- Technology used in 126 types of cars makes them easier to steal
- Volkswagen used its lawyers to keep the research under wraps until now
- Settlement allowed flaw to be revealed at conference for first time
Researchers have revealed a massive flaw in the remote controls used by hundreds of cars – and say Volkswagen and other manufacturers went to court two years ago to keep their discovery a secret.
Three European computer scientists say they have known about the flaws since 2012, and warned automakers.
The list of impacted cars includes luxury vehicles from Volkswagen’s Porsche, Audi, Bentley, and Lamborghini brands.
The list of impacted cars that use the Megamos tranpoder (pictured) includes vehicles from Volkswagen’s Porsche, Audi, Bentley, and Lamborghini brands.
Volkswagen used its lawyers to keep the research under wraps but now a legal settlement has allowed the documents to go public.
The researchers say the flaw lies in the widely-used Megamos Crypto transponder, which is responsible for the encryption between the car and remote.
It’s used in keys and car fobs and is designed to stop an engine from starting if it is not in close proximity to the vehicle.
The transponder includes a 96-bit secret key, proprietary cipher, and 32-bit PIN code, but the researchers realised that its internal security was weaker.
‘The Megamos Crypto transponder is used in one of the most widely deployed electronic vehicle immobilisers,’ the researchers write.
‘It is used among others in most Audi, Fiat, Honda, Volkswagen and Volvo cars.
‘At some point the mechanical key was removed from the vehicle but the cryptographic mechanisms were not strengthened to compensate.
‘We want to emphasise that it is important for the automotive industry to migrate from weak proprietary ciphers like this to community-reviewed ciphers … and use it according to the guidelines.’
One of the researchers, Flavio D. Garcia of the University of Birmingham, said: ‘It’s a bit like if your password was ‘password.’
The list of cars affects includes several luxury brands. Researchers experimented on, or exploited, the cars written above in bold
A hacker could potentially become a valet driver and steal a fleet of cars, or steal a rental long after returning it using the flaw, it is believed.
The flaw was discovered by Garcia, as well as Bariş Ege and Roel Verdult of the Radboud University Nijmegen in the Netherlands.
The list of affected cars included several models made by Audi, Fiat, Honda, Kia, Volkswagen, Volvo and many others.
They all rely on chips made by EM Microelectronic in Switzerland.
Tim Watson, Director of Cyber Security at the University of Warwick told Bloomberg: ‘This is a serious flaw and it’s not very easy to quickly correct.’
‘It isn’t a theoretical weakness, it’s an actual one and it doesn’t cost theoretical dollars to fix, it costs actual dollars.’
Researchers broke the transponder’s 96-bit cryptographic system, by listening in twice to the radio communication between the key and the transponder.
This reduced the pool of potential secret key matches, and opened up the ‘brute force’ option, which involved running through 196,607 options of secret keys until they found the one that could start the car.
This took less than half an hour.
Researchers presented their findings on Wednesday at the Usenix conference in Washington, DC
They say they gave the Swiss chip maker nine months to fix the problem in late 2012 before they planned on going public with their discovery.
Called RollJam, the gadget was built for $30 and can open cars at the click of a button, making auto hacking simple enough for anyone to do.
WHAT IS A ROLLING CODE?
Electronic car keys use what’s known as ‘rolling code.’ Every time you press the button, a new, randomly generated code is sent over a radio frequency to your car, which has a synchronized code generator that recognizes it and then burns it so it can never be used again.
The key and the car then create new codes for the next time around, and the process repeats.
In case the two ends get out of sync — say your kid grabs the keys when they’re out of range and presses the button a bunch of times — the car can recognize a few hundred future codes.
When it receives one of them, it disables all the prior ones.
Then in 2013, Volkswagen sued the universities – and the researchers personally – to block them from publishing their discovery to fellow academics, according to court documents.
Initially, a British court sided with the automaker, writing: ‘I recognise the high value of academic free speech, but there is another high value, the security of millions of Volkswagen cars.’
Eventually, both sides settled when the researchers agreed to omit a single line from their report – a pivotal detail which could allow a non-technical person to work out the hack.
Volkswagen said the hack takes ‘considerable, complex effort’ that’s unlikely to be used except by tech-savvy, organized crime syndicates.’
Volkswagen also said its latest cars, including the Golf 7 and Passat B8, aren’t vulnerable.
The flaw is similar to the Rolljam, which can built for $30 (£20), and let amateur hackers open dozens of cars and even get into garages.
The hacker behind the project says it will open cars from Chrysler, Daewoo, Fiat, GM, Honda, Toyota, Volvo, Volkswagen Group, Clifford, Shurlok, and Jaguar.
Ethical hacker Samy Kamkar, who last week cracked GM’s OnStar smartphone app security and demonstrated his ability to illicitly unlock and start a car over a mobile phonenetwork, says it uses a system known as a rolling code critical to how electronic keys work.
It’s a proven system that’s secured tens of millions of cars and remote garage door openers for years.
The RollJam takes advantage of a design flaw in the protocol that determines how keys communicate with cars.
It intercepts the ‘rolling codes’, one-time authentication codes exchanged by car and key that change with each lock and unlock.
The hacker behind the Rolljam project says it will open cars from Chrysler, Daewoo, Fiat, GM, Honda, Toyota, Volvo, Volkswagen Group, Clifford, Shurlok, and Jaguar
Because there’s no timeout on the codes, RollJam can intercept them to ensure they never reach the car.
‘I can put it on your car, so that the device will always have the latest code,’ Kamkar told Motherboard.
‘Every single time you lock or unlock your car I’ll have the latest code.’
He demonstrated the device at the Defcon hacker convention in Las Vegas where he said he wanted to build a gadget to unlock any car.
‘Unlocking ‘many different types of cars in makes and models… it’s like a universal remote’, he told Forbes.
‘On my car where I have time to look at the signal or chip, I can see the difference between lock and unlock and my device can alter it live,’ he said.
He has previously advised drivers to stop using a mobile app for General Motors Co’s OnStar vehicle communications system.
In a video posted to YouTube he shows hackers can exploit a security flaw in the product to remotely unlock cars and start engines.
Mr Kamkar says he has figured out a way to ‘locate, unlock and remote-start’ vehicles by intercepting communications between the OnStar RemoteLink mobile app and the OnStar service.
The hacker said he discussed the fix with representatives from GM, but their efforts failed to thwart the attack method he uncovered, which uses a device he built and dubbed ‘OwnStar’
Kamkar released the video a week after Fiat Chrysler Automobiles recalled some 1.4 million vehicles after hacking experts demonstrated a more serious vulnerability in the Jeep Cherokee.
That bug allowed them to gain remote control of a Jeep travelling at 70 miles per hour on a public highway.
GM said its engineers had reviewed Kamkar’s research.
‘A fix has already been implemented,’ the company said in a statement.
Kamkar said he discussed the fix with representatives from GM, but their efforts failed to thwart the attack method he uncovered, which uses a device he built and dubbed ‘OwnStar.”
‘They have not yet fixed the bug that ‘OwnStar’ is exploiting,’ he told Reuters.
Representatives with GM did not immediately respond to requests for comment on the status of the bug or fix.
The ‘OwnStar’ issue drew the attention of U.S. safety regulators from the National Highway Traffic Safety Administration.
Representatives from the agency discussed the issue with GM, said the flaw could involve doors and engine start-stop, but does not involve other critical safety systems, according to a person familiar with those discussions.
More than 3 million people have downloaded the OnStar RemoteLink mobile app for Apple iOS and Google Inc devices, according to OnStar’s website.
The hacker behind the project says it will open cars from Chrysler, Daewoo, Fiat, GM, Honda, Toyota, Volvo, Volkswagen Group, Clifford, Shurlok, and Jaguar
The comments below have not been moderated.
The views expressed in the contents above are those of our users and do not necessarily reflect the views of MailOnline.
Find out now