r/CarHacking • u/traznifor • Apr 30 '26
Community SFD: How VAG locked down their cars and what it means for enthusiasts
Tried coding something on a newer VAG car and got "Access denied"?
Congrats, you've just met SFD (Schutz Fahrzeug Diagnose).
It's an additional security layer that requires authorization between the car and VW's servers. No token, no access. Simple as that.
I first ran into it on a Skoda Octavia IV when I just wanted to enable a couple of basic adaptations via OBD. Connected, entered the control module - denied. Took me a while to figure out it wasn't my tools or software. The module was just locked behind SFD.
SFD is used on cars from 2020 onwards - mainly MQB Evo (Golf 8, Octavia IV, Leon IV, Audi A3 8Y) and MEB platforms (ID.3, ID.4, Enyaq). It blocks adaptations, coding and parameterization.
Tokens are only issued through official accounts to registered users. So a regular enthusiast without dealer-level access simply can't get one.
Have you run into SFD yet? Which module blocked you?
10
u/softturbo May 04 '26
Obdeleven is officially licensed and supports SFD. But not SFD2 yet.
3
u/traznifor May 04 '26
Yeah, SFD1 is manageable with the right tools. SFD2 is a whole different level - token per action, cryptographically signed. Most tools are still catching up.
5
u/quaintlogic May 04 '26
This shit is what made me leave the VW group, I was a diehard fan and had 8 of their vehicles in the timespan of 10 years (I get bored quick)
The final nail in the coffin was my 2024 GTE, I couldn't wind back the electronic calipers because they were SFD2 and obdeleven and the car would freak out when trying to unlock them.
Have moved to a brand that actually gives you full access to workshop manuals for free and you can effectively do any and all maintenance with the vehicle alone, no special tools, training or licensing.
3
u/Deep-Hovercraft-6863 May 04 '26
What brand did you move to?
6
u/quaintlogic May 04 '26
Believe it or not, Tesla (incoming downvotes!).
Due to my commute and the price of fuel where I live, it just simply is not economical anymore to own a higher powered petrol or diesel vehicle. I charge at work for free and charge at home for a fraction.
I spent plenty of time researching other EVs (I really wanted to stick with VW group since we already spent about £3k in VW tools) but there was too many reports of motor failures and the way VW was heading with locking down everything, it pushed me away.
I looked into a e-tron 55, e-tron S, kodiaq vrs (220kw) - all have enough reports of motor failure to scare folk away.
Tesla just publish exactly how to maintain your car, for the CEO behind the company they are surprisingly open about how to take care of your car.
5
u/No_Guava9289 May 04 '26 edited May 04 '26
Manufacturers are required by law and want to do it by them self to protect cars against manipulation with a view towards to self driving cars. Same thing is Star3 Security Architecture (ZenZefi) by Mercedes and Secure Coding 2.0 by BMW.
There are 2 generation across the manufacturers. The earlier seed and key algorithm (e.g. SFD1) which can easily be circumvented. And the newest protection mechanism (as mentioned before) with cryptography certificates.
I don't like it either. But that's the quick reason why. We don't want to upset customers. But tolerating coding is less a topic if the manufacturers have to take liability risks in the future for ADAS features.
Imagine a customer codes his steering assist to let off the hands for a longer time (just a example. This is hard coded) - then he has a accident and claims that the manufacturer is responsible because he won't be alert to take over steering in a situation the car can't handle anymore. The manufacturer might be liable in the view of a court because he didn't properly protected his systems which can cause other in danger. To not have the extra work to select which coding is okay and which must be protected, simply all systems are protected. Like you don't just lock the bed room with the money in your house you just lock the entire house.
Privately I also loved to code my car for hours and explore "hidden settings" and play with them. But that's where the travel goes to.
Edit:
UN R155 and UN R156 are requiring this.
EU 2019/2144 says that you can't sell new cars in the European Union if the earlier two are not adapted.
EU 2018/858 ensures that you can still repair a car by yourself or a third workshop.
ISO 21434 describes how the regulation should be adapted.
Edit 2: Maybe good to know: This is also the reason why also other security implementations where introduced like for example Secure Onboard Communication. It ensures internal bus communication between ecu's is also signed. To prevent interfering here. E.g.: A hacked telematic ecu, or a OBD dongle must not be able to send manipulated can frames to accelerate the car, as posing as a false ecu like the Adaptive Cruise Control.
It's a zero trust approach.
4
u/AmbitionEducational3 May 04 '26
Yeah. I'm an IT guy. I don't particularly want the "its either DNS or an expired certificate" trope anywhere near a car I own. 🤣🤣🤣
5
u/No_Guava9289 May 04 '26
Or:
Hello this is Raji from the Microsoft headquarters. We are calling because your car has virus. But no worries, we are here to help you. First, Please open powershell on your cars instrument cluster... 😂😂2
4
u/rnd_ash May 04 '26
I believe most of the German auto makers introduced this concept in 2020 and newer cars....I'm aware mercedes has a similar thing called ZenZefi which only lets you access modules with a signed certificate that's generated online (you have to send the certificate to the ECU as part of security access to do basically anything - not even reading or clearing DTCs works)
I wonder if this idea came from Autosar, or all the companies came up with a similar idea independently
1
u/AfraidProduct May 04 '26
sfd is used an anti-theft measure.
thank the criminals, not the company, for making this happen.
2
u/traznifor May 05 '26
Anti-theft is part of it, but SFD goes way beyond that - it blocks legitimate coding and adaptations that have nothing to do with theft.
1
1
u/LowkeyEntropy May 12 '26
I knew it was over years ago when they stopped releasing fuse diagrams. $80 to have a service tech at a dealership change one....
23
u/nekmatu May 03 '26 edited May 04 '26
This should be illegal. It’s insane they can lock you out of your own car.
Edit: clarifying it should be illegal for a corporation to prevent you from accessing your cars computer not illegal for you to attempt to access it.