In 2012, three computer security researchers at Radboud University discovered weaknesses in the Megamos chip, which is widely used in immobilisers for various brands of cars. Based on responsible disclosure guidelines, the scientists informed the manufacturer immediately, and they wrote a scientific article on the topic that was accepted for publication at a prestigious digital security symposium (USENIX 2013). However, the publication never took place because in June 2013 an English court, acting at the request of Volkswagen, ruled that the article had to be withdrawn. Now, in August 2015, the controversial article that was ‘banned’ in 2013 is being published after all.
What went before
In 2008, Radboud scientists discovered weaknesses in the MIFARE CLASSIC chip that was used for instance in the public transport chip card for the Netherlands, the ‘OV-chipkaart’, and in London’s Oyster card. At that time, the Dutch court refused to ban publication, partly because Radboud University scrupulously complies with responsible disclosure rules.
Because of this, Volkswagen took the ‘Megamos case’ to an English court in 2013. This was possible because one of the researchers had transferred to the University of Birmingham in the meantime. In June 2013, the English court issued an injuction.
Defence
Radboud University, together with the University of Birmingham, immediately challenged this English publication ban: the data about the chip that the researchers used in their study was acquired in a lawful manner. The manufacturer was also informed more than 9 months prior to the proposed publication. According to the responsible disclosure guidelines of the Dutch government, pre-publication notice of 6 months is sufficient.
The controversial article contains a scientific analysis of the level of security of the Megamos chip and is certainly not a manual for hackers. Radboud University is a strong defender of academic freedom and believes that car owners have the right to know the strengths and weaknesses of the security of their car.
continue http://www.ru.nl/english/news-agenda/vm/informatics-digital/2015/megamos_2015/