Loosely aware a controller manufacturer who wanted a bluetooth/wifi based password recovery utility with a fixed or predictable recovery key.

They were asked what their exposure would be if someone walked into a datacenter and used their phone to disable all the airconditioning systems.

Do they want the passwords for all their systems to match so they don't need to remember as many?

>but entering the Konami Code on the steering wheel to unlock the ignition is quite plausible.

The left, right, left, right part I can see, but surely up, up, down, down, would be difficult on most steering wheels :)

Needing two keys for a third one is not new. My 25 year old car needs two keys for adding the third, old Fiats has “red master” keys which are also required during adding keys.

That's common, and it's often a bit stricter. E.g. my Ford Lightning has a pocket you have to put the fob into for this kind of activity. For certain things you need both fobs, so you do one, and then the other, as part of a sequence in the programming. Just being in range isn't good enough.

> The entire UX is "press button to open car, go to dealership if you need new key"

Ironically proper security in this case would likely improve the user experience as well. The car provides a 64 bit (or larger) secret value and you manually program a standardized fob with it. No need for custom parts that are only available from the dealer.

I wonder if it's less about the cost of silicon, and more about the energy budget for a device that uses a button-cell battery.

Even if it's a problem with off-the-shelf stuff, I imagine a car-manufacturer could easily get something all nice and tiny and special-purpose.

> (with whopping 32 bits of security!)

Ha! DVDs at least had 48 bits. /s

It really depends on the way biometrics are implemented. If you're doing it Apple style, where a dedicated chip validates biometrics and uses encryption and signatures to prove to the OS that the user is who the say they are, they're as good and trustworthy as the software you're running on them (which in the case of macOS for instance requires full trust).

If you're doing the "fingerprints implemented as a webcam" or software based facial recognition from a shitty webcam, you're risking quick and easy bypasses. Still good enough for a computer you leave at home (as long as you don't need to protect yourself against shady law enforcement) but definitely not that secure.

From what I've been able to gather online, nobody but Apple and phone manufactures seem to care much about actually doing biometrics securely, including the biometrics hardware companies. It's such a shame because it's definitely possible to do better.

What you're describing is basically keeloq which is one of the most common rolling code systems. It sends a 28 bit serinal number a 4 bit button code, 2 bit code for repeat and low battery, and a 32-bit encrypted part with an incrementing sequence number.

The rx enforces the sequence goes up.

You press button to open. Attacker lets the first sequence go through and the door opens, while the button is still down the attacker jams your second transmission while capturing it themselves.

Now they have a code they can use to open again when you're not around, assuming you don't use it again in the meantime.

If you wonder how vulnerable systems keep getting deployed without it being malicious, you don't need to look any further than the nearest hotshot that thinks everything is "not that difficult" and that everyone else is incompetent.

Security of any kind is just hard. The defender must defend against any possibility while the attacker needs just one vulnerability. How much cost and range and battery life are worth losing when the attacker can just punch through a window with their fist?

with a battery life of two years? and durable against going through the washing machine?

When my favorite quadruped knocked my keys into the trash I had to get my car towed to the dealer for them to program me a new key. One one hand, top notch security as it was impossible to do any other way. On the other hand the total to get this done was something like $500 after everything.

Well they don't call them stealerships for nothing.

I wonder who make more money on this. The car dealer or the manufacturer.

Maybe the car manufacturers should just give up and adopt BTLE. Proper security, and you could unlock with your phone.

The attacks to rolling code keys are well known but these keys continue to exist. They allow you to pair a key yourself to the car that you buy online. Particularly in the US it's quite common that people buy used cars and then another key online that they pair themselves.

You won't be able to do this for instance with VAG cars that have KESSY. First of all the immobilizer is paired to the key, secondly the only way to pair a new key to it is via the manufacturer or a licensed dealership because you need a blob from their central server. But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one.

In general these types of attacks are much harder in Europe where immobilizers have a legal minimum standard that manufacturers have to meet. On the other hand in the US immobilizer are entirely optional, which has famously led to KIA and Hyundai cars shipping without them and the Kia Boys TikTok phenomenon.

[dead]