Slashdot Mirror
How To Hack a BMW: Details On the Security Flaw That Affected 2.2 Million Cars
0x2A (548071) writes BMW recently fixed a security hole in their ConnectedDrive software, which left 2.2 million cars open to remote attacks. Security expert Dieter Spaar reverse engineered the system and found some serious flaws [note: if you'd prefer English to German, try this translation], including using the same symmetric keys in all vehicles, not encrypting messages between the car and the BMW backend or using the outdated DES.
Somehow I don't think the definition of "remote attack" is "disassemble the computer, attach all kinds of expensive hardware to analyze communications and firmware, hack into the firmware to retrieve the encryption keys, so only then you can use a base station emulator to trick the car into thinking your remote machine is a BMW firmware server."
The "remote attack" requires physical access, specialized skills, and intense hardware interaction. It is not something that some Romanian skript kiddie can pull off from their mom's basement.
A company as big as BMW should be able to hire some security experts, so this should be a bit embarrassing for them.
But the truth of the matter is, doing security is not easy. Take web programming, for instance. Back when I first learned PHP, I found over and over that whatever design or coding approach seemed most straightforward and intuitive was inherently unsecure. All sorts of escaping and manual insertion of encryption functions are required, and that clutters up the code to the point of making it hard to maintain. I did manage to implement most of it in a common PHP file that I reused over and over again, but there was a huge learning curve, and it was a pain. Since then, people tell me that it's gotten a LITTLE better. For instance, database wrappers generate the SQL queries for you and automatically escape strings. But for the most part, it still sucks.
If there were a single best book to read on cyber security, then perhaps we'd have fewer problems like what BMW had. But in reality, to get good at it, you have to have a vast familiarity with the literature and tools. You do that much reading, you might as well get a PhD. And my friends with PhDs focusing on security are in academia, not industry, so we get more security papers but not more secure devices.
BMWs are expensive, BMW drivers tend to be affluent, affluent people can afford good insurance, replacing a stolen car is expensive, insurance companies will charge a higher premium on easily stolen models, affluent people might choose other cars because of high premiums and reduced sales and bad PR will force BMW to improve their security.
In theory, at least, the market response to easily stolen cars puts pressure on the carmaker to improve security.
Root cause of the problem seems to be some rigid adherence to specs and dim-witted error recovery process. If one mp3 file has a mismatch between its header declaration and its data section, that mp3 can misbehave. OK I will concede that. But the default action on seeing this mismatch should not be the whole entertainment module to crash, reboot and rescan the 8 GB memory stick all over again for media files. When it crashes and rescans, bluetooth does not work.It reminds me of Digital workstations where none of the the IEEE exception handler I install would work. Their default handler, which is to crash the process and write a coredump would kick-in no matter what I declare as error handler. BMW seems to be using an even more extreme version of this mode.
BMW is our customer, and they buy some engineering design analysis suites that we make in my place of work. I wonder how they will behave if I crash the entire computer every time a BMW engineer feeds an incorrect data to our suites.
I am not surprised it has so much of vulnerabilities. Anything that crashes this much will fall back to single user super user mode and present a console to the attacker sooner or later.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
>. Not making complete fucking moron decisions about security is easy, if you hire someone vaguely competent. BMW decided to skip that step to save a few bucks to ensure nice corporate bonuses, and customers suffered.
Their developers encrypted the relevant text messages and used hmac to ensure their authenticity, so they thought it was reasonably secure. It's not that they were INCOMPETENT developers, the issue that none of them were security experts. Because true security, security that can't be broken fairly easily by an expert who then publishes a tool for script kiddies to use, IS hard. BMW's programmers did as much as I'd expect any application programmer to do. It's then time for the security audit, by a truly qualified security person, to catch the kinds of mistakes that the author caught. I work with some very good programmers. Some of them are really good at UI design, some are good at managing large projects, some are very versatile. It's a really good team of professional programmers. I catch security errors they make all the time because I'm the security guy. On the other hand, they have to fix my GUIs to look nice because I'm not good at designing attractive GUIs.
While I do not work for BMW directly, the company I work for does do projects for BMW. One of the projects I worked on was the iOS app which is part of this ConnectedDrive system.
:)
To be precise, for the 'old' version of the app (My BMW Remote App) for non-i models we started off with this black box library (CD lib) which handled all the communication with the BMW servers.
While I didn't do any protocol analysis or looked at the communication between car and servers, even for this iOS app it was pretty clear to me and my colleagues what the security implications would be if someone were to be able to obtain log-in data just for that part of the communication.
Depending on the market (America, Europe, Japan, etc.) there are some limitations to what one can do with the app (based on the type of account, IIRC), such as from what range one can see where the car is on a map and whether one can unlock doors with the app or not (not allowed in the US market, from what I recall). Where these limitations are enforced I'm not sure. It might be based on the server, in which case this hack would bypass such limitations as well.
At any rate, this security leak does demonstrate quite succinctly how important it is to properly security audit such systems before releasing it into the wild. Even for the current project I do for BMW (related to the headunits), having an active internet connection means that security is essential, including plugging buffer overruns and similar.
Nobody wants to have one's headunit go blank during navigation, in a constant reset cycle or be turned into a spying device, after all
Note that I'm still under NDA for all of these projects, so I can't go into much detail.
Site & blog: http://www.mayaposch.com
PS, though I've been focused on computer security for twenty years, and before that worked as a locksmith and a private investigator, I STILL make mistakes. I STILL looks and things I've done and say "well that was dumb". I'm still learning, even still taking formal classes while I also serve as an expert consultant for build new courses in security.
My IQ tested as - let's just say "well above average" - so if it were easy you'd think I would have figured it out by now.
Everything is hackable... OnStar that has been in millions of GM cars is just as hackable using the EXACT SAME TECHNIQUES.
So if you have a portable cellsite that can spoof a cellular tower the device is looking for, you man in the middle it.
Nothing new here except that a bonehead in programming the whole system is using the same key over and over to make his job easier.
Do not look at laser with remaining good eye.
Like most companies security is considered a cost, an inconvenience or an after thought. Looks like there is no one who knows anything about security in the entire chain of designers who came up with this design for the cars. They seem to rely on security by obscurity.
Looks like a sneak preview of the future of the Internet of Things.
Who ever thought we would have to worry about the security of our toasters?
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Early ABS: can only reduce brake force. very dumb.
Slightly later ABS: gets the ability to pump. still very dumb. But now it can be used by traction control systems. First yaw control systems implemented on production vehicles in the late 1990s, using this functionality.
Modern ABS: increased sampling speed permits determining how fast the wheel locks up, which lets you take a good stab at detecting snow/gravel. Wheel is permitted to stay locked up longer under these conditions to build up something to stop with.
Brake-by-Wire: Used only on heavy trucks with air brakes. Normal air braking system is still present, actuated near bottom of full pedal travel in emergencies.
What the ABS system actually looks like: just like a normal braking system, except a pump (not a CPU) is inserted into the brake lines. When the system is not activating, the valving defaults to a mode which permits the brake system to behave like normal.
The only caveat is that some of the systems with yaw control are missing a proportioning valve, or don't have as much proportion in it as cars before yaw control. ABS is used to prevent rear-wheel lockup. That means that when the ABS fails, the rear brakes overapply, increasing rear brake wear and the risk of fishtailing.
Now, there are EPBs, or electric parking brakes, and those are a bad idea. If some manufacturer feels that a hand brake is too much work for their customers, they can still implement a foot parking brake.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Agreed, 100%. Further, IF you know what to look for when choosing your expert, rather than hiring them through three levels of middlemen, for a relatively small project you can pay him $500 to have a phone call early in the design phase and show up at a later planning meeting to review the design, then $500 more to review the final code and make adjustments that are minor to do, but have major impact. Of course you can also pay HP $10,000 to send him out. HP will pay TCML $3,000, and TCML will pay the expert who does the work $1,200. Guess how I know THIS. Hint - I didn't read it somewhere.
Also, security isn't just about not getting hacked. Secure systems are systems that continue to operate correctly, even when someone is TRYING to break them. Therefore, the suggestions your security expert makes will improve the reliability of your system in the face of other potential issues, like a flaky cell signal. Making a system keep working even when someone is trying to make it fail means the system is more robust under other circumstances as well.
My 2006 Prius has no trouble connecting to phones. They are all simple, connect to bluetooth, make a phone call type of connections. BMW tries to connect to the phone, its media storage, call logs, speed dial everything, at least in 2014 version. Four phones at the same time. But they assumed there will be a hard disk all the time.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Clearly, you are the only person commenting on Slashdot that makes programming mistakes.
In particular, BMW has a history of similar cockups - just search youtube for various "iDrive problems", "Check engine reset" issues, "Engine stalling" issues, etc. Those software problems go back years. The first iDrive implementation from 2002 using Windows CE was a legendary lemon.
It isn't just BMW, though - http://www.edn.com/design/auto...
I had a Renault Clio and Renault's unreliable electronics is legendary too, even though there it was more a poor design than necessarily bad code. But you will never know - nobody has seen the source code of the firmware in many of the control units. Often not even the manufacturer has it - it is outsourced and subcontracted, even for critical systems like ABS or ECU.
And I am pretty sure that this is industry-wide problem - the same control units are in many cars, especially today with all those shared platforms and alliances between manufacturers.
If someone is thinking about drive-by-wire cars (Nissan, uses a safety clutch to be legal atm, but they have publicly announced a push to go fully by wire http://www.caranddriver.com/fe...) or the recent idea about the OTA updates in this sort of cesspit of horrid and unaccountable code, they must be insane.