Posts by regregular

OpSec is hard. We are creatures of habit.

Re: The end

Using Snipping Tool saves a few steps out of this even.

Yet seeing paint go sucks.

Re: Not IoT related, just bad security

This is not 100% correct. I think your procedure applies only if all keys known to the vehicle computer are lost.

If you just lose one, you can order a replacement, it will arrive mechanically precut at dealership, and then the local dealer can use his diagnostic device to program the new keyfob into the vehicle. Procedure simplified:

1. Diagnostic device communicates to BMW central servers to get auth/leave audit trail

2. At least one keyfob known to vehicle has to be present for "authentication"

3. New keyfob is registered

4. Lost or broken keyfob is removed from pool

Unfortunately, BMW fucked it up majorly, and you can steal even the recent ones by using a handheld aftermarket piece of kit and generic transponder. Somewhere in the procedure is a way to bypass the "known keyfob present" requirement. IIRC from the tech analysis it had to do with shitty crypto implementation. It is possible to just a third key into the pool, bypassing the theoretically quite clever system.

There's youtube videos that show pros pulling that off, evidently on some models the interior motion sensors are too narrow, and you can smash a window, wiggle you arm to the diagnostic port without triggering the alarm, connect the handheld device, scramble the new key into the pool. Then you click the fob and off you go.

Re: Alarms

>> On most "modern" cars (15 years +) which are designed to be used with a remote key fob for unlocking, the alarm will be activated if you use the mechanical key to unlock the doors. To silence the alarm you then have to insert a registered/paired key into the ignition switch pdq.

Define "most", plesae. Most "modern american" cars? Because this does not hold true for ANY of the modern cars I have owned / driven in the past and had the need/curiosity of opening mechanically. That includes a 2006 Alfa Romeo, a 2003 VW, a 2012 BMW, a circa 2010 Audi A6. There is a trigger switch in the door lock assembly that will immediately trigger the alarm if you try to turn the lock brute force or if you try to pull the core out. But using a properly cut key to turn the lock without force has not set off the alarm on any vehicle I have ever seen (here in Europe). It in fact not only doesn't trigger the alarm (because door is opened) but it disables the "movement detection" sensor in the interior on all examples.

>> It actually makes sound logical design sense, as a mechanical brute force on the lock, or a forged key will trigger the alarm.

You are talking about two different things. Brute force (screwdriver) will sound alarm. A forged key is indistinguishable from a real one as far as the mechanical doorlock assembly is concerned. If the cut is right it fits.

The opposite is correct, if you have the legitimate key, but the keyfob lock/unlock is broken it would essentially mean the car cannot be used if it was indeed wired / setup like this. You could open the door with the mech key but the alarm would be blaring for no good reason at all.

You have to allow for complete failure of the keyfob electronics (dead battery, broken electronics) or you will have pissed customers swearing on $DEITY that they will never again buy a car from $BRAND. That is why the mechanical key is still part of the fobs. And the transponder for immobilizer is separate from the keyfob electronics and will allow starting of the vehicle so customer can haul himself home and replace battery or buy an overpriced replacement fob from dealership (and on being quoted the price he will then swear to $DEITY to never again...)

>> Seriously, where do you think the battery is, does that need another door to protect that?

It can go pretty much anywhere. And the article was not talking about unhooking the battery (which proper brands defend against by powering the alarm circuits with a small emergency power source NOT accessible from engine bay), but unhooking the alarm system. Because with the battery cut off you can't very well use the diagnostic port to register the duplicate key, can you, genius?

>> What if the alarm system box is in the cabin? What then? Is there a place on a car, or a device that will thwart someone armed with manufacturer knowledge and devices, AND a properly fitted key?

No, which is exactly my point, yound padawan. With a fitted key all bets are off anyway and it makes no sense that someone (allegedly) had to disarm some alarm system. So either there is shoddy reporting on the side of the DoJ that describe modus operandi wrong or some serious engineering idiocy.

>> All they needed to do was disable the primary alarm,

>> yes they needed to disable the alarm, THEN they needed to pwn the engine electronics security.

No, they SHOULD not need to do that. With a proper key the alarm should not go off. If your keyfob is out of juice or defective, opening the door mechanically with the cut key should not set off an alarm.

>> And so what. What if they just smashed and grabbed the car and hot wired it? Same thing,

Not really. That should set off the alarm. Just like tilting / rocking the car (think pulling/lifting onto trailer).

>> I say they did a fair job and a novel process. And nothing of value was lost!

I don't disagree, especially with "nothing of value" part. Because if the car is really engineered to bother it's customers with the alarm just because they dare to use a properly cut mechanical key I'd say good riddance. But, in reality, probably not even Mexicans would take possession of such shoddy lunacy, except for disassembling... oh wait, there you go.

>> Take the most advanced car and security; it can be thwarted with knowledge of the system, and that you can get to the vehicle and physically pwn it.

Without a doubt. But in this particular case, the not so uncommon case of a dead/defective keyfob would supposedly trigger the alarm even for the legitimate user. I mean, by including the cut key with the keyfob the manufacturer basically allows for this case. He says, well if you drop in a puddle, accidentally fire it from a spud gun or whatever, use the mech key, the transponder will disable the immobilizer even without power, well you're good to go. But if the DoJ is right Jeep thought differently, and I want to know who's the idiot here.

>> Duh. I've yet to see a car that can't be broken into. Do let Detroit know of your special knowledge, I'm sure they will hire you straight away! :P

Broken into will always work on a metal can with a huge amount of surface glass. And unfortunately driving away is also easy, even with high end brands. Because those idiots do not use proper protocols. It would be easy enough to thwart the "open the can and use diag interface to register new key then driva away" approach.

Re: Well...

<blockquote>The big brands are not unaware of this shift at all, [...] the car business is far more diverse, and doesn't gravitate to one pole the way IT does. [...] If there's something you're not considering, I think it's how the average customer will treat autonomy. For personal transport, it's not a product category, but rather a feature. An important feature, but a feature nonetheless, and one that may not be too desirable outside of the unique traffic environment of the mass-transit-starved SF Bay.</blockquote>

It's true, the demands put towards a car are very diverse and change from region to region and between each customer. I can only regard trends I see developing here in Germany, and the trend here is towards not owning a car anymore at all. Many urbanites these days just register with a car-sharing service and pick up a car somewhere in the neighborhood when they need one. This is of course vastly different in the US where public transport is not as developed and where usually longer distances are involved. But with that generation autonomous driving seems to be very popular, because despite needing a car every now and then they are not keen on driving. And of course they are not at all brand-loyal, excited by horses or torque or in need of color-matched contrast stitched leather seats or legendary panel gaps. They don't own the car, they just happen to drive it whereever and want it to be as simple as possible. Autonomy is an important feature, while many of the other features that make the brand identity of certain manufacturers are losing importance very, very fast.

<blockquote>You drive a BMW. BMW does not make its own transmissions. [...] Similarly, everything in the interior of your car is made not by BMW, but by other companies: Adient (seats), Faurecia (dashboard trim), Magnetti Marelli (switchgear and instrumentation, and external lighting). [...] This is how the car business works. Most "innovative technologies" pioneered by car brands are from third-party suppliers who specialise in these things.</blockquote>

Exactly, thanks for reaffirming this, I brought up those exact points in a previous post in this thread (currently 5th post down from top).

<blockquote>So, let's say BMW wants to make autonomous cars on one side, and Uber/Google/whoever wants to make autonomous cars on the other. Whereas the Silicon Valley people have to source and build everything around their big feature to make a car from it, the likes of BMW simply has to find one of the many autonomous-vehicle companies and strike a deal with them to build that killer feature into a BMW.</blockquote>

Generally, you are right of course. Two points though: this can cut both ways. Silicon Valley cash reserves rival many nations annual GDP. There might just be a buyout of an established but struggling carmaker by the Valley that then starts to churn out the whatever-car. Valley likes to buy turn-key solutions and an established manufacturer will have all the machines, sources, personnel, dealership network and know-how. That is my point, making a car today is not black magic anymore. The autonomy development is, the rest is up for grabs on the market if you have the cash.

Also, if BMW sources the "killer feature" components from a 3rd party, how can they claim that BMW is / will remain in the driving seat regarding autonomous driving in the future. That is a major claim I am in disagreement with.

Also, there is the difference in company liability between the USA and Germany. In a nutshell, before something can be marketed in Europe, you have to conclusively prove that your product works as advertised, is safe and won't cause damage or hurt/maim/kill people. In the USA you essentially have a free-for-all situation where a company can throw a product out, but then if it fails and causes damage or loss of life the lawyers are rubbing their hands. I am not sure how that difference can be squared between a german manufacturer and a US supplier, especially when the determination of safety is so immensely complex. For tires, shocks or other products the determination is easily done in a lab prior to approval.

So, my point remains, I am relatively certain that the major german manufacturers will get seriously sideswiped in the not too distant future by a product with superior autonomous features that they thumbed their noses at before, like the Tesla. And playing the catch-up game on two fronts, electric mobility and autonomous driving might prove impossible and drive them into a tiny niche or bankruptcy. The arrogance displayed by the BMW bloke mentioned in the article is very uncalled for.

<blockquote>If it's "just mechanical engineering", why has Waymo/Google abandoned its grand plans to build autonomous cars, and partnered with Fiat-Chrysler instead? </blockquote>

The last I read about that is that Google does not plan to follow the completely autonomous vehicle without wheels or pedals any further and has shifted that branch of development off towards Waymo. Regarding the Fiat/Chrysler deal, the last bit I read was that Google took delivery of 100 Chrysler vehicles to enlargen their test fleet. This suggest to me that they are not quite there yet, but not exactly giving up either. I am not sure if this qualifies as a partnership. With those ugly LIDAR contraption on the roof of the Chrysler Pacifica vehicles I am very sure that this is not a pre-production prototype but just a technology testbed that could just as well have been delivered by any manufacturer. But maybe I misread that or missed specifics of that deal.