[msdss]

I just got sent this e-mail from a friend of mine who was trying to get his brand new A90 Supra tuned. Take what you will from it... But be glad that you only need a bench unlock for your M2C, because you might need a fucking custom ECU in the future...

UPDATE: 8/20 build confirmed by Carbahn to have new ECU.

[Thescout13]

Had a feeling this was coming eventually. Bosch already does stuff like this in their heavy trucking division and their autonomous vehicle partnerships. Only a matter of time before this would trickle down to average street vehicles.

[chris719]

It's not only a Bosch thing. Automotive is slow to change and doesn't use the newest MCUs, which is why this hasn't happened already. In other embedded devices, things like ARM TrustZone and greater security awareness are making this sort of thing difficult, if not impossible.

It may get to the point that no one involved in tuning will have the skill to bypass these levels of protection. If they did, it is almost certainly worth more to someone as a zero-day exploit since it will probably target IP from a vendor like Renesas, NXP, Infineon, or even ARM.

[Kleinacus]

Between the m3/m4 reveal and this news, I'm pretty damn excited with my stage 1 m2c.

[AUSf22]

It was inevitable, in conjunction with the updated ISTA bmw scan tool being able to detect alterations to the ecu and auto flagging the car as being tuned.

It's fairly clear BMW don't want consumers to touch their ECUs.

My guess is there is too many cases where customers demand BMW fix their car during warranty period despite having heavily modified the engine or engine software.

[nioh_lbbm2]

It's a control thing industry wide amongst al vehicle makes and sectors including construction and farming. They do not want the possibility of user serviceability. See John Deere for example. Can't even work on your own tractor

[NathObeaN]

Wait... the information states newly manufactured M4s as of July also have this issue... does this mean M2C...? My M2C was manufactured in July... please don't tell me they've screwed my tuning chances...

[NISFAN]

Originally Posted by nioh_lbbm2

It's a control thing industry wide amongst al vehicle makes and sectors including construction and farming. They do not want the possibility of user serviceability. See John Deere for example. Can't even work on your own tractor

I doubt that. It's illegal to force single source in Europe. Anti competition legislation is a thing. OE manufacturer's lost a big case about sharing WIS and technical specifications needed to service their products.

Probably more to do with protecting ever stricter emission legislation. What's the point of tightening down on emissions when users can disable all that with a 5 minute flash tune. I guess manufacturers need to be seen to be combatting that. Along with a number of reasons why you don't want people poking around your coding.

[cpxchewy]

Originally Posted by NathObeaN

Wait... the information states newly manufactured M4s as of July also have this issue... does this mean M2C...? My M2C was manufactured in July... please don't tell me they've screwed my tuning chances...

That might be the case...

MEVD17.2 has been used in all N20, N55, and S55 engines and depending on the stock left it seems like Bosch just sent a newer batch to BMW. If it was pre-pandemic I would have said it was for sure but with the global supply chain being all messed up they might have used an ECU from an earlier production date.

I would assume the worst tbh.

[chris719]

Originally Posted by NISFAN

I doubt that. It's illegal to force single source in Europe. Anti competition legislation is a thing. OE manufacturer's lost a big case about sharing WIS and technical specifications needed to service their products.

Probably more to do with protecting ever stricter emission legislation. What's the point of tightening down on emissions when users can disable all that with a 5 minute flash tune. I guess manufacturers need to be seen to be combatting that. Along with a number of reasons why you don't want people poking around your coding.

It's also part of the focus on (cyber)security and transition to connecting the whole vehicle. The MCU/CPU vendors are all taking it seriously and giving out validated libraries and example code to their customers. It was only a matter of time.

It will end up as a cat-and-mouse game, but there is less financial incentive here than for things like iPhone exploits, so it will be slower going if they do it well.

[ChrisK]

I'm sure the S58 ECU will be locked down tight in the new m3/M4

[infinitekidM2C]

wowzers. Big news in the auto industry.

[nothingman]

I imagine this also affects the new M2CS

[Davil]

Originally Posted by nothingman

I imagine this also affects the new M2CS

Maybe not? I have no interest in tuning the cs (nor the c) but I did see this monster.

https://www.google.com.au/amp/s/www....bmw-m2-cs/amp/

[NathObeaN]

Originally Posted by cpxchewy

That might be the case...

MEVD17.2 has been used in all N20, N55, and S55 engines and depending on the stock left it seems like Bosch just sent a newer batch to BMW. If it was pre-pandemic I would have said it was for sure but with the global supply chain being all messed up they might have used an ECU from an earlier production date.

I would assume the worst tbh.

Hmmm... I agree, but as just stated, the M2 CS is in the wild and has been tuned no problem... so surely not? Maybe the Leipzig wasn't supplied the newer versions yet. If true... holy crap am I glad I got my M2C. OBD blocking is one thing, this is another.

[pz619]

It’s kind of circular. When the f platforms first came out no one was able to crack the ECU. It took about 3-4 years if I remember. That’s why there were so many piggybacks in the market as tuning solutions. I suspect this will be the same. We’ll see piggybacks come back, then someone will figure out the security features on the ECU, flash tunes will be back, then the manufacturer will find a new way to lock everyone out.

[Thescout13]

Originally Posted by pz619

It's kind of circular. When the f platforms first came out no one was able to crack the ECU. It took about 3-4 years if I remember. That's why there were so many piggybacks in the market as tuning solutions. I suspect this will be the same. We'll see piggybacks come back, then someone will figure out the security features on the ECU, flash tunes will be back, then the manufacturer will find a new way to lock everyone out.

While I like your optimism, the supposed change by Bosch is much much much more complex than past lock outs. If what ECUTEK is saying is true, it will take someone to understand this at the block level and figure out a workaround to tune it. And those engineers don't work for tuners they work for the chipmakers and design houses.

[chris719]

Originally Posted by Thescout13

While I like your optimism, the supposed change by Bosch is much much much more complex than past lock outs. If what ECUTEK is saying is true, it will take someone to understand this at the block level and figure out a workaround to tune it. And those engineers don't work for tuners they work for the chipmakers and design houses.

Yep, here is a good idea of what they are doing. Different family of processor but the techniques are all similar.

https://www.beningo.com/wp-content/u...rsST_RevA0.pdf

Once the level of skill of the implementation reaches a certain point, the attacks will most likely be side-channel or socially engineered. During debug and development, sometimes non-secure versions of the bootloader or unsigned firmware will be used. It might be that the tuners will need some tools or keys leaked from certain employees.

[Poochie]

Originally Posted by pz619

It's kind of circular. When the f platforms first came out no one was able to crack the ECU. It took about 3-4 years if I remember. That's why there were so many piggybacks in the market as tuning solutions. I suspect this will be the same. We'll see piggybacks come back, then someone will figure out the security features on the ECU, flash tunes will be back, then the manufacturer will find a new way to lock everyone out.

I suspect this time around will prove to be a lot more difficult.

With the advent of 4G LTE high-speed internet connection in all new vehicles, the system would now wireless, in real time, be required to "whitelist" a software update or modifications, before its allowed access to make a any data changes.

They are going to take a page from Tesla's playbook, where the vehicle electronically and actively communicates with headquarters.

I saw a video recently where a Tesla did a remote "audit" of these software features, updating the car's software to the latest version and removing the two $8,000 options. To recap, these features were included in the Model S at purchase, but when the software was updated—poof!—they were gone.

BMW is taking notes and sees this as a gateway to future innovations and a secure way of protecting their proprietary data.

[chris719]

Originally Posted by Poochie

I suspect this time around will prove to be a lot more difficult.

With the advent of 4G LTE high-speed internet connection in all new vehicles, the system would now wireless, in real time, be required to "whitelist" a software update or modifications, before its allowed access to make a any data changes.

They are going to take a page from Tesla's playbook, where the vehicle electronically and actively communicates with headquarters.

I saw a video recently where a Tesla did a remote "audit" of these software features, updating the car's software to the latest version and removing the two $8,000 options. To recap, these features were included in the Model S at purchase, but when the software was updated—poof!—they were gone.

BMW is taking notes and sees this as a gateway to future innovations and a secure way of protecting their proprietary data.

Yeah, there can be ways to defeat this too, but it just gets harder and harder to the point where it's not worth the effort.

[ASAP]

I used to care but really don't anymore... my 135i was FBO on e85 and trapped 122 mph but it didn't exactly make it a good all around car. These cars come from the factory and come with optimal parameters as is... my slower M2 makes me happier, in the end we are all just waiting for the electric revolution. Cars have gotten super fast and the speed has a very diminishing point of return at this point.

[akkando]

Originally Posted by Thescout13

While I like your optimism, the supposed change by Bosch is much much much more complex than past lock outs. If what ECUTEK is saying is true, it will take someone to understand this at the block level and figure out a workaround to tune it. And those engineers don't work for tuners they work for the chipmakers and design houses.

There's lots of great hackers out there that like a good puzzle, but few if any are interested in making cars go faster.