How To Hack A Porsche Research MuffledCourt halts disclosure of research into exploitable vulnerabilities in late-'90s immobilizer technology still being used to secure cars made by Audi, Volkswagen and others.
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
A British high court has banned the publication of an academic paper set to detail exploitable vulnerabilities in a car-immobilizer system that dates from the late 1990s, which remains widely used in Audi, Bentley, Lamborghini, Porsche and Volkswagen cars, among other vehicles.
The three computer scientists who discovered the flaws, which relate to the Megamos Crypto algorithm that's used to verify the authenticity of a car-ignition key, were set to detail those vulnerabilities at an information security conference next month in Washington. They said they found a software program on the Internet, publicly available since 2009, that included the algorithm, which was created by French security group Thales.
After the High Court of Justice of England and Wales blocked the publication of their paper, however, the researchers -- Baris Ege and Roel Verdult, information security researchers at Radboud University Nijmegen in the Netherlands, and Flavio Garcia, a computer science lecturer at Britain's University of Birmingham -- this week said they would abide by the decision.
[ Auto makers envision cars that are more connected to the cloud. Read 5 Ways Big Data Can Improve Your Car. ]
Although the court-ordered publishing ban was handed down on June 30, it gained little attention until Britain's Guardian detailed the high court's ruling Tuesday. That triggered a furious public debate over whether the publication ban served the public's best interests.
The ban was requested by Thales and Volkswagen, which originally developed the Megamos Crypto system. The system involves a radio-frequency identification (RFID) transponder, built into car keys, which can be used to transmit an encrypted signal to a vehicle and disable its immobilizer. Unless disabled, the immobilizer prevents a car's engine from starting. The system is now used in cars sold by Cadillac, Honda, Mercedes, Mazda, Nissan, Toyota and Volvo cars, among many other automakers.
Volkswagen told the court that publishing information on the system could "allow someone, especially a sophisticated criminal gang with the right tools, to break the security and steal a car," reported the Guardian. The automaker also argued that the algorithm used to disable the car's immobilizer was confidential information.
1 of 2