Hi all,

Is anyone aware of any immobilisers (such as Ghost 2) that would work with the EQS? I'm having to fit an S5 category tracker for insurance purposes and whilst doing that I thought it may be a good idea to have an immobiliser fitted as well. Too many thefts going on and I have waited almost a year for this car...

 

The good news is that Nobody is going to steal an EQS. THe other good news is that MB engineering appears to have built several factory installed immobilizers such as faulty 12 v sensors, front drive motor issues and myriad other such things.

 

It's a shame then that I have a 450+ which is RWD. Sounds like I'm missing at least 1 immobiliser. :P

I don't share your optimism (or pessimism) regarding no one stealing an EQS, they'll do it just because they can.

I'm still exploring this with a few third-party manufacturers, I'll post an update once I know more.

 

Will be following with interest. Not that cars being stolen would be an issue at my place but I cannot think of a third party immobilizer that would actually add safety. Cutting electric motor power feed or such would be too visible (and very dangerous, confuses the car with faults). A mechanical steering wheel lock would be good and perhaps the best option against computer nerd thiefs?

 

A number of options are specified as compatible with EVs. I'm keen to find out how they work as I had similar thoughts as you. The Ghost 2 for instance is marked as being compatible with the EQC, however EQS is not listed as supported. Waiting for a response from the manufacturer. They say that they immobilise using different methods by interfacing with the vehicles electronic control unit and apparently the device is thumbnail sized and very hard to trace. How this works in practice I don't know, but allegedly it's very effective.

I don't believe any solution in the market is going to make any car theft-proof. I'm just trying to make a would be adversary's job hard. In my opinion, it's just about not making it easy for the adversary and increasing the risk and burden on them.

Coming from a computer software and security background, I'm appalled at the state of vehicle security. The only reason we have a problem at this scale today is because all car manufacturers seem to be collectively cr@p at implementing reasonable digital / software security.

By the way, I do actually have both a steering wheel lock and a locking wheel clamp which are compatible with the EQS. I do use them occasionally when I feel it would be prudent to do so. They add about 5 minutes and lot's of noise to time of theft. Will they prevent determined people? No. But still a bit a of a deterrent. They are enough of a hassle to me that I don't use them day to day.

There's a context to everything, I live in an area which has over the past couple of years become a target for high value car, motorbike and even bicycle theft, inc. breaking into garages and such. Normally, I would say this is what insurance is for, but as I said, I just waited a year for this car...

 

I have no doubt about compatible devices but what level of additional security do they provide? Being small and well hidden is good but not really a big deal for pro thieves. I doubt original control units are changed (by SW) which means no additional security after the add on device has been removed.

Can you point issues with Mercedes security on new cars, other than "tunnelling" traffic between the car and the KG key (which is less of an issue with current keys).

 

I can't and I would really be pleased if no one can! The following is a generalisation not specific to Mercedes, my understanding is that the various control units in current cars don't operate on a zero-trust basis, this means that if you get access to the cars network via a diagnostics connector or even through a port on a headlamp, etc, you can get the engine to start without any keys or key relay attack. Now I don't know as a consumer if Mercedes cars or EQS in particular are susceptible to this kind of attack or not. I'm concerned enough though as my insurer would not insure this car for theft unless I attached a Thatcham S5 tracker (despite Mercedes' own theft protection service).

I'm just trying to introduce any sensible deterrent as possible and I do fully appreciate that nothing will stop a truly determined pro-setup.

I do intend to speak to manufacturers of Ghost (if they respond), because again like you, I have skepticism on how such an immobiliser would thwart theft if the adversary has gained access to the car's network and zero-trust has not been implemented. I would expect that the immobiliser will simply be bypassed like the cars own immobiliser.

 

I'm worried applying the principal of least privilege will infringe on my right to repair. My car isn't mission critical. I can always take an Uber or the bus. I'd get another insurance company before I did anything that might accidentally limit my access to my own vehicle just to create the illusion of security. My freedom is more important than their security.

 

Even an old Mercedes car cannot be started with the diagnosis tool without keys. A set of control units perform a complex authentication sequence for keys before the engine control unit activates (on an EV some other drive control unit). The security approach is public which is the case for all secure systems. Security is not based on the "algorithm" being unknown but on one way security functions instead.

Still true that security has been cracked to some extent on older cars like valid keys made on the basis of data read from EIS (with special tools, not the diagnosis tool). Even there physical access to chips needed.

 

Yeah, and on many (not too old) cars you can't really replace components like an ETM yourself. The dealer has to program it and they've moved on to new software for new models that doesn't do that any more. So your ONLY option is to get it rebuilt just to get around stoopid security that shouldn't have been there in the first place.

Security professionals frequently focus on vulnerabilities and countermeasures but forget to account for the importance of the target. They waste enormous amounts of money applying blanket "best practices" to systems that are of little value. That also means they're not spending enough time and money on the systems/components that really matter.

 

If anybody knows of a place where EQS are stolen, please let me know. I will park mine there.

 

Hi, I wasn't saying that the engine can be started with a diagnosis tool, I'm actually talking about a car being hacked and the engine started by gaining access to the CAN bus via the diagnostic port or elsewhere. Then adversaries are able to start the car without keys or a key relay attack. Now I'm not saying the EQS is susceptible to this kind of attack, because I don't know their CAN security architecture. If designers have not applied zero-trust principles, then the car is potentially open to all kinds of mischief. It is an interesting topic, you can read about the CAN-injection attack here if interested:

CAN Injection: keyless car theft | Dr. Ken Tindell

An update, Autowatch have contacted me regarding the Ghost immobiliser and they have offered to send an engineer to test compatibility with the EQS. They believe the immobiliser will be compatible and, if not, that they will be able to assess and determine the modifications required to get it working. I might take up their offer. Question remains, as you rightly pointed out, that this is not just about compatibility. Is such a third party product actually adding / providing additional security? I've started building an understanding of how the product works; the following is conjecture: it seems like they are using the same vulnerabilities that are exploited by CAN-injection attacks to tamper and thwart any legitimate or illegitimate messages sent to various control units, effectively immobilising the car. Theory is once the legitimate end user disarms the immobiliser, then the legitimate messages get through and the car operates normally. Is this going to protect a car against everything or a truly determined thief? I doubt so. It's just another deterrent. In my opinion, if it genuinely adds another 10-15 minutes to the time it takes to steal a car, this is a good outcome. So now the hard part is going to be to determine if the benefits are genuine or vaporware. I'm only hearing good things about these immobilisers and they are always written by installers. Haha, so that's very helpful!

Crito, talking about freedom, the least of our worries is a third-party immobiliser. Isn't the EQS recording and calling home with telemetry on how we drive, where we drive, what we do, etc, and that's just me staying on topic and not talking about our mobile phones. I think I left my freedom at the dealer. But I do want to point out that my insurance company hasn't asked me to fit an immobiliser, but they have asked for an insurance approved tracker. I'm OK with that as the car already has an inbuilt tracker. It's just annoying that I end up with two trackers.

 

Be VERY careful adding any after-market equipment to any power system in the EQS. I installed a dashcam into my first 450+ and it killed the 12V battery, which, in turn, caused a fault in one of the other power systems that took MB almost 2 months to debug.

 

Thank you, SirNH, this is really good to know. I must say I was contemplating adding a dashcam, as in the past, a rear dashcam has proved really useful when someone decided to rear-end my car at traffic lights! This raises questions re the tracker which I MUST get installed as I expect that will be hardwired into the 12V battery. How irritating can this get?

 

Does it need to be active while the car is powered off? If not, then use the 12V accessory outlet under the dashboard on the passenger side? I wanted my dashcam to be able to record even while the car was off, so this required hardwiring into other undocumented lines on the passenger side.

 

Thanks again, I will need to see with the tracker as that requires the "pros" to install and provide compliance certification. That will definitely be hardwired somewhere, but I don't know what they do. Re the dashcams, that's very useful advice. While, like you, I would have preferred some continuous or motion triggered recording while parked, much rather would I have a car that still works. I'll explore the accessory outlet and cable rooting options that presents.

 

Do you ever take a break?

 

He’s just a troll and doesn’t own a EQS.

 

You dont need either. The car has an imobilizer and a tracker
The key is an immobilizer system. The mercedes me app will track your car. If your car is stolen you simply call mercedes services and report it they will contact the police and tell them where the car is at any time..
SIMPLE.
Its not a 2010 KIA🙄

 

Not sure if these work with professional thieves though. They are only good for opportunistic car thefts and joy riders.
Professional thieves would disable manufacturers' security features like tracker. And they probably would be able to disable anything else you put in as well.

 

The tracker is part of the MBUX system to disable it would disable the entire vehicle. Same thing with the immobilizer. The onky way to cheat the system is to clone the key and that works in a rolling system. In effect the only way to steal the car is on a flat bed and even then the tracker would find it.

 

I'm not familiar with the correct terms but reading the referred article I interpret the "zero trust" approach has been used by Mercedes for ages. This does not apply to every control unit but all theft relevant control units.

The "start the engine" message may be unencrypted but the engine control unit would not accept it before the full authentication process is complete. Injecting CAN messages to overload signalling would not help, the challenge-response one way encrypted message exchange needs to go through before the start enable state is reached. Sounds like a very simple bug if other cars just accept the start command "out of sequence".

Thieves are clever and have invented ways to read critical information from the relevant control units like EIS and keys. This needs physical access to the chips on the control units, not only access via CAN bus. My understanding is that access to the relevant information by reading certain content from chips is more protected now, meaning even access to the chips does not help.