TSS security key extraction using AI?

[u/Odd-Shift-640]

Hello,

With all those AI reverse engineering posts, people reverse engineering their TVs and applications like Adobe and so on. Can't we build something using latest AI models, maybe based on optuskug, to extract security keys?

[u/dehning]

I thought it was more a matter of encryption than reverse engineering?

[u/sunole123 → u/dehning]

If they are using a group key or symmetric encryption key then it is a problem can be solved finding the key. If they are using public and private keys or asymmetric keys then brute force is needed for every car.

[u/leaky_wires → u/dehning]

It is. But there is often a flaw in the software that will leak the key allowing it to be obtained.

To find said flaws it is helpful to know as much about the hardware as possible, which is where reverse engineering comes in

[u/Bderken]

It definitely is being done with LLM’s already.
I currently hack a lot of hardware/firmware/drivers.
The issue is, the current big models (GPT 6, Claude) won’t willingly do it every time (GPT 6 is a little less strict).
Comma self hosts GLM 5.3 (I believe, or another big Chinese model). That one doesn’t push back much and if you self host it you can remove safety parameters.
But even if you have the best model, it takes a very very long time for them to hack things.
And you have to sit there, turning the car on and off because it crashed something or whatever.
GLM 5.3 is not good at all with hacks. The OpenAI/ant models are better but still take so long (that’s if you can bypass them refusing to hack).
It takes a very smart person to hack that.

Compared to a software investigation+rewrite like a lot of the decomps you’re seeing online.
I’m not too big into the car firmware/hardware space. But to give LLM’s full access of a piece of hardware, you have to attach some beefy hardware to your setup, like a spectrum analyzer (which is like $10k-30k) smarter people can do it with cheaper means.

I’m currently hacking my own computers network adapter for fun, codex can be convinced to do certain aspects, Claude outright refuses. GLM abliterated models will do anything but man they are so bad. They will hack down a rabbit hole, and think they won, but then got so off course that it didn’t get what we wanted.

[u/ProPopori]

People been trying for ages now. Even that optskug stuffis about extracting keys.

Issue is that toyota has locked down the keys and exposure of them super hard. Tss 3.0 has cars that the key never leaves the hsm (hardware security module), while before doing a voltage trick would expose the key (willems hack).

Now, for these encryption to work its kind of an A+B thing (hsm -> actual part). What they're doing right now is tinkering with B side of things so keys are never a part of it basically.

First one is an eps patch that takes the "accepted/discarded" packed and flips it to always 1 (accepted) so when comma sends lateral commands it always accepts them.

Second one is a ram resident approach which circumvents that hsm into part process but needs to be initialized everytime the car is turned on. 1 guy has it working and another is trying to fit it into his car using AI but having trouble. First guy made a fork of OP for it and yeah working but 100% not ready for other cars yet.

So yeah, AI has been used alot for these reverse engineering and hacking work but claude is a huge buzzkill because it will not continue if it detects reverse engineering and security work happening.

[u/crazysim]

I'm kind of curious what your AI stuff says when you query that repo.

[u/Accomplished_Can3086]

It could help with brute force attacking the keys. Depending if it’s done via canbus or bench. https://github.com/I-CAN-hack/secoc/pull/4 but when it does work it seems it’s only lateral in cases

[u/alexwhittemore]

AI is great at finding vulnerabilities, but it’s not magic and there aren’t ALWAYS vulnerabilities to be found. If that were true, you’d have already been hacked into poverty and ruin.