Stolen 1M CCTV footage
Discussion
Codswallop said:
What bastids 
BMW really need to sort out their security - not only have their cars become the fleet favourites like the Ford Mondeo once was, but they appear to be just as easy to steal, except now instead of using a bendy coat hanger, the scrotes use a bendy OBD cable.
I thought it was half a tennis ball over the door lock on a MK Mondeo.... BMW really need to sort out their security - not only have their cars become the fleet favourites like the Ford Mondeo once was, but they appear to be just as easy to steal, except now instead of using a bendy coat hanger, the scrotes use a bendy OBD cable.
Jakdaw said:
Tuvra said:
Surely BMW could sort this by putting the ODP port somewhere more suitable?
Like under a big padlock?
king needles now soaked in DNA would that be a bad thing?Moving the OBD port to towards the centre console would do the job.
I'd go for a dummy OBD port to be honest, wiring it up to damage the kit won't please your dealer when you forget to tell him, and you wouldn't want for the theives to get revenge by smashing the thing up or breaking into your house etc.
I'd go for a dummy OBD port to be honest, wiring it up to damage the kit won't please your dealer when you forget to tell him, and you wouldn't want for the theives to get revenge by smashing the thing up or breaking into your house etc.
XDA said:
LongLiveTazio said:
So I had a chat with the head BMW service manager at the BMW dealership recently and he told me that 'not many' had been stolen in the West Midlands area. Slightly economical with the truth and did the usual 'we're investigating'.
http://www.expressandstar.com/news/2012/04/06/thei...
"The X3 is attractively styled and good to drive, with low running costs and many desirable options"
Hurmmm.... is it?
What about having a physical key that needs to be inserted to enable the port?
Or BMW could update the alarm senors to cover the void, and the port is disabled if the alarm has been triggered?
Could PH use some contacts to get onto Watchgog?
I would of thought the beeb would have some cars that would be at risk of this sort of thing.
Probably not very much PH but I'm sure BMW would have to take notice or issue some sort of press release.
Or BMW could update the alarm senors to cover the void, and the port is disabled if the alarm has been triggered?
Could PH use some contacts to get onto Watchgog?
I would of thought the beeb would have some cars that would be at risk of this sort of thing.
Probably not very much PH but I'm sure BMW would have to take notice or issue some sort of press release.
tomoleeds said:
JapFreak786 said:
What year BMW's can this be done to? Brother own's a W plate 7 series.. Saw something about 1998 to 2005 on here?
they would not bother to nick thatLooking at the manual for the expensive latest programmers there was a failure in EWS4. This is for a laptop version but I think this is the same as the 3-in-1 devices used in the video which can be updated as they copy/reverse engineer (or just worked it out).
Edit2: also the tools are about cheap now€2000 €500
- Programming of key is going directly in the ignition lock! No need for
additional programmers and preparations of keys!
- Support of latest technologies from BMW:
1) EWS4 Secret Key (new 128-bit synchronization with engine control unit).
BMW documentation “says” that noone can read or write it, but we can do it
through OBD-II socket! Surprise!
2) SOPT (encryption of keys and synchronizations with engine control unit).
Now the keys can be programmed even for encrypted CAS! And even with
encrypted EWS4 Secret Key, and now it’s the first software that can do it!
- Many very useful functions and all of them can be done via OBD-II socket!
Edit: and from BMW
Electronic Vehicle Immobilizer 4
The electronic vehicle immobilizer 4 is an immobilizersystem that prevents unauthorized
engine start. It was used for the first time in the Car Access System 3 in the E92.
The electronic vehicle immobilizer 4 uses a new, modern encryption system. A 128 bit
long secret key is assigned to each vehicle and stored in the BMW database. This secret
key is kno wn onlyto BMW. The secret key is programmed and locked in the Car Access
System 3 and in the digital engine management.
Once entered in the control unit, the secret key can no longer be changed, deleted or
read. This therefore means that each control unit is assigned to a specific vehicle.
The electronic vehicle immobilizer 4 operates with bidirectional and redundant data
tr ansmission. The K-C AN (CAN prot ocol) and C AS-bus (K-bus protocol) are used for this
purpose.
Pin 30 of the Car Access System 3 serves as the connection to the CAS-bus.
The redundant data transmission enables operation of the electronic vehicle immobilizer
even if a bus system fails due to a defect.
Design of EWS 4
The vehicle immobilizer consists of the identification transmitter which identifies itself to
the vehicle and therefore to the Car Access System 3. The Car Access System 3
exchanges data via the CAS-bus with the digital motor electronics and thus cancels the
immobilizer function.
The softwar e for the electronic vehicle immobilizer as well as the enable for the starter is
resident in the CAS 3. The digital engine management is responsible for issuing the
enable for the ignition and fuel injection.
The gearbox functions are enabled by the electronic transmission control. The remote
control or the identification transmitter must be identified as matching the vehicle before
the electronic vehicle immobilizer issues the start enable. This already takes place before
a vehicle is unlocked.
10
E70 Car Access System 3
A renewed check (authentication) must be performed as soon as an attempt is made to
start the engine. The check establishes whether the remote control matches the vehicle
or the identification transmitter is located in the vehicle interior.
The vehicle can be started if the check is successful. Authentication starts with the
status "Terminal 15 ON".
Note: The start enable can be given only by a remote control matching the
vehicle or a suitable identification transmitter.
Start Enable through EWS
The start procedure is enabled by means of a special request and response procedure
known as challenge-response. As from "Terminal 15 ON", the digital engine
management sends an encrypted random number to the CAS 3. The digital engine
management generates the random number in a random number generator.
This might not be a problem with having to allow garages to have access, more like they might have messed up in design of it.
Edit2: also the tools are about cheap now
- Programming of key is going directly in the ignition lock! No need for
additional programmers and preparations of keys!
- Support of latest technologies from BMW:
1) EWS4 Secret Key (new 128-bit synchronization with engine control unit).
BMW documentation “says” that noone can read or write it, but we can do it
through OBD-II socket! Surprise!
2) SOPT (encryption of keys and synchronizations with engine control unit).
Now the keys can be programmed even for encrypted CAS! And even with
encrypted EWS4 Secret Key, and now it’s the first software that can do it!
- Many very useful functions and all of them can be done via OBD-II socket!
Edit: and from BMW
Electronic Vehicle Immobilizer 4
The electronic vehicle immobilizer 4 is an immobilizersystem that prevents unauthorized
engine start. It was used for the first time in the Car Access System 3 in the E92.
The electronic vehicle immobilizer 4 uses a new, modern encryption system. A 128 bit
long secret key is assigned to each vehicle and stored in the BMW database. This secret
key is kno wn onlyto BMW. The secret key is programmed and locked in the Car Access
System 3 and in the digital engine management.
Once entered in the control unit, the secret key can no longer be changed, deleted or
read. This therefore means that each control unit is assigned to a specific vehicle.
The electronic vehicle immobilizer 4 operates with bidirectional and redundant data
tr ansmission. The K-C AN (CAN prot ocol) and C AS-bus (K-bus protocol) are used for this
purpose.
Pin 30 of the Car Access System 3 serves as the connection to the CAS-bus.
The redundant data transmission enables operation of the electronic vehicle immobilizer
even if a bus system fails due to a defect.
Design of EWS 4
The vehicle immobilizer consists of the identification transmitter which identifies itself to
the vehicle and therefore to the Car Access System 3. The Car Access System 3
exchanges data via the CAS-bus with the digital motor electronics and thus cancels the
immobilizer function.
The softwar e for the electronic vehicle immobilizer as well as the enable for the starter is
resident in the CAS 3. The digital engine management is responsible for issuing the
enable for the ignition and fuel injection.
The gearbox functions are enabled by the electronic transmission control. The remote
control or the identification transmitter must be identified as matching the vehicle before
the electronic vehicle immobilizer issues the start enable. This already takes place before
a vehicle is unlocked.
10
E70 Car Access System 3
A renewed check (authentication) must be performed as soon as an attempt is made to
start the engine. The check establishes whether the remote control matches the vehicle
or the identification transmitter is located in the vehicle interior.
The vehicle can be started if the check is successful. Authentication starts with the
status "Terminal 15 ON".
Note: The start enable can be given only by a remote control matching the
vehicle or a suitable identification transmitter.
Start Enable through EWS
The start procedure is enabled by means of a special request and response procedure
known as challenge-response. As from "Terminal 15 ON", the digital engine
management sends an encrypted random number to the CAS 3. The digital engine
management generates the random number in a random number generator.
This might not be a problem with having to allow garages to have access, more like they might have messed up in design of it.
Edited by tercelgold on Monday 2nd July 16:10
Surely it shouldn't be difficult to program some feature in so that if the alarm is active, the doors are closed and the OBD port is accessed then it should lock down all aspects of the ECU and not allow this sort of interrogation? Why would anyone want to access the OBD port is the doors are closed then the alarm activated?
MissChief said:
Surely it shouldn't be difficult to program some feature in so that if the alarm is active, the doors are closed and the OBD port is accessed then it should lock down all aspects of the ECU and not allow this sort of interrogation? Why would anyone want to access the OBD port is the doors are closed then the alarm activated?
Simple, it would 'just' be a software change!Awaits flaming from the programming groups!
MissChief said:
Surely it shouldn't be difficult to program some feature in so that if the alarm is active, the doors are closed and the OBD port is accessed then it should lock down all aspects of the ECU and not allow this sort of interrogation? Why would anyone want to access the OBD port is the doors are closed then the alarm activated?
Exactly, this must be the answer? WAKE UP BMW!!!!!Just spread this around the office...car crime in southern Germany is almost nonexistent, first anyone I have talked to has heard about it (not saying BMW doesn't know, I'd bet my left nut everyone concerned is well aware of the problem).
Dummy OBD port and secret fuel pump switch +1 makes sense to be safe for the sake of 50 quid in parts and labour. A
man hug over the internet for the first creator of the Scrote zapper 1000, or whatever you eventually christen her
Dummy OBD port and secret fuel pump switch +1 makes sense to be safe for the sake of 50 quid in parts and labour. A
man hug over the internet for the first creator of the Scrote zapper 1000, or whatever you eventually christen her
RemyMartin said:
Not sure I'd want to be cutting into any looms on a Warrantied £43k BMW. Surely that would void it?
They would have to find the switch and wires first. In my Mustang, locating the wires would mean removing the seats and lifting out the fitted carpet. The switch was hidden in the centre console and would require removal in order to find it.Neither of those actions would be part of any service schedule.
There are also ways of interrupting the circuit without actually cutting wires. OEM pins and sockets are easily bought from dealers, so it would just be a matter of removing pins from a plug without cutting anything.
If it sounds like too much of a faff, fair enough. I tend to think that dealing with insurance companies, not to mention premium increases, and the inconvenience of being without a car would be much worse.
I just wouldn't be able to forgive myself if I did nothing to prevent the theft of my car when the additional measures are so simple and in-expensive.
Gassing Station | General Gassing | Top of Page | What's New | My Stuff