BMW Remote Unlock Wasn’t Using Secure HTTP

February 1, 2015 by Mike Szczys 32 Comments

Ah, the old HTTP versus HTTPS. If you want to keep people out, that trailing ‘S’ should be the first thing you do, especially if you’re trying to keep people out of a luxury automobile. It turns out that BMW screwed up on that one.

BMW has an infotainment feature called ConnectedDrive which builds your favorite apps and services right into the dashboard. You can even unlock the vehicle using this system which is built around a piece of hardware that includes a GSM modem and permanent SIM card. A security research group recently discovered that the commands sent for this system were being pushed over HTTP, the unencrypted sibling of HTTPS. The firm, hired by German automobile club ADAC, disclosed the vulnerability and an over-the-air upgrade has already been pushed to patch the flaw. The patch is described to have “turned on” the HTTPS which makes us think that it was always meant to be used and just configured incorrectly in the roll-out. We’ll leave you to debate that point in the comments. Seriously, how does something like this happen? It certainly sheds a lot more light on thieves being able to magically unlock high-end cars. Was this how they were doing it?

[Thanks Fabian]

Faceless Child’s Engineer Father Builds Him A Breathtaking Ride

January 22, 2013 by Mike Szczys 56 Comments

amazing-kids-car

Okay, the kid does have a face, but it looks like Dad blurred it for his protection. The real story here is the killer ride built by his engineer father. It’s far nicer than the cars driven by the Hackaday team, but then again, since it cost more than a BMW 3 series that’s no surprise.

[Lingzi] lives in China and does custom car work for a living. So to take on this project for his son was more of a stretch of the pocketbook than of his skill set. The car features a custom frame with rack and pinion steering, disc brakes, a rear differential, and a reputable suspension system. The body of the vehicle is crafted from carbon fiber. The lights all work and there’s an electric motor and transmission mounted just behind the driver’s seat. Unfortunately there’s no video of this in action (China blocks YouTube). But do take a look at the album above for pictures of the final paint job. There is also a little bit more information to be found in [Lingzi’s] Reddit discussion.

Keyless BMW Cars Prove To Be Very Easy To Steal

July 7, 2012 by Mike Szczys 84 Comments

A lot of higher end cars are now coming out with RF fobs that unlock and start the car. There is no longer a physical key that is inserted in the ignition. It turns out that for BMW this means stealing the cars is extremely easy for a sophisticated criminal. We always liked the idea of metal keys that ALSO had a chip in them. The two-tiered security system makes sense to us, and would have prevent (or at least slowed down) the recent rash of BMW thefts that are going on in the UK.

So here’s the deal. A device like the one seen above can be attached to the On-Board Diagnostic (ODB) port of the vehicle. It can then be used to program a new keyfob. This of course is a necessary feature to replace a lost or broken device, but it seems the criminals have figured out how to do it themselves. Now the only hard part is getting inside the car without setting off the alarm. According to this article there are ultrasonic sensors inside which are designed to detect intrusion and immobilize the vehicle. But that’s somehow being circumvented.

You can check out a keyfob programming demo, as well as actual theft footage, after the break.

Continue reading “Keyless BMW Cars Prove To Be Very Easy To Steal” →

Hackaday Links: Monday June 13

June 13, 2011 by Jeremy Cook 46 Comments

Tim wrote in to tell us about this simple hack where he replaced the stock button lights with some really cool Blue LEDS on an ’87 BMW. He uses some capacitors, to achieve the effect that it takes a bit for the charge to drain out so the lights stay on for a bit after being turned off. The lights themselves look really nice, so check out the pic.

Here’s an awesome coffee Table built using a large electrical board. It definitely would look good in anyone’s den, although it most likely has a low wife approval factor (WAF). This is actually based on a “motherboard wall that HAD covered before, but the “coffee table” form probably looks even better.

Finally, after the break is a video of someone washing an interactive art exhibit. Not sure if it qualifies as a hack, but it looks pretty cool to see lights following someone around when he’s washing the screen/window.

Continue reading “Hackaday Links: Monday June 13” →

CNC Milled Docking System For Droid

February 4, 2011 by Mike Szczys 18 Comments

[Steve] wanted a dock for his Droid phone but couldn’t bear to put cheap-looking parts in his nice BMW. He decided to build his own in order to satisfy his functional and stylistic needs. His main goal was to have a dock with no wires showing, but it also needed to be removable and have the ability to work with different devices (GPS, Droid, etc.).

The hardest part of a build like this is matching the bracket system to the car’s interior. [Steve] sidestepped the problem by starting with a commercial mounting bracket made specifically for the BMW E90 series. From there he added the female half of a mounting bracket he milled himself. The male half connects to this part using an edge connector, passing signals and power between the car and whichever device is currently installed. This way he can design brackets for different devices and not change what’s in the car.

To get a closer look, check out the video after the break. The system he came up with looks wonderful and works great.

Continue reading “CNC Milled Docking System For Droid” →

As Promised: More Industrial Robot Goodness

September 19, 2010 by Jakob Griffith 7 Comments

Remember [Mattythorne]? He took a BMW industrial arm and re-purposed it to write twitter messages on a white board. You can read a small excerpt here.

Well [Matt] is back, and as promised includes an entire write up for how he got @scribblebot scribbling twitter messages. It’s a little light on details and we wish there was some more in-depth how-to magic, but then we remembered with most of the population not having an industrial arm in the first place the extra time spent incorporating the extra info would be far from worth it. Regardless, it doesn’t surprise that the previous commentators were not far off the mark in how difficult programing one of these machines would be. While such arms do have a few built in libraries it looks like a very exhausting process to override the default axis of motion, incorporate a UI, build a pen holder, and more. And in the end, is it worth it? [Matt] tells us the arm is going to be going back to monotonous car building work soon, giving weeks of prep only a day in the limelight.

Re-purpose Industrial Robotic Arms

September 7, 2010 by Jakob Griffith 53 Comments

We must find out where you can acquire these industrial robots pictured above. Sure, you expect car companies like BMW to have a few lying around, which they used to make into a Twitter message writing robot. But Bungie, a video game company, to have one as part of an advertisement for Reach?

The former is just a scratch on the surface, with some pictures, but a much more decent writeup will be provided after September 12th. The latter has a few videos, and you can watch it recreate a monument with light ‘live’. And while both are impressive uses of old tech, neither answered our first question, we gotta get us one of these.

[Thanks Matt and FurryFriend]