Slashdot Mirror
A New Wireless Hack Can Unlock Almost Every Volkswagen Sold Since 1995 (arstechnica.com)
Volkswagen isn't having the best of times. Tens of millions of vehicles sold by Volkswagen AG over the past 20 years are vulnerable to theft because keyless entry systems can be hacked using cheap technical devices, reports Wired (alternate source). Security experts of the University of Birmingham were able to clone VW remote keyless entry controls by eavesdropping nearby when drivers press their key fobs to open or lock up their cars. ArsTechnica reports: The first affects almost every car Volkswagen has sold since 1995, with only the latest Golf-based models in the clear. Led by Flavio Garcia at the University of Birmingham in the UK, the group of hackers reverse-engineered an undisclosed Volkswagen component to extract a cryptographic key value that is common to many of the company's vehicles. Alone, the value won't do anything, but when combined with the unique value encoded on an individual vehicle's remote key fob -- obtained with a little electronic eavesdropping, say -- you have a functional clone that will lock or unlock that car. VW has apparently acknowledged the vulnerability, and Greenberg (writer at Wired) notes that the company uses a number of different shared values, stored on different components. The second affects many more makes, "including Alfa Romeo, Citroen, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot," according to Greenberg. It exploits a much older cryptographic scheme used in key fobs called HiTag2. Again it requires some eavesdropping to capture a series of codes sent out by a remote key fob. Once a few codes had been gathered, they were able to crack the encryption scheme in under a minute.
Keyword: since
Also, this is new tech defeating stupid implementations.
There are two types of people in the world: Those who crave closure
If you even read the summary, you'll see that it's VW, Alfa, Citroen, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot.
I only have one keyfob and it isn't actually paired with the car anyways - I have to open it old-school.
The preceding post was not a Slashvertisement.
You never buy a car with power windows.... every convenience is either an attack surface and/or a money sink when it needs to be repaired.
My eyes reflect the stars and a smile lights up my face.
Good, it should then be easy for VW to update all their cheating smog applications.
Table-ized A.I.
My key fob broke and Dodge wants several hundred dollars to replace it with a new one.
Plus, it would be way cooler to walk around with a Raspberry Pi on my keychain that opens my car, everyone else car, and turns down the radio of the car parked next to me at a red light.
So in 1995, we also saw SHA1 formally accepted as a standard. And SHA1 is now considered to weak to be secure against well-funded attackers.
The standard VW used had to be developed prior to 1995 if it was in production for the 1995 model year, so it's not surprising that it is more vulnerable. Compute capabilities have grown quite a bit.
The only real problem I see is that VW is still using 90s-era crypto in modern vehicles. I'm not surprised by this, and I'd be shocked if they were the only ones---but it is still a problem.
Cars with remote start and smartphone integration really need to have software support and upgrades over their anticipated lifespan. Sorry if it's a hassle, but cars are IT devices now.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
The page at Wired requires tons of third-party Javascript and then tries to block ad blockers, so here's a link to the raw PDF:
https://assets.documentcloud.org/documents/3010178/Volkswagen-amp-HiTag2-Keyless-Entry-System.pdf
RTFA:
The findings are to be presented at a security conference later this week and detail two different vulnerabilities...
The first affects almost every car Volkswagen has sold since 1995, with only the latest Golf-based models in the clear....
The second affects many more makes, "including Alfa Romeo, Citroën, Fiat, Ford, Mitsubishi, Nissan, Opel, and Peugeot," according to Greenberg.
devices thing may be getting out of hand. Besides car entry and starting lack of security, we have Blue Tooth door locks that broadcast their pass code in plain text, thermostats that send info to their manufacturer about where householders may be or not be, "smart" TVs with audio pickup and maybe video being compromised so as to pass their data to who knows where, refrigerators sending personal info in the clear to where ever, and most recently Blue Tooth enabled vibrators sending usage information to its manufacturer. We're living a security and privacy nightmare.
Real Fords are unaffected; if you read the paper, the vulnerable model are the Ka Mk2 and onward, which are actually rebadged Fiat 500's.
No Ford actually designed or engineered by Ford is in the list.
I was going to say exactly that. I have one key fob for me Charger, but I lose things, so I expect I'll lose it at some point, or break it. I'd love to crack it first. I hate to spend several hundred dollars on a spare.
I understand that slightly older Dodge vehicles can be hacked wirelessly through the infotainment system, but I don't think that hack applies to my car.
WVs were being stolen with a replay attack since nineties in Russia
Yeah, I can still open my 2010 truck with a coat hanger, so I ain't to worried.
This joke is older than the exploit.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
I get pulled over for burned out lamps too. Must be cause I am white. :(
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
You're right. It's just sitting in my pocket, on my desk, in a bowl, for anyone to take at any time without my knowledge. Pick any movie from the '90s. I'll start. The Thomas Crown Affair.
Keys aren't meant to keep people out. My house's front door is protected by a key -- only one key will fit the lock. And next to the door is a big glass window -- any key in the world will shatter that window..
Keys, like most security, are meant to require an attacker to escalate their attacks -- so the 7 year-old down the street won't accidentally enter my house, and so the expert burglar needs to actually do something that's always illegal. See, opening the door to my house is legal under so many circumstances. But picking the lock is legal under so very few.
The only security measure that's meant to keep people out is, and always has been, another person.
Good one. Let's crowdsource a list, shall we?
Coat Hanger
Slim Jim
Air Bag
from-inside-the-trunk
a knife through the rag top convertible
just plain forcing down the window with a glass-transport suction cup
jumping into the open convertible on a nice day
ten guys picking up a small car and carrying it away
four guys picking up half a small car and dragging it away
loading a small car into a large truck
using any tow truck on any car
a crow bar
a window-breaker
Yeah, it's the wireless that's the problem. Sure.
All the affected Audis have Bosch PCMs, and the immobilizer is in the PCM itself on many of them including my 1997 A8, which has a later ME5 sadly and not a ME7.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The cops continue booking me. The guys is screaming till he goes blue!
Sent from my ASR33 using ASCII
It's a shame someone hasn't invented a physical device that cannot be remotely skimmed, which the person could carry upon themselves and use with a physical interface to unlock the door. Perhaps a series of notches on some item that would inserted into the car?
If they fine you, money for the dept.
If they stop a thief, no money for the dept.
Right. Why should we believe that the wireless hack is new if the car it opens "since" 1995 is not...
It is more likely that if a key exists to open doors for twenty years that it is not new. Its probably twenty years old.
The only thing new here is the clue to the clueless.