CAN Injection: Keyless car theft

https://kentindell.github.io/2023/04/03/can-injection/

by kotaKat • 3 years ago

610 300 3 years ago

kentindell.github.io

Comma.ai is another great example of CANBUS hacking. I'm a bit worried there are a bunch of zero days sitting out there on CAN implementations. It's such a complicated system.

ziziyO• 3 years ago

Newer Toyotas (Rav4 Prime and 2022+ Model years) are not compatible with Comma due to encryption, I would guess that probably also defeats this attack.

baldeagle• 3 years ago

I believe either the data from the adaptive cruise radar, or the data to control the steering is encrypted. I don't know if lock controls are. It was a small but important subset

crazysim2• 3 years ago

On a RAV4 Prime (or RAV4 PHEV for those outside of North America), these ECUs reportedly have "ECU Security Key" (A SecOC implementation) or signed/authenticated CAN bus commands since replacing them requires a check in with a Toyota server to "Update ECU Security Key" :

ECM

Hybrid vehicle control ECU

Forward recognition camera

No. 2 skid control ECU (brake actuator assembly)

Rack and pinion power steering gear assembly

Clearance warning ECU assembly

Steering sensor

Central gateway ECU (network gateway ECU)

Combination meter assembly

Airbag sensor assembly

---

There's nothing about smart key in here specifically. Not sure on later "ECU Security Key" vehicles though. If someone were to look up replacement instructions for the Smart Key ECU on Toyota's TechInfo, and if it has ECU Security Key update as a step or not, that could answer this.

rasz5• 3 years ago

OF course it doesnt, Toyota locked out sensors and actuators used by Comma, not the immobilizer.

RockRobotRock• 3 years ago

Would love if they could add a keyless unlock feature to their devices.

maxerickson• 3 years ago

It's really only troublesome on stuff that has a radio. Like it's not great that you can take over an electronic device with brief physical access, but the physical access reduces the scope of the problem a lot.

adolph2• 3 years ago

The way things really work:

• your “bank deposit” is just an unsecured loan to a company who may not manage risk as well as you’d think

• your “car” is a collection of computers operating in an insecure data center to which you trust the lives of you and your’n

bri3d7• 3 years ago

For what it's worth, most European cars have much more robust immobilizer systems that use actual cryptographic primitives to both obfuscate and authenticate start-release messages.

This is for a variety of reasons - a legal and insurance company focus on immobilizer technology through companies like Thatcham Research as well as a more active threat model geopolitically.

There are, of course, weaknesses in these cryptosystems, but the documented attack describes an extremely poor system by modern standards.

droopyEyelids• 3 years ago

What do you think about how the article listed devices being available for all the European manufacturers?

bri3d7• 3 years ago

I would love to see a story about one! I don't work in automotive RE, it's only a hobby, so I don't have budget to go find and buy "emergency start" tools like these security vendors do.

As far as I am aware: there are All Keys Lost (AKL) immobilizer bypasses for, for example, Volkswagen Immo 5, but not "Emergency Start" bypasses. The difference is the level of access required: AKL bypasses require involved, long term physical access to a car, for example at a shop. They're useful for independent or fly-by-night shops and in a post-theft scenario, but they're not going to boost a car out of a driveway. Meanwhile, Emergency Start bypasses are plain-and-simple theft tools like the fake Bluetooth speaker from the article.

All of the VW Immo 5 exploits which I am aware are of the AKL style and revolve around being able to extract cryptographic material (CS/MAC/ImoDat_noKeyMst/ImoDat_noKeySecu depending on who you ask what it's called) from a control module by physically removing it from the vehicle.

This is a far cry from tapping the CAN bus at a headlight and injecting an unauthenticated CAN message.

Gordonjcp3• 3 years ago

Even in the mid-1990s the key-to-BECM protocols used in old Range Rovers was frankly massively overengineered, with a 48-bit rolling code key based off the vehicle's VIN and a 24-bit key code. The actual encryption routine is just a bunch of shifts, adds, and XORs, but so far it has resisted any attempt at spoofing keys.

There's a somewhat simple trick to get the engine to start without the immobiliser (but it requires special tools), but if the body ECU is immobilised most of the vehicle electrics will be locked out too.

solarkraft• 3 years ago

You mean on the CAN bus? Then why doesn't the article mention it?

aaronbeekay3• 3 years ago

I work in the space and I have not been impressed by the quality of Thatcham’s requirements once you get past the physical domain (door handle pull force, steering column locks, etc).

gambiting11• 3 years ago

The thing that has always bothered me about stuff like this is that there must be some incredbly skilled software and hardware engineers out there who can put this sort of thing together, and they basically decide to use their skills to steal peoples cars(or well, enable others to do that). On one hand I get it, on the other I really don't. I would love to read an interview with any of them and see what drives them.

Cthulhu_2• 3 years ago

If I were to guess, money. Good scratch to be made selling these tools, or even just working for a contractor and never be found making the tools themselves - just a one-off sell of information on how to build a device like these.

But yeah, morals are flexible, a lot of people don't care what their work is used for (whether they're directly aware or not). I mean personally I've worked for investment banking and the tobacco industry (websites/shops for e-smoking products), I've heard of others that have worked for gambling or "adult entertainment", and how many of you here work on either crypto or Amazon?

What's morally right, wrong and justifiable is flexible, is all I'm saying.

jnwatson• 3 years ago

This doesn’t look particularly sophisticated. It takes understanding of basic circuit design and embedded programming. The genius bit is leveraging a Bluetooth speaker. That’s a clever choice.

In many countries, engineering (especially hardware) don’t get paid a lot. I could imagine the pull of illicit sources of income being strong.

edent• 3 years ago

As opposed to the incredibly skilled engineers who... steal your personal data (or enable others to do that)?

I would love to read an interview with someone who applied to work for, say, Facebook. After all the news about their complicity in trying to set the world on fire - what drives them?

markus_zhang2• 3 years ago

Money (and a chance to apply what he learned at a much larger scale)? It pays very well and you can FIRE in less than 10 years. Especially when FB is much more legal than say stealing cars.

whimsicalism3• 3 years ago

I don't think critics of Facebook have even decided what they want their critique of Facebook to be.

My opinion is most of the negative reaction that people have to Facebook is intrinsic to websites where lots of people socialize online.

asdff6• 3 years ago

Why stop there? On HN you no doubt have engineers whose line of work is in mass death.

adolph2• 3 years ago

The whole supply chain of exporting stolen vehicles (and any other large scale illicit activity) is probably filled with people with great talent and skill: sales, logistics, banking, HR, information security, ... Someone in one of the importing countries might even get hired to develop the system for export to the US.

Imagine if you were someone with specific knowledge that was not remunerated and someone else with ill intent noticed. https://xkcd.com/2347/

IIAOPSW• 3 years ago

Subversive itch man. Its not about the money. Its about being above the rules.

Disclaimer: I've personally not stolen a car.

Nextgrid8• 3 years ago

Could you link to a job post or something that would be willing to hire for these skills and pay decently? Because even expert-level embedded software engineers don't actually get paid that much, and the guys who designed this may not be able to pass a typical interview (unlike the job, building this car theft tool doesn't require expertise in anything - mere logic, trial and error and learning as you go will get you there).

whimsicalism3• 3 years ago

building this car theft tool doesn't require expertise in anything - mere logic, trial and error and learning as you go will get you there

Are you joking? This involves expertise, maybe just not certified through formally-mediated channels.

eimrine3• 3 years ago

I have an opinion that dealing with non-FOSS creates an ability to do this. And the ability creates the market. This is a cycle of stupidity where a client (most of it) does not want to learn anything and a vendor happily supplies shit. Appearing of that kind of "skilled engineers" reminds me water-and-dum supremacy where water is a kind of opportunist actor and dam is a shitty security software. A dam made of shit will fall in a matter of time.

bobleeswagger2• 3 years ago

see what drives them

Failure of the establishment is their primary driver. It's the free market in action, crime pays.

ridgered4• 3 years ago

Maybe they have felony convictions, dubious immigration status or personality problems that make traditional legal employment difficult or impossible for them. Or maybe it just pays well.

DrewADesign• 3 years ago

Most of these lines of reasoning assume the people involved have the same amount of agency as any other developer/engineer, and I'm sure they're right in many cases-- plenty of talented American software developers have worked at companies making scummy malware even having other options. But I'll bet that a big chunk of it is difficulty getting legitimate work if you've already been convicted of a felony.

I'm not making excuses; there are plenty of ways that someone with these skills could make money legally with a felony conviction, like online freelance work. But, life choices so often come down to the path of least resistance, and if you add in a language fluency barrier, intermittent or slow internet access, or some other resistance, I'll bet it's a lot easier to say "Screw it. I've already got a record-- what do I have to lose?"

olabyne2• 3 years ago

Money ? (and a low bar of ethics) They sell the device 5000$, and it costs them almost nothing (a cheap bluetooth speaker, and a few $ of components).

heffer• 3 years ago

what drives them

Don't know. A stolen car presumably?

thesaintlives2• 3 years ago

It goes like this - in eastern europe and other funny places there was no dealer network for cars and so no service. If you lost a key or similar someone needed to fix it. At first it was quite simple. Read eeprom, change eeprom etc. This industry developed over a number of years as did the skills. If you have no other option for being employed as an electrical engineer this is probably quite ok. Later as markets opened up and the internet became a thing the tools found an international outlet. First auto locksmiths, then thieves stealing to ship abroad (africa etc) and then drug dealers who had and would pay big money to access cars that are used for hits and other work. So it continues. The latest high end cars have real encryption onboard with unique keys. Taking them is much harder...

user9452342• 3 years ago

Throwaway account. I have actually worked on this sort of stuff. These topics are well known in the industry and have been for a surprising amount of time (decades).

Some premium brands will have the immobilizer await proper crypto from the key reader. In this case the key reader is just there to read the key and pass on the message, there is no decision being made outside of the immobilizer.

Some premium brands will also have immobilizers in other places, like the gearbox. It too will await proper crypto to shift into gear.

Some premium brands will have signed CAN/FlexRay/Ethernet frames that will prevent message spoofing, though that isn't only for this situation.

Most of the time the Gateway module has a static firewall - basically fixed routing tables so only modules that need to will be allowed to talk to each other.

Finally some premium brands will have an HSM both in the key and in the immobilizers to keep the material safe.

There is a lot more to this topic obviously but the reason some brands don't have this (and other countermeasures) is simple: cost.

drtz3• 3 years ago

Most of the time the Gateway module has a static firewall - basically fixed routing tables so only modules that need to will be allowed to talk to each other.

This was exactly my thought. If the headlights, and any other easily access CAN bus wiring, were properly isolated from critical security ECUs via a properly configured gateway, this attack would be impossible.

bri3d7• 3 years ago

I don't think that segmenting CAN wiring is a good solution to this problem. The Powertrain CAN will always be accessible externally for some definition of "externally" (on older GM cars it ran across the bottom of the car to reach the transmission, for example), and even a separate "immobilizer" CAN would probably be accessible somewhere.

The solution, as implemented by many automakers already, is just to authenticate immobilizer messages. It works, and there's not a great excuse for not doing this in 2023.

redblacktree• 3 years ago

How does a person with a CAN tool and an insatiable curiosity for knowledge about his own car find detailed documentation for his own edification? Any leads?

CamperBob2• 3 years ago

There are one or two well-populated subreddits for car hacking, so that might be one place to start.

myself248• 3 years ago

The DIY-autonomous-car folks have assembled a wealth of knowledge.

quake2• 3 years ago

I've also worked in this space for a few years and the amount of HN-style overconfident "we can fix this in hardware like the old days, the computers are coming for us!" comments without understanding the automotive industry or how cars are wired is pretty hilarious.

Something that should be noted for anyone who actually reads this is that the level of vulnerability is wildly different between automakers. No universal solution exists.

aaronbeekay3• 3 years ago

Yep - and not just between automakers, the security model varies wildly between different electrical architectures from the same manufacturer. Like any industry, there are hard problems, some of which are technically difficult, and some of which are self-inflicted from history/culture/insularity. No sector with any significant value or market competition has only the latter.

timeless102• 3 years ago

Do manufacturer's advertise these features? Some manufacturers don't even include immobilizers. It would be nice to know which include extra features. Seems like it could be a selling point.

user9452342• 3 years ago

On the contrary unfortunately, it's all secret for the average consumer.

People that never worked in the industry greatly underestimate how much it really costs in R&D and production to make a car. Adding "authentication" and "encryption" in this environment is way more complex and has more implications than importing yet another library in a web app.

Even so a few manufacturers go to a great deal of effort to secure their stuff while others are using 20y old architecture because it works and it saves money.

I want to say that "premium" brands are much better, but there are a lot of exceptions. However cars with lower margins and lower overall cost will be worse.

lamontcg3• 3 years ago

These topics are well known in the industry and have been for a surprising amount of time (decades).

I always assumed that immobilizers were already using cryptography to talk to the ECU otherwise this kind of attack would be obvious.

mthomasmw• 3 years ago

Without working in the industry, how could someone vet for the internal cybersecurity of an upcoming car purchase? None of these security features seem to be publicly documented anywhere. I have spent a long time looking.

AlotOfReading4• 3 years ago

You can't. Heck, it's sometimes hard to tell even when you work inside and have all the docs. The best information you have is to look at the manufacturer's past history as evidence for their future security competence.

Manufacturers also aren't building every piece of software on a given vehicle. Many components will be done by suppliers that range from "meh" to "wtf" when it comes to security. Even the best reviewers will struggle to catch everything a sufficiently incompetent implementation screws up.

Thaxll2• 3 years ago

At that point if you have a recent car you need a steering wheel lock.

gambiting11• 3 years ago

Having owned some expensive cars and spent time with other owners, there are two schools of thoughts to this:

1) add every alarm, immobilizer, hidden kill switch, steering wheel lock, driveway bollard you can possibly afford and keep the keys in a signal blocking pouch at night.

2)Make sure the car is as easy to start and drive away as physically possible - don't add anything extra fancy to keep it safe other than what's already there from factory, keep the keys on a shelf right in front of the main door of your property, easily and clearly visible should anyone enter.

The reason is simple - for owners of fancy/exotic cars, if someone is coming to steal your car, they will take it. If you make it difficult, if you hide the keys and put locks on the steering wheel, they will come into your house and ask that you unlock it for them. And putting aside the idea of any heroics with self defense, the last thing you want the thieves to do is harm you or your family to take what is essentially just an object. Cars are replacable. Insurance will pay for the loss and therapy for you and your family - but insurance will do nothing about losing your life because you decided to stand up to someone with a weapon coming to take your car. Let them find and take the keys and fuck off as quickly as possible.

I was in group 1 when I started, now I'm in group 2 - the risks to me and my family are just not worth it.

Thaxll2• 3 years ago

From what I understand they just don't waste time trying to remove a physical lock, it's like bikes, it's a deterent.

vidanay• 3 years ago

2)Make sure the car is as easy to start and drive away as physically possible - don't add anything extra fancy to keep it safe other than what's already there from factory, keep the keys on a shelf right in front of the main door of your property, easily and clearly visible should anyone enter.

Back in the early 90's when I first met my not-yet-wife, she drove a rusted out '85 Datsun (not Nissan). There was a rust hole right in the door panel where you could reach your fingers in and manipulate the mechanical locking rod to unlock the door. One time someone "broke in" to her car and rummaged around in all her crap, didn't take anything, and was polite enough to re-lock the door when they were done.

dagw• 3 years ago

if someone is coming to steal your car, they will take it.

Not if stealing your neighbours car is easier. Unless you own something very exotic and the thief has essentially been hired to steal your specific car, no one want to steal _your_ car. They want to steal N reasonably nice cars as quickly and safely as possible and get out of there before anybody notices anything.

markus_zhang2• 3 years ago

I guess there are a third option: buy low cost cars.

sebzim4500• 3 years ago

The reason is simple - for owners of fancy/exotic cars, if someone is coming to steal your car, they will take it.

This doesn't seem to be true, given that as soon as it became hard to steal cars the number of car thefts dropped massively.

dwighttk• 3 years ago

I’m in group 3... my car is 23yo

Spivak2• 3 years ago

#2 is why people in my area generally leave their cars unlocked. If it's locked thieves will break your window or pry your door which is way more expensive than the $10 phone charger they'll get.

deanc• 3 years ago

In my home town (UK) my father leaves his keys by the front door. We've had multiple neighbours with higher-end cars (think Range Rovers and upwards, presumably stolen to order) broken into, and threatened with knives and guns as the thieves couldn't find the keys.

olyjohn3• 3 years ago

Hate to say it, but thieves know how to bypass those too.

Cthulhu_2• 3 years ago

Reminds me of a former colleague of mine who got an alert from his phone (I believe he got a call from a BMW support center); there was an attempted break-in of his car. He had a BMW that had an air pressure sensor in the cabin, which was triggered because someone had broken the window.

No trace of course once he got to the car / once the police was around, just a broken window. But the would-be burglars made a mistake; they went into the frame of the car (between the driver and rear passenger doors) through the plastic to disconnect a bundle of cables, but didn't fit the plastic back properly.

This bundle of cables went to the antenna that was required for the phone home functionality; if he hadn't had that addressed, the thieves would have been back a day or a week later to get into the car, with the pressure sensor / phone home alarm not being able to contact BMW HQ.

Organized crime has enough money, time, opportunity and incentive to buy cars and take them apart to find weaknesses.

asdff6• 3 years ago

I feel like for most car break in's there's nothing you can do. The crime can take 10 second and only needs your tshirt wrapped around your fist. Or a spark plug. Or the air bladders tow truck drivers use that you can find at the hardware store.

Plus when the alarm does indeed go off, people are liable to ignore it because these alarms are always going off for nothing.

rationalist• 3 years ago

frame of the car (between the driver and rear passenger doors)

FYI, that would the "B Pillar". The A Pillar is the one between the windshield and the driver door, the C Pillar is the one behind the rear passenger door.

exabrial2• 3 years ago

CAN network by its nature is supposed to be a "trusted network" with no external Inputs available (Air Gapped). But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99, yeah, we've sort violated the Air Gap principal.

Here's the problem everyone needs to pay attention to: If you demand Encrypted OR Signed CAN Bus, you will ABSOLUTELY get it from the manufacturers in the name of security. They will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car.

So be careful what you scream for. We already have enough un-repairable items.

drtz3• 3 years ago

Encrypting everything on the CAN would be overkill and probably cost-prohibitive for manufacturers. Not all messages need to be encrypted -- just the ones that allow you to disable the immobilizer.

leoqa2• 3 years ago

The solution is signing packets with PKI and verifying them on receipt. Nothing says you can’t flash firmware to add new packets etc but the CAN bus couldn’t be spoofed unless you had the private key.

cryptonector2• 3 years ago

Sensors whose outputs are used to do cruise control and lane keeping assistance and so on should also be encrypted.

I don't believe anything in this space is cost-prohibitive in the long term, or even in the medium term. It's just dev cost amortization, because the chips are cheap once they tape out.

wlesieutre• 3 years ago

Encryption isn't needed here, this could be prevented by messages from the smart key unit being signed with a key known to the immobilizer

Nextgrid8• 3 years ago

Or just make the "smart key" controller a dumb passthrough of the key's messages and do the actual decoding and verification of the key messages in the engine ECU. I'm in fact surprised this isn't the case, but then again most "security" you see on cars is more about trying to lock out the legitimate owner from doing their own repairs or key programming as opposed to true security designed to defeat skilled attackers.

nroets• 3 years ago

And if anyone is thinking that DSA or RSA is too difficult, Carter and Wegman of IBM invented Universal Message Authentication Codes in the 1980s

avidiax• 3 years ago

Or just have the smart key ECU and the recipient ECU use a rolling code or even a 1 time shared secret. The other ECUs can learn the rolling code in the factory, or in after-service with the left door open, right blinker on, hood open, and horn tapped 8 times, and then wait 20 minutes.

Without the key to see what the code is, no injector can spoof the frame.

With the after-market procedure making tons of noise and spectacle, and a nice long wait for the police to arrive, the thieves can't replace the key ECU.

With the system being simple, no key provisioning is needed, no non-public information, just an extra page in the manual and a software update.

bluGill• 3 years ago

hey will _gladly_ lock out the CAN bus so no third party accessories or diagnostic tools can work with your car.

No they won't. One the law requires them to allow third part diagnostics tool (only for things that are about emissions!). Two, the third party tool maters are paying a good chunk of money to get documentation on how to do diagnostics.

While new car buys won't care, car makers know that nobody can afford to buy a new car except by selling their old car (normally done as a trade in), and the buyers of used cars care that the car can be fixed so if third party tools don't work the car has a lot less value.

wongarsu• 3 years ago

But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks

I can see how they got there. When you're moving getting rid of miles of cables that link everything and move your car to a CAN bus instead, it makes sense to say that you don't want a central blinker-controller that runs separate wires to every blinker. Instead you just run CAN and power to each blinker and give them their own little controller. Fewer wires, less conceptual complexity, at the cost of putting a little PCB in each blinker.

But because "analog" blinkers had the accidental feature that they blink faster if one blinker is broken, you have to replicate that somehow with your new blinkers. And the easiest way to do that is to have the blinker write that to the CAN bus, since it's already right there.

eimrine3• 3 years ago

How on Earth adding computer and a little PCB of demultiplexor logic instead of multivibrator-controlled relay might be considered as less of conceptual complexity?

I do even doubt in length of wires point. You need a full bus plus a thick wire from power source per every lamp instead of just a one thick wire from relay.

PragmaticPulp3• 3 years ago

But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks.... totally NOT to check with Toyota if you've subscribed to their monthly "safety package" for $7.99,

That’s not what’s happening. The value in a CAN bus control is that you can significantly reduce the wiring requirements.

Old school blinkers and headlights would require separate power wires for every function: Blinker, low beams, high beams. Those separate wires would each be snaked through long wiring harnesses back to relays somewhere else in a central location.

With CAN, you can run a single large gauge power and ground pair and use the CAN bus to tell the remote module what to do with tiny signal wires. It may not sound like a big deal, but cars have a lot of electronic pieces all over. Simplifying wiring can add up to a significant weight and cost reduction. You now also have the ability to add more monitoring, such as simple sensors to detect when a bulb has failed

Vehicle manufacturing is ruthlessly optimized. Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.

exabrial2• 3 years ago

that part was a joke, fyi. CAN is very useful, but tends to be overused as well: https://www.caranddriver.com/news/a41611379/gmc-hummer-ev-ta...

londons_explore3• 3 years ago

And yet the obvious thing is for someone to be making and selling a "can bulb" - a tiny 4 pin bulb with 12V, GND, CAN-H/L pins. And all bulbs (led or not) on a car would be that. It would turn on/off commanded by the canbus and report status info back.

Yet car manufacturers don't do this. CAN transceivers are still too expensive to build into every bulb. Instead, a single CAN transceiver and microcontroller will control a whole set of nearby bulbs (eg. brake, indicator, reversing lights). That then makes it vehicle specific, so you don't get the economies of scale of just making a single model of can-bulb which fits lots of places in many cars from many manufacturers.

rpcope13• 3 years ago

Vehicle manufacturing is ruthlessly optimized. Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.

You make it sound as though this intended to be a benefit to the consumer or the end product. Having worked on and around cars, and being friends with people who do for a living, I am really unconvinced that the manufacturers do a lot of this for any consumer-friendly reason, rather than simply trying to squeeze a buck out of you.

I can absolutely tell you that Volvo, for example, does what the GP is talking about, and then some. On an old school GM or Toyota, if you break a simple switch or knob, or things that really should just be simple devices, you can just pull it out, go to the junkyard or a parts retailer, and put the new one in and be on your way. Not so for Volvo (and I'm sure this has caught on in other manufacturers): if your switch or control or whatever fails, and its hooked up to the CAN-bus, whatever replacement you find simply won't work until you've gone to the dealership (if they even let you use a part that didn't come from there at all) and gotten them to flash the part and whatever other crap needs flashing like a BCM to get them to be compatible (I think just flashing the serial number of a BCM or whatever it needs to play nice with to the switch), at the tune of a couple hundred or more dollars each time.

So in essence, a stupid simple part, that should have been $5-10 that the manufacturer likely never would have seen a dollar from in the aftermarket, is now a $200+ dollar flash at the dealership, using the manufacturer scan tool, and also increasingly requires only parts the manufacturer can generate. So no, I really am extremely skeptical, given what occurs *today* that 95+% of the junk on CAN bus is there for any reason other than to boost dealership and manufacturer profits for no other reason than the fact they can.

outworlder2• 3 years ago

The value in a CAN bus control is that you can significantly reduce the wiring requirements.

I'm adding a CAN bus to my 3d printer for this exact reason.

JohnFen3• 3 years ago

Vehicle manufacturers wouldn’t add complexity to common systems if it didn’t pay off.

I know this stuff "pays off" for the manufacturers, but I really wish they'd avoid including unnecessary complexity such as those horrific touch screens, call connections, etc. That sort of thing is why I won't buy newer cars.

bambax• 3 years ago

Simplifying wiring can add up to a significant weight and cost reduction

Maybe, but given the explosion of weight and cost of new vehicles, it's unclear where these savings went.

m4632• 3 years ago

ruthlessly optimized

One huge problem is that they put the smart key on the same bus as other stuff (headlights, body control) to save money/wiring.

These kinds of busses should be buried far inside the dashboard or some other hard-to-reach area.

Schroedingersat2• 3 years ago

So give the essential stuff its own circuit. Or encrypt and mandate the owner gets to set the key.

batushka3• 3 years ago

Mate have you seen old relay controled car? It has 3 times less wires and is repairable with simple tools. "Simplifying wiring can add up to a significant weight and cost reduction" it's just not there.

Tangurena22• 3 years ago

I used to work for General Motors. Many of the early luxury cars would have 100+ wirings going into the driver's door. Early versions of what has since evolved into CAN were trying to reduce it to 5 wires.

tantalor2• 3 years ago

monthly "safety package" for $7.99

Toyota subscription services described here: https://www.toyota.com/connected-services/

One of these is "safety connect" that does stuff like SOS button and stolen vehicle locator.

It is not for the built-in safety features like collision detection and lane departure alert.

kwhitefoot2• 3 years ago

All new cars in the EU have to have always online SOS connectivity so I don't think anyone can charge for it

" eCall is a system used in vehicles across the EU which automatically makes a free 112 emergency call if your vehicle is involved in a serious road accident. You can also activate eCall manually by pushing a button. "

"Compulsory for new car models

If you buy a new model of car, approved for manufacture after 31 March 2018, it must have the 112-based eCall system installed."

https://europa.eu/youreurope/citizens/travel/security-and-em...

boomchinolo78• 3 years ago

I had a BMW with encrypted CAN or very similar to what that would be. Would refuse to use a new module unless you had the dealership key. Which my mechanic managed to get from his friend at the dealership but still...

Needless to say, never again

Tangurena22• 3 years ago

That started with the high intensity headlights. They were such a high theft item that when they're disconnected from the battery, they go into a locked state that requires a dealership to do the unlock.

HPsquared• 3 years ago

That's just the next phase in the dialectic.

lcnPylGDnU4H9OF• 3 years ago

you will ABSOLUTELY get it from the manufacturers in the name of security

Fuckin' good. Then they can give me the damn encryption key so I can diagnose it myself. I am absolutely not going to subscribe to any sort of narrative like these things are mutually exclusive. I'll keep screaming for the security and the repairability.

politelemon• 3 years ago

They will never do that in the same name of security. Their aim is appl-ification and johndeerification; it's their object but will let you think it's yours as long as it's a revenue source.

fps• 3 years ago

you can scream all you want, most people who buy new cars won't care and will just lease for 3-5 years no matter what the manufacturer puts behind a paid upgrade/software subscription. They never have to repair their cars, because nothing breaks for the first 5 years. The used market might care, but manufacturers don't care about the used market at all, since they get no money from it.

efficax• 3 years ago

So be careful what you scream for. We already have enough un-repairable items.

Couldn't the keys for decryption be stored in a trusted module that can only be unlocked with the presence of the actual car key? Yes, this means key cloning attacks still get you access to the CAN, but if you can clone the key you can drive away with the car anyway.

yuuuuyu2• 3 years ago

Agreed. Careful what you wish for. All those enthusiasts out their enjoying hacking their vehicles (in the traditional meaning of the term) would not like crypto and HSMs on that bus.

It's like in the old days when internet traffic was unencrypted and so was Wifi. You could have a lot of fun just watching what's happening in your home network, and perhaps your neighbors (so I heard..legal grey area). Today? Nope. Everything is locked down. Wireshark shows you only lots of SSL. And that's not even proprietary stuff as the car crypto will be. The bad guys will obtain the keys or workarounds somehow. The good guys will be locked out.

rad_gruchalski• 3 years ago

But yeah, because headlights and blinkers needllessly complicated, cough er, need data uplinks....

Autonomous driving something something, computer controlling human actions something something.

aaronbeekay3• 3 years ago

I work at Ford on vehicle access and security and I’m quite familiar with CAN security challenges and solutions. (Of course, I don’t speak for my employer here.)

Without speaking specifically to Ford’s plans, authenticated CAN communications are absolutely coming. I don’t see many approaches that actually encrypt the data on the bus - instead a MAC is used for each frame with a shared key on both secure ECUs, and some protections against replay attacks and such.

I wouldn’t expect all CAN data to be protected by this kind of security - it’s a pain in the butt, and expensive. Instead, certain specific sensitive information (like whether there’s a key in the ignition!) is protected as needed.

The industry is also moving toward IP-based communications for a lot of vehicle networking, which comes with many of the benefits of the modern infosec world. Automotive has a lot of unique challenges, though - like another poster mentioned, key provisioning and management is a huge pain; latency and hard timing constraints are way more important in the onboard/embedded world; many automotive ICs have limited support for e.g., asymmetric encryption, and of course there’s a lot of pain generated from the way the industry does software development generally. It’s an interesting space.

AYBABTME2• 3 years ago

s/principal/principle/g

m3kw9• 3 years ago

Not sure why they are still using a 1000 year protocol when you have Ethernet as a faster alternative. Even commercial airliners uses tech based on Ethernet for their controls

blueflow• 3 years ago

Ethernet is actually older than the CAN bus, even if not by much margin.

shandor• 3 years ago

Cost, reliability, real-time operation characteristics, and simplicity of wiring (which means less weight and less cost)

zelos• 3 years ago

I believe manufacturers are starting to switch to automotive Ethernet.

kaftoy3• 3 years ago

They are including Eth, not switching to it completely. They will keep the CAN buss there as long as it makes sense. Instrument clusters with graphical display output do use the Eth more and more because the amount of data beats the capacity of a CAN bus by far, but devices without big data transfer needs will stay on CAN. For example, what need is ther for Eth for an electronic gear lever? Not much data being exchanged.

genmud• 3 years ago

I'm not sure if you know, but canbus is used all over the place, even in aviation. The main selling point is simplicity of wiring and circuitry, as well as the fact that many lower end / cheap microcontrollers have it built in.

Ethernet is great, don't get me wrong... but it is complex to implement in a system like a car. Each device needs to speak ethernet, be switched and likely have an IP stack. If you are lucky enough to have a built in MAC / PHY into your micro (which most don't), then you still need to put in transformers and protection circuits.

10BASE-T1S is the future IMHO, it is much simpler than traditional 10BASE-T, requires only 1 pair and can also provide power. For simple setups, only 2 resistors + 2 caps are necessary to implement and you can have multiple devices on a bus without requiring a switch.

Veliladon• 3 years ago

And this is why security parts need to be fucking paired.

rasz5• 3 years ago

Like battery in an iPhone, right?

msisk62• 3 years ago

I often dream of going back to a car without any electronics at all.

Of course, I've had those and they have their own problems. Carburetors and point ignition systems have their issues.

So I instead live in a world where even my chainsaw has a CAN bus.

gambiting11• 3 years ago

Just a reminder(I remember those times too) that before the advent of immobilisers and electronic ignition locks, any car could be started in about 30 seconds with some very basic tools. Car theft has been absolutely rampant until the mass adoption of immobilisers where it has literally dropped off a cliff - it hasn't stopped thieves completely of course, but it's very much the case of electronics reducing crime by an order of magnitude(at least here in Europe).

sourcecodeplz• 3 years ago

You could use a basic flat-head screwdriver for both the door and ignition ... Unreal really

cortic• 3 years ago

I remember those times too, though I've never had any cars stolen by car thieves. I have lost 4 cars to the tech. That is 4 times the security system bricked my car in a variety of different ways;

I suppose the big difference between a person stealing my car, and the immobilizer stealing my car is that my insurance has to pay out for that first one.

asdff6• 3 years ago

To be fair those cars are trivial to install your own immobilizer. Autozone will sell you a switch for cheap and you can tuck it under the carpet by the pedals, or install a dummy switch in one of the spare slots on your dash.

drtz3• 3 years ago

While having fewer computer controls in our cars may beneficial in some ways, theft-prevention is certainly not one of them.

My dad had an early-80s Ford pickup when I was a kid. The cylinder in its ignition switch was broken in a way that you could hop in, turn the ignition switch, start the truck, and drive away -- all without a key. The ONLY thing preventing extremely easy theft was a few tiny pins in a lock cylinder.

This is an extreme case, but it illustrates how easy it was to steal cars before modern theft-prevention: bypass the mechanical lock to connect a couple wires together, and drive it away.

msisk62• 3 years ago

I think nowadays an old car with a manual choke, a stick shift, and a separate coil where you can remove the ignition wire between the coil and the distributor would probably eliminate all theft outside someone just picking the whole thing up with a rollback tow truck. ;)

LeonM• 3 years ago

Carburetors and point ignition systems have their issues.

One of which is that if you apply 12V to the coil, you can bump-start the car and it will run. Theft of such cars is truly trivial.

Modern cars are in fact very hard to steal. Just because the car from the article has a flaw that allows you to unlock and start it via canbus, doesn't mean that all modern cars can be stolen like this.

eimrine3• 3 years ago

Stealing car is not an only issue in keyless access. A friend of mine has lost a little bit because somebody used to open the car and steal everything costly what was in salon while the car was parked near a mall.

vbezhenar3• 3 years ago

You can bring ECU from the same car, connect some wires and start any modern car just as well. Original ECU won't even know what's going on. We call it "spider". It's not as easy as just powering on ignition sparks, but similar attack.

UncleEntity2• 3 years ago

One of which is that if you apply 12V to the coil, you can bump-start the car and it will run. Theft of such cars is truly trivial.

Bump start?

Just jump the starter solenoid terminals with one of those remote start buttons or a screwdriver.

ls612• 3 years ago

Modern car theft in the US is unfortunately all too easy; you point a handgun at someone in their car and tell them to give you their keys. Until those who do that are violently stopped by the state cars will be easy to steal regardless of any technical countermeasures.

Car theft is largely a political problem, not a technical one.

berkes• 3 years ago

I have a Volkswagen T3 from '84 and the most complicated "computerized" part is bus of relays.

Yet the car is trivial to break into. Hell, I've locked myself out a few times and the Key from another T3, a key from a bycicle lock and a nail-file could open the car (but not start it).

My countermeasures are mechanical too, though: hidden circuit breaker, a lock on the steering wheel, one on the gas-pedal and one on the hand-break. All of them easy to circumvent, given some time, but that's one thing thieves often don't have: time to figure out unknows and weird stuff. Actual "security by obscurity" in a way.

PinguTS• 3 years ago

I have this. You can drive my truck from 1968 away just with a nail. You don't need any key at all. Not even the doors are locked and you woudn't need it anyway, because its a convertible truck like most of the trucks from that time. Does that make it better?

asdff6• 3 years ago

Hide your own immobilizer switch and leave the nail in the ignition for your own convenience.

Ralo• 3 years ago

I built a 1994 Toyota pickup and swapped in a OM617a mechanical diesel. It's a really fun party trick to unplug the battery and have it continue running.

In terms of security, it's my most secure vehicle. Mechanical diesel means its gonna need to be glowed which I have it setup as a push button and no thief will know this. As well, my shutoff switch is a toggle switch under the dash I leave to "off". It'll just crank and crank forever. And my biggest security feature? It's a manual transmission. Most see that and won't even try.

Security by obscurity

throwawayForMe2• 3 years ago

My first car was a used 1976 MGB. Some models came with an electric overdrive, mine didn’t but it still had the switch in one of the steering wheel stalks. A friend showed me how to switch some wires around so the unused switch would control the fuel pump. That was the extent of my theft protection, with the loose rag top there was no point even locking the doors.

emptybits• 3 years ago

I worry that industry solutions involving more proprietary layers and/or encryption on buses will make our vehicles and appliances even less modifiable, diagnosable, and serviceable by anyone except factory authorized techs.

In keeping thieves out, we're locking ourselves out.

Steering wheel locks and primitive offline immobilizers had their advantages...

TheRealPomax• 3 years ago

This title should be "CAN injection" in all capitals. It's not a verb, it's the acronym for the Controller Area Network. (And is used in all caps by the article itself)

AlphaWeaver• 3 years ago

Agreed, it seems to have been caught up in the Hacker News automatic title reformatting behavior, which prevents words in all-caps.

copperx• 3 years ago

Weird choice, given we have more acronyms than the military.

cjbprime3• 3 years ago

Great article. But:

And part of the problem is that this isn’t a vulnerability disclosure and so the processes that Toyota does have in place are not appropriate.

I didn't follow this part. I hear that the authors think their "you can use CAN fault injection followed by a spoofed unlock command to steal cars" technical writeup is not a vulnerability disclosure. But why not? (Other than because they said so.)

The fact that the vulnerability is exploited in the wild doesn't prevent it from being appropriate to report it as a vulnerability -- quite the opposite. They even provide several fix suggestions.

(I'm not personally arguing that it is wrong to disclose the vulnerability without coordination. I'm arguing that it's weird to make a choice like that while claiming you aren't making one.)

rwmj• 3 years ago

He's definitely letting Toyota off the hook there. This absolutely is a vulnerability and whatever the size of the company they should have a way to promptly deal with vulnerabilities.

(Of course it also doesn't surprise me in the least that Toyota isn't taking it seriously)

cjbprime3• 3 years ago

I can't tell whether they attempted to disclose it to Toyota through normal vulnerability disclosure channels, though. The article implies to me that they didn't.

qup• 3 years ago

According to his disclaimer, it's most of the manufacturers with the exact same vulnerability.

peteri2• 3 years ago

I can say that Toyota Insurance in the UK takes it seriously, they installed an immobilizer (the key fob for which is branded with a Lexus L) for free on my 2020 Lexus RX to combat this issue. I'm probably going to buy a steering wheel lock, more to advertise that the car will be a pain to steal than for any additional protection.

I first heard of the CAN bus hacking late last year (in an owners forum) but it does seem to have become more wide spread this year.

MagicMoonlight• 3 years ago

How about instead of keyless entry we just keep using keys.

You wouldn’t have a password being loudly screamed out of a speaker 24/7, so why would you design a car key to work that way?

Spivak2• 3 years ago

Keys wouldn't stop this attack, they're simulating the key the way a screwdriver would in the ignition of an older car.

This is "keyless theft" meaning "you can steal the car without the keys" not "you steal the car leveraging keyless entry."

outworlder2• 3 years ago

Keys, those things that rely on pins getting pushed by a piece of metal?

Not much of an improvement. Without a transponder in the key they are no more difficult to bypass than a light switch.

StephenAmar• 3 years ago

FYI, you can temporarily disable keyless entry on Toyotas fairly easily:

Hold down the lock button Hit the unlock button twice

peteri2• 3 years ago

On my Lexus that doesn't disable keyless entry, just puts the key fob into sleep mode. There is an option somewhere to disable keyless entirely, but when enabled it means you need to hold the key near (I think less than 10mm from meory) to the push button start.

1970-01-01• 3 years ago

If you live in one of these high-theft areas, you can still use security via obscurity. Put a rag between your intake and air filter, or remove a critical relay (fuel pump, starter) or unclip a critical sensor (crank, cam, etc.) if it's easily accessible. Or do all 3. Each takes about one minute.

mdibiase• 3 years ago

For ease of use, you could also hide a fuel pump switch inside the car that you have to press before going. It's an easy but effective solution for protecting your car and needs basic tools / wires.

Of course, the important thing is making sure the wiring is well done (proper wire gauge) and the switch is actually in a hidden spot.

olyjohn3• 3 years ago

Magnetic switch hidden under your cup holders. And a magic cup with the right magnet glued to the bottom.

miohtama• 3 years ago

"Open sesame" attack

NKosmatos• 3 years ago

Typical corporate answer: We regret to inform you that the reported vulnerability is not in fact deemed as serious as you describe. A hacker/thief having physical access to your car, thus able to inject messages into the CAN bus, is not consider a serious security threat. Thank you for contacting our security department and perhaps you’d be interested in a monthly subscription for running a remote security diagnostic of you car!

ChumpGPT• 3 years ago

If you have a vehicle that you don't want stolen, perhaps a kill switch for the fuel relay is needed. Easy to install and hide. Will prevent the fuel pump from coming on. Something else to consider is a steering lock although it can be defeated, just more work for the would be thief.

Sometimes simple hardware can be a good solution is for a software problem.

redder23• 3 years ago

Are there any modern cars that have good modern mechanical parts but have no computers in them whatsoever?

rconti• 3 years ago

nope, wouldn't pass emissions.

rasz5• 3 years ago

Computer is not a problem here, bad design is. Ancient fully mechanical cars can be started by simply push starting.

sebstefan• 3 years ago

Modern cars are protected against thefts by using a smart key that talks to the car and exchanges cryptographic messages so that the key proves to the car that it’s genuine. [...] The thieves found a simple way around this: they used a hand-held radio relay station that beams the car’s message into the home to where the keys are kept, and then relays the message from the keys back to the car. The car accepts the relayed message as valid because it is - the real keys were used to unlock the car. Now that people know how a relay attack works generally possible to defeat it: car owners keep their keys in a metal box

? The car talking to the key first? Can't the key just not talk to the car at all unless the button is pressed on the key fob or shortly thereafter?

ilikehurdles2• 3 years ago

A lot of cars in the 2010s made available touch-based convenience access. ie if I have the fob on my person, the car unlocks when I touch the handle of a door, or gesture to open the trunk.

In the 2020s, I’m increasingly seeing smartphone (NFC?) keys being the sole thing you need to drive off with the thing so no fob is even necessary.

rootusrootus2• 3 years ago

NFC?

Or bluetooth. I'd rather have a pocket fob than have to take my phone out and hold it up to an NFC reader.

The problem with the bluetooth method is reliability. My Tesla decides not to unlock for me perhaps once every 20 times I walk up to it. Sometimes just a few seconds while it figures it out, sometimes I have to open the up and hit the door unlock button.

My wife's Bolt uses a pocket fob, and so far it has never refused to unlock the doors on command.

nilleo• 3 years ago

That's sort of how it works. The car "wakes" the key up to auth with it when you touch the switch on the door. The relay attack is bidirectional so it replays both the wake up from car to key and the response from key to car.

mdmglr• 3 years ago

So the device is using the controller on the JBL speaker with a modified firmware? And the grafted on components are to interface with the CAN bus?

UncleEntity2• 3 years ago

It’s using the battery of the speaker and the obfuscation of carrying around a Bluetooth consumer device. To the cops it looks innocent enough.

They seem to also pull out the speaker to make room for the add on board which does all the magic.

vbezhenar3• 3 years ago

If you don't want your car to be stolen, why not installing proper security measures? I don't really understand why someone would trust manufacturer to protect a car. In my country nobody does that, first thing you do after you bought a new car is you install additional security devices to prevent theft.

3-cheese-sundae• 3 years ago

What's an example of the devices you're talking about?

vbezhenar3• 3 years ago

Additional security modules. They detect hits, they don't allow engine to start unless they're unlocked with remote control. In my country most popular brands are Starline and Pandora.

98codes• 3 years ago

For example?

blobbers• 3 years ago

Is this the sort of thing that works on any CAN bus car, or are older cars immune to it since their ignition might not be on this same system?

Is my 11 year old car a little more "steal" proof to these elegant methods?

tonymillion2• 3 years ago

If you have push button ignition then yes there's a chance your car is vulnerable.

Any CAN bus? No, it takes time to sniff the bus and get all the control messages, older cars may be especially vulnerable since they likely don't have as many security precautions in place.

CAN has been in cars for quite a long time, the infiltration systems haven't due to high-cost/lack of electronics.

On a side note, the hack talked about in the article could be performed by a Arduino UNO and a $5 can bus transceiver.

potatochup• 3 years ago

Age doesn't really matter in this case. This is laziness on Toyotas part by not authenticating the messages between the "Smart Key" ECU and the main engine control microcontroller.

0xbadcafebee• 3 years ago

One look at the basic CAN architecture diagram and you see the problem. There's no reason for a secure key exchange to be on the same network path as every other device. Wrapping it in magic crypto sauce is not a permanent fix, because someone will just find a novel way to defeat the cryptosystem, like they always have.

If a thief wants to steal the car, make it harder. There should be one physical path from the key system to the ECU that allows key operations, and it should be protected by a really annoying and time-consuming process so that theft is so annoying that most people won't ever try it. After that is done, they can start sprinkling it with magic crypto sauce. (It's also very hard to get magic crypto sauce right; unless you hire the few really talented crypto people, whoever you hire to write crypto will make mistakes, and a hacker has unlimited time to find one)

Obviously existing car models won't be changed, but future ones should be. Car theft isn't just an inconvenience for the owner; it makes committing other crimes easier and harder to trace, results in more property damage, increases the black market for chopped cars, increases insurance premiums, etc.

nirav722• 3 years ago

One day used cars with the least amount of tech are going to be worth a lot of money in secondary markets. Especially because of the recent move to subscription based feature options some auto makers are trying out.

fy20• 3 years ago

To whom exactly? A handful of people wearing tin-foil hats? The rest of the world is going to be happy they can pay $9.99 a month to be able to remotely turn on the AC in their car.

nirav722• 3 years ago

Sure people will people for convenience and automakers will charge a subscription for providing that remote connectivity. But that wasn't the point in context of this article - the specific exploit detailed in the article can be applied to almost any non-connected vehicle in the last decade.

wkearney99• 3 years ago

Many (most?) vehicles have more than one CAN bus and messages for other networks are NOT bridged across them.

kaftoy3• 3 years ago

Not sure what you mean by "not bridged across them", but devices on different communication busses (CAN, Flexray, Ethernet...) do communicate with each other through these devices called "Gateways".

whimsicalism3• 3 years ago

Crazy that this attack developed in the wild. I'm impressed.

WalterBright• 3 years ago

Or just go back to having mechanical keys.

93po• 3 years ago

At first I forgot what I was reading and assumed the vandalism was because this guy had annoyingly bright headlights and a neighbor was making a point for him to fuck off with that

PanMan• 3 years ago

It surprised me the hacking toolkit came in a JBL speaker - I guess they reverse engineered that as well, flashed it with custom firmware, and it had most of the hardware needed for this hack?

Nextgrid8• 3 years ago

The article shows they soldered a custom board with a microcontroller on top of the JBL board - the only parts of the speaker board that are reused is the battery charging side of things.

nippoo• 3 years ago

As someone who's designed a product that's legitimately meant to unlock cars over the CAN bus, I'll be sad when encrypted/authenticated CAN communications become the norm! Users should be able to connect to the CAN bus in their own car and remotely lock/unlock the vehicle. There are ways of making a car more secure (there are already several different CAN buses in modern cars - having a security-specific CAN bus inaccessible without physical access to the inside of the vehicle should be a minimum!)

To start the vehicle, other manufacturers have the key communicate with the ECU directly, bypassing the accessory CAN bus.

Something I'd like to see is a unique private RSA key given to car owners on a USB stick upon purchase of the vehicle to allow them to replicate their own keys.

thesaintlives2• 3 years ago

Great post. One thing to add is most car door locks can be opened without much difficulty and without damage and usually not turning on the alarm. Open and plug device straight into the can bus. No need for headlight damage...

red_admiral• 3 years ago

In the old days, before cars were computer systems, thieves could still steal cars by hotwiring them - as I understand, the key ignition was basically a lock where if you turn the key then wire A connects to wire B (and if you turn it even further into "starter" position then wire C is somehow involved too) and a competent thief could easily strip out the lock assembly and just connect the wires with a jumper cable. Plus ca change.

In said old days, my late grandfather had a steering wheel lock, basically a giant padlock with a metal bar attached and the whole thing painted yellow. I assume that would work just as well in today's electronic days.

CAN Injection: Keyless car theft

Related Stories