The keys are generally just passive RFID chips so it's more like an authorized_keys file.
The problem here isn't that there's no physical key, those are usually laughably easy to circumvent. I think the real trick here is the physical attack they used to break into the vehicle and gain access to the OBD port without setting the alarm off.
There's a number of cheap and obvious tricks BMW could have used to make the RFID portion of this attack a lot harder. Including, making the OBD port more difficult to actually get at without actually sitting in the car and not letting the new key start the car for some reasonably long period of time.
If the alarm system is ultrasonic, I can envision breaking into the car by blasting several watts of power at the same frequency at the car. Loss of receiver dynamic range due to gain compression or transducer saturation == loss of ability to detect changes in the phase of the transmitted signal consistent with someone opening a door and climbing in.
What in the world was wrong with plain old car keys -- especially with an added RFID security chip in the key handle or fob?
Regular car keys are a pain in a lot of ways, and not all that secure, either.
To really do this correctly, you need to have cryptographic challenges between a key and an ECU, and to prevent the ECU from just getting swapped, you probably want to have several processors in various parts of the car, such that replacing them all quickly is too hard. Then you still have the problem of someone driving the car into a faraday cage and driving off to attack at his leisure, but that's hard to defend against (there, you probably have a continuous heartbeat signal and respond on loss of the signal, or just pay someone with a gun to guard your car...)
You should be able to put vehicle ignition control and access control logic inside a tamper-responding processor and secure it, even with all communications over an open bus. If you were going to be super paranoid, your vehicle would have vehicle-specific timing information built into the engine which was difficult to deduce from analyzing it after removing the ECU, so just swapping in a "skeleton key" ECU wouldn't work. No one is likely to do that for a car, but it is basically how the Permissive Action Links on nuclear weapons work (variable length wires for the explosive lenses on the primary; if you don't have the exact timing information to set them off at the right time, the weapon will be subcritical.)
> To really do this correctly, you need to have cryptographic challenges between a key and an ECU,
Nonsense. The problem isn't cloning the key, the problem is that you are reprogramming the lock to accept this new key you happen to have with you. No amount of crypto is going to save you when your verifier is full of holes.
You can't even use signing to only accept approved programming devices since OBD regulations enforce it's openness.
> all communications over an open bus
Now this is an interesting point. The bus that the OBD is connected to controls a whole bunch of devices all over the car. It's possible that no access to the inside of the car was required to execute this attack. Looking at the video it doesn't seem like they really stoop inside the car to grab anything actually so perhaps there's a way to get at the CAN bus via the presumably electronic wing-mirror?
1) The cryptographic challenges are a necessary but not sufficient part of building a secure car access control system. All the active components in a car are horrible from a security perspective, usually huge libraries from third-party manufacturers, and all kind of duct-taped together. So bad that a malformed audio cd in the entertainment system could actually totally pwn the car, including driving controls.
2) There are wireless extensions to OBD-II to run tire pressure monitors. You can do a no-touch OBD-II hack. Presented at USENIX last year.
Tesla is really the only manufacturer who is likely to do better, since they build a lot of stuff in-house vs. buying badly documented components. I would love to audit the Model S (especially if in doing so I got an earlier delivery position).
> You can't even use signing to only accept approved programming devices since OBD regulations enforce it's openness.
I think you could get openness with signing. You have a central, non-profit authority that blesses, records, and publishes all signings in real time. When a car turns up missing, you see if anybody re-keyed it and the police have a discussion with them. You could recoup expenses with a modest charge per re-key.
You might be over-thinking this. It's possible to disable the factory alarm motion sensor by double-pressing the lock button on the key fob. This is a feature for people (like me) who take their car on ferries, and who don't enjoy listening to a cacophony of car alarms while on the ferry (I appear to be in minority here, if recent trips were anything to go by)
Apparently a fair few owners don't know this feature exists (didn't read the manual/didn't have a manual) and were in the habit of "checking it was locked".
So, if you can't remember if you locked a BMW, UNLOCK it first, then LOCK it. Locking twice disables the alarm.
Agreed. I'm going to guess when I hit the lock button a second time, and all the lights in the car went on, that was supposed to indicate the alarm was now off? As opposed to indicating the car was indeed locked?
Is he programming the keyfob? or is he adding the key to the car's authorized_keys list?