Castles built on sand

摘要

Karsten Nohl's assessment of dozens of car makes and models found weaknesses in the way immobilisers are integrated with the rest of the car's electronics. The immobiliser unit should be connected securely to the vehicle's electronic engine control unit, using the car's internal data network. But these networks often use weaker encryption than the immobiliser itself, making them easier to crack. What's more, one manufacturer was even found to use the vehicle ID number as the supposedly secret key for this internal network.