[Avernar]

Just found another article with a little more detail. It looks like they sent bogus values and increased the packet rate way above normal. So it looks like the manufacturer of the car they tested had some intern write their firmware.

But as I said, on the Jeep they'd just crash the WCM, assuming it's vulnerable to such an attack.

Edit: Just found the research paper, reading it right now.

[5-90]

Things I've found about about TPMS (have it on my wife's 2005 Suzuki Verona...)

1) Most mechs aren't even sure how it works - at least, no-one can explain it to me (even in general terms.)

2) The sensors run $80-90 in the aftermarket. I don't even want to think about OEMR prices...

3) The sensors have batteries, but they generally can't be changed. A flat battery means a whole new sensor, instead of a two-dollar battery.

4) TPMS is still a pain because it doesn't tell you which tyre is low, just that a tyre is low.

5) TPMS requires a disparity of something like 10-15% in a given tyre - I usually catch a low tyre from handling variations before that (typically around 5%, from what I've found. And, I usually know which tyre is low.)

6) When the batteries start getting low, the system will start "falsing" on you - telling you you have a low tyre when you don't.

7) Some higher-end systems have a sensor in the spare tyre, and if the spare gets low it will trigger the TPMS light (but you can't tell - and you check the four tyres on the road and they're fine...)

Conclusion? When I finally get a chance, I'm getting into that IP and pulling that damned bulb out. FMVSS thinks it's necessary, but I think that's because people don't know how to drive or pay attention to their vehicles anymore. Driver's ed is a joke anymore - and has been for fifteen years (since I put my two boys through it. They took DE, my wife polished them off, and they got their licenses. Then, I told them to forget everything they'd learned and spent six months teaching them how to drive properly. If I'd taught them, they'd have been entirely too competent to pass the CA DMV practical...)

TPMS, Anti-Collision RADAR/SONAR, "parking assist system" - it all goes in line with what I've been saying for twenty years - "Build a car any idiot can drive, and every idiot will have one." This is not how you improve roads safety - safety lies between the ears! There are, simply put, people who should not drive at all. Period. Full stop.

It's licensed because it's a privilege, not a right. Yes, you have the right to move about the country freely, but there's nothing telling you you have to drive to get where you want to go.

[Avernar]

Just read the research paper, very interesting.

Originally Posted by 5-90

1) Most mechs aren't even sure how it works - at least, no-one can explain it to me (even in general terms.)

The sensors start to transmit data when they detect the wheel rotating faster than a predetermined speed. The sensor sends it's ID, temperature, pressure and a few flags every minute. The vehicle can also tell the sensor to transmit if it detects bad packets.

Originally Posted by 5-90

4) TPMS is still a pain because it doesn't tell you which tyre is low, just that a tyre is low.

That's just the manufacturer being cheap. Since each sensor has a unique ID it's easy for the computer to tell which one is low.

Originally Posted by 5-90

5) TPMS requires a disparity of something like 10-15% in a given tyre - I usually catch a low tyre from handling variations before that (typically around 5%, from what I've found. And, I usually know which tyre is low.)

That's the indirect system using the ABS sensors instead of the direct system of TPMS modules in the tires. The direct system is more sensitive and can detect low pressure in all tires (doesn't need a disparity).

Originally Posted by 5-90

6) When the batteries start getting low, the system will start "falsing" on you - telling you you have a low tyre when you don't.

Again, cheap manufacturer. The data packets have a low battery flag. The computer can tell the difference between low battery and low pressure. Low battery should trigger the TMPS malfunction indicator, not the TMPS low pressure indicator.

Originally Posted by 5-90

7) Some higher-end systems have a sensor in the spare tyre, and if the spare gets low it will trigger the TPMS light (but you can't tell - and you check the four tyres on the road and they're fine...)

See response to 4.

[JIMBOX]

Heh Heh--see #9

JIMBO

[jstrubberg]

I removed mine and disabled the light.

Really, it's just not that hard to check the tires when you gas up the Jeep.

[paul84043]

Wow, not sure what happened there, I swear it was there when I was writing my reply!! Really!!!

Here's the link.

Hackers Wirelessly Crash Car's Computer At Highway Speeds

It has a screencap of the hackers actually crashing the cars computer at highway speeds....that's scary!!

Take a look at it, it's very interesting...

Paul.

[jstrubberg]

No, it has a screencap of a custom message on the alert screen. It says they eventually sent enougn data to fry "an onboard computer".

It's not a good thing, but let's not go all chicken little. Unless you freak out over the TPMS going off, you aren't in any danger from this little stunt.

[5-90]

Originally Posted by Avernar

Just found another article with a little more detail. It looks like they sent bogus values and increased the packet rate way above normal. So it looks like the manufacturer of the car they tested had some intern write their firmware.

But as I said, on the Jeep they'd just crash the WCM, assuming it's vulnerable to such an attack.

Edit: Just found the research paper, reading it right now.

Which research paper? I would probably like to see it myself, particularly if it gives a "nuts and bolts" approach (I don't like not knowing how something works when I have to deal with it.)

Read your reply - and you do raise some good points. However, I think my ultimate point still stands - "Build a car any idiot can drive, and every idiot will have one." 'Drivers' have been becoming less competent over the last twenty to thirty years, and adding all of these creature features under the guise of "safety devices" doesn't help. Technology should never replace skill or training - and if you can't be trained up to recognise a potentially unsafe driving condition as it occurs (if not before you get in the car,) then you honestly don't belong in the left seat.

Period.

(I know there are those of you who will say that your wives are assisted by these creature features - but wouldn't they be assisted even more by actually learning? My wife is an excellent driver, in addition to having been trained by SCPD years ago, and having gotten finishing training from me - she hadn't taken EVOC, I've been through it twice. Plus E&E. Plus heavy vehicles. Plus inclement weather/hazardous conditions. Plus ...)

"Feature creep" is not RPT NOT the way to make the roadways safer. "Feature creep" simply allows for less competent indivuals to "drive" on the roadways (I use the term advisedly there - most of the "drivers" I'm forced to share the road with don't even know how to operate a motor vehicle, much less actually drive one...) which does two things, both bad.

1) Increased traffic. More people on the roadways = greater probability of roads incidents, greater probability of injuries resulting therefrom, and greater probability of major roads incidents (I prefer "incidents" over "accidents" - very few of them are truly accidental. Kinda like how we firearms instructors stopped using "Accidental Discharges" a few years back in favour of the term "Negligent Discharges" - if your firearms discharges when you don't expect or want it to, what did you do wrong to make it happen? Maybe one in one million unintentional discharges are well and truly "accidental.")

2) Decreased mean capability. Less skill = less roadway safety.

Throw in all of the DWD (Driving While Distracted) we see daily - with cellphone use and texting being chief among those (JFTR, I do not and will not talk on the 'phone while driving, unless there is a genuine medical emergency involved. I don't even know how to text...) and you have a recipe for a major disaster - or frequent injuries and inconveniences.

Of course, as "feature creep" makes people think that cars are safer in collisions (yeah, right...) we see more unsafe conduct behind the wheel...

- Talking on the telephone (having an animated conversation while you're supposed to be driving. Hands-on or hands-free - doesn't matter. Stop it! Pull over and talk, don't talk while you're moving...)
- Texting while driving (I just want to throw hammers at these people to make them stop. Or maybe live grenades...)
- Eating that requires both hands (I can understand a simple sammich - or a hamburger. But a bowl of soup? I've even seen eating with chopsticks while driving. I'd have immediately revoked that license!)
- Applying makeup. Aren't you supposed to do that at home, before you leave?
- Fixing hair. See applying makeup.
- Shaving. Men and women (facial hair for men, legs for women.) WTF?

Much of that because people have this idea that they're not going to get hurt in a roads incident. Right.

News flash - you don't want to get hurt in a roads incident? Don't get involved in one! Don't do anything that increases the likelihood of getting involved in one! Six airbags isn't a guarantee that you won't get hurt - not getting involved is a guarantee that you won't get hurt.

The more feature creep I see, and the more "safety devices" I see added, the more I want to get a mid-1960's M35A2 and use it for a DD running greasel or WVO. I won't get hurt - if you don't screw up around me, you won't get hurt, either. See how it works?

[Avernar]

Originally Posted by paul84043

Wow, not sure what happened there, I swear Hackers Wirelessly Crash Car's Computer At Highway Speeds

I've read that article. No mention of a successful buffer overflow. They're not sure why the wireless module stopped working.

Originally Posted by paul84043

Wow, not sure what happened there, I swear It has a screencap of the hackers actually crashing the cars computer at highway speeds....that's scary!!

That would be either Photoshop or an ODBII test tool. I've read the research paper and they did not make any custom messages or make any other instrument misbehave.

Don't believe everything you read, the stories get more exaggerated the further from the original source they get.

[paul84043]

I wish I could find the exact article I was reading yesterday.
I know that there are always shades of grey, and manufacturers are all going to to their own thing to their own level of satisfaction. Unfortunately, all of them are corporations and will spend as little money as humanly possible on any given project to the point the the potential liability balances out.
The Pinto is a classic example. Ford was COMPLETELY aware of the problem with the gas tank exploding, but the corporate lawyers and accountants figured that the cost of liability lawsuits was far outweighed by the cost of a recall so they just left it alone. It's a very interesting story.
I'm not saying that every vehicle on the planet can be controlled remotely by the big giant head, but the more complex systems they put in these vehicles the less control we actually have over them. Take Audi's random, full throttle acceleration issues a few years back. I know of at least two people that died as a result of it before they decided it was "really" a problem. I think one of them was actually a little boy.
Yeah...probably not worth going all "chicken little" over, but definitely something to keep in mind. If you get in the position that you're asking yourself "should I keep these sensors, and move them to my other tires", you might just want to leave them out....
If they can get all the way in to the point that they can throw a message up on your cars display, who knows what else they can do, and do you really want to find out?

[paul84043]

I checked on Snopes and can't find anything on the whole thing being a hoax, they're usually pretty good about those kind of things, surprised that there was nothing at all.
The article that I read yesterday was brand new and did reference most of the previous research.
Personally....in my Jetta, the TPMS is a pain in the butt. I have to adjust the pressure from winter to summer because it's so sensitive. I'm thinking about getting VAG-COM and just setting it to 20 pounds, that would still catch a low tire before it became a major issue.
I think I'm going to wrap my Jeep in tinfoil, that way they won't be able to hack it, or read my mind when I'm driving...

:-)

[Avernar]

Originally Posted by 5-90

Which research paper? I would probably like to see it myself, particularly if it gives a "nuts and bolts" approach (I don't like not knowing how something works when I have to deal with it.)

THE research paper. The one that all these articles are reporting on. Here's the PDF: Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study

Please note that the paper uses the acronym ECU to mean Electronic Control Unit and not Engine Control Unit. That's where all the confusion is coming from. When the say they crashed an ECU they mean the wireless module, not the engine controller.

Originally Posted by 5-90

Read your reply - and you do raise some good points. However, I think my ultimate point still stands - "Build a car any idiot can drive, and every idiot will have one." 'Drivers' have been becoming less competent over the last twenty to thirty years, and adding all of these creature features under the guise of "safety devices" doesn't help. Technology should never replace skill or training - and if you can't be trained up to recognise a potentially unsafe driving condition as it occurs (if not before you get in the car,) then you honestly don't belong in the left seat.

I totally agree. In North America they'll let pretty much let anyone drive a vehicle. Pretty soon you'll find drivers licenses in cereal boxes. That's why I like the idea of mandatory TPMS. If a little light in the console gets the idiots to go to their dealers to get their tires properly inflated, so much the better.

I have no problem with those that regularly check their tire pressure manually from disabling the system. I just hope the people with the "TPMS sucks, I'm getting rid of it" attitude actually do regular checks and are not just disabling the system for some Luddite anti-technology reasons.

As for me, I'm leaving them enabled. They don't bother me and actually helped me find a screw in my tire before I noticed anything wrong.

[paul84043]

Yeah, you have many valid points. Somehow we've managed to make it all these years without TPMS, but it is a very valid question to ask how many millions of gallons of fuel have been wasted, and how many accidents could have been avoided with the monitoring technology.
It's good to be able to have these discussions, for me it actually helps me think through an issue....

Oh, and I apologize for basically hijacking this thread...it was not my intention!!

[Avernar]

Originally Posted by paul84043

I wish I could find the exact article I was reading yesterday.

No you don't. Never take what a news story or blog says as fact. They'll always be errors (intentional or not) and many exaggerate things to drive up traffic to their site. Always go to the original source.

Take a look at the PDF link I posted. That's the original research paper.

Originally Posted by paul84043

I know that there are always shades of grey, and manufacturers are all going to to their own thing to their own level of satisfaction. Unfortunately, all of them are corporations and will spend as little money as humanly possible on any given project to the point the the potential liability balances out.

Unfortunately that's true. It's only when you get into the high end supercars where the manufactures actually take pride in their work and want to give you a perfect car.

Originally Posted by paul84043

If you get in the position that you're asking yourself "should I keep these sensors, and move them to my other tires", you might just want to leave them out....
If they can get all the way in to the point that they can throw a message up on your cars display, who knows what else they can do, and do you really want to find out?

As long as you have all the facts. Ripping out a safety feature because of some second (or third) hand information on a web site is going overboard.

All they can do is fake the tire pressure reading and managed to crash one wireless control module. They didn't repeat the test after replacing the module so we don't know if it was just a defective module or a design flaw.

[Avernar]

Originally Posted by paul84043

I checked on Snopes and can't find anything on the whole thing being a hoax, they're usually pretty good about those kind of things, surprised that there was nothing at all.

The whole thing is not a hoax, just some of the second hand details. I'm glad the reasearchers looked into this. Maybe it will put some pressure on the manufactures to address some of the issues.

Originally Posted by paul84043

The article that I read yesterday was brand new and did reference most of the previous research.

If you can find the article then I'd like to see it. But if it doesn't link to more information from the researchers I'll take it with a grain of salt.

Originally Posted by paul84043

Personally....in my Jetta, the TPMS is a pain in the butt. I have to adjust the pressure from winter to summer because it's so sensitive.

The original paper said that the sensors also send the temperature and that the computer can compensate for it. It looks like in the Jetta the manufacturer didn't bother.