There's a secondary issue - car manufacturers are training people to stick untrusted USB sticks into their cars. If the car isn't fully secured, it is theoretically possible that a rogue internal component would be able to endanger the car and its passengers. It turns out that entertainment systems often talk to the rest of the car via a CAN bus. My friend Marc Rogers successfully hacked the Tesla Model S in part using the car's infotainment system. OK, what's the worst that could happen with a phony software update for a glorified car radio? One would hope that the firmware is cryptographically signed so that it cannot be maliciously modified - but given BMW's fairly poor record on securing their cars ( original in German), it's not guaranteed. Why Is This A Bad Thing™?īecause the software download goes via http rather than http s, it is theoretically possible for an attacker to modify the file before it gets to you. Just click and download.Ī look through the various BMW forums shows that software updates for different cars all follow a similar pattern. No need to guess a VIN or agree to any terms.

The user is asked to agree to a 'usage right agreement' - but it's not necessary the software is available to anyone without requiring authentication.įor example, the i3's software is available at The user enters their Vehicle Identification number, it is sent across to an unencrypted API. I mean, everything is unencrypted including the software download! To do so, all you need is a standard USB memory stick with sufficient memory capacity.

You can perform this software update yourself. This offer is available for selected vehicles manufactured after March 2010. The BMW Group allows part of the vehicle software to be updated, to enable compatibility of the latest tested Bluetooth or USB devices in the vehicle. So, that's the major software updates, what about the minor ones? It turns out that the entertainment system can be updated by anyone with a USB stick and access to your vehicle. That means booking your car in and waiting for a day or two for the update to take place. Despite having a capable 3G modem, all major software updates have to be performed by an authorised dealer. The Coming Civil War over General Purpose Computing - Cory Doctorow Emphasis added. For example, modern cars are computers we put our bodies in and Boeing 747s are flying Solaris boxes, whereas hearing aids and pacemakers are computers we put in our body.

We used to have separate categories of device: washing machines, VCRs, phones, cars, but now we just have computers in different cases.

That's a huge problem - software runs our lives and, if it is defective, it can ruin us. The BMW i3 is an amazing electric car - let down by very shoddy software.

Bmw software update usb