# end of VCDS for 2021 onwards vehicles



## kevin#34 (Jan 8, 2019)

Audi introducing _functions on demand_ and consequently _vehicle diagnostic protection_, this means that starting with 2021 models it will not be possible to play with activations, adaptations, retrofits and so on [smiley=bigcry.gif]

https://www.audi.com/en/company/investo ... emand.html

http://www.vag-com-espanol.com/EN_SFD-M ... or_UMB.pdf


----------



## powerplay (Feb 8, 2008)

Personally I would hate to buy a car that I know is fitted with hardware from the factory I can't use or don't want. In my head that's extra weight I'm lugging around all the time!

This is similar to the software as a service model and another avenue to tap into additional income, which offers flexibility in addition to you being locked-in. This will do nothing for my own personal "brand loyalty" it will probably force me to consider other models, especially for continual-subscription model for features - I don't fancy paying per-month to have matrix headlights, it could add hundreds or thousands to the cost of owning a car - keep it for 5 more years and not only does it devalue more, it costs you more in perpetual licensing!

On the flip side it might make selling a car easier if the buyer is willing to stump up the additional license fees to Audi in addition to the purchase of the vehicle to get the things they want.

And if Audi can activate a feature, eventually some hookey software will be able to do the same, just like for almost every piece of computer software currently in existence.


----------



## Ruudfood (Apr 9, 2018)

What the website seems to indicate is that things like ASI, interior lighting and Park Assist will be part of the hardware but not activated in the software. Does that mean that the hardware is so cheap that it doesn't cost much for it to be included even if it's not used, and they'll make up the cost through activations?

I guess this makes it easier for Audi to build cars to a standard spec then choose to have the hardware activated either when the care leaves the factory, when it gets to the dealer or when the customer chooses to turn it on.

One benefit is that it will potentially make it quicker from order to delivery (depending on other specs like seat trims of course).

But as powerplay says, it won't be long before someone is able to hack it...provided of course that there is also not a way for the car to "report back" to Audi which options are active/inactive, or that the dealer will not accept warranty claims for "unauthorised" functions.


----------



## spidey3 (Aug 13, 2019)

Ruudfood said:


> [...]it won't be long before someone is able to hack it...provided of course that there is also not a way for the car to "report back" to Audi which options are active/inactive, or that the dealer will not accept warranty claims for "unauthorised" functions.


As a software engineer who has some significant experience with cryptographically secure systems, I have to disagree. There are off-the-shelf tools available that make it trivial for manufacturers to secure their systems so thoroughly that it is NOT possible to hack into them, even if you devoted every computer on the planet to the hacking effort for the next 10 years.

The only reason why most current cars don't do this is because so far there has been no monetary benefit to manufacturers in encrypting everything.

But if you move to a Feature-as-a-Service model, in which drivers subscribe to each feature that they want, then that calculus changes. The manufacturer would have a huge incentive to make access to features cryptographically secure, and impossible to enable via hacks.

Remember: The real world is not a TV show or movie. In the real world, hacking into systems isn't a matter of having a really smart nerd on staff, giving them a lot of caffeine, and telling them you need the answer before little Janey is killed by the bad man. In the real world of cryptographically secure systems, it's a matter of the number of CPUs and the number of years of CPU time that can be devoted to the hack.


----------



## Emanuel29 (Oct 28, 2019)

spidey3 said:


> Ruudfood said:
> 
> 
> > [...]it won't be long before someone is able to hack it...provided of course that there is also not a way for the car to "report back" to Audi which options are active/inactive, or that the dealer will not accept warranty claims for "unauthorised" functions.
> ...


That's what NASA said before having their Jet Propulsion Laboratory hacked with a $25 computer (Raspberry Pi)


spidey3 said:


> Remember: The real world is not a TV show or movie. In the real world, hacking into systems isn't a matter of having a really smart nerd on staff, giving them a lot of caffeine, and telling them you need the answer before little Janey is killed by the bad man. In the real world of cryptographically secure systems, it's a matter of the number of CPUs and the number of years of CPU time that can be devoted to the hack.


But, nonetheless, nice movie, Swordfish

On a serious note,
While encryption is indeed hard to break in (definitely not impossible) I don't see Audi adopting any encryption algorithm any time soon. And even if they do, they will still allow dealers to pass-through and that's a vulnerability which will be exploited very fast right there.
Have a feeling they will make it even easier to activate hidden functions.


----------



## blackvalver (Jan 6, 2020)

it's way overdue for the EU to legislate to open up software access on cars, like they basically did for emissions and OBD2
If you look how open-source software has changed giants like Microsoft I think it would be very bad for a big manufacturer like VAG to effectively hammer their own products residuals by making repair costs more expensive, what fleet buyer is going to go for models that have lower value at 3 years old?


----------



## Blade Runner (Feb 16, 2018)

Emanuel29 said:


> While encryption is indeed hard to break in (definitely not impossible) I don't see Audi adopting any encryption algorithm any time soon. And even if they do, they will still allow dealers to pass-through and that's a vulnerability which will be exploited very fast right there. Have a feeling they will make it even easier to activate hidden functions.


Reading the Audi blurb, the only way to activate the selected feature will be for Audi to send a code directly to the car (after the feature is selected and paid for via the MyAudi app or web site). The user won't even know what the code is, as it will be sent over the air, so difficult to see how this can be easily hacked. Code will be specific to car (VIN number) and purchased feature.

To me, it sounds like a reasonable way to proceed (subject to pricing!) as it will avoid all the hassle and expense of trying to retrofit a feature to a used car you bought thinking (incorrectly) the said feature was present. Just think of all the "Can I retrofit xxx to my 2016 TT?" threads on here! In contrast, adding something like ASI should be a 5 minute job. It is already working in Germany and Norway and is working well by all accounts. The things they are offering to "book" (strange word to use!) won't add much to the weight of the car (a few kgs?) but will save them a lot of money on production line costs.

Not clear to me how the dealers will be involved, as the system seems to be set up as a direct interaction between the owner and "Audi central" via the MyAudi app. The blurb does say that "Dealers also have an opportunity to participate in the new business model. They receive a percentage commission for every booking their customers make", but its not clear (yet) how they will even know that a feature has been activated? - At least not until the car is next in for a service?


----------



## macaddict111 (Jun 13, 2018)

Well THAT'S dumb. I don't really care about them locking vehicle control modules. Yes I've enjoyed being able to code minor features/traits on and off with VCDS. I also am totally against people being able to flash/tune certain control modules to work differently than they were designed, to the potential of breaking emissions laws. But the whole "paying every month to use the headlight features already installed in my car" is so freaking stupid.

Also I totally disagree, I think it's only a matter of time before someone cracks their scheme, and once they do they don't really have the platform to completely change their encryption scheme to make up for it on all those control modules. VW is already saying they have an "offline" version where the module sends a code and the server sends a code back. This is sooo easy to exploit.


----------



## Emanuel29 (Oct 28, 2019)

> Reading the Audi blurb, the only way to activate the selected feature will be for Audi to send a code directly to the car (after the feature is selected and paid for via the MyAudi app or web site).


Sending a code directly to the car implies your OBDII will have internet connection. Are you sure about that?
They will send it to the Multimedia? Woah, can't wait for it. They will crack it right away and at maximum you will lose connectivity to Audi Connect & MyAudi. But you don't need it anymore after you activate everything I guess.


> The user won't even know what the code is, as it will be sent over the air, so difficult to see how this can be easily hacked.


They can't just send a code to the car. It does not work like that in my opinion and I am not an expert but, at maximum, they can just send remote data to your car (if it is connected to the internet) basically make the car download a file and run it after. (And ofcourse, in that data, it would be included your so hidden authorization login they want to introduce, getting hold of it in plain text will not take much longer, believe me)
But that's if they are planning to implement the extras using the Multimedia interface.
If they, somehow, want to introduce connected to internet OBD port, that means the data sent to your car contains just some settings which can also be activated manually (just as we do now with VCDS's and OBDEleven) once you get into the control units, so, pointless again.
*Making a slight off-topic comment here; someone might realize that they can't sell you a locked OBD car until they clearly state it and you still buy it. What if <insert famous laptop manufacturer name here> sold you a laptop with only one guest user and the admin account locked away?* I'm stupid, Apple actually does it in an indirect way and people still buy their products. The way they do it now, like having those security access codes legally in the diagnostic module, is using the excuse that we might broke something and are there just for safety and could be given away if asked to.
You bought a car, you own it, all of it, it's as simple as that. If they want to introduce into my car the things I never asked for, I must be able to manipulate them the way I like to as it is mine and I paid for it. (?) Or just keep them out of my car.


> Just think of all the "Can I retrofit xxx to my 2016 TT?" threads on here!


Those dudes ask how they can retrofit mechanical parts mostly, not VCDS or OBDEleven things, which even if asked, they'd get an answer very quickly. So, not something Audi will do by "sending a code" anyways.
Off topic: I've activated the simple G-meter (just an example) on my TTS by one click, they will charge you $100 minimum for doing that click in the future, are you okay with it?


> Not clear to me how the dealers will be involved, as the system seems to be set up as a direct interaction between the owner and "Audi central" via the MyAudi app.


As far as I can see in the second brochure, they give information to dealers how will they log in into the control units for diagnosis, so they will definitely have access to it. Having access to it means having access to OBD port, there you can do anything you like.
But, once again, that's for the OBD port, if they do "on demand" or "remote activation" that implies internet, and would also imply the activation will be done through the multimedia which as I said previously, will be very easy to crack with the cost of losing connection to MyAudi which... oh... no one uses.
*And yes, let's not talk about cracking. There are no actual programs or games or anything like that which are not found in a cracked version right now on the internet.*

Long story short, if they become Apple, I will just change brand, as anyways, TT is out of production :roll:


----------



## powerplay (Feb 8, 2008)

If it comes to it Audi will do its reasonble best to encrypt or otherwise make it as hard as possible to work around.

Even if workarounds become possible, it's really only a small % of owners that would take advantage of it, most I think would just subscribe for whatever features and drip feed audi with money, it just makes sense for Audi :lol:

Having said that, third part companies are not adverse to dedicating resource and hardware to overcoming things if there is a profit to be made.

Remember when Sky TV was in its infancy and TV was mainly on the analogue Astra satellites and scrambled - you unplugged your card from the receiver and you just got a mess on the screen?

I remember there were makeshift card emulators/decrypters on the market, sold through the back page ads of magazines, that plugged in the sky box sticking out the card slot with circuitry exposed, you could copy someone else's card and it would give you free access to everything.

Totally illegal I would think but they were a lot cheaper to buy than a sky sub and worked well (so I'm told). Where there's a way theres a will...


----------



## AudeeTeeTee (Sep 7, 2020)

The whole car industry is moving this way, and most volume manufacturers will be adopting a similar model.

It has several advantages for the manufacturer :

1. It's cheaper to have one build spec which includes most of the hardware for most options, than to have hundreds of different combinations being built on the production line.
2. Cars can be built ahead, then customise to customer spec by software after the build - rather than each car being built to customer spec. This will reduce new vehicle lead times.
3. They can sell options at any time in the cars life, not just when they are new. 
4. They can tap into subscription/as a service/on demand revenue opportunities.

The disadvantages : they risk 3rd parties developing activations which deprives them of revenue (e.g. SatNav on a TT). The move to SFD will prevent this by encrypting access. And you can bet it will be so deeply embedded, it will be exceedingly difficult to bypass.


----------



## Blade Runner (Feb 16, 2018)

Emanuel29 said:


> > They can't just send a code to the car. It does not work like that in my opinion and I am not an expert but, at maximum, they can just send remote data to your car (if it is connected to the internet) basically make the car download a file and run it after. :


When I was describing how the activation will work, I was not expressing an opinion. I was simply quoting (rephrasing) from the Audi web site:

"_Booking and payment are handled via the app or the myAudi web portal. We attach great importance to secure processing of the transaction. After the booking process has been completed, the Audi IT back end sends a signed data package to the car via the mobile network. The function is available the next time the vehicle is started_".

https://www.audi-mediacenter.com/en...-demand-a-new-form-of-individualization-13240

Audi have plenty of clever technical people and I'm sure they have given plenty of thought to how people might try to "hack" the system. I am also pretty sure that it wont be easy. As Audi is sending the code they will obviously have a record of it being sent to car with VIN number xxxxxxxx on date yyyy, and the user will probably get email confirmation and a MyAudi 'feature list' update. Mismatches cause by unauthorised/illegal upgrades (if they are indeed possible) should therefore be easy to spot if the car goes into a dealer for service or is checked prior to re-sale.


----------



## minsTTerman (Aug 5, 2003)

Hmmm, seems to me like it's no different to the way people currently buy music (Spotify, Apple Music etc), films, TV, computer programs etc and as an old fuddy duddy, I don't like it!

I personally don't want to rent/lease everything, which is essentially what it is. You basically rent your music from Spotify - as soon as you stop paying them the monthly fee you have no music, same with films and TV and by the looks of it car features.

I like to buy a cd or blu ray - I own it forever and only have to pay once for it. I'd like it to be the same with my lights and other features. How long before you get a basic tuning map on the engine that gives you say 100 BHP and if you want more you have to pay £X per month to get more power.

Trouble is while people are willing to do it, all manufacturers will jump on the band wagon.


----------



## Barmybob (Nov 4, 2015)

For the CO2 neutral policy to work we will be expected to keep our vehicles for much longer. It also seems quite clear that Audi will be pushing people to lease rather than own. I have to suspect that leasing of features is just a further element of their business model, giving them a constant income stream from each vehicle.

For second hand vehicles the dealers will be able to include features limited to the period of any new lease. This would make vehicles more attractive or personalised for new keepers. What is less clear is what affect it would have on vehicles falling outside of the dealer network, especially when being traded in at a non Audi franchise.


----------



## red_TTS (Jun 27, 2020)

edited


----------



## macaddict111 (Jun 13, 2018)

red_TTS said:


> Emanuel29 said:
> 
> 
> > Off topic: I've activated the simple G-meter (just an example) on my TTS by one click, they will charge you $100 minimum for doing that click in the future, are you okay with it?
> ...


Not the topic for this thread.


----------



## Emanuel29 (Oct 28, 2019)

Blade Runner said:


> Emanuel29 said:
> 
> 
> > > They can't just send a code to the car. It does not work like that in my opinion and I am not an expert but, at maximum, they can just send remote data to your car (if it is connected to the internet) basically make the car download a file and run it after. :
> ...


That implies that the OBDII port will be left untouched and the activations are done by the MMI System or just another Unit they will introduce. Which will be cracked quickly, you will lose the internet connection to MyAudi and Audi Services but you will gain all those upgrades for free. I personally do not use any MyAudi apps in my car. 
Dealers where I live don't care about these things and my next buyer I'm sure will be very content he won't pay monthly for the extra features.

To the guy who asked about G-Meter; some versions of MMI need firmware update for it to work. Torque and Power Graph isn't working for me either; most likely car doesn't have the sensors for it.


----------



## kevin#34 (Jan 8, 2019)

finally can anybody confirm if TT 2020 onwards models are affected by SFD (vehicle diagnostic protection) or not??


----------



## Mokorx (Apr 26, 2017)

TT Model 2022 can be coded normally. There is no diffrent compare to pre 2022 model. VCDS OBDeleven still work fine.

The only different compare to pre 2019 model year is that 2019 onwards coding some ECU requires hood to be opened.


----------



## kevin#34 (Jan 8, 2019)

ok, thanks, I am going for a '19 or '20 YM and I was afraid the '20 could have been affected by SFD


----------



## base86 (Nov 20, 2019)

SFD can be removed with OBDeleven and then you can plugin VCDS and code what you like. I've done so with my new Skoda Enyaq. Have tried OBDeleven on my TT but rather work with VCDS.


----------



## kevin#34 (Jan 8, 2019)

luckily it seems that the TT platfrom has been left free, being its death forecasted in a couple of years.. (low cost/benefit ratio to justify its implementation on this model, apparently)

however, according to other forums (obdeleven, ross-tech...) it seems that once the SFD protection has been removed, modules that are re-coded are then red-flagged automatically and warranty will not cover them anymore (to get the token to access to the SFD protected modules, VIN, modules S/N and other data linked to the car are sent and kept to Audi database)


----------



## Kenway (Jul 19, 2021)

kevin#34 said:


> luckily it seems that the TT platfrom has been left free, being its death forecasted in a couple of years.


Was about to suggest the same. At least there is one positive side of Audi's constant neglect of the TT model line. Sure the MyAudi app has zero features and the hardware is old gen.

But at least we can still use our tools


----------



## kevin#34 (Jan 8, 2019)

for the TT, the only useful feature of the myaudi app is the destination sending directly to the car navigation, end of the story...


----------



## Kenway (Jul 19, 2021)

kevin#34 said:


> for the TT, the only useful feature of the myaudi app is the destination sending directly to the car navigation, end of the story...


I remember back in 2016 it had other functions but they got removed with zero warning. But yes, now the only thing useful is the send to car feature. Which I believe you can do now via your google maps anyways.


----------



## kevin#34 (Jan 8, 2019)

correct, it had even street view, very useful when I had eed to find a specific building or street number...





Kenway said:


> I remember back in 2016 *it had other functions *but they got removed with zero warning. But yes, now the only thing useful is the send to car feature. Which I believe you can do now via your google maps anyways.


----------



## jjo5555 (Feb 22, 2021)

spidey3 said:


> As a software engineer who has some significant experience with cryptographically secure systems, I have to disagree.


As a CISO tacking vulnerabilities and threat actors daily I would say your confidence in your colleagues abilities is misguided. You can encrypt as much as you like but someone will unintentionally code a buffer overflow, memory reuse or any other number of vulnerabilities in to allow takeover/compromise.


----------

