A team of researchers from the University of Birmingham (England) has discovered a computer error that allows vehicles to be opened and also started without using their original keys. The bug endangers more than 100 million cars. The report was presented at the 2016 USENIX Computer Security Symposium held in Austin, Texas (USA).
The English experts showed the existence of two major security flaws in the ignition and input systems of various brands, but they mainly affect all the Volkswagen brand models of the last 20 years , some of its brands such as Audi and Skoda, but also other well-known manufacturers such as Nissan, Alfa Romeo, Citröen, Fiat, Ford, Mitsubishi, Opel or Peugeot, all of them manufactured after 1995.
How does the hacking work?
Two separate attacks hurt different models. The first fault is in the ignition system. It is not easy, but it is possible for a hacker to find out the encryption keys, which usually have a unique and a shared key. The shared key is easy to obtain. Thus, for Volkswagen group cars, the signals that the vehicle key exchanges with the vehicle itself can be intercepted and cloned using an Arduino board and a simple radio receiver. The plate would act as a key.
The second flaw is in the old cryptographic scheme called HiTag2 , still in use. HiTag2 is a cryptographic system that is responsible for generating the eight remote control codes that randomly open the vehicle and that are modified each time the button is pressed. None of the cars has an alarm system for this type of cyber attack.
From Volkswagen they ruled out that a hacker could steal a car (yes open it but not start it). That is , the Volkswagen group recognized these vulnerabilities but claimed that they would not necessarily be able to start the car and take it away. For its part, Opel reported that the hacking system requires a lot of technical complexity, so the opportunities to carry it out are very limited.
