may2021 - 36

DIAGNOSTIC TECH

Since 2008, manufacturers have
been required to equip their vehicles
with controller area network(s) (CAN).
Since that time, various systems have
had the means to share information
freely and openly. When one connects
a device to the OBD-II port, the potential for malicious activity is very real.
In 2015, two white-hat hackers,
Charlie Miller and Chris Valasek,
demonstrated such vulnerabilities
on a 2014 Jeep Cherokee. The two
proved that security flaws weren't
limited to the vehicle manufacturer
as it also included the cellular network
providers supporting Fiat Chrysler
Automobile's (FCA) Uconnect telematics system.
Their work sparked a major reprioritization of security at the highest
levels, and this is one of the reasons
we're now seeing different security
features being introduced into the
vehicle. Additionally, there will likely
be federal regulations in place sometime in the future.

FCA (NOW STELLANTIS)
Since 2018, FCA began producing vehicles with a new Secure Gateway Module (SGM) (Figure 1). What this did
was remove direct scan tool access
from the J1962 OBD-II connector
for any of the networked modules
not related to OBD-II emissions.
Sometime after SGM's introduction, a solution was born. Today,
many of the aftermarket scan tools
have established licenses with the
AutoAuth program in order for their
customers to obtain access to systems behind the SGM. Right now,
the following tool manufacturers
offer tools that will allow for secure
access under this agreement:
* Autel
* Bartec
* Belron

*
*
*
*
*
*
*
*
*
*
*
*
*

Bosch
CAS
Hunter Engineering Company
Launch Tech USA
Mac Tools
Matco Tools
Mitchell 1
Opus IVS
OTC
Safelite
Service Lane eAdvisor
Snap-on
TOPDON
If a service provider wants to gain
access to FCA's systems that reside
behind the SGM, they will need to
register their shop with AutoAuth.
From there, the shop is allocated six
user slots under the $50/yr license.
AutoAuth provides a plan that costs
$2/user/year if additional users are
needed. Once the shop is registered,
they can then begin to add supported
tools under their AutoAuth account.
To begin tool registration, one will
need each tool's serial number to
complete the process. Once all that is
in place, registered users will be able
to access all modules on FCA's SGMequipped vehicles.

FORD
Since around 2019, Ford established
security for some of the ADAS systems on their vehicles. Even with the
Ford Diagnostic and Repair System
(FDRS) and Ford J2534 Diagnostic
Software (FJDS), aftermarket users
cannot access these systems without
the use of a valid Vehicle Security
Professional (VSP) credential issued
by the National Automotive Service
Task Force (NASTF).

NASTF
NASTF's Vehicle Security Professional (VSP) program is essentially a trust system that is used to

36 Professional Distributor I May 2021 I VehicleServicePros.com

NASTF's Vehicle Security Professional program is essentially a trust system that is
used to establish authentic operations into
various vehicle security related functions.

establish authentic operations into
various vehicle security-related
functions. There are multiple entities that make up this trust system,
which includes OEMs, the National
Insurance Crime Bureau (NICB), and
the NASTF Registry. If you're interested in gaining authentic access to
security-related operations, then
you'll want to apply for an account
with NASTF.
To start, you'll need to become a
member of NASTF, which you can do
for free. Then, you'll want to log into
your NASTF account and look for
the " Vehicle Security " link. On that
page you'll find a ton of information
including a checklist that will help you
get started. There is an application fee
that covers many things including a
background check. NASTF reports
that if an application is submitted
with everything required, the approval
process can take as little as a few days.
However, I recommend that you try
and obtain your credentials in advance
of you actually needing them. If you're
using OEM websites for service operations, you'll want to look for any areas
that discuss NASTF and be sure to get
your NASTF VSP ID connected to the
OEM sites you use.

http://www.VehicleServicePros.com

may2021

Table of Contents for the Digital Edition of may2021