• Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Home
  • About Darknet
  • Hacking Tools
  • Popular Posts
  • Darknet Archives
  • Contact Darknet
    • Advertise
    • Submit a Tool
Darknet – Hacking Tools, Hacker News & Cyber Security

Darknet - Hacking Tools, Hacker News & Cyber Security

Darknet is your best source for the latest hacking tools, hacker news, cyber security best practices, ethical hacking & pen-testing.

Car Immobilisers Using Weak Encryption Schemes

December 23, 2010

Views: 14,105

Another case of a certain industry lagging behind, I mean come-on – who seriously still using proprietary cryptography algorithms in 2010? Especially only 40 or 48-bit protocols, with the processing power available on hand now and new techniques like GPU based cracking – that just doesn’t cut it.

The latest discovery of such implementations was in the immobiliser technology used by car companies to secure their expensive vehicles. A researcher Karsten Nohl has exposed these weaknesses at the recent Embedded Security in Cars conference in Germany.

Weak cryptography means that car engine immobiliser technology has become easy for crooks to circumvent.

Nothing weaker than 128-bit AES is considered sufficient protection for e-commerce transactions, but car manufacturers are still using proprietary 40-bit and 48-bit encryptions protocols that are vulnerable to brute force attacks. Worse still, one unnamed manufacturer used the Vehicle Identification Number (VIN) as the “secret” key for the immobiliser.

The weakness of the technology was exposed in security research by ethical hacker Karsten Nohl of Security Research Labs, who links the weakness of the technology with a growth in car thefts in Germany last year, following years in decline.

Nohl outlined preliminary findings from his research at the recent Embedded Security in Cars conference, in Bremen, Germany. His research covers the communications between card immobilisers and engine electronic systems in dozens of cars. For example, Nohl was able to crack the Hitag 2 car immobiliser algorithm used by Dutch firm NXP Semiconductors in around six hours.

And using the VIN number as the secret key? Well, that’s not very secret is it? It’s akin to using the MAC address of a computer as the SSH secret key, no one in their right mind would do that. I guess that’s what happens when you leave the engineers to implement cryptography schemes without having anyone around handy with the cluestick.

I’d imagine some of these systems are protecting extremely expensive cars, so some basic equipment, some strong crypto knowledge and 6 hours and you can land yourself a $100,000 car. Not bad for a days work.

The research builds on work by other computer scientists and encryption experts dating back at least five years. In 2005 Ari Juels of RSA Labs and researchers at Johns Hopkins University in Baltimore, Maryland, circumvented the encryption system used by Texas Instruments.

Manufacturers of car immobiliser technology have defended the robustness of their technologies.

“To our knowledge the direct causal link between the failure to adopt AES systems and the rise in car theft cannot be drawn,” Thomas Rudolph of NXP told New Scientist.

Texas Instruments claimed its proprietary cryptographic systems might be stronger than AES. Nonetheless both firms are in the process of phasing out their home-cooked crypto tech in favour of industry standard encryption systems based on 128-bit AES.

And what it is with TI claiming their system MIGHT be stronger than AES? When did ‘might‘ ever give anyone confidence? In all honesty, there is no reason at all for using proprietary algorithms or implementations. Those out in public like AES have been tried, tested and approved by the greatest crypto minds in the World, I don’t care how smart you think your employees are – but trust me they aren’t as smart as the people scrutinising AES.

I hope to see all companies using weak proprietary protocols in any industry phase them out and switch to tried and tested industry algorithms.

Source: The Register

Share
Tweet
Share4
Buffer
WhatsApp
Email
4 Shares

Filed Under: Cryptography, Exploits/Vulnerabilities, Hardware Hacking Tagged With: aes, Cryptography, karsten nohl



Reader Interactions

Comments

  1. Bogwitch says

    December 23, 2010 at 10:26 am

    “Texas Instruments claimed its proprietary cryptographic systems might be stronger than AES”

    And the demon of security through obscurity raises it’s ugly head again. There appears to be an assumpotion at TI that their ‘roll your own’ algorithm has never leaked. I guess that they have 100% staff satifaction and 100% staff retention.

Primary Sidebar

Search Darknet

  • Email
  • Facebook
  • LinkedIn
  • RSS
  • Twitter

Advertise on Darknet

Latest Posts

Falco - Real-Time Threat Detection for Linux and Containers

Falco – Real-Time Threat Detection for Linux and Containers

Views: 329

Security visibility inside containers, Kubernetes, and cloud workloads remains among the hardest … ...More about Falco – Real-Time Threat Detection for Linux and Containers

Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Views: 626

As threat surfaces grow and attack sophistication increases, many security teams face the same … ...More about Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

Views: 571

With more businesses running Linux in production—whether in bare metal, VMs, or containers—the need … ...More about Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

SUDO_KILLER - Auditing Sudo Configurations for Privilege Escalation Paths

SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Views: 607

sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with … ...More about SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Bantam - Advanced PHP Backdoor Management Tool For Post Exploitation

Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

Views: 462

Bantam is a lightweight post-exploitation utility written in C# that includes advanced payload … ...More about Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

AI-Powered Cybercrime in 2025 - The Dark Web’s New Arms Race

AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Views: 690

In 2025, the dark web isn't just a marketplace for illicit goods—it's a development lab. … ...More about AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Topics

  • Advertorial (28)
  • Apple (46)
  • Countermeasures (228)
  • Cryptography (82)
  • Database Hacking (89)
  • Events/Cons (7)
  • Exploits/Vulnerabilities (431)
  • Forensics (65)
  • GenAI (3)
  • Hacker Culture (8)
  • Hacking News (229)
  • Hacking Tools (684)
  • Hardware Hacking (82)
  • Legal Issues (179)
  • Linux Hacking (74)
  • Malware (238)
  • Networking Hacking Tools (352)
  • Password Cracking Tools (104)
  • Phishing (41)
  • Privacy (219)
  • Secure Coding (118)
  • Security Software (235)
  • Site News (51)
    • Authors (6)
  • Social Engineering (37)
  • Spammers & Scammers (76)
  • Stupid E-mails (6)
  • Telecomms Hacking (6)
  • UNIX Hacking (6)
  • Virology (6)
  • Web Hacking (384)
  • Windows Hacking (169)
  • Wireless Hacking (45)

Security Blogs

  • Dancho Danchev
  • F-Secure Weblog
  • Google Online Security
  • Graham Cluley
  • Internet Storm Center
  • Krebs on Security
  • Schneier on Security
  • TaoSecurity
  • Troy Hunt

Security Links

  • Exploits Database
  • Linux Security
  • Register – Security
  • SANS
  • Sec Lists
  • US CERT

Footer

Most Viewed Posts

  • Brutus Password Cracker – Download brutus-aet2.zip AET2 (2,298,130)
  • Darknet – Hacking Tools, Hacker News & Cyber Security (2,173,106)
  • Top 15 Security Utilities & Download Hacking Tools (2,096,640)
  • 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) (1,199,691)
  • Password List Download Best Word List – Most Common Passwords (933,528)
  • wwwhack 1.9 – wwwhack19.zip Web Hacking Software Free Download (776,171)
  • Hack Tools/Exploits (673,301)
  • Wep0ff – Wireless WEP Key Cracker Tool (530,185)

Search

Recent Posts

  • Falco – Real-Time Threat Detection for Linux and Containers May 19, 2025
  • Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance May 16, 2025
  • Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked) May 14, 2025
  • SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths May 12, 2025
  • Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation May 9, 2025
  • AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race May 7, 2025

Tags

apple botnets computer-security darknet Database Hacking ddos dos exploits fuzzing google hacking-networks hacking-websites hacking-windows hacking tool Information-Security information gathering Legal Issues malware microsoft network-security Network Hacking Password Cracking pen-testing penetration-testing Phishing Privacy Python scammers Security Security Software spam spammers sql-injection trojan trojans virus viruses vulnerabilities web-application-security web-security windows windows-security Windows Hacking worms XSS

Copyright © 1999–2025 Darknet All Rights Reserved · Privacy Policy