Schneier on Security

Anοnymous • July 15, 2012 10:56 AM

@ Onno Kreuzinger:
“The claim that europe’s law makers require the OBU to allow Key reprogramming is of course nonsense; they require unencumbered access to diagnostic data so that any car-shop can repair your car, no one requires BMW to omit a re-keying protection.”

Actually, they do. I’m no expert on EU laws, but the guys over at Pistonhead seem to think that as part of that “repair” rule, EU law requires that any independent, unregistered garage must be able to replace a lost key without requiring access to either secret information nor even special tools. They even (apparently) restrict where the OBD port can be placed, to make sure it is quick and easy to find.

Under those conditions it is obviously impossible to completely prevent a thief from making a working key fob. All you can do is exploit the environmental differences between the two scenarios to make things more difficult for the thief. For example, on some models the alarm sounds if the OBD port is accessed whilst the alarm is armed. A nuisance in a garage dealing with a defective alarm, but a major headache for a thief.

You could easily do a lot more than that. You /can’t/ disable the port when the alarm is armed, otherwise it would be impossible to get diagnostics for a car with a defective alarm. However you could certainly make it much harder to access if the alarm is armed. Say, something like this:
1. When the alarm is off, you can access the port directly.
2. But if the alarm is armed, you instead need to request an override on the port. This request would cause the horn to sound several times, and then a count-down starts running, with the 4-ways periodically flashing. If during normal business hours, or if the GPS believes itself to be in your normal service agent’s garage, then the count-down will be 15 minutes. Otherwise, the count-down will be one hour.

@B. D. Johnson:
“I understand (and believe that) OBD should be accessible openly. The question is why all the information necessary to program the fob would be there.”
For two reasons. Firstly, it actually works the other way around; you program the car to accept the fob. Since the OBD port apparently allows write access to all the configuration data – including the list of accepted fobs – the result follows.

Secondly is the point where EU rules come in. We can easily imagine improvements to this protocol that don’t allow this. For example, you could prohibit writing key registration data to the OBD port until a secret authentication key has been provided by a special BMW key programmer. /But that is illegal./ The EU rules are intended to promote competition between garages, and part of the way they do this is to forbid any kind of proprietary restriction on car management interfaces. The basic idea is that it is mandatory that an independent, unregistered business shall be able to issue a replacement key fob. If he can’t do that, then the car maker is breaking the law. If he can do that, then so can a thief.

@M.V.
“The thieves didn’t start the car, … no evidence for programming a key on site.”
You are mistaken. The victim’s description of the attack makes it clear they started it as soon as it was on the street. They just pushed it off the driveway first to avoid waking him up, so they would have more time to get clear.

Furthermore the attack is not novel but has been occurring on this model of car for at least several months if not longer, and there is plenty of other evidence that this is how they do it. The novelty of this video is that it is the first time they have been filmed doing it. Or rather, the first time the footage has been published.

@Richard:
“The manufacturer … could give the owner the password so they can let garages access it.”

Unfortunately, experience with security-coded car stereos is that most owners will write the password in the log book they keep in the glove compartment, many will forget it within a month and expect the garage to be able to look it up for them (which defeats the purpose), and the ones who /didn’t/ write it in the log-book will forget to pass it along when they sell the car. This is one of the challenges of securing expensive consumer goods: making it usable by even the dumbest legitimate customer, who has years in which to screw up; and yet secure against even the smartest crook, who only needs to outwit you once.

@Daniel:
There was no security guard, because this was the driveway of a private house in suburban London, not Johannesburg. This is described in the accompanying text, but can also be seen from the second camera footage at the end of the video. That is also the reason they pushed it off the driveway before starting; to avoid waking the occupants, who were sleeping only a few feet away.

And I believe you are quite wrong about the video footage. If you look closely, and compare the views from the two cameras, it is clear that they tried to cover over the first camera with some sort of bag, but it was semi-transparent! With the bag in place the footage just loses some colour! They clearly didn’t even realise the second camera was recording them until too late; one guy notices it and is about to cover it when he is signalled that it is time to go. Furthermore, the footage could be very useful for investigators and possibly for prosecution. The guy wearing the horror mask had his face completely covered, but that won’t help him much once his mates are arrested. The rest of them expose enough clear, detailed close-ups of the eyes and nose that they could be identified by someone who knows them. Maybe not good enough for a verdict, but good enough for a warrant. There is also clear, detailed colour footage of their clothing (possibly disposable), footwear (maaaybeee also disposable, but in at least one case it is a distinctive and expensive brand that is probably his own shoes) and also a nice shot of a very distinctive shoulder satchel. Finally, while the horror mask does obscure the face very effectively, it is also pretty distinctive. Certainly not enough to uniquely identify a person, but enough to make someone think “Hmm, Eddie’s a bit of a geezer, and he has a mask like that”.

@phanmo:
“I worked at a dealership when they introduced PATS, if I remember correctly, management added an additional 30 minutes labour on every car equiped with it, on the off chance.”
So management was using customer ignorance to rip people off … the 30 minute delay doesn’t add any labour cost, because there is no need for the mechanic to wait while the delay is running. You trigger the countdown as soon as the car arrives on the lot, go back to whatever else you were doing, and then simply do the (2 or 3 minutes) job on that car shortly after the delay runs down.

@mh:
“nobody would design such system without authentication) … I’m quite sure that this weakness was fixed already …”

You’re twice mistaken. The system is designed without authentication, and that is the issue that has been mandated by EU rules. And the problem has not yet been fixed. In fact BMW has gone into ostrich mode like Microsoft in the bad old days, even though some insurers are starting to refuse theft coverage.

“…been used for years in Sweden to steal premium …”
Yes, the OBD vulnerability has existed for years in all modern European cars. What is a bit new here is how in interacts with the BMW’s factory fitted alarm system. If you can get physical access to the OBD port, you pwn the car. Hence, access to the port must be made as difficult as possible when the car is locked, and so thieves must first defeat the car security system. However in the case of some late model BMWs the crooks have realised that the security system /does not/ protect the OBD port. So this very expensive car actually has no security at all. The convergence of these two issues results in a £40,000 car that is easier to steal than a bicycle.