6 ms·
Hacking an Audi: performing a man-in-the-middle attack on FlexRay
- chews 7y agoThis is a fantastic writeup and it's truly brilliant what the very clever folks at comma.ai are up to. Very slick stuff indeed.
- stuff4ben 7y agoI wish I could hack my Lexus RX350's LKAS. It's pretty bad and seems to bounce left and right between the lanes. It gets to the point that I just shut it off since I don't want to fight it when driving long distances as it's very tiring. It's probably a timing issue as the computer isn't getting updates fast enough and has to keep correcting which causes the bouncing between the lane. A Tesla this is not!
- alphabettsy 7y agoDoes your vehicle actually have lane centering or just lane keep? Lane keep, which is more common, does not attempt to keep the vehicle in the middle of the lane. It just prevents departing the lane without signaling.
- Smoosh 7y agoPart of the problem with these new technologies is that every car company gives each capability a unique name. It takes considerable effort to untangle the meaning of all the manufacturer-specific names to determine whether Audi Active Lane Assist is the same as Lexus Lane Keeping Assist but not Mercedes Distronic Plus unless it's Mercedes Distronic Plus with Steering Assist.
- alphabettsy 7y agoTrue, but I fear being more specific would lead to extremely long names that still wouldn’t matter to people who can’t be bothered to read the details or understand their vehicle. Could the average person tell the difference if they just called one Lane Departure Prevention and the other Lane Departure Prevention with Centering or might people just assume they’re the same? Idk, maybe we should try it.
- coribuci 7y ago> Part of the problem with these new technologies is that every car company gives each capability a unique name. It's because of Mickey Mouse (copyright/patent law). Same like with "4x4" and "all wheel drive". They don't want to get sued by competitors. They also want to sound like clickbait.
- numpad0 7y agoActually when Subaru first built their EyeSight system, it was almost Tesla Autopilot, but Japanese authority feared it’ll lead to Autopilot type crashes. The authority was right in hindsight, but then couldn’t conceive the idea of mandatory driver monitoring system, and instead ordered Subaru to ensure driver is alert by making intervention too little and late. So most LKA/LKAS should do just as well as Tesla’s, only the firmwares are built deliberately with different parameters. Technology wise it should be the same.
- mayank 7y ago> It's pretty bad and seems to bounce left and right between the lanes. 2019 Audi SQ5, exact same problem, had to disable it too. I really wonder if these non-Tesla manufacturers are getting pre-fab'd chipsets from the same place. It's really an impediment rather than driver assist. I've noticed that it steers by itself pretty well on long curves, but anything other than and I'm weaving in the lane and begging for a roadside sobriety check.
- numpad0 7y ago> wonder if these non-Tesla manufacturers are getting pre-fab'd chipsets from the same place That's exactly the case. The 'strains' I'm aware of are Subaru/Hitachi, MobilEye, NVIDIA, Bosch, Continental and there shouldn't be more than 3 other than these. Most car manufacturers buy one of these or pay one of them to install another of them, as a camera that speaks in steering angles. You'd notice a lot of those camera units look identical across brands. I think yours is MobilEye(same as Tesla AP1).
- hcazz 7y agoHave you double checked the settings for lane keep assist on your Audi? I have a 2018 Q5, and you have the options between "early" correction and "late" correction. If it's set on "late" correction, then it seems to bounce between lanes as your described. When it's set to "early" correction, it indefinitely stays centered (assuming it can see the lanes).
- mayank 7y agoInteresting, I haven’t seen options for those. I’ll check in the settings tomorrow, thanks!
- crazysim 7y agoLSSP? I've noticed that some TSSP openpilot users use an alternate steering angle sensor for their openpilot installations called ZSS because the stock sensor isn't too accurate. If this is stock though, there's more than just timing I think.
- o-__-o 7y agoOn Ford it’s timing. The LKAS is read by the PCM which then relays info to the PSCM. The idea is that the steering module is fire walled by the PCM. The CCM and ABS are similar. Toyota and Lexus expose the power steering controller to the CANBUS allowing takeover attempts
- kfarr 7y agoMaybe it's just me, but the regulatory oversight around these automated features seems insufficient. I'm trying to imagine equivalents from older passive safety technology like seatbelts that don't always work, airbags that pop out prematurely, or cruise control that accelerates without warning. Doesn't seem like those would pass muster "back in the day"? (Not to mention Uber autonomous vehicle flat out killing a pedestrian with no criminal culpability.) Maybe it's a case of severity -- automated lane guidance isn't viewed as a serious problem when it fails? But who makes that decision? I don't drive much anymore but when I do it's in a Zipcar with relatively recent Subarus that have this lane guidance technology. I always turn it off as it invariably makes mistakes within a few hours of usage and seems more dangerous on than deactivated.
- UweSchmidt 7y agoRegulating technology is difficult. You can easily set up a mechanical seatbelt test that tests a mechanism 1000 times, but how would you test an algorithm? Also, many people died before seatbelts became mandatory; so much for "back in the day".
- carlmr 7y ago>how would you test an algorithm? You can send out drivers that test if it works well. And then you can record that data, and check what is causing the issues and add these frames as test data? But the testing IMHO is a bit too late. You need UX designers and psychologists giving inputs from the start. You need SW quality by design, not by process. You need to rid yourself of any management layers that don't understand software.
- numpad0 7y agoAutomotive peoples’ mindset of safety and computing is weird. They say it’s better to floor it when leading car is not moving, or better to engage lane centering at a borderline safe moment, to make drivers used to it. Or they say they want computers to delay software edge-case issues after it had occurred. They have passions but the whole industry don’t seem to have much background handling sentient beings.
- 7y ago
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- gnicholas 7y agoThe lane-tracing on the 2019 Toyota RAV4 is also very poor. I rented one for a long road trip and was surprised how often it lost the lines (even when clearly painted, in good weather, during the day), and how much it ping-ponged, even when it supposedly 'saw' the lines. I hope to not buy another car until lane-centering gets decent, or is updated by non-Tesla car companies OTA. I understand Cadillac has a good system, but everything I've tried (Toyota, Honda, Subaru) has been so mediocre as to be useless.
- Glawen 7y agoThey do not know about Vector Canoe ? I did this "hacking" every other day when testing software on a prototype vehicle
- RealityVoid 7y agoMaybe drifting a bit, but I hate the business model Vector has. They have reasonably good software, but their Canoe SW has that horrible scripting language that is... well, horrible, but that everybody uses and because it's historically been used and the vendors have all the test panels and whatnot in it, the developers are locked in to pay for exceptionally expensive SW for a sub-par product. Better than most other sw in automotive but it pales with open-source SW that does more complex things in other fields.
- pd0wm 7y agoSeems like the https://www.vector.com/int/en/products/products-a-z/hardware/frstress/ https://www.vector.com/int/en/products/products-a-z/hardware... has some similar functionality. I have never used it, but by reading the documentation I'm not sure if it would have been useful here. The frame with ID 65 which needs be overwritten, actually contains 4 different messages indicated by the last byte in the payload. To properly time the modification you need to sync up on that, which the Vector box can't do. Also price on request, so probably not in the price range of our target audience.
- gburdell3 7y agoThere's a pretty big difference between testing software with a protocol that you know and understand, and reverse-engineering the communications on a production vehicle.
- sircastor 7y agoI had to price out a CANoe license for a project at work a while back. They came back to us asking for low five-figures.
- jboy55 7y agoIs this a 'man in the middle' attack for 3rd party nefarious purposes, like controlling someone else's Audi ... Or just plain reverse engineering of a communications protocol to hack the software for 1st party education and extension? Why the click-baity title as if this is some great compromise to the integrity of the Audi? Am I missing something?
- mtreis86 7y agoThe latter, "We built a python script to read a joystick and used a panda to send the CAN messages to the FPGA, which overrides the appropriate bits on the FlexRay bus to control the EPS. By combining the results from the previous steps, we were able to control the steering with a joystick."
- ex3ndr 7y agoI didn't get it, FlexRay usually uses end-to-end encryption and it seems that everything is in a plain text? Audi just decided not to encrypt something?
- mrlambchop 7y agoFrom experimentation with recent Mercedes and BMW, its encrypted, although I do recall that early X5's were not protected.
- _pmf_ 7y ago> On the Q8, the FlexRay bus has cycle time of 5 ms, so each ECU can send messages at 200 Hz. That's weirdly worded. The cycle repeats (disregarding multiplexed PDUs) every 5 ms, but there are lots of messages within a cycle. Even on CAN, it's not uncommon to have > 2000 msg/s (looking at Daimler trucks with 70% utilization).
- harywilke 7y agoI really wanted the company to be called ",,," when i read: "This medium post is about a project by three comma employees"