Attacks/Breaches
7/30/2013
11:12 AM
Connect Directly
RSS
E-Mail
50%
50%

How To Hack A Porsche Research Muffled

Court halts disclosure of research into exploitable vulnerabilities in late-'90s immobilizer technology still being used to secure cars made by Audi, Volkswagen and others.

But Radboud University Nijmegen has expressed frustration with the legal action and delays by Volkswagen and Thales over the "outdated" chip, despite their having been notified of the vulnerability some time ago.

"The researchers informed the chipmaker nine months before the intended publication ... so that measures could be taken," said a statement released Monday by the university. "The Dutch government considers six months to be a reasonable notification period for responsible disclosure. The researchers have insisted from the start that the chipmaker inform its own clients."

The researchers said they obtained all of the information in their paper from the public domain, meaning no significant obstacle would face anyone else who wants to find exploitable vulnerabilities in the immobilizers. "The paper reveals inherent weaknesses, on the basis of mathematical calculations, and is based on an analysis of publicly available information," said Radboud University Nijmegen. "The publication in no way describes how to easily steal a car, as additional and different information is needed for this to be possible."

Furthermore, the researchers said that exploiting the weaknesses they've identified wouldn't exactly be practical. An attacker would have to run a software program that would take, on average, two days to identify a working crypto crack. The software would need to be run fresh for every different immobilizer targeted.

Their talk, "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer," is still listed on the website for this year's USENIX Security Symposium, to be held next month, although as of Tuesday it was labeled as being "presentation only," suggesting that the researchers will no longer demonstrate a working exploit of the vulnerability.

A spokeswoman for Volkswagen didn't immediately respond to an emailed request for comment about how the automobile manufacturer planned to mitigate the vulnerabilities identified in the Megamos Crypto system, or what might be required to correct the vulnerability in any vehicle with such a system.

It was unclear whether an English court's ban on publication would extend to a conference in the United States, but by Monday both of the institutions involved said their researchers would refrain from publishing their paper. "The University of Birmingham is disappointed with the judgment which did not uphold the defense of academic freedom and public interest, but respects the decision," said a spokeswoman via email, reported the BBC.

The researchers had argued that their right to publish their paper was protected by the European Convention on Human Rights, which includes freedom of speech protections by which Britain has agreed to abide. But the High Court judge nevertheless imposed an injunction, pending a full trial.

Attorney Tom Ohta at British law firm Bristows told the BBC that the manner in which the researchers had obtained the cryptographic details has so far proved to be their legal undoing. "An important factor here was that the academics had not obtained the software from a legitimate source, having downloaded it from an unauthorized website," he said. "This persuaded the court that the underlying algorithm was confidential in nature, and bearing in mind the public interest of not having security flaws potentially abused by criminal gangs, led to the injunction."

Despite that setback, this is far from the first time that computer scientists have set their sights on hacking car systems and detailing related flaws in a research paper. In 2010, for example, a team from Rutgers University demonstrated how tire pressure sensors in some cars could be remotely spoofed.

That research was followed by a group of Swiss scientists who successfully deactivated car immobilizers, unlocked doors and started engines by using wireless repeaters to amplify the signal from a wireless key fob from a target's home to their car.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RoyKelly2
50%
50%
RoyKelly2,
User Rank: Apprentice
8/1/2013 | 2:12:03 AM
re: How To Hack A Porsche Research Muffled
Let's look at all of the facts. first points from the article, then my take on each one

1.
The researchers said "They said they found a software program on the Internet, publicly available since 2009, that included the algorithm, which was created by French security group Thales."
2.
The researchers said they obtained all of the information in their paper from the public domain, meaning no significant obstacle would face anyone else who wants to find exploitable vulnerabilities in the immobilizers. "The paper reveals inherent weaknesses, on the basis of mathematical calculations, and is based on an analysis of publicly available information," said Radboud University Nijmegen.
3.
An attacker would have to run a software program that would take, on average, two days to identify a working crypto crack. The software would need to be run fresh for every different immobilizer targeted.
4.
The automaker also argued that the algorithm used to disable the car's immobilizer was confidential information.

5.
Attorney Tom Ohta at British law firm Bristows told the BBC that the manner in which the researchers had obtained the cryptographic details has so far proved to be their legal undoing. "An important factor here was that the academics had not obtained the software from a legitimate source, having downloaded it from an unauthorized website," he said. "This persuaded the court that the underlying algorithm was confidential in nature, and bearing in mind the public interest of not having security flaws potentially abused by criminal gangs, led to the injunction."

MY TAKE

1.
This tells me that the information is on the internet and can be found, and that the algorithm was created by Thales. I'm not sure where 2009 comes into play - was that when Thales created the algorithm or when the information was put on the web?
2.
The researchers say the algorithm is crackable, based on mathematics.
I know that any algorithm is crackable, but good ones take years to break (where breaking the algorithm means that someone could log in as someone else, or gain access to information they should not). Plus, the information is on the web, most likely open to anyone.
3.
Two days to hack a Porshe? That makes it almost worthwhile.... naw.... too long.
4.
If the algorithm is confidential information, then anybody knowing the algorithm is "unauthorized".
I also know that even secret algorithms can be discovered, given enough computing power and time. this is why hiding the algorithm and saying "I'm secure" is security suicide.
5.
The lawyer is saying that because the researcher did not get the algorithm from Thale or Volkswagen, the researchers "downloaded it from an unauthorized website." See my second part of 3, above.
bknabe
50%
50%
bknabe,
User Rank: Apprentice
7/31/2013 | 1:22:41 PM
re: How To Hack A Porsche Research Muffled
The article says they downloaded the information from "an unauthorized website." Regardless of what type of site it was, that tells us that, if they want it, the bad guys already have the software, may have had it for four years, and if they wanted to crack, likely already have. Preventing this publication to protect the public is passing legislation to that says:

"The hole in the dike shall immediately cease and desist transport of water through said dike."

Useless.
proberts551
50%
50%
proberts551,
User Rank: Apprentice
7/30/2013 | 6:58:14 PM
re: How To Hack A Porsche Research Muffled
They said they found a software program on the Internet, publicly available since 2009, that included the algorithm, which was created by French security group Thales.
Thanks for this information. How many theives now know where to find it? unless it has been removed.
Tedlschroeder
50%
50%
Tedlschroeder,
User Rank: Apprentice
7/30/2013 | 5:39:05 PM
re: How To Hack A Porsche Research Muffled
This approach doesn't help at all. It only means that someone who isn't a white hat is either currently figuring out the answer or already has. If the vulnerability is well understood something should have been done within the 9 month period to fix or mitigate the problem. This is the sort of thing that happens when non-technical people get involved in technical decisions.
RoyKelly2
50%
50%
RoyKelly2,
User Rank: Apprentice
7/30/2013 | 5:02:23 PM
re: How To Hack A Porsche Research Muffled
Hiding your algorithm or "Secrecy through obscurity" while using it daily to disable the immobilizer invites bad guys to attack your system. There have been numerous cases where an insecure algorithm was hidden and was broken easily - just ask Netscape. The story doesn't say where they got the information, just that it was publicly available. Maybe I should try to crack their algorithm using open source tools I have ;>)
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.