RE: BMW puts the OBD fix in

[Al 450]

Scuffers said:

Panda76 said:

This fix will be shortlived imo. The code(s) will be broken again.

that does not have to be the case, if they implemented a decent one-way, one-time encription key to the CAS module, this problem would go away.

Yes, it would potentially cause issues years down the line when BMW dont give a stuff about a 15+ year old car and stop providing the keys, but it would make cracking it way beyond the roadside thief.

No-one cracked the code, they are just using dealer spec diagnostics equipment to do this. BMW (along with all manufacturers) is forced by European law to release for general sale all dealer tools including diagnostic equipment. The thieves are just using dealer equipment or a Chinese copy of the dealer equipment to do this. For the people stealing the cars it's not a complex thing to do, they are car thieves after all and therefore not the sharpest. They are just plugging in and pressing buttons.

It is perfectly feasible to copy a tool or routine without 'cracking' the encryption on it in the same way you can copy someone's credit card onto a new card and use it without breaking the 128bit encryption. Whatever BMW engineer has to be released to the general public by law and therefore it can be copied or reverse engineered by Chinese diagnostic equipment suppliers.

This vulnerability has always been there just never exploited because until recently you needed a physical key to turn the ignition barrel. Almost every vehicle will be vulnerable to this, anyone could go to Ferrari and buy their dealer diagnostic kit and go and do this. They just might set the alarm off in the vehicle. Also they may have the usual safeguard which is to require a second authentication factor e.g. submit the VIN to the manufacturer electronically to get a one time code to enable the key learn to occur.

Don't go thinking car criminals are some kind of sophisticated cyber criminals these days, 'Gone in 60 seconds' was a film not a documentary on car theft professionals!

[KeyR1]

Cheib said:

Dear Pistonheads Towers,

Despite specificually being asked to and a 90 page thread having been running on this forum for seveal months there has be absolutely no coverage of this issue as a news item until now. The day BMW announce a fix you gibve it coverage.

Frankly I find it incredibly disappointing that the first day you give it coverage is the day there is positive news from BMW. You could have done your many members a huge service by publicising this much earlier, some of them may have been able to avoid having their cars stolen.

The only conclusion to draw is that the relationship with BMW is worth more than the reltionship with the thousands of members of Pistonheads

I feel really sorry to be short, but, Have you not used the search function? There are 3 others before this one.

[Ed.]

KeyR1 said:

Cheib said:

Dear Pistonheads Towers,

Despite specificually being asked to and a 90 page thread having been running on this forum for seveal months there has be absolutely no coverage of this issue as a news item until now. The day BMW announce a fix you gibve it coverage.

Frankly I find it incredibly disappointing that the first day you give it coverage is the day there is positive news from BMW. You could have done your many members a huge service by publicising this much earlier, some of them may have been able to avoid having their cars stolen.

The only conclusion to draw is that the relationship with BMW is worth more than the reltionship with the thousands of members of Pistonheads

I feel really sorry to be short, but, Have you not used the search
function? There are 3 others before this one.

He does have a point though, both times the issue has been on the front page the blame has been put on the OBD rather than the alarm. They also made the point that most manufacturers are just as susceptible when the current trend would suggest not.

[Scuffers]

Al 450 said:

No-one cracked the code, they are just using dealer spec diagnostics equipment to do this. BMW (along with all manufacturers) is forced by European law to release for general sale all dealer tools including diagnostic equipment. The thieves are just using dealer equipment or a Chinese copy of the dealer equipment to do this. For the people stealing the cars it's not a complex thing to do, they are car thieves after all and therefore not the sharpest. They are just plugging in and pressing buttons.

It is perfectly feasible to copy a tool or routine without 'cracking' the encryption on it in the same way you can copy someone's credit card onto a new card and use it without breaking the 128bit encryption. Whatever BMW engineer has to be released to the general public by law and therefore it can be copied or reverse engineered by Chinese diagnostic equipment suppliers.

This vulnerability has always been there just never exploited because until recently you needed a physical key to turn the ignition barrel. Almost every vehicle will be vulnerable to this, anyone could go to Ferrari and buy their dealer diagnostic kit and go and do this. They just might set the alarm off in the vehicle. Also they may have the usual safeguard which is to require a second authentication factor e.g. submit the VIN to the manufacturer electronically to get a one time code to enable the key learn to occur.

Don't go thinking car criminals are some kind of sophisticated cyber criminals these days, 'Gone in 60 seconds' was a film not a documentary on car theft professionals!

Sorry, thats just not the case...

EU OBD rules have nothing in them about access to the cars security systems

And if the CAS was on 128bit one way, one time passcode encription, then no, you cant just clone/copy it.

I do wish the EU excuse would be put to bed, this is not the reason for this glaring hole in BMWs security.

[KeyR1]

From what I have seen the issue is actually an Alarm "BLACK SPOT" that can be utilised by "crooks" to get access to the panel, not the fact that power is to it when the car is inactive. The Deficiency is with the placement by BMW of said OOBD port, not the actual proposal of having to cater it. The Alarm issue is something imho that should never of got past Thatcham to warrant the device "Cat1" approval.

Having said that, I am no car mechanic or Quality assesor of any manufacturer,

Put this another way. If somebody put the alarm panel to my house within arms reach of breaking a window near it that had a 5 inch squard alarm dead spot. I would be livid and I presume the said installer and maufacturer of the product would more than likely have the book thrown at them.

Why so long to acknowledge the fault? It isn't rocket science. Move the port, simples.

edit: Just saw Ed's Post, yes, it occured to me after writing my part that there was no mention of the alarm being at fault. I was short, sorry

Edited by KeyR1 on Saturday 15th September 13:14

Edited by KeyR1 on Saturday 15th September 15:31

[SR06]

Im on a waiting list for the M3 update. In the meantime Ive taken to sitting in my car at night with nothing to do other than polish my Gatling gun.

[WeirdNeville]

Ed. said:

He does have a point though, both times the issue has been on the front page the blame has been put on the OBD rather than the alarm. They also made the point that most manufacturers are just as susceptible when the current trend would suggest not.

KeyR1 said:

From what I have seen the issue is actually an Alarm "BLACK SPOT" that can be utilised by "crooks" to get access to the panel, not the fact that power is to it when the car is inactive. The Deficiency is with the placement by BMW of said OOBD port, not the actual proposal of having to cater it. The Alarm issue is something imho that should never of got past Thatcham to warrant the device "Cat1" approval.

Can we please get one thing straight:
The alarm black spot is NOT the primary problem.
The OBD port being "live" is NOT the primary problem.

The problem is that the security system in affected BMW's lets you "inject" an unknown key into them to become an "accepted" key with NO authentication and NO verification. Whether this is clever hacking by the crooks or a simple but serious failure by BMW is a moot point - it can be done.

This should not be possible, and is indeed impossible with other manufacturers. We do NOT see keyless thefts of this kind with any other manufacturer at present.

The alarm blackspot helps the thieves complete the process undetected, but the key coding is so fast (10 seconds with some devices) that even by the time you've got to your window to look, the thief can deactivate it by pressing the unlock button their newly coded key even if they HAVE set the alarm off.
If the OBD port wasn't "live" then they would simply use auxiliary power. I suspect that the "2 minutes" that BBC watchdog got was with a menu driven Key coder, more like a diagnostics computer. There are devices which are fully automated. You plug them into the OBD with a key in the induction reader, a light lights up, the key is good to go.

I've been aware of these thefts since the start of the year, I've got first hand experience of the methods used.

Edited by WeirdNeville on Saturday 15th September 20:40

[Agent Orange]

WeirdNeville said:

This should not be possible, and is indeed impossible with other manufacturers. We do NOT see keyless thefts of this kind with any other manufacturer at present.

Are you sure about that? This site seems to suggest the same is possible with VW, Audi, Mercs, Ford etc.

"AUDI KEY LEARNING DEVICE BY OBD/NO PC NEEDED/NO PRESSING BUTTONS / JUST PLUG THE DEVICE IN OBD AND LEARN KEY IN 25 SECONDS"

"UNIVERSAL MERCEDES TRANSPONDER FOR E / C AND G CLASS

This transponder is prepared to program directly to the car ,just insert the key into the ignition and the transponder will program itself immediately to start the car"

http://www.keyprogtools.com/

Edited by Agent Orange on Saturday 15th September 21:13

[WeirdNeville]

Agent Orange said:

WeirdNeville said:

This should not be possible, and is indeed impossible with other manufacturers. We do NOT see keyless thefts of this kind with any other manufacturer at present.

Are you sure about that? This site seems to suggest the same is possible with VW, Audi, Mercs, Ford etc.

"AUDI KEY LEARNING DEVICE BY OBD/NO PC NEEDED/NO PRESSING BUTTONS / JUST PLUG THE DEVICE IN OBD AND LEARN KEY IN 25 SECONDS"

"UNIVERSAL MERCEDES TRANSPONDER FOR E / C AND G CLASS

This transponder is prepared to program directly to the car ,just insert the key into the ignition and the transponder will program itself immediately to start the car"

http://www.keyprogtools.com/

The Site says it, we (the police) haven't seen it in the wild at all. BMW's have been and still are the only cars being stolen in this manner.

[Agent Orange]

WeirdNeville said:

The Site says it, we (the police) haven't seen it in the wild at all. BMW's have been and still are the only cars being stolen in this manner.

Thing is you could leave a car unlocked in front of 99% (ok maybe 95%) of the population and it wouldn't get stolen.

It's the thieves that are the problem not any security but none the less I wonder if we are making it easier for them by all cars from a single manufacturer having the same or very similar security system.

At least in the past the car thieves didn't know the security they were dealing with until the approached the car. Now they can target a particular make and model.

[KM666]

E500 TAT said:

It has to be within a certain distance from the (IIRC) drivers seat.

The OBD port must be located within 30" or so of the steering column. So there are many locations within almost 3 feet of the steering coulmn. This sounds like poor design.

[joylove]

KM666 said:

E500 TAT said:

It has to be within a certain distance from the (IIRC) drivers seat.

The OBD port must be located within 30" or so of the steering column. So there are many locations within almost 3 feet of the steering coulmn. This sounds like poor design.

I had an Audi where the OBD port was under the ashtray. Discovering the location was a Google search away.

The core issue is and will always be that you can code a new key without an existing valid key, exacerbated by that there is no mechanical key barrel.

[anonymous-user]

WeirdNeville said:

Can we please get one thing straight:
The alarm black spot is NOT the primary problem.
The OBD port being "live" is NOT the primary problem.

The problem is that the security system in affected BMW's lets you "inject" an unknown key into them to become an "accepted" key with NO authentication and NO verification. Whether this is clever hacking by the crooks or a simple but serious failure by BMW is a moot point - it can be done.

This should not be possible, and is indeed impossible with other manufacturers. We do NOT see keyless thefts of this kind with any other manufacturer at present.

The alarm blackspot helps the thieves complete the process undetected, but the key coding is so fast (10 seconds with some devices) that even by the time you've got to your window to look, the thief can deactivate it by pressing the unlock button their newly coded key even if they HAVE set the alarm off.
If the OBD port wasn't "live" then they would simply use auxiliary power. I suspect that the "2 minutes" that BBC watchdog got was with a menu driven Key coder, more like a diagnostics computer. There are devices which are fully automated. You plug them into the OBD with a key in the induction reader, a light lights up, the key is good to go.

I've been aware of these thefts since the start of the year, I've got first hand experience of the methods used.

Edited by anonymous-user on Saturday 15th September 20:40

Calm down dear, caps lock and bigger fonts don't make your point any more valid.

[Scuffers]

D3fender said:

Calm down dear, caps lock and bigger fonts don't make your point any more valid.

I disagree, needed to be highlighted as people still keep bringing it up.

[kambites]

I don't even agree with the point. I think the primary problem is the alarm system.

Are significant numbers of LHD cars being stolen in this way? I believe the alarm works properly on that side.

[JimmyTheHand]

kambites said:

I don't even agree with the point. I think the primary problem is the alarm system.

security is multi-layer - it is no good having good alarm, is someone can plug in a programmer and add a key in the time it takes someone to walk over and ask what the problems is - at which point the thieves just say alarm is playing up and unlock the car with new key to show it.

You could also consider how often you might allow someone access to the inside of the vehicle - I always get mine washed at local hand car wash, though I stay within view, how easy would it be for one to just slip a coder into port?

kambites said:

Are significant numbers of LHD cars being stolen in this way? I believe the alarm works properly on that side.

As this issue has been present since 2007 according to BMW - how many RHD were stolen this way last year? Showing evidence of it not happening doesn't mean it couldn't happen - just that it isn't

[kambites]

JimmyTheHand said:

Showing evidence of it not happening doesn't mean it couldn't happen - just that it isn't

Agreed, but if it isn't happening it doesn't matter that it could as long as that continues to be the case.

All the thefts I've heard of have been when the car was parked on people's drives by an occupied house and have only been successful because it's completely silent.

As plenty of people have pointed out, lots of cars can program new keys from their OBD port, but the theft problem seems to be heavily skewed towards BMWs. I would assume this is because it's the only manufacturer who fits an alarm rubbish enough that you can get to the OBD port without triggering it.

Of course changing any part of the system wculd solve the problem, but the only part of the system which is clearly broken, to my mind, is an alarm which lets someone get to major internal components of the car without triggering. If the alarm did its job, we would not behaving this discussion.

ETA: Although to be fair, we probably also wouldn't if you couldn't program keys in ten minutes from the OBD port.

Edited by kambites on Sunday 16th September 14:34

[JimmyTheHand]

kambites said:

Agreed, but if it isn't happening it doesn't matter that it could as long as that continues to be the case.

Once knowledge on how to break the system is out – it is usually just time

kambites said:

All the thefts I've heard of have been when the car was parked on people's drives by an occupied house and have only been successful because it's completely silent.

so they switch to doing it in railway/supermarket car parks - a bit more risk, but I doubt they'll worry that much

kambites said:

As plenty of people have pointed out, lots of cars can program new keys from their OBD port, but the theft problem seems to be heavily skewed towards BMWs. I would assume this is because it's the only manufacturer who fits an alarm rubbish enough that you can get to the OBD port without triggering it.

Or the other makes have ab another stage to process – e.g. enter a token which the car needs to activate that key which is only available from manufacturer.

kambites said:

Of course changing any part of the system wculd solve the problem, but the only part of the system which is clearly broken, to my mind, is an alarm which lets someone get to major internal components of the car without triggering.

as someone with a background in electronics, software and security – my take is the alarm maybe inadequate (to a degree understandable to limit false positives), but the ability to program a key in such away is a naïve mistake and suggest a fundamental problem placing security as a low priority in the design process. What is worrying is these cars are becoming remotely accessible via mobile phone technology and some of the next potential steps will cars communicating with each other – at which point security matters become very serious concerns - ( Link)

kambites said:

If the alarm did its job, we would not behaving this discussion.

We wouldn't because the alarm would work, so the only topic would be the port issue, however there is no guarantee it would not have raised its head at some point

[kambites]

To be honest, the whole security issue seems a bit of a non-event to me anyway - the number of cars being stolen is pretty small and anyway, that's what insurance is for. What would worry me far more, is how slow BMW were to do anything about it.

I'd happy buy a car that's relatively easy to steal. I would not buy a car from a company that doesn't seem to care that its cars are easy to steal when many of its customers do care, because it doesn't bode well for the rest of their customer service.

Edited by kambites on Sunday 16th September 15:09

[HowMuchLonger]

kambites said:

To be honest, the whole security issue seems a bit of a non-event to me anyway - the number of cars being stolen is pretty small and anyway, that's what insurance is for. What would worry me far more, is how slow BMW were to do anything about it.

Only a matter of time before the insurance companies (actuaries) twig that BMW = higher risk of theft than other vehicles, then watch the effect on insurance premiums. If I ran an insurance company I would refuse point blank to insure the cars at risk.