Slashdot Mirror
'Banned' Article About Faulty Immobilizer Chip Published After Two Years
An anonymous reader writes: In 2012, three computer security researchers Roel Verdult, Flavio D. Garcia and Baris Ege discovered weaknesses in the Megamos chip, which is widely used in immobilizers for various brands of cars. Based on the official responsible disclosure guidelines, the scientists informed the chip manufacturer months before the intended publication, and they wrote a scientific article that was accepted for publication at Usenix Security 2013.
However, the publication never took place because in June 2013 the High Court of London, acting at the request of Volkswagen, pronounced a provisional ban and ruled that the article had to be withdrawn. Two years ago, the lead author of a controversial research paper about flaws in luxury car lock systems was not allowed to give any details in his presentation at Usenix Security 2013. Now, in August 2015, the controversial article Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer that was 'banned' in 2013 is being published after all.
Luxury cars you say? Fuck 'em.
Memo to authors who think they will be sued into silence:
Put your pre-published papers in escrow in a country that's out of reach of any potential lawsuits, with instructions that if it is not published by a certain date that they publish it.
Don't try this if you live in a country where you could be locked up for contempt of court for doing this (emigrate first!), and don't try this for state-secret-level stuff like nuclear-weapons-research or you will likely find yourself behind bars or otherwise "permanently silenced." But for stuff like car-safety issues for people who live in relatively sane-legal-system countries, "publication escrow" will probably become the norm for researchers who work in "people will sue me into silence" research areas.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The High Court of London is located in the City of London. You know, corporate paradise. The only reason this corporate court even had the power to issue an injunction against the publication of the paper is because one of the researchers moved to Birmingham.
Two years? That's outrageous. Any vendor that takes that long to patch their holes *deserves* to get zero-day'd.
Things like this, and that nonsense that the court in Boston pulled wrt/ to the researchers and their DEFCON presentation, really sour me on the idea of "responsible disclosure." If the result of my courtesy is going to be a lawsuit and a gag order, I'd not be particularly inclined to offer vendors the courtesy in the first place.
Maybe there's a place for a network of "vulnerability escrow" services. Submit the vulnerability simultaneously to the vendor and the service, which would have to reside outside of the terrirory of whatever court system has jurisdiction over the researchers, and a stick 30-day timer starts, after which the data is automatically and immediately released.
Imagine all the people...
my understanding is that it still hasn't been "patched." The root cause is so far down in the implementation that it can't be patched.
I'm sorry, but sane-legal-systems went extinct.
Captcha: confine
Better yet,
don't inform the manufacturer and publish anonymously.
Companies show time and again that there is no advantage to telling them about vulnerabilities.
Better to just tell the world and let the company deal with the fallout.
If they just replaced the chip - and whatever device it was contained inside (engine block? entire car? let's hope not) with a patched chip or, more likely, a dummy chip that didn't have any purpose other than to say "no, sorry, function disabled" whenever it was asked to do something, that would patch the vulnerability.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
this is an information which should be cared of 2 years passed away and .. car makers did something ? a lot of fixes ? nothing ?
nice job.
It gives a bad impression to spam off-topic in other articles.
Does that "this will go to the press if I don't check in" failsafe actually work in real life, or only in detective fiction?
Who provides this kind of service? My first guess would be an attorney, but that might require some explaining and some examining of information and the attorney might be unwilling to play along if they thought they would get some blowback from it.
We put everybody at risk when companies are not forced (by virtue of having lots of time to fix the bugs) into fixing code quickly. By increasing the time companies have to fix the code it opens up opportunity for others to discover the same bugs and begin actively exploiting them. You may think this unlikely- but we already know that companies are submitting this bug information to entities such as the NSA who then proceeds to exploit them until the vulnerabilities are fixed. As it's not widespread exploitation it's rare for anybody to pick up on unlike in the case of typical commercial maleware thats widely distributed.
I like how Slashdot is so efficient now that they put their dupes together in the same summary:
they wrote a scientific article that was accepted for publication at Usenix Security 2013. However, the publication never took place
Two years ago, the lead author of a controversial research paper about flaws in luxury car lock systems was not allowed to give any details in his presentation at Usenix Security 2013.
systemd is Roko's Basilisk.
Many companies have demonstrated that responsible disclosure (let them know, and give them a reasonable amount of time to fix the problem before going public) works well. Some companies have demonstrated that responsible disclosure doesn't work with them, because they don't fix things until it's public (Microsoft used to be part of this team). A few companies, such as the one being discussed in this article, are actively hostile to responsible disclosure, and will take pains to *prevent* disclosure in order to eliminate *their* risk for not fixing the vulnerability.
The problem is that you don't know, when contacting a new company, which 'team' they belong to.
If they're on team friendly, you get feedback indicating an estimated time to fix, and you can base your disclosure timeline based on that, or go with a default (your choice).
If they're on team indifferent, you don't get a response, and you can go with your default disclosure timeline. No skin off your nose there.
The only real problem lies in the folks on team hostile, as they can (and are prepared to) make your life *quite* miserable. There really ought to be a list of these folks that security researchers can reference, and go with immediate, full disclosure for them.
Immos are just a backup electronic key embedded in your real key. They either work by contacts on the key, or by radio with a little loop antenna wrapped around the ignition lock, and the radio tag embedded in the head of the key. The key immo code has to match the immo code in the pcm or whatever, e.g. these immo chips. And then the car either doesn't get started, or it gets killed after getting started. The function tends to be built into the pcm, but there's also matching codes in other modules most times like the cluster and the tcm.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
No, it does not work.
If you are injuncted against publishing in your country, having someone else publish it somewhere else counts as you publishing it, so you can be held responsible for violating the injuntion. It works like that in every sane legal system, so the "emigrate first" part will leave you in places you really don't want to be.
The problem is that you don't know, when contacting a new company, which 'team' they belong to.
Well, you can always contact them from some hotmail address - or a less traceable Chinese equivalent. If they don't respond timely, publish anonymously. The same if they seems hostile.
Who cares how long the development time is? When a company has a dangerous product, the Press is supposed to ensure the product gets fixed. Imagine if the Dell Laptop battery issue was put under a gag order for 2 years. Dell and the court knew that it could catch fire causing death and injury, but did not want to hurt Dell's profit margins.
I have no idea why people lose any established logic because something is Electronic versus Mechanical. If a person could hit a car a certain way and cause the transmission gears to fall off, it would be all over the news and a law suit. Even if the Transmission was being developed for decades (as many are), there would not be a gag order on findings. Why you want to put an electronic system on a pedestal and insult people who can equate the two is appalling.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
It does protect the information against yourself and the company to some extent.
The first part works because it's relatively easy to work up the moral backbone when the shit hasn't hit the fan yet. Yes, you might get sued eventually but whether you're sued or not, the information will be published. At the point when you put the information in escrow you are still brave or uninformed enough and when you aren't any longer, the information is secure and will be published.
The second part works because in some cases a company might prefer the information getting out on favourable terms and decide to let you off based on that. This is legally speaking a form of blackmail, if the company doesn't go along...
In summary, you put things in escrow not for yourself, but because you believe that some things are bigger than you. If you don't believe that for the particular case in question, don't put it in escrow. If you don't believe that in general, please jump in front of a train.
The issue here is that this isn't like a piece of computer software where you can disclose the vulnerability to the vendor, give them a few months to push a patch and then go public.
The only way for Volkswagen and the many other car makers using this Megamos cryptography chip can fix their cars to not be vulnerable would be to replace both the computer system responsible for the immobilizer AND the keys/remotes/etc that talk to it. That would be a VERY expensive exercise.
And what about cars that are old enough where its just not possible to redesign the computer module and run a new production run (e.g. the computer module may rely on other components that you cant get anymore)
Or trying to find every single example of a car (whether made by Volkswagen or otherwise) that contains one of these vulnerable security chips so that it can have its system replaced?
That's what you get for acting responsibly
My ism, it's full of beliefs.
You're not telling us anything we don't already know. Fixing defects in cars that have been distributed widely is a very expensive exercise. It's also a normal and expected part of distributing products with warrantees. The problem with the perspective you're presenting here is that it flips one important aspect of reality on its head. That is to say that, in reality, the problem is already extant. Releasing the information about it isn't creating it.
The lesson here is to remain anonymous when following your responsible disclosure guidelines. They can't get a court injunction against publication if they don't know who wrote the paper or who is planning to publish it. You just mail them a copy of the paper anonymously with a note saying that it will be published worldwide in X number of months.
Am I the only one who thought that they ought to have posted the paper on-line on a site outside the jurisdiction of the judge in question?
I'm all in favour of responsible disclosure, but years should not be required to resolve a serious security flaw.
linquendum tondere
this is why all exploits should be announced first as a working exploit kit or working worm kit posted anonymously to 4chan. over and over again companies spit in the face of security research and threaten researches with civil and criminal prosecution for discovering their shoddy work.
Snowden and Manning are heroes.
Funnier if you had said it was deprecated.
Okay, so the immobilizer functionality has been defeated, and the only "harm" is that it makes your car easier to steal. Other than that, it doesn't interfere with your normal use of the car.
I'd be much more worried if they figured out a way to permanently immobilize your car or install a back-door so they could control it remotely at a later date.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If you are injuncted against publishing in your country, having someone else publish it somewhere else counts as you publishing it,
I doubt it.
I don't see how this timeline can be "contempt of court" in a country that actually (vs. theoretically) values free speech, etc.:
* Monday I put information in escrow abroad, saying "no matter what, release this a year from now, and if I or anyone else contacts you in this manner between now and then, release it immediately"
* Tuesday, I contact a company and share my disclosure with them
* Wednesday I get an injunction
* Thursday I fight the injunction and notify the judge of what I did on Monday
* The judge knows that he can order me to contact the overseas party holding the data in escrow but that any attempt to do will backfire and nothing I say or do now to comply with his order will change that
* The judge knows the odds of his getting a foreign government to seize the data before it is released are zero
* The judge knows that if he tries to hold me in contempt for doing something BEFORE the case ever hit a courtroom he will be overturned on appeal
* The judge knows that, barring specific situations like state secrets or bankruptcy fraud where criminal statutes may come into play, the only remedy for the other company is to sue me for damages, and that since the data isn't released yet, any suit for damages is likely premature.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Meant to say "On Wednesday I receive an injunction barring disclosure".
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
An injunction doesn't physically stop you. It just provides legal penalties. But if you had no ability to control the release, and the deadman was set before the injunction, you could prove innocence.
And emigration isn't hard, or leaving you in places you don't want to be. Plenty of places are better than the US. And the way US corporations work, if you contact a US company with something, they'll get a US injunction against you. Yes, if they were to file it where you are, then it'd be more effective. But the way it works, it's better/easier to file in the US only, then sue the non-US citizen for actions taken outside the US.
Learn to love Alaska