eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
New research presented at the USENIX security conference this week revealed that there is a critical weakness in vehicles that could enable an attacker to unlock and start a car remotely. The research was conducted by computer science researchers at the University of Birmingham in the United Kingdom.
“We show that the security of the keyless entry systems of most VW Group vehicles manufactured between 1995 and today relies on a few, global master keys,” the research abstract states. “We show that by recovering the cryptographic algorithms and keys from electronic control units, an adversary is able to clone a VW Group remote control and gain unauthorized access to a vehicle by eavesdropping a single signal sent by the original remote.”
Not only does the paper provide insight into the flaws in Volkswagens, but it also details similar flaws in the Hitag2 mechanism used in Alfa Romeo, Chevrolet, Peugeot, Lancia, Opel, Renault and Ford vehicles that enable a rolling code approach for keyless entry.
“Our findings affect millions of vehicles worldwide and could explain unsolved insurance cases of theft from allegedly locked vehicles,” the paper states.
While the impact of vehicle theft is likely in the tens of thousands of dollars per stolen vehicle, the researchers’ approach makes use of a $40 device they built using the open-source Arduino micro-controller.
The researchers contacted Volkswagen Group in November 2015 and met with the company in February to discuss the findings. According to the researchers, VW Group acknowledged the vulnerabilities.
“As mentioned in the paper, we agreed to leave out amongst others the following details: cryptographic keys, part numbers of vulnerable ECUs [electronic control units], and the used programming devices and details about the reverse-engineering process,” the researchers stated.
Vehicle security experts contacted by eWEEK were not surprised by the new disclosure of widespread issues in VW Group vehicles. David Barzilai, co-founder of Karamba Security, noted that his company has been seeing similar security issues with multiple brands. Karamba launched its flagship Carwall security platform in June in an effort to help secure vehicles’ ECUs.
“The innovation of the USENIX paper is that it shows that a single brand and its subsidiaries are exposed, with all cars that were sold since 1995, as they all use the same master key,” Barzilai told eWEEK.
Corey Thuen, senior consultant at IOActive, said the keyless entry risk is in line with IOactive’s expectations.
“We see these types of vulnerabilities being systemic to the auto industry, and this area of vulnerability is the most likely to be exploited by attackers,” Thuen told eWEEK. “Unless we’re talking about nation states or similar groups, your average hacker is motivated by money, so any vulnerabilities that can be turned into dollars, like this keyless entry attack, are going to be a higher likelihood.”
In Thuen’s view, the real trouble in the auto industry, and in particular with the keyless entry risk, is all about vendor failure to follow security industry best practices. In this case, Thuen said that proper key infrastructure and management were lacking, with the vendor instead making use of hardcoded information. He added that in IOactive’s recently released Commonalities in Vehicle Vulnerabilities report, the issue is documented in detail.
Barzilai believes the Karamba Carwall platform could in fact be used to limit the risk of such keyless attacks. He noted that the reported hack on VW was done through reverse-engineering an ECU and obtaining a private key.
“With Karamba installed, hacking into the ECU and then reverse-engineering it would be detected and prevented as a deviation from factory settings,” he said. “Therefore, the attack would have probably been prevented.”
Barzilai added, “The attack shows that security should be done from a system approach, and the ECU is the attack surface or attack gateway to the car.”
Security is a very difficult thing to “bolt-on” after the fact, according to Thuen. A failure to follow security best practices during the design and implementation phases can be very difficult, and often impossible, to remediate afterward.
“Microsoft, Google, Apple, OWASP and now auto-specific organizations like the Auto-ISAC have learned a lot over the past couple decades, and the auto industry needs to take advantage of that,” Thuen said.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.