Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Weak cryptography means that car engine immobiliser technology has become easy for crooks to circumvent.

Nothing weaker than 128-bit AES is considered sufficient protection for e-commerce transactions, but car manufacturers are still using proprietary 40-bit and 48-bit encryptions protocols that are vulnerable to brute force attacks. Worse still, one unnamed manufacturer used the Vehicle Identification Number (VIN) as the "secret" key for the immobiliser.

Nohl outlined preliminary findings from his research at the recent Embedded Security in Cars conference, in Bremen, Germany. His research covers the communications between card immobilisers and engine electronic systems in dozens of cars. For example, Nohl was able to crack the Hitag 2 car immobiliser algorithm used by Dutch firm NXP Semiconductors in around six hours

The research builds on work by other computer scientists and encryption experts dating back at least five years. In 2005 Ari Juels of RSA Labs and researchers at Johns Hopkins University in Baltimore, Maryland, circumvented the encryption system used by Texas Instruments.

Manufacturers of car immobiliser technology have defended the robustness of their technologies.

"To our knowledge the direct causal link between the failure to adopt AES systems and the rise in car theft cannot be drawn," Thomas Rudolph of NXP told New Scientist.

Texas Instruments claimed its proprietary cryptographic systems might be stronger than AES. Nonetheless both firms are in the process of phasing out their home-cooked crypto tech in favour of industry standard encryption systems based on 128-bit AES. ®

Agentless Backup is Not a Myth