Deactivating electric motor for aftermarket immobilizer

[shakta]

Hi everyone,

I am new here. Just bought a 2014 Instyle a month ago.

I had a vendor fit the car with an aftermarket anti-theft system.

They could wire it to the ICE but didn't have luck with deactivating the electric motors.

Mitsubishi Motors won't help


Anyone did anything similar? How do you lock down the electric motors from an aftermarket anti-theft system?

Thank you for your help.

 

[zzcoopej]

I had a vendor fit the car with an aftermarket anti-theft system.
Anyone did anything similar? How do you lock down the electric motors

The PHEV key is an immobiliser, what extra is being added by an aftermarket system?
eg http://www.myoutlanderphev.com/forum/viewtopic.php?f=9&t=752

 

[jaapv]

My dealer fitted a Cobra immobilizer and alarm with drivercard. The system prevents the car from entering into "ready" state.

 

[jaapv]

I had a vendor fit the car with an aftermarket anti-theft system.
Anyone did anything similar? How do you lock down the electric motors

The PHEV key is an immobiliser, what extra is being added by an aftermarket system?
eg http://www.myoutlanderphev.com/forum/viewtopic.php?f=9&t=752

Be under no illusion. Factory-fitted systems can be disabled within a few seconds:


http://www.cs.tufts.edu/comp/116/archive/fall2015/arichardson.pdf

 

[zzcoopej]

Be under no illusion. Factory-fitted systems can be disabled within a few seconds:
http://www.cs.tufts.edu/comp/116/archive/fall2015/arichardson.pdf

If you open the PHEV with the button on the actual door, the key needs to be within about 1metre of the car. Unless the "thief" is standing next to you, good luck with them receiving even the door code. And then the immobiliser transmission is only inside the cabin (try starting the PHEV with the key outside the car) so again the "thief" must be very friendly!
However if you use the lock/unlock on the fob which can be done 20 metres away from the PHEV, I agree there is potential of compromising at least the door, however I remain dubious about exposing the immobiliser.
Does an aftermarket immobiliser have access to more sophisticated technology than vehicle manufacturers?

 

[Muddywheels]

I'm afraid you're wrong about criminal standing next to you - I used to think the same zzcoopej

http://www.driving.co.uk/car-clinic/six-ways-thieves-can-break-into-a-car-and-how-to-prevent-it/

I know LR owners who never used the fob buttons and had their vehicles taken without the key by using the "relay" method - use of Faraday pouch or keeping fob in tin at home blocked my LR fob signal but doesn't appear effective with the Mitsubishi fob :?

 

[jaapv]

Be under no illusion. Factory-fitted systems can be disabled within a few seconds:
http://www.cs.tufts.edu/comp/116/archive/fall2015/arichardson.pdf

If you open the PHEV with the button on the actual door, the key needs to be within about 1metre of the car. Unless the "thief" is standing next to you, good luck with them receiving even the door code. And then the immobiliser transmission is only inside the cabin (try starting the PHEV with the key outside the car) so again the "thief" must be very friendly!
However if you use the lock/unlock on the fob which can be done 20 metres away from the PHEV, I agree there is potential of compromising at least the door, however I remain dubious about exposing the immobiliser.
Does an aftermarket immobiliser have access to more sophisticated technology than vehicle manufacturers?

Yes, aftermarket systems are far more sophisticated, with Canbus protection, microwave sensors and a driver card.
The factory alarm is class1, most aftermarket systems are class 3 or 4 ( with a vehicle tracking system). Then there is the Bearlock mechanical steering wheel lock.

BTW, the unlock code and starting code are on a chip which can be skimmed remotely by the guy standing next to you at the Tesco checkout.

 

[anko]

IMHO, the difference between class 1 security system and higher classes says nothing about how easy it is to deactivate the security system. It only mens what is fitted to the security system:

Class 1 features mainly just an immobiliser
Class 2 adds for instance perimeter breach detection and an audible alarm (a class 1 system is not an alarm system at all )
Class 3 adds for instance anti sabotage measurements (separate battery) and tilt detection
Class 4 ... etc.

So, in the Netherlands, the factory installed installation is a Class 1, where in other countries it may be a Class 2 as an alarm sound is added / activated. But my certified aftermarket class 3 system (also Cobra, but without Driver Cards) is controlled by the same RKE system as the factory system. This means the RKE itself meets the standards set forth by SCM.

 

[jaapv]

Anko, as far as I am aware, the Cobra system cannot be approached through the OBD port, as opposed to the factory system. Is this correct?

 

[anko]

Anko, as far as I am aware, the Cobra system cannot be approached through the OBD port, as opposed to the factory system. Is this correct?

Don't know. I was just arguing that many aftermarket systems can be as easily disabled as the factory alarm, using the techniques described in the PDF you linked to. Cobra Driver Cards are (IMHO) a not so common exception.

 

[AndyInOz]

...

use of Faraday pouch or keeping fob in tin at home blocked my LR fob signal but doesn't appear effective with the Mitsubishi fob :?

Yes, I did the same, and have come to the same conclusion, it does not appear to stop the fob from communicating with the car.

(RFI proof pouch that is...)

This is annoying because the relay/power-amp hack is becoming very cheap and common.

This means that it is trivially easy for a thief to enter, start and drive your car around the corner, to be loaded onto the waiting flat-bed.

(and then re-birthed and re-programmed at leisure).

 

[jaapv]

Anko, as far as I am aware, the Cobra system cannot be approached through the OBD port, as opposed to the factory system. Is this correct?

Don't know. I was just arguing that many aftermarket systems can be as easily disabled as the factory alarm, using the techniques described in the PDF you linked to. Cobra Driver Cards are (IMHO) a not so common exception.

Probably because the Driver Card requires a handshake, instead of a reading out of a passive chip,

 

[shakta]

Also here's a way to disable the factory alarm system by hacking the car through WiFi: https://www.pentestpartners.com/blog/hacking-the-mitsubishi-outlander-phev-hybrid-suv/

The aftermarket system I bought is also using physical protection of their electronics by hardening and locking the hood. You can only open the hood if you put the system into service mode. They have their system in 25,000 cars and none was stolen yet. Thieves weren't even able to open a single hood.

Of course nothing is unhackable, but by prolonging the time taken to hack it you will divert thieves to an easier target.

 

[anko]

Also here's a way to disable the factory alarm system by hacking the car through WiFi: https://www.pentestpartners.com/blog/hacking-the-mitsubishi-outlander-phev-hybrid-suv/

The aftermarket system I bought is also using physical protection of their electronics by hardening and locking the hood. You can only open the hood if you put the system into service mode. They have their system in 25,000 cars and none was stolen yet. Thieves weren't even able to open a single hood.

Of course nothing is unhackable, but by prolonging the time taken to hack it you will divert thieves to an easier target.

For sure. But on the other hand, how many PHEV's without such system have been stolen in the last three years? And out of those, how many were stolen by hacking the FOB or the WiFi? Try to keep some perspective ;-)

 

[HHL]

Also here's a way to disable the factory alarm system by hacking the car through WiFi: https://www.pentestpartners.com/blog/hacking-the-mitsubishi-outlander-phev-hybrid-suv/

The aftermarket system I bought is also using physical protection of their electronics by hardening and locking the hood. You can only open the hood if you put the system into service mode. They have their system in 25,000 cars and none was stolen yet. Thieves weren't even able to open a single hood.

Of course nothing is unhackable, but by prolonging the time taken to hack it you will divert thieves to an easier target.

For sure. But on the other hand, how many PHEV's without such system have been stolen in the last three years? And out of those, how many were stolen by hacking the FOB or the WiFi? Try to keep some perspective ;-)

Yes, and how many of those 25000 with the system installed would not have been stolen anyway..........
People are getting a bit paranoid :roll:

 

[shakta]

Is there anyone who has done this before?

Any ideas how to lock the electric motors (either through the control unit or otherwise)?

Thank you.

 

[jaapv]

The point is that on this type of car an immobilizer does not "lock" the motors or the ICE, it prevents the computer from booting up the car.
Working on the various parts is the wrong approach. I suggest that you get a reputable system installed by or through your Mitsubishi PHEV dealer. They'll either do it themselves or will use a service that knows what it is doing.
You will need an official dealer to service the car anyway, if only to read and reset the logs and to install firmware updates.

 

[anko]

Would you have the same concerns with a normal car that didn't have the E-motors? The PHEV has an electronically controlled parking brake that locks the front transmission and prevents the front wheels from spinning. Check that this EPB can not be disengaged without turning off the alarm and you should be fine, right? Regardless of the state of the E-motors.

There is documentation on-line that will tell you were the Rear Motor Control Unit is hooked up to the secondary CANBUS. I am pretty sure that if you undo that joint (or electronically disconnect it) the rear motor will not work. I have know idea whether it will be locked, but my guess is it will not. Is that a problem? On a FWD car the rear axle is not locked either.

 

[ian4x4]

Is there anyone who has done this before?

Any ideas how to lock the electric motors (either through the control unit or otherwise)?

Thank you.

https://dl.dropboxusercontent.com/u/106981165/PHEV/PHEV%20Outlander%20Technical%20Highlights%20for%20MMAL.pdf

Tech Highlights Manual page 52 says there is an electric parking lock actuator controlled by the PHEV ECU.

This physically locks the front transmission.

I would suggest that if the PHEV is not booting up then it will be very hard to move.

 

[jaapv]

Also here's a way to disable the factory alarm system by hacking the car through WiFi: https://www.pentestpartners.com/blog/hacking-the-mitsubishi-outlander-phev-hybrid-suv/

The aftermarket system I bought is also using physical protection of their electronics by hardening and locking the hood. You can only open the hood if you put the system into service mode. They have their system in 25,000 cars and none was stolen yet. Thieves weren't even able to open a single hood.

Of course nothing is unhackable, but by prolonging the time taken to hack it you will divert thieves to an easier target.

For sure. But on the other hand, how many PHEV's without such system have been stolen in the last three years? And out of those, how many were stolen by hacking the FOB or the WiFi? Try to keep some perspective ;-)

Yes, and how many of those 25000 with the system installed would not have been stolen anyway..........
People are getting a bit paranoid :roll:

Possibly, but over here insurance companies insist on decent aftermarket alarm and tracking systems. But then, LHD cars are far more popular in Eastern Europe than RHD ones.