EEVblog #1181 - Car ECO OBD2 Fuel Saver SCAM

[nctnico]

BTW: I made my previous (turbo diesel) car run 5% more efficient using a 1.5V zener diode. Bonus points to the first one who figures out where I put it!

Disable EGR and use the zener to keep the ECU from figuring it out?

No. Offset the turbo pressure sensor so the ECU allowed to inject more fuel at low RPM giving is more power in low RPM (also known as eco-tuning). With the fix it allowed to drive the car at 70km/h in 5th gear instead of 4th gear.

[SilverSolder]

What if the device actually works...  by making the driver being more careful on the gas pedal?   Recent research has shown that placebos work...   even if the patient knows he is getting a placebo!

https://www.npr.org/sections/health-shots/2016/10/27/499475288/is-it-still-a-placebo-when-it-works-and-you-know-its-a-placebo

[janoc]

@EEVblog
Even if that thingy wanted to program the ECU the car needs to be a very old one because most new ones wont talk to devices that arent running the official SW from the car manufacturer(aside from a few basic things OFC)....

That doesn't mean you can't make a dongle that will talk to a particular make/model of a car and actually do something (whether useful or not). For some cars it is easier than others. Most cars don't use any cryptography or strong security anywhere, only security by obscurity (aka protocols are secret and only the dealerships/authorized mechanics have access to the software). Which inevitably means it will leak at some point and get reverse engineered/cracked.

And re basic things - well, it depends on the car but for some you can do some truly scary stuff through the OBDII port. E.g. this Jeep model from 2016 or so (which is pretty recent) where the attackers were able to mess with brakes - while the car was moving. Or messing with the steering. The security in car industry is pretty much nonexistent, only designed to keep unauthorized repairmen out, not to actually stop any dedicated attackers.

https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/

E.g. this exists and is apparently popular:
https://www.mybluefin.co.uk/

Of course, a tiny dongle claiming to be able to reprogram (almost) any car and model is most likely BS.

[Mr. Scram]

What if the device actually works...  by making the driver being more careful on the gas pedal?   Recent research has shown that placebos work...   even if the patient knows he is getting a placebo!

https://www.npr.org/sections/health-shots/2016/10/27/499475288/is-it-still-a-placebo-when-it-works-and-you-know-its-a-placebo

What if the device works by making the driver think he can be more careless with the right foot, increasing consumption? Maybe even while making him thing it's actually better.

[Rerouter]

Depends on the model of car, but most vehicles expose all of there memories (even runtime RAM) via a special per manufacturer mode, Now I have 0 doubt the devices out there cannot possibly do what they are claiming, though they can kinda do something, even if its the wrong thing to do, Reset the ECU memory every time it starts up the the stored 100Km economy average is above what feels "normal" In my own experience this tends to make the fuel range and average economy values on most instrument clusters also reset, meaning for the first few minutes into a trip, it can seem like you have much more range, or more economy, because that average has been discarded.

I have been slowly digging into the manufacturer programming modes for other things, and there is a lot of copy-paste stuff going around where different car manufacturers use the same brand ECU's etc, And some much more scary things that could be used to make things seem more economic, e.g. most european instrument clusters, even if they use an analog fuel signal, has a test mode where you can set it to read a certain value via can. same for the range and economy displays, without the vehicle getting upset you can lie to the driver, You can alter the scaling of the RPM gauge, to make it seem like your running at lower RPM, and stuff I really would never want to see one of these device touch, shift the gearbox switching points dynamically.

As for security, some have recently started using magic tokens to enter these programming modes, this to me seemed to be spurred by the Airbag Controllers before anything else, but I feel that was in response to people resetting them after an accident to sell write off cars. however per year model these tokens seem fixed, Its only really the indentured repair manufactures, e.g. certain tractor companies that are doing things like signing firmware updates and making it a right pain to enter the programming modes, (VS scattered CRC for blocks in most vehicles)

[Lockon Stratos]

@EEVblog
Even if that thingy wanted to program the ECU the car needs to be a very old one because most new ones wont talk to devices that arent running the official SW from the car manufacturer(aside from a few basic things OFC)....

That doesn't mean you can't make a dongle that will talk to a particular make/model of a car and actually do something (whether useful or not). For some cars it is easier than others. Most cars don't use any cryptography or strong security anywhere, only security by obscurity (aka protocols are secret and only the dealerships/authorized mechanics have access to the software). Which inevitably means it will leak at some point and get reverse engineered/cracked.

And re basic things - well, it depends on the car but for some you can do some truly scary stuff through the OBDII port. E.g. this Jeep model from 2016 or so (which is pretty recent) where the attackers were able to mess with brakes - while the car was moving. Or messing with the steering. The security in car industry is pretty much nonexistent, only designed to keep unauthorized repairmen out, not to actually stop any dedicated attackers.

https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/

E.g. this exists and is apparently popular:
https://www.mybluefin.co.uk/

Of course, a tiny dongle claiming to be able to reprogram (almost) any car and model is most likely BS.

Well i only have experience with only one manufacturer but their system is pretty strict, you cant change anything that has electronics in it without an online connection to the main server god knows where. Its actually so strict that even in production a specialized tool is needed to get all the new parts to talk to each other...

[Rerouter]

I can guess the vehicle your talking about is 1 of 3 brands, My top guesses would be Volvo or Mercedes,

Of the manufacturer diagnostic tools I have seen, its generally only new commissioning of units that need the online part to pull the latest firmware, I've been stuck on site for about 3 hours while I slowly watched the progress bar increase for the download on an out of data firmware on 1 module of a truck, for the next truck I asked the tech to try switching off wifi after he had logged in to the tool, and he could change anything without the forced firmware update. (had 15 trucks to do fittings to over the course of a week, and no body has the time for 3 hours per vehicle of downloads due to the software not caching any of the downloads)

[Lockon Stratos]

None of those, this manufacturer do not have trucks.

/EDIT
And you cannot disconnect from the network if you want to install any new parts(hell, maybe by now it is mandatory to be connected to the network the whole time).

[janoc]

Well i only have experience with only one manufacturer but their system is pretty strict, you cant change anything that has electronics in it without an online connection to the main server god knows where. Its actually so strict that even in production a specialized tool is needed to get all the new parts to talk to each other...

BMW does this. And there are tons of published hacks and workarounds for it online, so that you can "code" and program the various bits and pieces to work with the car when you change them without going to the dealer (and paying top $$$ for them doing it). E.g. my boss was replacing one module that controls most of the lights in the car recently and reprogrammed it using a generic dongle and a copy of the manufacturer's sw downloaded online. So much for such "security".

[Lockon Stratos]

BMW does this. And there are tons of published hacks and workarounds for it online, so that you can "code" and program the various bits and pieces to work with the car when you change them without going to the dealer (and paying top $$$ for them doing it). E.g. my boss was replacing one module that controls most of the lights in the car recently and reprogrammed it using a generic dongle and a copy of the manufacturer's sw downloaded online. So much for such "security".

Thats a pretty big gamble right there, if he borks it then the dealer wont touch it and he will have a very expensive paper weight... AFAIK in case of the manufacturer i know even if you have the software from the web you still need the online connection to the main server to get the codes so the car will talk to the new part.

[langwadt]

Hypermilers know about OBD2 gadgets that really can boost MPG - the Scangauge being one of the earliest ones. Quite a bit more complex than a box with flashing LEDs, but not that much more complex.

afaikt Scangauge is just a monitor

Of which, what I would like to see is a gadget that uses GPS data and computer vision to learn the timing of the traffic lights and inform the driver to speed up or slow down in order to maximize the chances of getting to it on green. Not at all an easy task but it can save a lot of time as well as energy.

traffic lights are usually timed to do that at regular speeds already

[German_EE]

I like to watch car mechanics because I learn stuff, and in years of doing this I have only seen a mechanic use the OBD port once.

We had lost a key so we needed to a) delete the lost key from the ECU list and b) program a new key. The Ford mechanic had to use a Ford issued notebook plugged into the car and running the security software, and this would only work when also connected to the Ford servers over the Internet.

The cost of all this? Enough to ensure that I will NEVER lose a car key ever again.

Random dongles from China don't have a chance.

[janoc]

Thats a pretty big gamble right there, if he borks it then the dealer wont touch it and he will have a very expensive paper weight... AFAIK in case of the manufacturer i know even if you have the software from the web you still need the online connection to the main server to get the codes so the car will talk to the new part.

Yeah, but also keep in mind that replacing a broken module (which literally just bricks itself in software because of a power spike or whatever - it can be reset and made to work again) is maybe 30 minutes of work + cost of the module.

If you go to the dealer, they will charge you several hundreds of euro for literally plugging in a dongle into that OBDII port and clicking a few buttons. I am not saying it is a smart thing to do, especially for people who don't have much clue about electronics, but for the owners of the older, out of warranty cars, the financial motivation to tinker like this is strong.

[Mr. Scram]

The most painful part is that's it's essentially DRM to prevent lawful owners from repairing their cars, while doing little in the way of actual security. Cars are still full of security holes, with hackers remotely activating brakes and throttle by means of a laptop.

[amyk]

My car doesn't even have a computer, much less an OBD2 port

[SilverSolder]

Cars are still full of security holes

That's probably why they start and run reliably...

At work, the IT guys tell me 99.9% of the problems they deal with are to do with security.  [Not hackers trying to get in...  but security related software and systems causing problems for legitimate users]

[Rerouter]

Your confusing the type of security, this is about basic things like buffer overflows, and only really for the non physical access hacks, e.g. way too many canbus connected radios can be used to gain read / write access to canbus via bluetooth or wifi without authentication. So far i have not seen any ECU's that get upset from byte extension, etc, because the transceiver discards everything that isn't valid.

For physical access, how they currently set things up and have workshops able to access or edit things prevent them from ever really locking it down, Just like how a certain line of chips have a programming method documented, if you dig in deep enough you can also find the programming methods for ECU's, ABS modules, Instrument Clusters, Etc, all via Canbus or through a proxy connection for most parts these days, as that is generally how they commission them on the assembly line.

The hard part is finding the definition of what byte controls what function or switch, how a given modules memory is segmented, etc, this is why most documented hacks only touch on the easy stuff like broadcasting standard messages like throttle position request, brake application request, gear selection request, This is the easy picking, especially if you have physical access, as its just replay attacks with well documented specifications. some cars even have fun things like steering wheel angle messages for full fly by wire vehicles. but you could repeat this "hack" with a ELM327 and an hour of your time on just about any car post 2003

[SilverSolder]

The point is that adding security also adds extra layers of things that can go wrong and prevent the car you are trying to fix from working for the authorized owner/user.  That is the problem the IT guys spend their lives on -  encryption, configuring firewall rules, etc. etc.

I don't think it is a good idea (awful design, actually) that the radio can be used to hack into a car, but on the other hand if someone wants to mess with you and your car, they could let the air out of the tires or key the car, or partly cut the brake lines, or the steering linkages, or any number of bad things.  The only real security is for your car to be garaged and watched whenever you are not driving it...

[johnlsenchak]

Another  Big Clive  video  !

[thunderbolt87]

Guys,

I was just checking the CNN website and ... is that Dave's Aussie tan in the ad ... and his lab in the back?



This is hilarious! Or... not. Dave, please sue them! 

-Felix

[thinkfat]

Yep. Timecode 4:29

[EEVblog]

I was just checking the CNN website and ... is that Dave's Aussie tan in the ad ... and his lab in the back?
This is hilarious! Or... not. Dave, please sue them! 

Link?

[thunderbolt87]

Hey,

I'm not able to get that particular ad again because stuff is rotating. But it was on a regular article page like:

https://edition.cnn.com/2020/02/27/politics/chinese-laser-us-aircraft/index.html

At the very end, in the paid content section. I was just looking through that section cause it was striking
for me how much ads they have these days. Yellowpress quanitity...

I'll post some more complete proof if I see that again. I swear it was there.
(Maybe google/youtube tracked that I visited some automotive software related sites before  )

-Felix

[bluewave]

Love this (old) video! Was given one of these devices today. Looks exactly like Dave's one - same packaging and all.

Opened it expecting to find the same as the video...but NO!! Totally different circuit! Has a prominent and ancient  PIC16F69, complete with 4MHZ crystal.
I haven't explored the workings of the circuit or powered it up, but noticed two small problems:

NONE of the pins of the MCU are connected to anything (top or bottom) - it is just there for looks! No connections under the chip, vias, nothing. Probably a non-functional factory second I am guessing - or just an empty fake package.

The crystal pads connect to NOTHING else in the circuit.

 

[Artz]

Fuel economy is a big selling feature now. If there was something this simple that could make any meaningful impact on fuel economy why wouldn’t the manufacturer do that from factory. None of these fuel saving gizmos ever work.