Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[MrDude_1]

This is a pretty neat article...

http://jalopnik.com/how-the-nissan-leaf-can-be-hacked-via-web-browser-from-1761044716

shows you how automakers, even EV automakers, dont understand that actual security is needed if you're going to connect to the car wirelessly....

[MostlyBonkers]

Thanks for sharing that, Dude. I know someone who's leaf I'd love to hack! I probably won't get the time though... [emoji22]

[MostlyBonkers]

They've pulled the service... Boo!

http://www.bbc.co.uk/news/technology-35660641

[BrianTRice@gmail.com]

Well, they suspended the service, which is the right thing to do while a fix is developed and vetted. I read a little bit about the vulnerability, and it's embarrassing because the service design as a whole makes it obvious.


Ref. http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html

This should give pause to any manager of a vehicle firmware project with a wireless connection, but hopefully just to get them to reason through the system design so that it's easy to make it good, rather than a paranoid approach that locks everything down.

Anyway, this sort of thing is why it's hard to get protocol access from a vehicle vendor.

[protomech]

Anyway, this sort of thing is why it's hard to get protocol access from a vehicle vendor.

If your protocol is too half-baked to publicly document then it's too half-baked to place into production.

[MrDude_1]

Anyway, this sort of thing is why it's hard to get protocol access from a vehicle vendor.

If your protocol is too half-baked to publicly document then it's too half-baked to place into production.

bingo.
Security through obscurity is not security at all.

[BrianTRice@gmail.com]

Anyway, this sort of thing is why it's hard to get protocol access from a vehicle vendor.

If your protocol is too half-baked to publicly document then it's too half-baked to place into production.

bingo.
Security through obscurity is not security at all.

All quite true, but it's admittedly difficult to hire or train people to develop secure services/protocols.

Let's not forget the CAN Bus standard, designed from the trusting 1970's perspective that gave us Ethernet, telnet, etc. All automotive standards are insecure right now once you get physical access to the vehicle ports, and occasionally some passwords.

I'll also admit that I treat the Zero tank bag as vaguely secure because I know that no one yet knows to even look in there for goodies, even if it's trivial to break into, but losing a toll bridge token and some tools or a pair of gloves is low-risk. Exposing vehicle controls over unauthenticated internet connections, on the other hand, is a different class of exposure.

[MrDude_1]

Anyway, this sort of thing is why it's hard to get protocol access from a vehicle vendor.

If your protocol is too half-baked to publicly document then it's too half-baked to place into production.

bingo.
Security through obscurity is not security at all.

All quite true, but it's admittedly difficult to hire or train people to develop secure services/protocols.

Let's not forget the CAN Bus standard, designed from the trusting 1970's perspective that gave us Ethernet, telnet, etc. All automotive standards are insecure right now once you get physical access to the vehicle ports, and occasionally some passwords.

I'll also admit that I treat the Zero tank bag as vaguely secure because I know that no one yet knows to even look in there for goodies, even if it's trivial to break into, but losing a toll bridge token and some tools or a pair of gloves is low-risk. Exposing vehicle controls over unauthenticated internet connections, on the other hand, is a different class of exposure.

I should point out that this issue is a simple HTTP/PHP server and that the methods to secure and authenticate have been around since the 1990s (thats about 20years or so for those of us that forget)
ANY web developer should have known to atleast have a token.

[BrianTRice@gmail.com]

All quite true, but it's admittedly difficult to hire or train people to develop secure services/protocols.

...

I should point out that this issue is a simple HTTP/PHP server and that the methods to secure and authenticate have been around since the 1990s (thats about 20years or so for those of us that forget)
ANY web developer should have known to atleast have a token.

Yes, thanks for making that explicit. This sort of thing is part of my day-job and I forget to be explicit about such things. Still, managing a car's HVAC remotely seems like auditing at a project level much further ahead of just securing HTTP endpoints.

Here's my point, though: how does an automotive company hire good web people or manage a good/sound web/services project? It's not easy to recruit from that perspective. I'm simultaneously disappointed and sympathetic.

[CrashCash]

Just to bring this a little closer to home, I have Wireshark on my rooted Android phone so I watched the Zero app protocol, and it's not encrypted or anything. I saw my VIN, the model name and year, and a couple other things go by in plaintext, during the connect handshake.

(an aside: since it transmits the model year, why doesn't the app display this instead of being hardcoded to 2013?)

There's no security other than the standard Bluetooth pairing process, but that's a hell of a lot better than a full Internet connection, plus you can't control anything other than the custom profile.

If your protocol is too half-baked to publicly document then it's too half-baked to place into production.

Pretty much no one documents proprietary protocols these days. Zero doesn't document their app protocol. Suzuki doesn't document the protocols for the USB diagnostics box I have. I'm surprised Yamaha documents the testing protocol for the ABS on my FJR-1300. I can test-fire the ABS pump and solenoids by inserting a jumper and doing certain things with the ignition and kill switches. That's an exception to the rule.

One of the problems is the way manufacturers look at things. They consider anything computer related to be "really hard stuff" and probably feel people won't take the time or have the resources to hack on things. They don't understand there's a security community out there that thrives on just that.

I'll bet if you went to a Nissan engineering manager 3 months ago and said "but it's just HTML underneath!" he's probably feel you were speaking Greek. Even once you explained things, I think it'd be hard to get him to understand it's a simple attack.

[protomech]

Just to bring this a little closer to home, I have Wireshark on my rooted Android phone so I watched the Zero app protocol, and it's not encrypted or anything. I saw my VIN, the model name and year, and a couple other things go by in plaintext, during the connect handshake.

(an aside: since it transmits the model year, why doesn't the app display this instead of being hardcoded to 2013?)

There's no security other than the standard Bluetooth pairing process, but that's a hell of a lot better than a full Internet connection, plus you can't control anything other than the custom profile.

I assume you're looking at app to bike?

On the iOS app (1.0.7) at least it displays the model (2014 SR).