Are you guys concerned about bypassing SGW?
I was wondering about security risk when bypassing SGW to take advantage of Tazer Mini features.
I did a little research and found this post on JLWranglerforum.....
Someone questioned the risk when bypassing SGW.
See response below.....
Your intuition is spot on. Yes the thing that gets disconnected is the Security Gateway Module (SGW). If this component is bypassed, such as using a Tazer, then on-board vehicle security is potentially compromised and unauthorized access (tampering) can occur. Not that it most definitely will, but it may.
The SGW can be thought of as a firewall for the vehicle's internal control bus. All the vital control components, the Engine, Transmission and Body Control Modules are all better protected from tampering with the SGW installed. The SGW only allows authenticated external Controller Area Network (CAN) protocol messages to pass into the internal communication network from any outside sources. This includes all the infotainment components such as the UConnect radio.
Authentication uses the latest industry standard encryption algorithms. It essentially requires that each and every message received must be from a trusted source. In other words, you must prove that you are in fact who you say you are AND that you have been pre-approved to communicate (send CAN messages) to any of the internal control modules.
Unfortunately, the automotive industry has a very tight 'lock' on exactly who has this authorization. This is pretty much limited to the factory diagnostic tools, the Guardian (On-Star like) remote service providers and the UConnect radio. That's about it.
This makes it extremely difficult for the third-party programming products (such as the Tazer) to gain access to the internal controllers. So in order to get around this, these third-party tools 'bypass' the SGW entirely. This then allows any CAN message to be injected into the internal CAN Bus from any source (by anyone, or anything) without regard to any type of authentication. Essentially there is little to no digital security with a 'bypassed' SGW.
This is exactly how the third-party tools gain unfettered access, in order to be able to do their magic and provide their non-factory supported way-cool behaviors. This is also why they are relatively inexpensive. They just 'pirate' their way into your vehicle.
The real down-side is that this now allows any marginally skilled hacker potential access into your vital vehicle components as well. All they need is your cellular connected UConnect 4 radio's MAC (Media Access Control) Address. A pretty easy thing to do for even the most novice of hackers.
Once this addressing information is known, without the SGW provided firewall, there is really now nothing to stop them from injecting arbitrary CAN messages of their choosing into your vehicle. They can literally be as nefarious as they want to be.
Fortunately, some tools like the Tazer work in two modes of operation; 'Live' and 'Non-Live'. Unfortunately the really cool features work in the 'Live' mode where the Tazer must remain plugged-in at all times (the SGW must be bypassed) in order for it to function. Once 'married' these features must interactively communicate to one or more of the internal control modules in real-time (live) to work. ESS Disable, the various light shows and the 30 and 60 second timer features are all 'Live'.
On the other hand the 'Non-Live' features, such as tire size, TPMS thtesholds and LED lighting simply do just a one time configuration and therefore don't need to remain continuously plugged-in. Once 'married' and configured, the Tazer can then be safely removed (while still 'married') and the SGW can be reinstalled. In this mode, no digital security is then compromised. All external CAN access must again be crypto authenticated.
So only you can be the judge of just how 'cool' some of these 'Live' functions are relative to how much risk you're willing to live with. Some argue that this risk is really (really) small. But without the SGW installed there certainly now exists a non-zero probability that your vehicle may be exploited. Recall, Murphy's Law states that "if something CAN happen, given enough time it WILL happen".
I personally own and use the Tazer JL Mini myself. But use only it's 'Non-Live' capabilities. I should have purchased the much cheaper Tazer JL Lite which provides no 'Live' functionality. Oh well...
I really hope this answers your question. Many forum members chide me on my willingness to provide detailed posts. I'm glad to do so as long as it helps you or anyone else.
Happy and safe Jeeping...
Jay
.I know, I tried everything which helps me sleep better at night, knowing I at least tried my best.
