAN bus network plug and power. Sure some gauges flick when you turn the key, but just because they don't doesn't mean it isn't electronic.

So the needle and flippy odometer are basically purely electro-mechanical devices in most cars, and of the whole cluster, only the speedometer is the required instrument. And there are probably enough purists out there where the needle instrument would remain an option. They all get the information the same way so it's really a matter of swapping the panels around during manufacture.

As for all that "electronic crap"? They've gone this way because electronics have proven themselves to be far more robust, durable, cheaper and way more featureful than their old mechanical counterparts. It's why throttles are electronic despite supposedly being more complex - a throttle cable fails surprisingly often versus your pot and servo (while the latter gives you cruise control as a free option - it's just software now). Brakes remain hydraulic with mechanical backup (though many are electric rather than vacuum assist). Hell, even your transmission is basically all electronic - automatic transmissions used to be almost all mechanical but that lead to the control box being very finicky where 1/16" of an inch can trigger a recall. It's why modern automatic transmissions are so efficient - knowing how the engine is loaded, the speed, throttle position and many other sensors, the transmissions can figure out what gear to use.

And yes, going electronic makes life a lot simpler - the mess of a wire harness is far simplified, it's cheaper to manufacture, and way more reliable. It's also why previously high-end features reserved for luxury cars can be hand in your $15,000 econobox. In the end it's all software, and software is remarkably cheap.

Of course, it's unlikely remote update would become a standard low end feature anytime soon - I mean, you have to handle cases where the vehicle may not be set up to connect to an owner's wifi network, 3G isn't available everywhere (and who's gonna pay for it?), etc.

That said, remote access does have its uses - perhaps monitoring your car from inside the house. This will be more standard in range-limited vehicles like electric cars, so you can see the status of your car inside on your phone (state of charge, charging or not, etc) and even have it run the AC or heater while still on house power so the car is cool or warm when you get in.

Anyhow, you want electronic crap free cars? We call them classics. And even those aren't all electronics-free, as people have learned that electronic fuel ignitions make life much nicer (twist 'n' go - no longer worry about vapor lock, cold weather, etc.), and yes, you can get 'em with automatic transmissions too, and creature comforts like AC.

Of course, if you do go true all mechanical, be prepared to spend a few days every month working on it. It's why there are a lot of shade tree mechanics - things fail constantly.

Re:Definition of "Remote Attack"

[Anonymous Coward]

So physical access to one BMW gives you permanent remote access to millions of others, and that's not a remote attack? Um, okay.

Re: Definition of "Remote Attack"

[toddestan]

A patient thief would just wait for someone to walk off and not notice. In a busy car park, it probably wouldn't take long. An impatient one could just club you in the back of the head with a tire iron while you're busy trying to figure out why the remote isn't working.

Re: Definition of "Remote Attack"

[mjwx]

One of the most common attacks is actually the simplest. The thief waits in the car park with a jammer. Most cars use 433MHz in Europe, penalty 915 in the US. The victim walks away and presses the lock button on their key fob and doesn't notice that the car didn't actually respond. Once inside the thief can use the OBD-II port to steal the car.

I prefer keyless entry as you press a button on the car to lock it, and even if jammed it will always lock.

I dont walk away from my car until I hear the poorly synchronised clunks of the door locks.

Not that I'm worried about jammers and MITM attacks (they haven't quite made it to Australia just yet), rather I'm yet to find a key fob that works perfectly every single time. If you're pointing a little bit too far in the wrong direction or your body is in they way enough that it blocks the signal your car fails to lock.

Almost all cars have a visual signal (normally the indicators flashing) and most cars have an audible signal letting you know the car has been locked.

This is why I quit web programming

[Theovon]

A company as big as BMW should be able to hire some security experts, so this should be a bit embarrassing for them.

But the truth of the matter is, doing security is not easy. Take web programming, for instance. Back when I first learned PHP, I found over and over that whatever design or coding approach seemed most straightforward and intuitive was inherently unsecure. All sorts of escaping and manual insertion of encryption functions are required, and that clutters up the code to the point of making it hard to maintain. I did manage to implement most of it in a common PHP file that I reused over and over again, but there was a huge learning curve, and it was a pain. Since then, people tell me that it's gotten a LITTLE better. For instance, database wrappers generate the SQL queries for you and automatically escape strings. But for the most part, it still sucks.

If there were a single best book to read on cyber security, then perhaps we'd have fewer problems like what BMW had. But in reality, to get good at it, you have to have a vast familiarity with the literature and tools. You do that much reading, you might as well get a PhD. And my friends with PhDs focusing on security are in academia, not industry, so we get more security papers but not more secure devices.

Re:This is why I quit web programming

[drinkypoo]

A company as big as BMW should be able to hire some security experts, so this should be a bit embarrassing for them.

But the truth of the matter is, doing security is not easy.

No, the truth of the matter is in your first paragraph. Designing and building a car is not easy. Not making complete fucking moron decisions about security is easy, if you hire someone vaguely competent. BMW decided to skip that step to save a few bucks to ensure nice corporate bonuses, and customers suffered. BMW should be on the hook for each car stolen in this fashion, and have to pay complete replacement value, because they failed to make a good-faith effort at security.

Re: This is why I quit web programming

[Anonymous Coward]

And 99% of all products and services skip that step. But the scariest thing is that they lie about it and keep their system closed to hide it.

Re:This is why I quit web programming

[gnupun]

Not making complete fucking moron decisions about security is easy, if you hire someone vaguely competent.

But isn't connecting a car to the internet inherently stupid (for the consumer, not the vendor)? The risk of theft and car crashes via hacking are inherent in such a design decision whereas there are few benefits, such as getting updates without visiting the dealer.

By connecting your car to the internet, billions of people and a few thousands of hackers and govt agents can now gain control of your car, also the car manufacturer can track your car usage info and sell that to advertisers and three-letter agencies.

It's like connecting your toaster to the internet -- pointless and not very useful.

Re:This is why I quit web programming

[X.25]

A company as big as BMW should be able to hire some security experts, so this should be a bit embarrassing for them.

But the truth of the matter is, doing security is not easy. Take web programming, for instance. Back when I first learned PHP, I found over and over that whatever design or coding approach seemed most straightforward and intuitive was inherently unsecure. All sorts of escaping and manual insertion of encryption functions are required, and that clutters up the code to the point of making it hard to maintain. I did manage to implement most of it in a common PHP file that I reused over and over again, but there was a huge learning curve, and it was a pain. Since then, people tell me that it's gotten a LITTLE better. For instance, database wrappers generate the SQL queries for you and automatically escape strings. But for the most part, it still sucks.

If there were a single best book to read on cyber security, then perhaps we'd have fewer problems like what BMW had. But in reality, to get good at it, you have to have a vast familiarity with the literature and tools. You do that much reading, you might as well get a PhD. And my friends with PhDs focusing on security are in academia, not industry, so we get more security papers but not more secure devices.

Problem is, you are not a security professional/expert, nor should you be as a web programmer.

In similar fashion, people doing security for BMW should be security professionals and not engineers that just got tasked with also developing security.

It happens way too often, in almost every industry.

Usually to "save money". Pretty ironic.

Re:This is why I quit web programming

[Lumpy]

"No, the truth of the matter is in your first paragraph. Designing and building a car is not easy."

Maybe to dumb people it's not easy. to the rest of us... yes it really is easy. It's a well defined and massively repeated process. An engine is trivial, a car suspension is trivial. a whole car is trivial.

When you add shit to it for the sake of adding shit.. That is when it get's complex. No I dont need a computer on my brakes. a computer to the side of my brakes looking for slipping and trigger a modulation piston to give me anti-lock? Sure. but if the computer fails, I will have brakes.

Idiot designers want to put the computer in the middle so all braking is done by the computer. When it fails you have no brakes.

Re:This is why I quit web programming

[drinkypoo]

An engine is trivial, a car suspension is trivial. a whole car is trivial.

Bull, followed by shit. Making a car that will function as well as a Model T is pretty easy, any dick with a little machining and welding experience can probably manage that. Making a car that will function as well as the lamest BMW, let alone something as complex as the i8, is a massive engineering challenge just to execute, let alone to do well.

No I dont need a computer on my brakes. a computer to the side of my brakes looking for slipping and trigger a modulation piston to give me anti-lock? Sure. but if the computer fails, I will have brakes.

It's sad that you think you know so much about cars, but you don't know that this is how ABS works. When the system isn't doing anything, the valving permits pedal pressure to actuate the brakes like it always has.

Idiot designers want to put the computer in the middle so all braking is done by the computer. When it fails you have no brakes.

Which designers are these? Literally the only vehicles with brake-by-wire are some very expensive heavy trucks with air brakes, and they have (get ready to be amazed) normal air valve control backup.

Re:This is why I quit web programming

[drinkypoo]

But isn't connecting a car to the internet inherently stupid (for the consumer, not the vendor)?

Yes, it's both stupid and unnecessary. If I must have a network in my car, then why not just let me download an ISO, burn a CD, and slip it into my CD player? The factory stereo is probably already an MP3 player, and already on the CAN bus, so all the necessary hardware ought to be there. Many cars have a USB port for music now too, so obviously putting the image on a flash drive would be even better. Many Blu-ray players update using this model, and it seems to work fine there.

But with that said, these guys made really dumb mistakes that could probably have been avoided just by checking Wikipedia, let alone by hiring a security expert.

Re:This is why I quit web programming

[fahrbot-bot]

It's like connecting your toaster to the internet -- pointless and not very useful.

Not useful? With this toaster running NetBSD you can program all the toaster's features remotely.

Re:This is why I quit web programming

[Anonymous Coward]

Back when I first learned PHP, I found over and over that whatever design or coding approach seemed most straightforward and intuitive was inherently unsecure.

I think the key to that is "Back when I first learned PHP". PHP is kind of the poster boy for insecurity, and surprisingly odd behaviour.

http://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

Re:This is why I quit web programming

[tipo159]

But isn't connecting a car to the internet inherently stupid (for the consumer, not the vendor)? The risk of theft and car crashes via hacking are inherent in such a design decision whereas there are few benefits, such as getting updates without visiting the dealer.

...

It's like connecting your toaster to the internet -- pointless and not very useful.

Right. There is no conceivable use case to connect a car to the internet. Current traffic conditions and best route information for current conditions? What use is there for that? Streaming music? Who would want that? Automated reporting of accidents when the occupants are non-responsive? What a dumb idea, right?

Re:This is why I quit web programming

[drinkypoo]

Right. There is no conceivable use case to connect a car to the internet. Current traffic conditions and best route information for current conditions? What use is there for that? Streaming music? Who would want that? Automated reporting of accidents when the occupants are non-responsive? What a dumb idea, right?

The only part of that which requires communications with the rest of the car is the accident reporting, and that can be one-way. But that's not how automakers have implemented their infotainment systems. They're just now beginning to use ethernet between the purely entertainment modules, and steering wheel controls are overwhelmingly still carried over a bus that has more important jobs to do.

It's not that it doesn't make sense to have an internet-connected system in the car, it's that it doesn't make sense for it to even have a mechanism which permits it to update the car remotely without user interaction. Having to put the key in a special lock and turn it before a firmware update or other setting change can physically occur would solve a lot of problems. It wouldn't prevent theft, of course, but it would help with the rest of these issues. I'm not against OTA updates, I'm against them being able to happen without my consent and possibly at an inopportune moment.

Re:This is why I quit web programming

[AmiMoJo]

But isn't connecting a car to the internet inherently stupid

Not at all, as long as the functionality of said connection is limited. My Nissan has internet connectivity but it is only used to allow me to control non-critical stuff like the aircon and battery charging, or for the sat-nav to update its list of POIs. Nissan seem to have a clue when it comes to security - there are actually two OBD-II ports, and the one accessible from the cabin is read-only so can only be used for diagnostics and data logging.

Re:This is why I quit web programming

[Lumpy]

Ahh I wondered when the resident Slashdot moron would come back out to troll me.

How you been?

Re:This is why I quit web programming

[toddestan]

At some point, you still have to walk over to the toaster to put the bread in it. While you're there, it's not a big deal to program the toaster by twiddling a few knobs or pushing a button or two. You also have to be there to remove the toast when its down. A toaster running NetBSD is still a cool project, but that doesn't mean it's really useful.

Re:This is why I quit web programming

[fahrbot-bot]

At some point, you still have to walk over to the toaster to put the bread in it. While you're there, it's not a big deal to program the toaster by twiddling a few knobs or pushing a button or two. You also have to be there to remove the toast when its down. A toaster running NetBSD is still a cool project, but that doesn't mean it's really useful.

Good points all, though, I was actually being sarcastic - sorry. Personally, I never run anything in the kitchen, or at home in general, that can easily catch itself or something else on fire w/o supervision.

Re:This is why I quit web programming

[Actually, I do RTFA]

Pretty sure the "brake by wire"is a reference to the Prius's problems.

Re:This is why I quit web programming

[mjwx]

Bull, followed by shit. Making a car that will function as well as a Model T is pretty easy, any dick with a little machining and welding experience can probably manage that.

Do you know how stupidly complex the Model T's controls were? Whatever Henry Ford was smoking when he released that I would like some of.

But I agree with your post. Anyone who thinks designing a car with off the shelf engine and suspension parts is delusional and has clearly never tried to modify a car. You cant simply buy bits off the shelf and expect them to fit together like lego. Hell, you can barely do that with wheels and they've got standardised connectors (stud patterns). Its nothing like building a computer where you buy a CPU, mainboard, HDD and case that just slot together. After you get the right parts and fit them, there is still a bit of fettling to get them right.

Very little of your car is plug and play. We cant even get manufacturers to use ISO connectors and DIN standards for stereos.

dem haxxorz

[Anonymous Coward]

dey be in ur car, haxxin

You know, im fine with a car that doesnt have

[Anonymous Coward]

a data bus & a computer screen for environmental/stereo/window/mirror controls.

I dont think i really need a CPU between the brake pedal & the actual bakes.

Or in the steering wheel.

Usually i scoff at the luddites who resist the computerization of everything. But im with them here. Computerizing all this crap just adds fail points, it adds NOTHING to the usefulness of the car.

Guess ill stick with my late nineties cars for a couple more decades.

Re: You know, im fine with a car that doesnt have

[therealkevinkretz]

Isn't anti-lock braking accomplished with a CPU between the brake pedal and the brakes?

Re: You know, im fine with a car that doesnt have

[Ogi_UnixNut]

Not originally. Originally ABS was all mechanical. Nowadays they have a ECU fo do a "better job" at it (things like detecting slippage/lock on a per wheel basis).

And even then, if the ABS electrics fail, you still have full brake power, just no anti-lock. So even then, there is no "CPU between the brake pedal and the brakes". At least on every car pre 2005 (I stay away from any car that is newer, so I don't know about new ones, but I would be amazed if the brakes are fly-by-wire even now)

Re: You know, im fine with a car that doesnt have

[sjames]

Definitely not. The ABS is alongside and can influence the applied braking force, but even with power off, the brakes still brake.

Re: You know, im fine with a car that doesnt have

[drinkypoo]

Early ABS: can only reduce brake force. very dumb.

Slightly later ABS: gets the ability to pump. still very dumb. But now it can be used by traction control systems. First yaw control systems implemented on production vehicles in the late 1990s, using this functionality.

Modern ABS: increased sampling speed permits determining how fast the wheel locks up, which lets you take a good stab at detecting snow/gravel. Wheel is permitted to stay locked up longer under these conditions to build up something to stop with.

Brake-by-Wire: Used only on heavy trucks with air brakes. Normal air braking system is still present, actuated near bottom of full pedal travel in emergencies.

What the ABS system actually looks like: just like a normal braking system, except a pump (not a CPU) is inserted into the brake lines. When the system is not activating, the valving defaults to a mode which permits the brake system to behave like normal.

The only caveat is that some of the systems with yaw control are missing a proportioning valve, or don't have as much proportion in it as cars before yaw control. ABS is used to prevent rear-wheel lockup. That means that when the ABS fails, the rear brakes overapply, increasing rear brake wear and the risk of fishtailing.

Now, there are EPBs, or electric parking brakes, and those are a bad idea. If some manufacturer feels that a hand brake is too much work for their customers, they can still implement a foot parking brake.

Re: You know, im fine with a car that doesnt have

[ceoyoyo]

A friend of mine mentioned her courtesy car at the mechanic was an audi with a button to apply the emergency brake. I didn't believe her. These things really do exist?

Re: You know, im fine with a car that doesnt have

[drinkypoo]

A friend of mine mentioned her courtesy car at the mechanic was an audi with a button to apply the emergency brake. I didn't believe her. These things really do exist?

Yep. They are now common on luxury cars. You need a scan tool which speaks non-standard (vendor-specific) OBD-II commands in order to even change the brake pads, because sending a command to the ABS computer is how you retract the EPB. For an Audi, that means $250 for K-line cars, and $350 for CAN-bus cars.

Re: You know, im fine with a car that doesnt have

[ceoyoyo]

So do they fail on or off? If you're driving along and your battery cable falls off, does you e-brake immediately go full on, or not work at all?

Re: You know, im fine with a car that doesnt have

[drinkypoo]

So do they fail on or off? If you're driving along and your battery cable falls off, does you e-brake immediately go full on, or not work at all?

It doesn't work. People don't believe in e-brakes any more, so now they're just parking brakes. Seriously, if I post about a paragraph rant about how there's no such thing as an e-brake, I'll bet you a dollar that some asshole will come along and claim that they were never anything more than a parking brake. But as the owner of a car whose e-brake system is actually capable of making a (one (1), that is) full-speed panic stop, that is to say a W126 Mercedes-Benz, I find this notion ridiculous.

EPBs are bad, mmkay? But they're now quite common, and just another reason why the best cars are from the late eighties to late nineties, if not the early sixties to early seventies. Obviously, the mid seventies to mid eighties were a dark time for automobiles...

web programming isn't

[Anonymous Coward]

The problem you describe is with your tools, where "straightforward" and "intuitive" are inherently insecure. You could start and ditch PHP.

The obvious retort is that it's not the tools, but the bad programmers. Some tools are written by those same bad programmers and it's the bad programmers that keep on using the tools. And it should be them that should ditch those bad tools. Which is what I said in the first place: Ditch the bad tools and pick better ones. In the process, you'll have to become a better programmer too. No help for it, so sorry.

Re:web programming isn't

[Anonymous Coward]

Yeah, no shit. Who uses SQL escapes? That's just begging for an exploit. What is this, 1999?

Prepared statements with bound query parameters.

At least there's a reasonable market factor

[swb]

BMWs are expensive, BMW drivers tend to be affluent, affluent people can afford good insurance, replacing a stolen car is expensive, insurance companies will charge a higher premium on easily stolen models, affluent people might choose other cars because of high premiums and reduced sales and bad PR will force BMW to improve their security.

In theory, at least, the market response to easily stolen cars puts pressure on the carmaker to improve security.

Re:At least there's a reasonable market factor

[AmiMoJo]

I read somewhere that people in London can't even get insurance for certain models of BMW any more.

Re:At least there's a reasonable market factor

[Actually, I do RTFA]

In theory, at least, the market response to easily stolen cars puts pressure on the carmaker to improve security.

I was under the impression that most people purcahsed cars every 3-5 years. So I'm not sure why you think that market pressures will force them to fix the problem on existing models. On future models, sure...

So; it was a move to HTTPS...

[tlambert]

So; it was a move to HTTPS...

http://grahamcluley.com/2015/0...

Did they bother to fix heartbleed and POODLE while they were in there, or are they using an old stack, and it's still perfectly posible to implement the attack with a single additional step? In other words is this a "We must take some action!" fix, or is it a "We must take effective action!" fix?

BMW software sucks big time.

[140Mandak262Jamuna]

I have a 2014 X3. The damn thing would not connect to any of my Google Nexus phones via blue tooth. They have a very limited set of handsets they support. They don't seem to test anything other than iPhone and Samsung. Supposed to connect to 4 phones at the same time. The damn module crashes all the time and forgets perviously paired handsets that worked well earlier. Their mp3 playback is abysmal. All those old mp3s I ripped from CDs back in 1990s and early 200s play back flawlessly in every mp3 player, every computer, every device I have tried. From memorex-mp3-CD-R, to WesternDigital-TV box to chromebooks to sansa ... But in X3 it would not play, repeatedly crash the module, or get into endless loops.

Root cause of the problem seems to be some rigid adherence to specs and dim-witted error recovery process. If one mp3 file has a mismatch between its header declaration and its data section, that mp3 can misbehave. OK I will concede that. But the default action on seeing this mismatch should not be the whole entertainment module to crash, reboot and rescan the 8 GB memory stick all over again for media files. When it crashes and rescans, bluetooth does not work.It reminds me of Digital workstations where none of the the IEEE exception handler I install would work. Their default handler, which is to crash the process and write a coredump would kick-in no matter what I declare as error handler. BMW seems to be using an even more extreme version of this mode.

BMW is our customer, and they buy some engineering design analysis suites that we make in my place of work. I wonder how they will behave if I crash the entire computer every time a BMW engineer feeds an incorrect data to our suites.

I am not surprised it has so much of vulnerabilities. Anything that crashes this much will fall back to single user super user mode and present a console to the attacker sooner or later.

they used encryption, hmacs, thought they knew

[raymorris]

>. Not making complete fucking moron decisions about security is easy, if you hire someone vaguely competent. BMW decided to skip that step to save a few bucks to ensure nice corporate bonuses, and customers suffered.

Their developers encrypted the relevant text messages and used hmac to ensure their authenticity, so they thought it was reasonably secure. It's not that they were INCOMPETENT developers, the issue that none of them were security experts. Because true security, security that can't be broken fairly easily by an expert who then publishes a tool for script kiddies to use, IS hard. BMW's programmers did as much as I'd expect any application programmer to do. It's then time for the security audit, by a truly qualified security person, to catch the kinds of mistakes that the author caught. I work with some very good programmers. Some of them are really good at UI design, some are good at managing large projects, some are very versatile. It's a really good team of professional programmers. I catch security errors they make all the time because I'm the security guy. On the other hand, they have to fix my GUIs to look nice because I'm not good at designing attractive GUIs.

Re:they used encryption, hmacs, thought they knew

[drinkypoo]

It's not that they were INCOMPETENT developers, the issue that none of them were security experts, and didn't bother to consult any.

FTFY.

Re:they used encryption, hmacs, thought they knew

[Fnord666]

BMW's programmers did as much as I'd expect any application programmer to do. It's then time for the security audit, by a truly qualified security person, to catch the kinds of mistakes that the author caught.

No. Security is not an afterthought or something do be approached at the end. It needs to be an integral part of the software development lifecycle from soup to nuts. Anything else results in "ship it now, we'll fix it later" decisions and we end up where BMW is today.

Re:they used encryption, hmacs, thought they knew

[ceoyoyo]

Using the same key for each car is a pretty obvious flaw that's bitten a few companies. Having your car compromised by a motivated expert is pretty much unavoidable. Having all your cars compromised by one motivated expert, once, and anybody with a passing familiarity with Google afterwards, is really something that shouldn't happen anymore.

Re: they used encryption, hmacs, thought they knew

[Anonymous Coward]

The one break once break everywhere design didn't need to come from an expert, any dev with half a brain should be able to see that floor

I worked on the ConnectedDrive system

[Elledan]

While I do not work for BMW directly, the company I work for does do projects for BMW. One of the projects I worked on was the iOS app which is part of this ConnectedDrive system.

To be precise, for the 'old' version of the app (My BMW Remote App) for non-i models we started off with this black box library (CD lib) which handled all the communication with the BMW servers.

While I didn't do any protocol analysis or looked at the communication between car and servers, even for this iOS app it was pretty clear to me and my colleagues what the security implications would be if someone were to be able to obtain log-in data just for that part of the communication.

Depending on the market (America, Europe, Japan, etc.) there are some limitations to what one can do with the app (based on the type of account, IIRC), such as from what range one can see where the car is on a map and whether one can unlock doors with the app or not (not allowed in the US market, from what I recall). Where these limitations are enforced I'm not sure. It might be based on the server, in which case this hack would bypass such limitations as well.

At any rate, this security leak does demonstrate quite succinctly how important it is to properly security audit such systems before releasing it into the wild. Even for the current project I do for BMW (related to the headunits), having an active internet connection means that security is essential, including plugging buffer overruns and similar.

Nobody wants to have one's headunit go blank during navigation, in a constant reset cycle or be turned into a spying device, after all :)

Note that I'm still under NDA for all of these projects, so I can't go into much detail.

Looks like they never considered security

[140Mandak262Jamuna]

Like most companies security is considered a cost, an inconvenience or an after thought. Looks like there is no one who knows anything about security in the entire chain of designers who came up with this design for the cars. They seem to rely on security by obscurity.

Re:Looks like they never considered security

[Ol Olsoc]

Like most companies security is considered a cost, an inconvenience or an after thought. Looks like there is no one who knows anything about security in the entire chain of designers who came up with this design for the cars. They seem to rely on security by obscurity.

Looks like a sneak preview of the future of the Internet of Things.

Who ever thought we would have to worry about the security of our toasters?

Re:Looks like they never considered security

[ColdWetDog]

Who ever thought we would have to worry about the security of our toasters?

Just wait until your toaster is sitting in the garage trying to warm up for the morning commute.

And your BMW is in kitchen, trying to make toast.

ps more than 20 years experience, still screw up

[raymorris]

PS, though I've been focused on computer security for twenty years, and before that worked as a locksmith and a private investigator, I STILL make mistakes. I STILL looks and things I've done and say "well that was dumb". I'm still learning, even still taking formal classes while I also serve as an expert consultant for build new courses in security.

My IQ tested as - let's just say "well above average" - so if it were easy you'd think I would have figured it out by now.

Moral of the story....

[Lumpy]

Everything is hackable... OnStar that has been in millions of GM cars is just as hackable using the EXACT SAME TECHNIQUES.

So if you have a portable cellsite that can spoof a cellular tower the device is looking for, you man in the middle it.

Nothing new here except that a bonehead in programming the whole system is using the same key over and over to make his job easier.

Re:Moral of the story....

[antdude]

Yep. Nothing is 100% secured. :(

I am curious which one is more secured. Electronic (modern cars) or physical (old cars).

Re:Moral of the story....

[toddestan]

Well, if the security was done correctly (like https) they wouldn't be able to man in the middle it. The car would be able to know it's not talking to the proper server, and anyone just passively ease-dropping on the connection would just get see an encrypted data stream. Apparently this is not how it was done.

Re:BMW software sucks big time.

[Lumpy]

Which is funny because my 2007 BMW X3 connected with everything including nexus 4 HTC M8 etc...

The problem is BMW is pulling a GM and having their own people make the electronics now and they suck at it. the older Telematics modules were far better, same as the becker/alpine radio systems.

exactly, and consulting can be only ~$1,000 IF

[raymorris]

Agreed, 100%. Further, IF you know what to look for when choosing your expert, rather than hiring them through three levels of middlemen, for a relatively small project you can pay him $500 to have a phone call early in the design phase and show up at a later planning meeting to review the design, then $500 more to review the final code and make adjustments that are minor to do, but have major impact. Of course you can also pay HP $10,000 to send him out. HP will pay TCML $3,000, and TCML will pay the expert who does the work $1,200. Guess how I know THIS. Hint - I didn't read it somewhere.

Also, security isn't just about not getting hacked. Secure systems are systems that continue to operate correctly, even when someone is TRYING to break them. Therefore, the suggestions your security expert makes will improve the reliability of your system in the face of other potential issues, like a flaky cell signal. Making a system keep working even when someone is trying to make it fail means the system is more robust under other circumstances as well.

Re:exactly, and consulting can be only ~$1,000 IF

[AmiMoJo]

If a major car manufacturer spent only $10k, let alone went with the budget $1,200 option, I think we would be criticising them for being cheap and not valuing security enough. For a system that will be deployed world wide in hundreds of thousands of vehicles they should be setting up a security department and hiring a team of experts to work full time on implementing it right.

Re:exactly, and consulting can be only ~$1,000 IF

[toddestan]

If the security was present, well designed, and well implemented, I don't think most would care how they necessarily did it.

and I will continue

[Anonymous Coward]

to drive my old BMW. No need for fancy computers and gadgets in a fucking car.

Re:BMW software sucks big time.

[Anonymous Coward]

I have a 2014 X3. The damn thing would not connect to any of my Google Nexus phones via blue tooth. They have a very limited set of handsets they support. They don't seem to test anything other than iPhone and Samsung. Supposed to connect to 4 phones at the same time. The damn module crashes all the time and forgets perviously paired handsets that worked well earlier.

Sorry... I couldn't get past that part. I'm stuck still trying to comprehend why the f**k I'd want or need my phone to connect to my car via bluetooth, regardless of what make/model phone it was? Can I adjust the A/C and heat from the dash? Gas pedal, brake pedal, shift? Pretty sure I don't need my phone for those - in fact I can't imagine *any* situation that my phone connecting to my car while its in motion would be anything *other* than a safety problem, because I shouldn't be looking at a damn phone while driving anyways. And, TBH, my passengers don't need to be connecting to my car either IMHO, nor the random stranger in the car on the road next to me.

Re:BMW software sucks big time.

[140Mandak262Jamuna]

Did you order the navigational package? The navigation was part of some stupid package that included road sign reading camera, lane departure warning system and a load of crap for 3 or 4K. Now a days I get far more accurate and up to date maps in my phone, why the hell I need to fork that over? So, like a fool I am ordered a custom X3 without the nav package. This config seems to be very rare and they seem to have never tested their system when the hard disk is not available. They seem to have a quick start or check point core dump in the disk and reboot quickly back if you have a hard disk. Also scanned thumb drive cache exists in the disk, so it does not take long to get past that stage. But you don't get the hard disk the system takes so long to come back up.

My 2006 Prius has no trouble connecting to phones. They are all simple, connect to bluetooth, make a phone call type of connections. BMW tries to connect to the phone, its media storage, call logs, speed dial everything, at least in 2014 version. Four phones at the same time. But they assumed there will be a hard disk all the time.

good point, mentioned in my other post

[raymorris]

That's a good point, and one that I mentioned in my post which appears just above yours, but not my GP post.

Depending on the complexity of the project, budget, and impact, it sometimes make sense to engage the expert at three points:
Early planning (might be a conference call)
Late planning (to validate the design/architecture prior to much coding)
Pre-release (to check for any oversights in the actual coding)

Re:ps more than 20 years experience, still screw u

[radarskiy]

Clearly, you are the only person commenting on Slashdot that makes programming mistakes.

How exactly is this news ...

[janoc]

In particular, BMW has a history of similar cockups - just search youtube for various "iDrive problems", "Check engine reset" issues, "Engine stalling" issues, etc. Those software problems go back years. The first iDrive implementation from 2002 using Windows CE was a legendary lemon.

It isn't just BMW, though - http://www.edn.com/design/auto...

I had a Renault Clio and Renault's unreliable electronics is legendary too, even though there it was more a poor design than necessarily bad code. But you will never know - nobody has seen the source code of the firmware in many of the control units. Often not even the manufacturer has it - it is outsourced and subcontracted, even for critical systems like ABS or ECU.

And I am pretty sure that this is industry-wide problem - the same control units are in many cars, especially today with all those shared platforms and alliances between manufacturers.

If someone is thinking about drive-by-wire cars (Nissan, uses a safety clutch to be legal atm, but they have publicly announced a push to go fully by wire http://www.caranddriver.com/fe...) or the recent idea about the OTA updates in this sort of cesspit of horrid and unaccountable code, they must be insane.

Re:How exactly is this news ...

[drinkypoo]

If someone is thinking about drive-by-wire cars (Nissan, uses a safety clutch to be legal atm, but they have publicly announced a push to go fully by wire http://www.caranddriver.com/fe...)

Wow, I am so looking forward to being able to get one of those steering sensor+wheel packages from a crusher. That's just the thing to use to build a really quality FF wheel on.

Re:BMW software sucks big time.

[NeutronCowboy]

The main application for piping your phone through your car audio is that phone calls are clearer, and you get access to your audio books, music, or online newspapers that have an audio stream. In other words, making sure that your car system isn't obsolete 3 years after you buy it requires a tethering mechanism. And bluetooth is the simplest one out there.

Re:BMW software sucks big time.

[adolf]

Serious question: Am I alone in the thought that modern "infotainment" systems built into new cars are generally not useful items to have?

My own horror story involved borrowing a friend's Ford Flex to make a delivery of communications gear that wouldn't fit in my old BMW 325i: I tried, eyes-off-road, to get my then-current Droid 4 to sync with the Ford Sync, only to find that I had to stop the car first. I tried for a total of about 40 minutes. It should've just said "Hey, asshole: Stop the car and try again." Instead, we (it and I) just went through a long series of byzantine loops that had no indicators that seemed to lead toward success before I happened to fiddle with it while actually stops.

So, the stuff barely works. And I wouldn't even have cared, if Ford's POI database had the location of a Wal-Mart built in...a Wal-Mart that had been standing for over a half-decade before the vehicle was built.

And, the price: I myself can do a very elaborate custom install, or pay someone else to do a somewhat basic custom install for that sort of cash.

These days, what merit is there to automotive electronics that is not superceded by a cheap 6" tablet stuck on the dash, tethered to a cheap data plan on a wireless hotspot? Or made to automatically arise from the dash, as a theft deterrent? $3-4k buys a -lot- of 3D printed parts...and maybe the 3D printer to print them.

Plug in a big flash drive and a good DAC with USB OTG, add amplifiers and speakers (there is already room for them, if the factory stuff doesn't exist), and call it a day.

What am I missing? (other than: The rest, as they say, is only software.)

Re:BMW software sucks big time.

[140Mandak262Jamuna]

The automotive companies have always seen a fully integrated in-dash system as a profit center. Look at the price of navigation pacakge, upgrading to recent maps etc. 1800$ for in-dash navigation? 200$ for latest map DVD? what the hell? The auto makers think, "they bought my car. I can nickel and dime them, I can charge outrageous mark up on trivial plastic stuff". But the tablets with voice commands and google maps with latest google predicted traffic out perform anything these guys peddle. They do not have such a large user base to test, they are not used to releasing updates every year. Their hardware update cycle is around 4 years for a new model car.

They did exactly the same thing with in-dash radio, till finally SAE defined standard connections and after market cassette players flooded the market. One car maker will break ranks, Tesla has already done it, and just install a 10 inch tablet or provide a niche to place Bring-Your-Own-Tablet prominently in the dash. Some standard protocols to allow dedicated buttons in the wheel or the dash to send commands to the tablet... that will become a selling feature of that car model. Soon all manufacturers will be forced to stop trying sell us 1800$ nav packs and 200$ map dvds. Till then we have to put up with this crap. Or with the rise of 3D printing we might get a snap on module for the specific model of the car that accepts a 6inch or a 10 inch tablet and a dedicated buttons for "map/music/play/pause/skip/voice-command-phone/voice-command-map" keyboard to be to be stuck in a convenient place.

Free market will send price signals. Till the signal is heard and reacted on, it sucks to be on the receiving end.

Why focused on entertainment in cars?

[Anonymous Coward]

When I researched a new car last summer, I looked for safety features like collision avoidance, blind spot, adaptive cruise control, lane switch detection. Most of the cars had all kinds of stuff focused on navigation, entertainment, working with smart phones and supporting hands free phones.

I really love the adaptive cruise control in the car I got. It scales down to stop the car when I'm going slow and something jumps out. Yes, more of this kind of software!

The voice phone dialing? My Moto-X cell phone was better. I like receiving the hands free bluetooth, but for everything else, my phone with a wired earpiece was *way* better. I've considered unpairing the bluetooth and going back to the earpiece. I'd rather they didn't waste their time developing it. Heck, it doesn't even sync my phonebook!

The GPS is ok, but I prefer the garmin stand alone I already had. If I pay a subscription the gps can do some lame traffic alerts. I didn't find it worth the $ after the free trial was up. Frankly, anything in a car is *not* going to match what google and other companies can do with cell phones.

Why aren't there things like "If you go 2 mph slower, the next light will be green" or do the speed limit and it will be green. Or speed up, merging onto the interstate at 40 mph is dangerous...