[Brandt51]

Originally Posted by msdss

Man, this is not at all an accurate statement. Millions are spent developing the hardware and software that goes into these. There are companies that exist purely to break these encryptions. If they are unsuccessful, their business will fail. It is these same companies that are telling people it is improbable.

Closed loop systems like this are incredibly hard to break, even before this new system. Take the current M2C as an example. This new one takes the encryptions to a new level.

Take another, simpler system for example, like a password for a website... if you used a 12+ character alpha numeric it would take a computer 10+ years to crack it. Now what if that password was 10,000 characters, with no hardwire connection?

As far as I understand this, the encryption for this is on the cpu itself. there is no bench unlocking this. you would have to physically replace the entire ECU with an unencrypted one... which is basically what this comes down to.

I like that example. After dealing with tuning in the diesel world, I am not of fan of aftermarket stuff. The OEMs barely got it down, I haven't been fortunate enough to enjoy anything trouble free. Aftermarket just doesn't have the resources to reliably improve stock stuff with OEM consistency.

Motorcycle stuff seems legit though, but thats the trickle down from racing. Do we have racing stuff available to us?

[Brandt51]

Originally Posted by NathObeaN

What makes you say that? I have no doubt the programmers working for protuningfreaks (for example) make an awful lot of money as a business. I also think you're doing them a disservice by saying an ECU is 'just a computer'. It's not like coding for an ECU is the same as writing an app for the iPhone.

It's a fancy computer?

[cpxchewy]

Originally Posted by NathObeaN

What makes you say that? I have no doubt the programmers working for protuningfreaks (for example) make an awful lot of money as a business. I also think you're doing them a disservice by saying an ECU is 'just a computer'. It's not like coding for an ECU is the same as writing an app for the iPhone.

They're not wrong though. An ECU is just a computer and they're pretty much security engineers. Sure it's not the same as the people who write apps for iOS but It's the same as the people who try to jailbreak iPhones. It's the same as the people who found the heart bleed security bug. It's the same as the people who attack CPUs like meltdown or spectre.

The exact process is the same. You find a vector of entrance and you're able to execute a modified platform with unsigned code. The issue is that because the process is almost brute force and trial and error or scanning the system, the earlier in the boot cycle there is security signing in the system, the more it means that higher level exploits aren't going to hold. In addition, the lower the level, the simpler the code is and the less chance for error or injection.

There was once a time when the iPod touch had a exploit that allowed jailbreak but every time it restarted the boot loader would lock the iPod out. So even though the iPod was actually jailbroken it doesn't keep. This will be the same for new ECUs too. They might be able to find a different vector to inject new maps, but it won't be permanent and can cause the boot to fail.

[bavinger]

I currently have a FBO 2016 M235i with BM3 Stage 2 tune. I was just about to order a 2021 M2C until I read this...

This would be a deal-breaker for me if I couldn't tune the new M2 with Bootmod3!

Are we sure that a 2021 M2C would not be tunable??

I'M FREAKING OUT MAN!!!

- Brian

[doughboy]

Makes me glad I have my 2018 M2C still with OBD tuning open.

It's never been to BMW, never will do either....

It's a keeper

[NathObeaN]

Originally Posted by bavinger

I currently have a FBO 2016 M235i with BM3 Stage 2 tune. I was just about to order a 2021 M2C until I read this...

This would be a deal-breaker for me if I couldn't tune the new M2 with Bootmod3!

Are we sure that a 2021 M2C would not be tunable??

I'M FREAKING OUT MAN!!!

- Brian

PTF (BM3 makers) have confirmed it is an issue affecting N55 and S55 cars so far. There hasn't yet been a confirmed case (that I am aware of) of an M2C shipping with one of these newer ECUs though. I am taking mine in next month with a garage to check.

[NathObeaN]

Originally Posted by doughboy

Makes me glad I have my 2018 M2C still with OBD tuning open.

It's never been to BMW, never will do either....

It's a keeper

Required a bench unlock though? Or did the early 2018 models have the OBD open completely still? Lucky if so!

[RJD851]

I have a week 41 build M2C arriving in a few weeks. Since I live in the Bay Area, I was planning on taking it to Carbahn for a possible Stage 1 tune so I'm curious to see what happens.

[MovingChicane]

Originally Posted by RJD851

I have a week 41 build M2C arriving in a few weeks. Since I live in the Bay Area, I was planning on taking it to Carbahn for a possible Stage 1 tune so I'm curious to see what happens.

Please report back.

I have a mid-December delivery date and was planning the same.

[mikewills]

I am also interested in this.

[Robin_NL]

Originally Posted by NathObeaN

Required a bench unlock though? Or did the early 2018 models have the OBD open completely still? Lucky if so!

Yep. No bench unlock whatsoever.

Mine is from 10-2018 and I MHD flashed my car last august. But when I made the appointment for my first oil service(2 years) last september my dealer stated there is some new software available.
I immediately replied:Please do not touch my software!
And so they did not. I'm a loyal customer and they know me for >25 years.

I 'm happily sliding around with >500HP

Cheers
Robin

[David1]

Originally Posted by RJD851

I have a week 41 build M2C arriving in a few weeks. Since I live in the Bay Area, I was planning on taking it to Carbahn for a possible Stage 1 tune so I'm curious to see what happens.

Your locked. My July 2020 build comp is locked as are the 2021 Supras.

[FaRKle!]

Originally Posted by David1

Your locked. My July 2020 build comp is locked as are the 2021 Supras.

What HWEL version does your DME have?

My friend's 2019 and my 2021 both have 000019DE-011.029.002. He was able to tune his, I haven't tried mine yet. He has the older .001 bootloader, but tuners said .002 is also unlockable.

[GregInNewMexico]

Originally Posted by David1

Your locked. My July 2020 build comp is locked as are the 2021 Supras.

Mine was built in July 2020 as well, so I am guessing mine is locked too. I am not in a hurry to tune as my car is very new and I am still getting used to the power, so I don't mind waiting until a work around is found. Personally speaking, it would be nice to have CS power and some more rubber on the rear. All that being said, if we are going to be waiting for a crack, just remember: All software has bugs. If someone is committed to breaking into the system, they will find a way.

[RJD851]

Originally Posted by David1

Your locked. My July 2020 build comp is locked as are the 2021 Supras.

I'm thinking the same thing, but since I'm local to their shop it's easy for me to drive the car there and at least get their input.

[NathObeaN]

Originally Posted by David1

Your locked. My July 2020 build comp is locked as are the 2021 Supras.

Have you had it confirmed to be locked? Many are jumping to the assumption that if their CAR was built after June 2020 then they have a locked DME. Not true. It's the production date of the DME that counts, not the car.

[Gizmo 335i]

Originally Posted by RJD851

I'm thinking the same thing, but since I'm local to their shop it's easy for me to drive the car there and at least get their input.

Please let us know as soon as you can. I have an 8/20 build and was going to get a tune after break-in.

[infinitekidM2C]

TAG, some of these folks (armchair IT guys) think that "eventually" there will be a solution. Please explain if that's actually likely.

[RJD851]

Originally Posted by Gizmo 335i

Please let us know as soon as you can. I have an 8/20 build and was going to get a tune after break-in.

The ship with my M2C lands at PH on 11/14, hopefully I can take delivery the following week.

I'll try to make it to Carbahn the week of 11/23 or 11/30 and have them take a look at my car/DME. I'll report back here afterwards.

[Superdaws]

I've checked my M2C that was built June 2020. Pretty confident I don't have the new ECU, but I do obviously have the boot loader that needs to be patched to enable OBD tune.

Build date 8 June 2020, delivered Oct (Aus waits longer). HWEL version 19DE v11_019_002.

[doughboy]

Originally Posted by NathObeaN

Required a bench unlock though? Or did the early 2018 models have the OBD open completely still? Lucky if so!

Still open-OBD till about Spring 2019 I think?

Mines still dated July 18 DME version. Never been updated.

[GregInNewMexico]

Originally Posted by infinitekidM2C

TAG, some of these folks (armchair IT guys) think that "eventually" there will be a solution. Please explain if that's actually likely.

I AM an IT guy with a long and very successful career of 25 years. Solutions architect and programmer, I hold multiple security certifications including SANS, a globally recognized computer security organization(look it up if you care) and am a member of the their advisory board.

All software has bugs. Including the firmware (software) that runs your bmw "Hackers" can potentially use these pre-existing bugs on your various devices, to bypass the security and infiltrate them. Have a computer or phone? Guess why you get updates on your supposedly secure devices? I guarantee that the BMW updates that you get also contain security fixes To make things even more fun, a lot of time the very bug fixes that are supposed to harden a device, create new security vulnerabilities! Hooray!

Vulnerabilities = potential for infiltration or to do other things, like crack an ECU.
Here is a good example of firmware vulnerabilities:

https://www.csoonline.com/article/34...e-threats.html

There are practically unlimited articles about firmware and software insecurity and lots of examples of companies who were caught with their pants down after they have been hacked, sometimes to the tune of millions or hundreds of millions in damages. If large corporations such as Intel, Apple, Microsoft, IBM, etc.. have errors in their firmware and software, you betcha BMW does too.

All it takes is some effort and willingness on someone's part who has the skills to break into a given system. We have seen this in the industry again and again and again. Security is hard. Very hard.

So this is where I am going with this: When you wave dollars in front of a talented "hacker" to crack software/firmware, they become more and more willing to do the deed as the dollar figure increases. How much does a flash cost, how many locked ECUs are out there, and how many folks are willing to pay for a flash? That is your potential right there.

So if it pays enough to hire such a person, and there are many such talented folks, to crack the ECU to get a bunch of BMW owners to hand over money for a tune, you bet someone will try. Most likely a pre-existing tuning company who already has access to talent and can afford the dev time up front, or who is willing to trade in parts to an expert who also loves cars.


That is why I feel it is highly likely that this current scheme from BMW will fail.


So I am not trying to bust your chops, just sharing what I know. Some of what we know as computer security experts is literally frightening, especially in banking, finance, and higher. Nations fail at security after pouring money and manpower into it, so when someone makes the claim that something is uncrackable, we literally roll our eyes and sometimes even laugh.