Hacker News Reader

Comment by trenning | Hacker News Reader

Look to the automotive industry then. I owned a shop as a mechanic for several years working on euro cars mainly as well as a lot of track cars. The software in cars has gotten insanely advanced, and yet independent shops are still able to service cars because there's support from 3rd parties on diagnostic equipment from companies like Snap-on who make diagnostic equipment.

Look at the auto enthusiast market for standalone ECUs that have been common for years. ECUs in modern cars are black boxes that are reverse engineered for aftermarket purposes. Software isn't a wall that can't be breached.

View on HN

Is communication with the ECU encrypted in some cars? Will it be in the future? If that happens, it will become much harder to replace components with aftermarket devices.

It seems to me that it must be, since we're going to have self driving cars depending on all the components in the car working within a tight specification. How can manufacturers assure that the customer's car is still safe and won't randomly kill people or become weaponized? This is presumably a liability issue, and obviously a marketing issue as well. (And instead of "encrypted" I read "authenticated".) Does right to repair also come with feature reduction? By this I mean... go ahead and fix your car and put in whatever components you want, but know that as soon as you put in non-official parts, the car won't drive itself any more.

Yes, communication is already encrypted or "protected" in almost all modern cars. New interfaces like FlexRay offer true cryptographic protection (albeit usually weak - things like AES with a universally shared key/IV across a whole model line are common), but even older systems have "protection" in the form of obfuscation, XOR and transformation based challenge-response algorithms (the one in VW cars runs a cute bytecode script against the challenge to yield the appropriate response), serial-number validation, and so on.

For example, most modern VW AG cars have all of their core modules protected by Component Protection, a system where the identities of the modules are synchronized together as a (somewhat successful, actually) anti-theft measure. If modules are "mixed and matched" (for example, a used head unit is installed in a different car), they don't function. Private shops can subscribe to a service to reprogram this protection (GeKo) at a cost of around $1000 USD/year.

By and large these systems are usually reverse engineered over time as the protection is usually not very good, but the overall ability to add additional hardware is, indeed, getting more challenging.

Reply on news.ycombinator.com