The Car Thieves Using Tech Disguised Inside Old Nokia Phones and Bluetooth Speakers (vice.com) 44
An anonymous reader quotes a report from Motherboard: A man sitting in the driver's seat of a Toyota is repeatedly tapping a button next to the steering wheel. A red light flashes -- no luck, the engine won't start. He doesn't have the key. In response, the man pulls up an usual tool: a Nokia 3310 phone. The man plugs the phone into the car using a black cable. He then flicks through some options on the 3310's tiny LCD screen. "CONNECT. GET DATA," the screen says. He then tries to start the car again. The light turns green, and the engine roars. This under 30 second clip shows a new breed of car theft that is spreading across the U.S. Criminals use tiny devices, sometimes hidden inside innocuous looking bluetooth speakers or mobile phones, to interface with the vehicle's control system. This allows thieves with very little technical experience to steal cars without needing the key, sometimes in just 15 seconds or so. With the devices available to buy online for a few thousand dollars, the barrier of entry for stealing even high-end luxury cars is dramatically reduced.
The video showing the man using a Nokia 3310 to start a Toyota is just one of many YouTube videos Motherboard found demonstrating the technique. Others show devices used on Maserati, Land Cruiser, and Lexus-branded vehicles. Multiple websites and Telegram channels advertise the tech for between 2,500 Euro and 18,000 Euro ($2,700 and $19,600). One seller is offering the Nokia 3310 device for 3,500 Euro ($3,800); another advertises it for 4000 Euro ($4,300). Often sellers euphemistically refer to the tech as "emergency start" devices nominally intended for locksmiths. Some of the sites offer tools that may be of use to locksmiths, but legitimate businesses likely have no use for a tool that is hidden inside a phone or other casing. Some of the sites even claim to offer updates for devices customers have already purchased, suggesting that development of the devices and their capabilities is an ongoing process. "At the moment, impacted vehicles are generally wide open to these sorts of attacks," says Motherboard. "The only proper fix would be to introduce cryptographic protections to CAN messages [...] via a software update."
The video showing the man using a Nokia 3310 to start a Toyota is just one of many YouTube videos Motherboard found demonstrating the technique. Others show devices used on Maserati, Land Cruiser, and Lexus-branded vehicles. Multiple websites and Telegram channels advertise the tech for between 2,500 Euro and 18,000 Euro ($2,700 and $19,600). One seller is offering the Nokia 3310 device for 3,500 Euro ($3,800); another advertises it for 4000 Euro ($4,300). Often sellers euphemistically refer to the tech as "emergency start" devices nominally intended for locksmiths. Some of the sites offer tools that may be of use to locksmiths, but legitimate businesses likely have no use for a tool that is hidden inside a phone or other casing. Some of the sites even claim to offer updates for devices customers have already purchased, suggesting that development of the devices and their capabilities is an ongoing process. "At the moment, impacted vehicles are generally wide open to these sorts of attacks," says Motherboard. "The only proper fix would be to introduce cryptographic protections to CAN messages [...] via a software update."
"introduce cryptographic protections" (Score:2, Informative)
The car makers will "introduce cryptographic protections" alright.
Though they'll mysteriously do nothing against theft, being full of holes and shoddily done, but will serve nicely as argument that "right to repair" is simply impossible for "security reasons". As a bonus, they might even serve as argument that "you must've left the car unlocked" since the car "is cryptographically protected", so no insurance coverage for you.
And we, well, the government's consumer protection agency, will perforce put up w
Re: (Score:2)
Re: (Score:2)
An older car with a moderately complex key system...
Value of the car is low so it's not worth stealing to the serious car thieves, and it's not the easiest car to steal so it dissuades casual joyriders.
Re: (Score:2)
Re: (Score:2)
No, a really bad car is easy to steal and will be stolen by kids looking for a casual joyride.
The middle ground is the sweet spot, no value for the serious thieves but too difficult for the joyriding kids.
Re: (Score:2)
Re: (Score:2)
You don't want security for normal user USB. They want to plug in or bluetooth and listen.
What the hell these USB connections are doing passing stuff on to the car network I don't know.
Re: Time and again (Score:2)
Re: (Score:2)
What the hell these USB connections are doing passing stuff on to the car network I don't know.
There's no evidence (in the video, anyway) that the guy is hooking up to the car's USB ports - the only connection you see being made is a USB-A cable getting plugged into the "Nokia phone". I'm wondering if the other end is hooked up to the OBD port.
Re: (Score:2)
>I'm wondering if the other end is hooked up to the OBD port.
Yes. Probably a USB to canbus adaptor. OBD II usually has canbus connection.
From TFA : “All they have to do is take two wires from the device, detach the headlight, and stuff the wires into the right holes in the vehicle side of the connector.”
Canbus is a two wire bus.
Re: (Score:3)
The government didn’t require immobilizers on cars for this period and Kia saved a few pennies by not implementing it. This doesn’t happen in Canada to the same models. Immobilizers are standard for every other manufacturer.
Re:Time and again (Score:4, Insightful)
A man sitting in the driver's seat of a Toyota
People don't even read the first sentence of the summary anymore...
Does anyone still install a randomly located kill switch? If this keeps going we may return to those great days.
Re: (Score:2)
Insurance companies should be demanding them. If they refused to insure cars without decent security then manufacturers would quickly develop decent security.
How about a hefty "known insecure vehicle" surcharge that appears prominently on the bill, along with a note to contact the manufacturer to get the issue fixed?
Re: (Score:2)
That has already happened:
https://www.chicagobusiness.co... [chicagobusiness.com]
Re: (Score:3)
Good luck getting a 45nm ECU to run modern cryptography. There's a reason that a halt in car manufacturing led to a chip shortage. These rusty old fab lines weren't being used for anything else.
My Maserati (Score:2)
Does 185.
Re: (Score:3)
Was that an upgrade from the wagon, Joe?
Re: (Score:2)
He can't tell you; he lost his license, now he don't drive.
Re: (Score:2)
My car's so old (Score:4, Funny)
Re: (Score:1)
Customers are defrauded here (Score:3)
One of the simplest tasks in cryptography should be; build a device, which authenticates with another, independent device and thereby authorizes its operation. The connection used for this purpose is exclusive to this task (except for optional service and debug modes).
Yes, it may prove a challenge, that this authentication device must run on a small battery for years, but at the same time its cryptographic engine is only energized when its owner intentionally activates it, which is a few seconds per day. The keys to open the car are kept secretly stowed away at the car maker, there's no public record or online data base for these key codes. If that car ever needs new keys, it can be a nightmare to get that done, and an expensive one, too.
So here we are:
Please someone explain to me the technical difficulty in creating a working, reliable and safe car key, which can not be imitated by a tiny gadget worth less than a new motor control unit. Until then I tend towards an explanation in form of "endemic mixture of criminal negligence, unmitigated corruption, and reckless incompetence"
Re: (Score:2)
One of the simplest tasks in cryptography should be; build a device, which authenticates with another, independent device and thereby authorizes its operation.
Amazingly, this is not a solved problem in the general case.
That's because in the general case, it's a much harder problem. In the case where you are merely pairing one physical device with another, and in which you can require the presence of an existing physical key to add a new one, or require someone to pull the ECU and push a physical reset button if the existing physical keys are all destroyed, it is ridiculously simple.
Re: (Score:2)
However, for cars, you have a problem which is that you need to be able to start the vehicle when the key fob battery is dead. That means you have to make some security compromises in favor of functionality.
At one point, you could do that with a key. Now it's usually done with a proximity reader for a second mechanism within the fob.
Ultimately it was decided that dead fob battery start was worth some security compromises. Whether t
Re: (Score:2)
Yes and I'm pretty sure this is how modern garage door openers work.
However, for cars, you have a problem which is that you need to be able to start the vehicle when the key fob battery is dead. That means you have to make some security compromises in favor of functionality.
I know that car companies do such things, but that approach never made a lot of sense to me. You could just as easily:
Re: (Score:2)
Amazingly, this is not a solved problem in the general case.
In fact, it's an amazingly well solved problem, every unix passwd file basically does this, together with its login process. Car key sends a string, car auth controller hashes that string, and if the hash matches one of the stored hashes the car will obey to whoever holds that car key. You will say "but everyone can sniff that code!", but this evidently did not happen in these car theft cases. The sellers of these car hacking devices never sniffed on car owner's authentication attempts. People with access t
Re: (Score:2)
Incompetence actually.
Before electronic keys, car keys used cheap wafer locks, known by the lock industry to be basically piss-poor security. Think about it this way - the lock on
Re:Customers are defrauded here (Score:5, Insightful)
As for the car manufacturers... If they wanted actual security, they'd start not with crypto (which, given your implementation, is just DRM by another name, and DRM never works long term.) but with an ethernet switch port + Access Control List like design. People shouldn't be able to plug in random crap to the headlamp port to start a car [slashdot.org], any more than they should be able to use a cell phone to do the same. Having a basic list of what ports on the ECU can have what devices connected to them and limiting what commands those ports can receive as a result is fucking basic security. As is limiting the "secure" ports to physically secure endpoints. (I.e. You should need the key to be able to reach a secure port without damaging the car in a very visible and obvious way.) None of which requires any crypto to do. The fact that this is not the case already shows massive incompetence by the industry in basic physical security. Of which, no electronics can ever fix because they are dependent on it.
Re:Customers are defrauded here (Score:5, Insightful)
Mod this up insightful.
Some car manufacturers actually tried encryption. And then turned it off as it drove dealers crazy, and car owners got pissed that they were not able to add upgrades like a CD changer themselves (when those were still a thing).
Re: (Score:2)
People hate being locked out of their car when they don't have the physical key to the physical lock, and they hate being locked out of their car with cryptography to which they don't have the key. They also hate when their mechanic is locked out of their car.
Encryption means it's "locked", and if you don't have a key you're locked out of your own car.
Re: (Score:2)
As for the car manufacturers... If they wanted actual security, they'd start not with crypto (which, given your implementation, is just DRM by another name, and DRM never works long term.)
No, sir, this is not a DRM situation, unless the crook steals your key and copies it. The article, however, described little devices, which would open any car of a certain make, without the need to ever see that key, and different such devices available for a wide range of cars.
I insist on that fact: a safe protocol as required for the implementation of a safe and reliable car key system, is old technology. The last necessary patent for such a thing must have expired years ago. It is up for grabs, it runs o
Re: (Score:2)
Re: (Score:2)
It's entirely possible to do in a manner that is at least as secure as a key.
Public key crypto to authenticate, i.e. the car encrypts a random number and the key is the only device that can decrypt it.
Add an accelerometer to the key that blocks authentication when it's not in motion. Only needs to be a tiny amount of motion, like it would get when on someone's person.
Also add a strict time-out that requires the key to respond instantly, and send an encrypted frequency to respond on. That way a relay attack
Re: (Score:2)
What years of Toyota vehicles are vulnerable? (Score:2)
"Hidden inside of a phone" (Score:2)
More like custom J2ME was loaded into the phone to cause it to send the appropriate unlocking codes over a serial link.
But wording it as a 1960s spy novel is more "exciting".
You could ignite the Space Shuttle with a 3310 (Score:2)
And with a small hack you would be able to connect to USB as well.
Tow truck next step (Score:1)
What would make this INFORMATIVE (Score:2)
How about a more precise description of the vulnerable platform(s)?
Is a car that simply has an RFID fob vulnerable, or just cars that feature (say) app connectivity for remote start, etc