Slashdot Mirror
A New Wireless Hack Can Unlock Almost Every Volkswagen Sold Since 1995 (arstechnica.com)
Volkswagen isn't having the best of times. Tens of millions of vehicles sold by Volkswagen AG over the past 20 years are vulnerable to theft because keyless entry systems can be hacked using cheap technical devices, reports Wired (alternate source). Security experts of the University of Birmingham were able to clone VW remote keyless entry controls by eavesdropping nearby when drivers press their key fobs to open or lock up their cars. ArsTechnica reports: The first affects almost every car Volkswagen has sold since 1995, with only the latest Golf-based models in the clear. Led by Flavio Garcia at the University of Birmingham in the UK, the group of hackers reverse-engineered an undisclosed Volkswagen component to extract a cryptographic key value that is common to many of the company's vehicles. Alone, the value won't do anything, but when combined with the unique value encoded on an individual vehicle's remote key fob -- obtained with a little electronic eavesdropping, say -- you have a functional clone that will lock or unlock that car. VW has apparently acknowledged the vulnerability, and Greenberg (writer at Wired) notes that the company uses a number of different shared values, stored on different components. The second affects many more makes, "including Alfa Romeo, Citroen, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot," according to Greenberg. It exploits a much older cryptographic scheme used in key fobs called HiTag2. Again it requires some eavesdropping to capture a series of codes sent out by a remote key fob. Once a few codes had been gathered, they were able to crack the encryption scheme in under a minute.
Story at 11. Yawn. If someone has a 1995 VW and it gets stolen, they'll probably be cheering.
If you even read the summary, you'll see that it's VW, Alfa, Citroen, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot.
I only have one keyfob and it isn't actually paired with the car anyways - I have to open it old-school.
The preceding post was not a Slashvertisement.
You never buy a car with power windows.... every convenience is either an attack surface and/or a money sink when it needs to be repaired.
My eyes reflect the stars and a smile lights up my face.
Good, it should then be easy for VW to update all their cheating smog applications.
Table-ized A.I.
My key fob broke and Dodge wants several hundred dollars to replace it with a new one.
Plus, it would be way cooler to walk around with a Raspberry Pi on my keychain that opens my car, everyone else car, and turns down the radio of the car parked next to me at a red light.
So in 1995, we also saw SHA1 formally accepted as a standard. And SHA1 is now considered to weak to be secure against well-funded attackers.
The standard VW used had to be developed prior to 1995 if it was in production for the 1995 model year, so it's not surprising that it is more vulnerable. Compute capabilities have grown quite a bit.
The only real problem I see is that VW is still using 90s-era crypto in modern vehicles. I'm not surprised by this, and I'd be shocked if they were the only ones---but it is still a problem.
Cars with remote start and smartphone integration really need to have software support and upgrades over their anticipated lifespan. Sorry if it's a hassle, but cars are IT devices now.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
I'm sure, that's how that emission cheating software got into all those cars ;-=
The page at Wired requires tons of third-party Javascript and then tries to block ad blockers, so here's a link to the raw PDF:
https://assets.documentcloud.org/documents/3010178/Volkswagen-amp-HiTag2-Keyless-Entry-System.pdf
I'm sure that's how that emission cheating software got into all those cars ;-)
Yeah its an interesting hack, but you can open any car with a rock to the window.
Is old enough they can have just about anything they want. Provided the smell of mildew isn't a deterrent :)
RTFA:
The findings are to be presented at a security conference later this week and detail two different vulnerabilities...
The first affects almost every car Volkswagen has sold since 1995, with only the latest Golf-based models in the clear....
The second affects many more makes, "including Alfa Romeo, Citroën, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot," according to Greenberg.
devices thing may be getting out of hand. Besides car entry and starting lack of security, we have Blue Tooth door locks that broadcast their pass code in plain text, thermostats that send info to their manufacturer about where householders may be or not be, "smart" TVs with audio pickup and maybe video being compromised so as to pass their data to who knows where, refrigerators sending personal info in the clear to where ever, and most recently Blue Tooth enabled vibrators sending usage information to its manufacturer. We're living a security and privacy nightmare.
Real Fords are unaffected; if you read the paper, the vulnerable model are the Ka Mk2 and onward, which are actually rebadged Fiat 500's.
No Ford actually designed or engineered by Ford is in the list.
I was going to say exactly that. I have one key fob for me Charger, but I lose things, so I expect I'll lose it at some point, or break it. I'd love to crack it first. I hate to spend several hundred dollars on a spare.
I understand that slightly older Dodge vehicles can be hacked wirelessly through the infotainment system, but I don't think that hack applies to my car.
Those are japanese cars, not asian cars.
keys can be copied. shocker. not new to electronic keys. not new to wireless keys. has there ever been a key that couldn't be copied?
what "can" be done has never mattered. what "is" done is all that matters.
if keys are copied and cars are stolen, it's not a problem for car makers -- just like if my pen gets stolen, it's not a problem for pen makers. That car makers include some kind of security feature in the form of a key is nice, but I don't think that key is even mentioned in the car's warranty.
if cars are stolen, it's the problem of law enforcement, law creators, or your educational/economic systems. You ain't gonna resolve theft with security -- no one ever has.
My old pens said: "This pen stolen from,,,". My new pens say: "If you don't shave your head, this isn't your pen."
No Ford actually designed or engineered by Ford is in the list.
Nobody wants one. They can be stripped down on the spot. All I need are some tail light covers and the light bulb for the rear license plate. You know what a nuisance those roadside "safety" inspections can be, well, if you're black.
You are a nasty wasty individual.
This joke is older than the exploit.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
I get pulled over for burned out lamps too. Must be cause I am white. :(
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
You're not being serious are you?
All the affected Audis have Bosch PCMs, and the immobilizer is in the PCM itself on many of them including my 1997 A8, which has a later ME5 sadly and not a ME7.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The cops continue booking me. The guys is screaming till he goes blue!
Sent from my ASR33 using ASCII
It's a shame someone hasn't invented a physical device that cannot be remotely skimmed, which the person could carry upon themselves and use with a physical interface to unlock the door. Perhaps a series of notches on some item that would inserted into the car?
I have a little button on my browser that turns Javascript off/on, works great on Wired.
use a flatbed tow truck.
We are only talking about the ability to unlock the car, there are several tools on the market which can open nearly any car in the $100 price range. Let alone the no tech solution of a rock to the window. Which wouldn't even set off any alarm unless you opened the door afterwards. We aren't talking the ability to steal the car, only unlock it.. Pretty irrelevant in my eyes.
If they fine you, money for the dept.
If they stop a thief, no money for the dept.
When I was in school in the midlands we used to joke that we had lessons in how to steal cars; how ironic that academics in Brum are now using intelligence rather than the tool we used to employ: house bricks ;)
Let this be a lesson, never buy over-priced, cheating, expensive to repair, German lemon cars.
Next thing you know the hackers will control the steering wheel. The next thing you know, the CIA will off people by driving their car into a tree at high speeds via wireless remote control over some CAN bus lines.
VW has always been a mechanic's best friend. Now it seems they are a thieves best friend too.
This is all well and good (or bad depending) but my experience with my own VW golf is that the fob only works when I'm within 30 or 40 feet of the car. I'm thinking I'd be able to see someone lurking about with the hardware to snoop on the signal from the fob. Then what good will it do them because I'm going to jump in the car and drive it to somewhere else. Unless the snooper is targeting me and knows my habits, for example snoop the fob signal when I'm on my own drive so they know I'll be back later, then they have no reason to thing that they will randomly come across me again. If they are deliberately targeting me then I've got more problems than I thought. Even then if I unlock my car on my drive I'm likely to see someone close enough to intercept the signal and be suspicious.