Tazer Mini JL - Question about what is lost?

[gpoverland]

Good Morning, Evening, Night... whichever...... Quick question... When you install the TAZER MINI module, you disconnect a factory module, and then plug the cable into the MINI. Pretty easy stuff for the double-jointed, but my question is in two parts:

1. What is the module you disconnect and what does it do?
2. Is the TAZER able to provide the same functionality or better? I know the laundry list of functions a married TAZER MINI can provide, but I just want to make sure we're not opening the Jeep up to some security issue or something.... Thoughts??

Sponsored

 

[OlderSpice]

It is a gateway security module that is mounted to the left knee panel speaker pod

Chrysler Security Gateway Module

 

[DadJokes]

I’m certainly no guru but I believe it’s basically put in the loop and all works like stock.

 

[jeepoch]

Devon,

Your intuition is spot on. Yes the thing that gets disconnected is the Security Gateway Module (SGW). If this component is bypassed, such as using a Tazer, then on-board vehicle security is potentially compromised and unauthorized access (tampering) can occur. Not that it most definitely will, but it may.

The SGW can be thought of as a firewall for the vehicle's internal control bus. All the vital control components, the Engine, Transmission and Body Control Modules are all better protected from tampering with the SGW installed. The SGW only allows authenticated external Controller Area Network (CAN) protocol messages to pass into the internal communication network from any outside sources. This includes all the infotainment components such as the UConnect radio.

Authentication uses the latest industry standard encryption algorithms. It essentially requires that each and every message received must be from a trusted source. In other words, you must prove that you are in fact who you say you are AND that you have been pre-approved to communicate (send CAN messages) to any of the internal control modules.

Unfortunately, the automotive industry has a very tight 'lock' on exactly who has this authorization. This is pretty much limited to the factory diagnostic tools, the Guardian (On-Star like) remote service providers and the UConnect radio. That's about it.

This makes it extremely difficult for the third-party programming products (such as the Tazer) to gain access to the internal controllers. So in order to get around this, these third-party tools 'bypass' the SGW entirely. This then allows any CAN message to be injected into the internal CAN Bus from any source (by anyone, or anything) without regard to any type of authentication. Essentially there is little to no digital security with a 'bypassed' SGW.

This is exactly how the third-party tools gain unfettered access, in order to be able to do their magic and provide their non-factory supported way-cool behaviors. This is also why they are relatively inexpensive. They just 'pirate' their way into your vehicle.

The real down-side is that this now allows any marginally skilled hacker potential access into your vital vehicle components as well. All they need is your cellular connected UConnect 4 radio's MAC (Media Access Control) Address. A pretty easy thing to do for even the most novice of hackers.

Once this addressing information is known, without the SGW provided firewall, there is really now nothing to stop them from injecting arbitrary CAN messages of their choosing into your vehicle. They can literally be as nefarious as they want to be.

Fortunately, some tools like the Tazer work in two modes of operation; 'Live' and 'Non-Live'. Unfortunately the really cool features work in the 'Live' mode where the Tazer must remain plugged-in at all times (the SGW must be bypassed) in order for it to function. Once 'married' these features must interactively communicate to one or more of the internal control modules in real-time (live) to work. ESS Disable, the various light shows and the 30 and 60 second timer features are all 'Live'.

On the other hand the 'Non-Live' features, such as tire size, TPMS thtesholds and LED lighting simply do just a one time configuration and therefore don't need to remain continuously plugged-in. Once 'married' and configured, the Tazer can then be safely removed (while still 'married') and the SGW can be reinstalled. In this mode, no digital security is then compromised. All external CAN access must again be crypto authenticated.

So only you can be the judge of just how 'cool' some of these 'Live' functions are relative to how much risk you're willing to live with. Some argue that this risk is really (really) small. But without the SGW installed there certainly now exists a non-zero probability that your vehicle may be exploited. Recall, Murphy's Law states that "if something CAN happen, given enough time it WILL happen".

I personally own and use the Tazer JL Mini myself. But use only it's 'Non-Live' capabilities. I should have purchased the much cheaper Tazer JL Lite which provides no 'Live' functionality. Oh well...

I really hope this answers your question. Many forum members chide me on my willingness to provide detailed posts. I'm glad to do so as long as it helps you or anyone else.

Happy and safe Jeeping...
Jay

 

[gpoverland]

Devon,

Your intuition is spot on. Yes the thing that gets disconnected is the Security Gateway Module (SGW). If this component is bypassed, such as using a Tazer, then on-board vehicle security is potentially compromised and unauthorized access (tampering) can occur. Not that it most definitely will, but it may.

The SGW can be thought of as a firewall for the vehicle's internal control bus. All the vital control components, the Engine, Transmission and Body Control Modules are all better protected from tampering with the SGW installed. The SGW only allows authenticated external Controller Area Network (CAN) protocol messages to pass into the internal communication network from any outside sources. This includes all the infotainment components such as the UConnect radio.

Authentication uses the latest industry standard encryption algorithms. It essentially requires that each and every message received must be from a trusted source. In other words, you must prove that you are in fact who you say you are AND that you have been pre-approved to communicate (send CAN messages) to any of the internal control modules.

Unfortunately, the automotive industry has a very tight 'lock' on exactly who has this authorization. This is pretty much limited to the factory diagnostic tools, the Guardian (On-Star like) remote service providers and the UConnect radio. That's about it.

This makes it extremely difficult for the third-party programming products (such as the Tazer) to gain access to the internal controllers. So in order to get around this, these third-party tools 'bypass' the SGW entirely. This then allows any CAN message to be injected into the internal CAN Bus from any source (by anyone, or anything) without regard to any type of authentication. Essentially there is little to no digital security with a 'bypassed' SGW.

This is exactly how the third-party tools gain unfettered access, in order to be able to do their magic and provide their non-factory supported way-cool behaviors. This is also why they are relatively inexpensive. They just 'pirate' their way into your vehicle.

The real down-side is that this now allows any marginally skilled hacker potential access into your vital vehicle components as well. All they need is your cellular connected UConnect 4 radio's MAC (Media Access Control) Address. A pretty easy thing to do for even the most novice of hackers.

Once this addressing information is known, without the SGW provided firewall, there is really now nothing to stop them from injecting arbitrary CAN messages of their choosing into your vehicle. They can literally be as nefarious as they want to be.

Fortunately, some tools like the Tazer work in two modes of operation; 'Live' and 'Non-Live'. Unfortunately the really cool features work in the 'Live' mode where the Tazer must remain plugged-in at all times (the SGW must be bypassed) in order for it to function. Once 'married' these features must interactively communicate to one or more of the internal control modules in real-time (live) to work. ESS Disable, the various light shows and the 30 and 60 second timer features are all 'Live'.

On the other hand the 'Non-Live' features, such as tire size, TPMS thtesholds and LED lighting simply do just a one time configuration and therefore don't need to remain continuously plugged-in. Once 'married' and configured, the Tazer can then be safely removed (while still 'married') and the SGW can be reinstalled. In this mode, no digital security is then compromised. All external CAN access must again be crypto authenticated.

So only you can be the judge of just how 'cool' some of these 'Live' functions are relative to how much risk you're willing to live with. Some argue that this risk is really (really) small. But without the SGW installed there certainly now exists a non-zero probability that your vehicle may be exploited. Recall, Murphy's Law states that "if something CAN happen, given enough time it WILL happen".

I personally own and use the Tazer JL Mini myself. But use only it's 'Non-Live' capabilities. I should have purchased the much cheaper Tazer JL Lite which provides no 'Live' functionality. Oh well...

I really hope this answers your question. Many forum members chide me on my willingness to provide detailed posts. I'm glad to do so as long as it helps you or anyone else.

Happy and safe Jeeping...
Jay

That was a perfect and thorough response. Thank you. I’m a fairly experience (26+ years) network/cyber architect; however, my experience is focused on typical IT related targets. I read the modules specta and thought it was the security gateway. The very device introduced to prevent hacks like those exposed a few years back where it was proven bad-actors could literally “hit the breaks” through the unconnect 3G connection. Thanks for the food for thought!

 

[DadJokes]

Devon,

Your intuition is spot on. Yes the thing that gets disconnected is the Security Gateway Module (SGW). If this component is bypassed, such as using a Tazer, then on-board vehicle security is potentially compromised and unauthorized access (tampering) can occur. Not that it most definitely will, but it may.

The SGW can be thought of as a firewall for the vehicle's internal control bus. All the vital control components, the Engine, Transmission and Body Control Modules are all better protected from tampering with the SGW installed. The SGW only allows authenticated external Controller Area Network (CAN) protocol messages to pass into the internal communication network from any outside sources. This includes all the infotainment components such as the UConnect radio.

Authentication uses the latest industry standard encryption algorithms. It essentially requires that each and every message received must be from a trusted source. In other words, you must prove that you are in fact who you say you are AND that you have been pre-approved to communicate (send CAN messages) to any of the internal control modules.

Unfortunately, the automotive industry has a very tight 'lock' on exactly who has this authorization. This is pretty much limited to the factory diagnostic tools, the Guardian (On-Star like) remote service providers and the UConnect radio. That's about it.

This makes it extremely difficult for the third-party programming products (such as the Tazer) to gain access to the internal controllers. So in order to get around this, these third-party tools 'bypass' the SGW entirely. This then allows any CAN message to be injected into the internal CAN Bus from any source (by anyone, or anything) without regard to any type of authentication. Essentially there is little to no digital security with a 'bypassed' SGW.

This is exactly how the third-party tools gain unfettered access, in order to be able to do their magic and provide their non-factory supported way-cool behaviors. This is also why they are relatively inexpensive. They just 'pirate' their way into your vehicle.

The real down-side is that this now allows any marginally skilled hacker potential access into your vital vehicle components as well. All they need is your cellular connected UConnect 4 radio's MAC (Media Access Control) Address. A pretty easy thing to do for even the most novice of hackers.

Once this addressing information is known, without the SGW provided firewall, there is really now nothing to stop them from injecting arbitrary CAN messages of their choosing into your vehicle. They can literally be as nefarious as they want to be.

Fortunately, some tools like the Tazer work in two modes of operation; 'Live' and 'Non-Live'. Unfortunately the really cool features work in the 'Live' mode where the Tazer must remain plugged-in at all times (the SGW must be bypassed) in order for it to function. Once 'married' these features must interactively communicate to one or more of the internal control modules in real-time (live) to work. ESS Disable, the various light shows and the 30 and 60 second timer features are all 'Live'.

On the other hand the 'Non-Live' features, such as tire size, TPMS thtesholds and LED lighting simply do just a one time configuration and therefore don't need to remain continuously plugged-in. Once 'married' and configured, the Tazer can then be safely removed (while still 'married') and the SGW can be reinstalled. In this mode, no digital security is then compromised. All external CAN access must again be crypto authenticated.

So only you can be the judge of just how 'cool' some of these 'Live' functions are relative to how much risk you're willing to live with. Some argue that this risk is really (really) small. But without the SGW installed there certainly now exists a non-zero probability that your vehicle may be exploited. Recall, Murphy's Law states that "if something CAN happen, given enough time it WILL happen".

I personally own and use the Tazer JL Mini myself. But use only it's 'Non-Live' capabilities. I should have purchased the much cheaper Tazer JL Lite which provides no 'Live' functionality. Oh well...

I really hope this answers your question. Many forum members chide me on my willingness to provide detailed posts. I'm glad to do so as long as it helps you or anyone else.

Happy and safe Jeeping...
Jay

Thanks for the information. So, to make sure, none of the JL Lite features are live and require it to remain plugged in? That’s what I’ve ordered. https://www.zautomotive.com/product/tazer-jl-lite/

 

[jeepoch]

Daniel,

I'm no Z Automotive expert. When I was ordering the Tazer, it sounded like the Lite was all I needed. All I really wanted was to set my tire size for the 35s I had just installed. The Dealership wanted a one time $125 fee for doing it.

However, after I started reading up on the Tazer in general it had me intrigued. So instead of being frugal, I dropped the extra on the Mini.

But to tell you the truth, I'm not exactly certain where the Lite functionality stops and the Mini starts. I do think there is more non-live features in the Mini. But I do know none of the live features are in the Lite.

Jay

 

[Shots]

...... But to tell you the truth, I'm not exactly certain where the Lite functionality stops and the Mini starts. ....

Here's a list of the features. You can see what the Mini does that the Lite doesn't.

 

[Shots]

..... Many forum members chide me on my willingness to provide detailed posts. I'm glad to do so as long as it helps you or anyone else.
......

I do usually do the same, but don't catch much flack about it. Either people think "freaking engineers" and then move on, or they just skim the post and read the shorter ones.
I think an articulate response like you posted, with information to support it is very valuable. On the down side they tend to be thread killers since it will usually eliminate speculation, debate or doubt which keeps posts coming in. I'll be surprised if this thread is active after a week.

 

[MacJack]

Good post you guys... I like detail. I'm taking out my Tazer Lite which I also upgraded to Mini for all the features.

Question is if I do just the Lite features, I can unplug the Tazer and they will be kept in the vehicle...?

 

[CapnKing]

I have tried everything and cannot unplug the 2 connectors to install the Mini. This is embarrassing! I know there are tabs on the back and can feel them but cannot depress them and pull down at the same time. Any suggestions are appreciated.

 

[MadDog27]

Have you tried removing the kick panel to help gain better access? If you pull on the wires carefully while holding the clips, it should release. Can be a pain the first time though.

 

[jeepoch]

Charlie,

The tabs are towards the front facing the engine compartment. They each press in just slightly. It doesn't take much effort. Don't try to push them in at the same time. Only do one at a time. Once you have one loose just pull it down just enough to clear the connector then tackle the other.

I've probably had my Tazer connected dozens of times now. It takes me about thirty seconds. I found it easier to start by placing a flashlight down near the accelerator and leaning in just enough to peek under looking up. Granted, this isn't the most comfortable position but better than feeling around in the dark.

The connectors are pretty easy with a light touch one at a time.

As a last resort, you can always remove the kick panel under the steering wheel to get even more room. Unfortunately, I can't give you much advise there. Never done it.

I also believe Z Automotive also sells a little extender cable giving you a little more wiggle room if all else fails. Another piece of advise though; make up your mind to either use the 'Live' features and leave the Tazer always plugged in or use the 'Non-Live' features and once married (and configured) plug everything back up to the Security Gateway Module. Leaving the connectors disconnected will blow a fault code.

Jay

 

[CapnKing]

Thanks MadDog and Jay! I have removed the panel--will give it another try tomorrow. I do plan on leaving it in place.

 

[Rhinebeck01]

I have tried everything and cannot unplug the 2 connectors to install the Mini. This is embarrassing! I know there are tabs on the back and can feel them but cannot depress them and pull down at the same time. Any suggestions are appreciated.

@CapnKing

I urge you to hold off on doing this deed for a few days... Do order the SGW Extension Cable, first.
Then, after you get the SGW Extension Cable, disconnect the connectors at the gateway and install the SGW Extension Cable.

Reason why.... Because you are going to be having to connect and reconnect your Tazer JL Mini, many times over the course of your ownership of your JL. Regardless of whether you leave the Tazer JL Mini attached 24/7, 365... or even if you don't use "Live Features" and leave the Tazer JL Mini unattached...... you still MUST hook up the Tazer JL Mini, and unmarry the Tazer JL Mini before you bring the JL to the stealership Service Dept. Then when you get the vehicle back, you hookup the Tazer JL Mini and remarry it....

Buy the mentioned extension and you will only have to deal with those two connectors up there once.. and after that removing the Tazer JL Mini will be no issue at all for you.

By the way, when you go to disconnect the cables. First, push up firmly.... force the cable into the connector...... now push in on the connector's release on the back of the cable, and at the exact same time /while still holding the release in, firmly pull down on the cable.. A little wiggle of the cable as you pull on it, also helps to get the connector free.

Sometimes a teen or Gal pal can do the deed without trouble as their hands are smaller... finger's more nimble.

https://www.zautomotive.com/product/z_sgw_ext/

Sponsored