Hacker News Reader

Comment by randunel | Hacker News Reader

How would you deal with spare parts, then? If every spare part you swap on your car is able to check and sign messages, then this defeats the purpose. If every spare part needed to be programmed with the private keys, this significantly increases the cost of maintenance and prohibits non-dealers from making such changes. Besides, are the private keys really private when dealers can access them?

ECUs are already tightly paired with immobilizers and dashboards, so they already need to be swapped together. Let's not do this with other parts which frequently break such as lights, locks and windows, please.

View on HN

Easy, only an authorized dealer can make repairs to the vehicle. After a period of time the manufacturer may elect to no longer authorize any repairs, so as to incentivize the purchase of safer and cleaner automobiles.

Right to not repair

New spare parts can begin unprogrammed, and then program themselves on first use. This first use wouldn't be secure (it would be vulnerable to MITM attacks), but I believe that would be acceptable to the threat model of a thief attacking a parked car.

Reprogramming of 2nd hand components to a different vehicle might also be possible, but using some procedure which is hard to do from outside the car. For example, short two pins on the back of the lock.

How does that part know that it is being unprogrammed in the car and not in the thieves yard with cracked diagnostic tool?

So basically I need to pretend to be a new part to steal a car. Some common key as an attack vector.

Presumably, if you're able to replace the lock on a locked car with your own, you don't need to fool anything, you're already inside the car.

I guess the attack vector would rather be some unscrupulous mechanic replacing the part with a bogus one that would accept every unlock command, and the thief, in cahoots with said mechanic, would show up and unlock the car once the owner got it back from the shop.

Well the thing is that this is how cars with encrypted immobilizer gets stolen today (deffo not the case of RAV4)

- Open a hood

- Connect new, unprogrammed ECU (no immobilizer loaded)

- You can now start the car without chip in your key

As I see, people are reinventing wheel here, and are creating same problems as OEMs did 10-15 years ago.

Assuming they're willing to break a window or sacrifice the hood and related bodywork to pop it open without a key, is it really so easy to swap an ECU without having to take half the car apart?

My dad used to have a Citroën that would require taking out the whole front bumper assembly to change a freaking light, so it would be beyond stupid to have the ECU easily accessible...

Here Golf Mk7 - https://www.golfmk7.com/forums/index.php?threads/missing-eng...

ECU is on the right side in plastic cage next to a battery.

To get into the car thief will use a relay attack on your key, so no damage to the car will actually occur.

That ECU swap happens only if you have car with keys. If you have keyless car (start/stop button) then you can relay your way into starting engine.

So does a car with keys have somewhat better resistance to these attacks?

Of course, they seem harder and harder to come by for some reason...

That really depends on manufacturer. But in general it is more secure to use 2FA (Wireless link + mechanical token) than using 1FA (Wireless link and a button). Thief needs to jump through more obstacles, increasing the change of his failure.

However even mechanical token can be generalized as this video shows: https://www.youtube.com/watch?v=9NtDH-8z95M

So I think that in the end it probably does not matter. When somebody wants to steal your car, you have probably no chance to prevent it.

The ECU is in different places but they have pretty standardized plugs to connect to the wiring loom. You just unplug it and plug in a new one.

Yea, this attack doesn't make any sense as a threat model worth defending. If the thief is willing and able to replace substantial amounts of the car's electronics:

1. They're already in the car. So how you authenticate the ECU and door modules to each other is really irrelevant. They bypassed that already.

2. They can just go ahead and replace the ECU and all the door modules with their own. So, again, how auth works doesn't matter.

3. At some point, you have to ask: Am I replacing the electronics in the car, or am I replacing swapping all the non-electrical parts from one car to another?

This... seems like a relatively trivial problem to solve?

Each device that needs to sign messages (which probably should be only the ECU) is provisioned with a certificate signed by the carmaker. The device is also provisioned with a public-key pair, which is signed by the certificate (so you have chain of trust back to the manufacturer). The public key pair could be either programmed when the firmware is first flashed or generated at first boot.

A new door BCM accepts the first broadcasted public key from the ECU which is correctly signed. This would happen inside the factory for a new car, or when a new BCM is installed to replace a faulty one.

A used door BCM from a junk yard car could be programmed to accept a different (signed) public key by:

1. Being in the unlocked (and perhaps window-down) state; and 2. Pressing some combination of door buttons; and 3. Sending an appropriate command over the CANbus

It, of course, then verifies that the new key is correctly signed and reprograms itself to the new key.

You don't need to sign all messages. Only those coming from the critical component, like the key fob, and the only parts that need to check signatures are the critical ones from the perspective of theft.

Once you replace the key fob, you must reprogram your engine ignition.

What prevents a thief from reprogramming the engine ignition for some other key? The same thing that prevents the thief from starting ignition manually: it's buried in the car. Notice that in this case, thieves rely on CAN buses running in easily accessible places.

If the thief can access your car's ignition directly, you can't stop them anyway.

You could allow to pair the part to some central control unit, when the car is unlocked. I don't speak car or cryptographer so so I have no idea about how to go about it, but this seems like a workable solution.

Reply on news.ycombinator.com