Jailbreaking Subaru StarLink
github.com
github.com
Taking something apart does not void the warranty!
In fact it is illegal in the US for companies to arbitrarily deny the warranty unless they can prove that the user actually broke the item, taking apart ≠ breaking.
Magnuson–Moss Warranty Act (P.L. 93-637)
https://ifixit.org/blog/10016/warranty-void-if-removed-stick...
There's a huge practical difference between gearheads modifying the physical parts of their cars and a world where any Tesla buyer could as easily tweak engine, breaking etc. performance as they could download an app or re-flash their phone. You'd have idiots who'd otherwise never bothered to modify their cars dying as a result of trying to rice up their ride.
It's the same situation as RC planes and drones. The RC community had a natural selection bias for decades and wasn't worth regulating, then drones became available on the mass-market resulting in a bunch of idiocy that regulators needed to scramble to keep up with.
I think car manufacturers are rightly paranoid about that. There's a lot of profoundly stupid and unsafe stuff you could trivially do with a Tesla if you had access to the software, and if it was easy to install those sorts of things people would do so en masse.
Its also more technically feasible to prevent modification, and speaking as a fellow road user, I think I'd rather you run with stock firmware.
Until the courts can provide adequate compensation to the family of someone was was killed or to a crash victim who received life-changing injuries, I don't think that's going to be a compelling argument in this sort of situation.
Tesla has pushed updates which were broken in obvious ways that have killed people. It’s certainly possible to have a company like Tesla develop firmware in a safe way so that restricting what can run on the cars makes sense but that’s not what’s going on right now.
This mindset is honestly frightening, I like to actually own the products that I have purchased.
Sure, but sometimes your ability to customise a product to do whatever you want with it can also affect others, and at that point your rights and theirs have to be balanced.
My go-to example of this is modern communication devices like phones and tablets. There are obvious concerns about security and privacy with such devices, and obvious arguments in favour of the hardware design and software running on them being open to audit and verification so owners know their device isn't quietly betraying them. Those naturally lead to suggestions that all firmware should be open to owner modification, black boxes should not exist, etc.
What a lot of people don't realise is that if you let some idiot who doesn't know what he's doing mess around with the firmware driving the actual radio components in those devices, it's entirely possible for just a single device to cause widespread disruption that could interfere with the operation of numerous other devices in the area, with obvious implications for safety, security, and general quality of life for everyone else affected.
Even fewer people realise that the technology for isolating a rogue unit (which exist anyway from time to time due to things like hardware failure, manufacturing defects or software bugs) is very limited in its capabilities, because unfortunately the laws of physics still take precedence over whatever laws or regulations we choose to create as a society. In other words, not only can one rogue device cause chaos, it can cause chaos for an extended period because even the professionals operating the network have limited powers to do anything about it quickly.
To finish by returning to your own analogy, sure, I would have concerns about a car refusing to move until it's towed to a service centre authorised by the manufacturer if its tyres didn't have enough tread. That's obviously a form of lock-in that isn't in the owner's interests. However, I would have fewer concerns about a car refusing to move if its tyres didn't have enough tread to be safe until the problem was fixed, as long as any suitable method that made the car safe would immediately remove that block.
To the extent that a product is designed to only operate efficiently (or at all) with continued access to manufacturer services, it’s probably a bad idea to disqualify yourself from that access. But there are only two ways to solve that, either A) disallow the sale of products that rely on first-party services, or B) requiring manufacturers to uphold their end of the services contract while you do god-knows-what with your end of it (the product). Neither of these is the clear moral high ground that hacker types seem to think they achieve in this argument.
Microsoft understands this which is why they offer updates to known pirated versions of their software.
Making things difficult for a few pirates is less important to them that making sure things stay secure. They also don't want a bunch of windows systems out there, slow due to viruses mucking up their reputation.
Also, if a modified Tesla catches on fire at a charging station, do you think the headlines will mention that it was modified or will it just be “Tesla catches fire and blows up at supercharger”
While you wouldn't fully void your warranty the dealer/manufacturer would be under no obligation to replace parts you broke.
If I were to try to take apart the dash of my car I'd guess I would be looking at a 6 hour project minimum.
You think a company is going to heavily lock down an embedded system they don't expect anyone to try to access, or are they going to make the password easy so that all the techs and engineers can remember it?
1. I believe Harman had a previous device hacked back around 2014 due to a weak shadow hash. My guess was that they learned their lesson and made the password more complex. An easy way to test would be to diff the latest shadow file in the updated Subaru images (assuming they exist) -- if it changed, you may be right, if not, I'd still wager it is strong enough.
I don't like the idea of a backdoor like that available, but it is what it is.
2. The QNX6 hashing mechanism, to the best of my knowledge, isn't fully understood. Upstream changes to JTR seem to indicate that it has some form of bug in it or isn't fully reverse-engineered. That, along with having to spend presumably a large amount of time learning about contributing to hashcat & gpu programming, made this seem like a potential dead end without massive time investment.
So, is it possible it is crackable? Almost certainly, but I'm one guy doing this and you have to spend your time carefully in these ventures.
Given the reet of the work and your first point, it does seem like yours is the smart choice in this case. I was just surprised you didn't tey bruteforcing via ssh at first.
Thanks for the awesome article by the way! My Mazda got totalled last month, and I got a new 2019 Honda Fit I haven't gotten around to messing with yet. This gives some great ideas for how to proceed.
I just wonder if this 'smart tech' will become like when you find a CD changer in the trunk of a car. Except these smart dashes won't be easily removable/swappable like an old cassette deck.
And in a lot of modern cars the head unit is replaceable even if the manufacturer didn't envision it as such because of course the market has produced replacements anyway - like on Mercedes cars the entire head unit can be replaced by a custom one with a larger screen and running Android while not losing any of the factory functionality. On Nissan's you usually get a full dash replacement for custom radios. Quick search in AliExpress uncovers custom head units for nearly any car in existence.
Wrong. The basic model of a Dacia Duster doesn't even come with a radio. You need to upgrade from the Access (base) trim level to the Essential trim level to get a headunit.
I’m responding to “Seems like it's the new norm, like how radio became the norm in cars after some time. I bet people were complaining about that in the same way you are now.”
In 1975, there was no danger your radio would become obsolete or outdated at anywhere near the speed that an awful touchscreen tablet built into your car in 2020 will. So, I’m not referring to buying a car now with an AM/FM radio. I’m not sure what one would use that for other than as an AUX input.
Many of the devices in cars currently have bugs, poor interface, slow performance, and are generally inferior to modern phones. So, continuing to perform as they do now is not a relief.
It’s like having a phone from 2014 built into ... uh, your car. I’ve upgraded my real phones and tablets 3-4 times since then, despite that the old ones still functioned same as they did when new.
One example is that it’s difficult to pair iPhones with some cars from a few years ago. What happens when software updates make me unable to connect to the Bluetooth in my car? I doubt that Ford or GM is going to release a timely update.
You might ask: why do people upgrade computing devices that still function?
They're starting to put cars on the same obsolescence train as consumer electronics. This is on a device that costs a helluva lot more. I suppose that EVs have the same issue.
The parts situation is going to be interesting. Lacking standardized design and only a limited number of years of guaranteed (and high cost) replacements, it should be interesting in a decade. Cars a tough environment and I'm afraid that wrecking yards will see a lot of usage in terms of both cars become obsolete/unfixable and as sources of spare parts.
It's interesting that the original sin of pushing towards this situation is the mandatory backup camera. Once the screen and a tolerably fast embedded system get installed, cost reduction leads you to a monolithic place for car controls. The modern fascination with cell phones probably helps the population go along.
I would think the best solution for this is to have swappable, upgradable tablets. Maybe basic operations built in, and a dock for a tablet that you could change whenever.
For any of this to function well, the manufacturers either have to work closely with competent consumer software companies, or become one themselves. It reminds me of the situation where cell phone carriers are expected to update the ROM on your old android phone, and often don’t do so regularly, because they’re not competent software or hardware companies.
Old Guy checking in: no, they weren’t. They were saving themselves fifty bucks by checking the “No radio: -50.00” box on the form.
This will be much harder to find on new cars in the US. As our May 2018, all new cars are required to have backup cameras (https://en.m.wikipedia.org/wiki/Backup_camera#Mandates). Now that a screen is required, it's harder to financially justify putting in a head unit that includes physical dials. Instead we're stuck with crap like "find the button for volume on the screen, then tap it 15 times to adequately adjust it". I'm hanging on to my 2011 Honda Civic for the foreseeable future, and pray the UI won't suck on newer vehicles or find a basic trim 2016-2018 that doesn't do everything on the screen.
I appreciate the safety aspect, but hate the UI of every car I've interacted with.
Any recommendations for cars whose UI doesn't suck?
If for some reason you get a trim level that does not have cruise control, it's easy to add: drill a hole in the steering console, mount the lever, and plug it in. The car is already programmed with the feature.
In the premium space, BMW has always maintained a medium-high bar with recent iterations of iDrive. (There have been many revisions and trim variations of their system, but approximate rule of thumb for acceptable tech is 8+ inch screen, 2013 onwards.) It's not going to wow a UI nerd, but if you plan to own the car for multiple years, it's slick and effortless once you're familiar with it—especially as almost any menu item anywhere in the system can be programmed to one of the 8 or so preset buttons on the dashboard.
I therefore have dedicated buttons in my car for "Call my wife", "Trip computer details", "Open destination address book", "Spoken directions on/off", and "Begin navigating to home." And if you think that will get too complicated too quickly, BMW thought of that: each preset button has a capacitive sensor in them so if you place your finger on the button without pressing, the screen will remind you what that button is programmed to do. It's nice.
Get a steering wheel with controls on it if the manufacturer doesn't offer physical buttons on the head unit. I'd be super surprised if you couldn't put a higher trim Civic's steering wheel on a lower trim Civic. Look for part outs from totaled cars (the sport and SI trims are good places to look - kids drive them irresponsibly, and they have high end tech that is usually salvageable when the body gets totaled).
I'm fairly happy with my Subaru Impreza - it has the head unit described in this post. The physical knobs and seek buttons make up for the dusty, stragnely-sensitive-sometimes, strangely-unsensitive-other-times screen.
The UI also doesn't control anything except the radio, navigation, and some system settings. All the climate controls are on separate knobs or buttons (I actually liked the physical dials for fan/temp on my old Mazda 3 Sport, the Tourings and above changed to electronic buttons and it's not as intuitive as the dials).
Anything before the late 90s? Buying an old car and then installing your own backup camera would be one possible way to get the useful features but not the annoyances.
All we need now is integration of biometrics to start the vehicle, so they know exactly who the driver is. For our safety, of course.
I feel like there are a ton of nice improvements to be had from the 2015 version if they could be figured out: 1. Better Spotify integration with album cover display, playlist scroll 2. Mirror google maps to the display 3. Show any push notifications that come in via your phone 4. Display engine diagnostic info when check engine light is on 5. Display a nice background image when not in use
These are just a few features I’d personally love to see, not sure if any are at all feasible.
Wow, this is so cool! I've been getting emails from Subaru to update my headunit. No idea that I'd see it getting detailed on github and hacker news.
>Harman and Subaru should not assume that the biggest flaw is releasing update files. Letting customers update their own head units is wonderful, and it lets security researchers find flaws and report them.
Yes!! Good good, I have to coordinate with a "Service Technician," drop my car off, have it sit around for a couple of hours, then get it back for something that would take me 20 minutes to do.
Don't blur information- block it out.
Anyhow, the hack itself is impressive. I tip my hat to them.
>> "7965616820746869732069736E277420746865207265616C206B65792E2E2E2E".scan(/../).map { |x| x.to_i(16).chr }.join
=> "yeah this isn't the real key...."Of course in a free world physical access to a device you own would mean that you can modify its behavior ("hack" the software).
The point of this is that hey, this isn't actually that hard if you're willing to put in the time. If you're moderately talented, you can probably learn it too!
As opposed to the standard exploit write-up/security conference circuit thing, where a lot of the details are kept secret and it seems like the entire point is to make other people think you're cool instead of teaching something. :)
Disabling the network connection would pretty much stop the tracking. Alternately, disabling GPS would work. Anybody worried about both stored data and about cellular companies reporting tower locations would need to disable both.
Undesired updates can mostly be stopped by disabling the network connection. Dealer service could be trouble; they might do an update without asking for my permission. Scrambling the crypto keys would probably stop the dealer service people from making updates.
Some of the above would also be needed to keep Subaru from uploading camera data taken in my garage. As it is now, Subaru could be watching me in my house!
So, take the above as the high-priority goals.
I’m not saying this shouldn’t be a thing, but it requires more thought that just giving users root
https://en.wikipedia.org/wiki/International_(Nice)_Classific...
Hence, as the check wasn't working, I never ran into the check. Dat file signatures may very well be in the header or stored somewhere else.
P.S. Thank you for writing this! It’s super interesting snd very easy to follow. I’ve shared it with friends both for the content and also as an example of excellent technical writing.