The UK's charging infrastructure is patchy at best. At worst it is a confusing mess of incompatible standards, over-priced chargers, and woefully inadequate central planning.

The only time I had to hire a regular car was when ferrying my in-laws to the airport. The i3 is spacious - but not big enough for four adults and seven suitcases!

I'm firmly committed to EVs (electric vehicles), but my next car won't be an i3. In fact, I think it is unlikely that I'll ever drive a BMW again.

Cost

The i3 is a company car. My old employer paid for the lease, and I paid the tax on the benefit I receive. In the UK the tax rates for electric vehicles are incredibly low - so I was isolated from the capital cost of the vehicle. There are also discounts on the London congestion charge.

The i3 was stupidly expensive. It's a high-tech bit of kit, but I got tired of BMW trying to extract every extra penny out of me.

• Want a charging cable for your car? That's extra!
• Reversing camera and sensors? Extra cost!
• Adaptive Cruise Control? It's pretty nifty but you have to pay to get the entire interior upgraded just to get the steering wheel with the correct buttons.

Most other EVs come with those things as standard. BMW say that most i3 drivers are new to the BMW brand. That's certainly true in my case. But BMW's attitude to selling cars hasn't caught up with its high tech manufacturing. A bewildering array of options, hidden behind a website which barely works, each priced based on numbers plucked from thin air.

Getting the car was, frankly, a nasty experience. But it pales in comparison to the real horrors the car has in store.

Crappy Software

Several of the i3's features fail to work.

• Adaptive Cruise Control is meant to keep your distance from the car in front. It doesn't work if the sun is too low in the sky. Like, you know, when you're commuting. It also randomly fails with an alarming "bong" noise, if the screen mists up or it starts raining. Which brings me on to...
• The automatic windscreen wipers aren't very sensitive. Maybe it doesn't rain in Germany, but in the UK wipers are a necessity. Sometimes they just wouldn't react to the buckets of rain falling onto the car. Still, at least the car is easy to park, right?
• The auto-parallel parking is... eccentric. I know I'm lazy for not parking myself, but that's why I'm paying silly money for the car. Sometimes the sensors wouldn't see the gap to park in, sometimes the car would hit the kerb, sometimes the parking would stop mid-manoeuvre. Oh well, at least the GPS gets you where you're going, eh?
• The navigation software was a disappointment. I was expecting buttery-smooth 30fps animation - but I got a shuddery mess. The interface was painful to use and updates came through a paid for USB stick. I stuck with the free Google Maps app on my phone and had a much nicer experience. Even the navigation prompts came through Bluetooth. Mostly.
• Bluetooth is too hard for BMW. I got bored with all the little niggles with the entertainment system - scroll wheels which wouldn't work, lack of cover art, random sound drop outs. Small issues, yes, but when you're paying this much for a car, you expect a better service.
• Updates are woefully delivered. There's a 3G modem in the car, but you have to update manually with yet another USB stick.
• I've detailed just how bad the i3's web browser is before - so I didn't get that particular option.
• There is a mobile app. It's slow, poorly localised, and features some truly hideous design decisions.
• It is meant to send email alerts when charging is interrupted or the battery is low. The mails are poorly designed and sometimes come hours after they would have been useful.

Luckily I never had cause to use the pedestrian detection feature, but I have severe doubts that it would have performed as intended.

The i3 is an amazing car to drive, but it is a terrible car to use.

The Drive

Amazing. Seriously. It left me with a smile on my face after every drive. It is as silent as a ninja and as fast as... err... another ninja!

The steering responded to the merest touch of the wheel and the car leaped forward at the lights and left others in its dust. The i3 uses regenerative braking - as soon as you lift off the accelerator pedal, the car begins to slow down as it harvests kinetic energy to recharge the battery. Driven correctly, you should never need to touch the brake pedal.

With all that said, the ride is very stiff and bumpy. Great on motorways, but on the more dilapidated streets it feels like running in plimsolls. Maybe the average BMW owner is too rich to drive on anything but the finest surfaces?

I put 12,000 miles on the i3 in a year. Without a doubt this car is the quickest, most fun, and most pleasant drive there is.

Charging

The vast majority of my charging was done at home. With a 7kW charger fitted I was able to go from empty to full in 4 hours. Parked overnight and full in the morning. Perfect!

My employers were generous enough to install some free chargers at work. These were supplied by PodPoint and, I'm sorry to say, not very reliable. We were never sure if it was a poor installation, an incompatible car, or simply defective units - but the points would fail and leave some people limping along to the next nearest point. I was lucky - the 80 mile range of the i3 was enough to get me to work and back on a single charge.

When I started driving the i3 a year ago, there were only a few EVs in our car park - now it is full of Leafs, Outlanders, and the occasional Tesla. They're now putting in several regular plug sockets. If you're going to be at work for 8 hours, it doesn't really matter how fast your car charges, does it?

And so we come on to the sorry state of public charging. In a sensible world, councils and businesses would stick up free charging spots to encourage EVs. The cost of electricity is negligible (less than £3 to fill one up), but you could always recoup the money with a contactless credit card reader. Easy, no?

No. Instead we have a dozen incompatible charging schemes, each of which requires their own RFID card or mobile app. Got a card for charging in London? It won't work when charging in Norwich! Want £2 worth of electricity? Download our app, register, and pay £6. Plus parking costs!

That's before we get on to broken points, incompatible charging sockets, and petrol cars parking in front of the chargers. GAH!

On the plus side, the "Rapid" chargers will take the i3 from empty to 80% in 30 minutes. Frankly, after a few hours of driving, having a 30 minute mandatory break for food and rest is probably a good idea!

If you only drive within the range of your EV, it's a beautiful and stress free experience. If you have to rely on the vagaries of the UK charging network... well, you better start collecting a wide range of RFID cards and hope for the best!

I cheated and got the i3 Rex. It has a small petrol tank (9 litres) which can recharge the battery as you drive. Over the year, I think I filled it up about 6 times. Half of those were because I couldn't be bothered to wait for a charge, the rest because of charging failures.

What's Next?

As I change jobs, the i3 is going back. I looked at getting a replacement for my personal use - but I just couldn't justify the price. I've gone for a Renault Zoe - it's not as glamorous, but has a longer range and costs a fraction of the i3.

There are several EVs which cost less than the i3 and come with more features. Perhaps the Zoe's software won't be any better (it couldn't be any worse) - but at least I won't feel like I'm being charged a premium price for a second rate product.

The i3 is a disappointment simply because it shows so much promise. It steers itself in a traffic jam and can park itself! But you're never confident that the software won't crap out at an inconvenient time.

EVs are the future of personal driving. The cost is approaching parity with petrol cars. The range is already suitable for the majority of drivers. Charging at home and work solves most of the problems of poor infrastructure. The software is getting better all the time.

The i3 is a tantalising glimpse at what mass market EVs could be - but it falls short of glory.

Earlier this month I accidentally kicked off a minor kerfuffle over whether BMW was respecting the GPL. Their i3 car contains a huge amount of Open Source Software and there was some confusion as to BMW's compliance with the licence terms.

I took a look through the car's user interface and, hidden away, was this email address.

I dropped them an email. And then a reminder.

Well, today I received this letter in the post:

With this ancient piece of spinning media :-)

That's 950MB of open source goodness!

Mirror

To save you having to get a DVD shipped to your location, I've mirrored the files on GitHub. A file tree is also provided at the end of this blog post.

Lots of interesting - and outdated - software packages in there.

Lessons

• In my original blog post, I speculated on BMW's GPL compliance, that was irresponsible of me.
• Large companies move slowly. It's tempting to go off on a Twitter crusade if you haven't heard back after five minutes. Patience, grasshopper.
• Customer service agents are geared up to deal with normal queries. It's unfair to take them to task for not understanding software licences.
• BMW would do well to set up a simple website or FTP site containing all of this data. Or, at the very least, making it more obvious how to obtain it.
• Open Source Software is wonderful!

File Listing

You can download from GitHub - but here's a quick list of everything on the DVD. Enjoy!

.
├── [7.1M Sep 14  2011]  1000-com.st.havana.kernel-207-7.patch
├── [2.0K Mar 16 14:32]  alsa-intf-git-r3
│   └── [202K Jul  8  2014]  alsa-intf-git-r3-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  alsa-lib
│   ├── [ 558 Jul  8  2014]  alsa-lib-1.0.24.1-r1-patches.tar.gz
│   └── [813K Jul  8  2014]  alsa-lib-1.0.24.1.tar.bz2
├── [790K Feb  9  2012]  alsa-lib-1.0.21a-23.tar.bz2
├── [992K Feb  9  2012]  alsa-utils-1.0.16.tar.bz2
├── [ 24K Feb  9  2012]  anacron-2.3.tar.gz
├── [2.4M Jan 26  2012]  apache-etch-1.1.0-incubating-src.zip
├── [1.1M Jan 26  2012]  apr-1.3.8.tar.gz
├── [1.2M Jan 26  2012]  asn1c-0.9.21.tar.gz
├── [1.4M Sep 23  2013]  asn1c-0.9.24.tar.gz
├── [2.0K Mar 16 14:32]  atk
│   └── [729K Jul  8  2014]  atk-2.2.0.tar.bz2
├── [2.0K Mar 16 14:32]  attr
│   ├── [ 666 Jul  8  2014]  attr-2.4.46-r3-patches.tar.gz
│   └── [330K Jul  8  2014]  attr-2.4.46.src.tar.gz
├── [2.0K Mar 16 14:32]  audiorouter-git-r1
│   └── [ 20K Jul  8  2014]  audiorouter-git-r1-prepatch.tar.gz
├── [ 56K Feb  9  2012]  autofs-3.1.7.tar.bz2
├── [2.0K Mar 16 14:32]  base-files
│   └── [3.4K Jul  8  2014]  base-files-1.0-r3-patches.tar.gz
├── [2.0K Mar 16 14:32]  base-passwd
│   ├── [1.5K Jul  8  2014]  base-passwd-3.5.22-r10-patches.tar.gz
│   └── [ 71K Jul  8  2014]  base-passwd_3.5.22.tar.gz
├── [ 45K Feb  9  2012]  base-passwd-3.5.9.tar.gz
├── [2.3M Feb  9  2012]  bash-3.0.tar.gz
├── [272K Feb  9  2012]  bc-1.06.tar.gz
├── [ 87K Feb 10  2012]  BigDigits-2.3.0.zip
├── [2.0K Mar 16 14:32]  bigreqsproto
│   └── [100K Jul  8  2014]  bigreqsproto-1.1.1.tar.bz2
├── [ 15M Feb  9  2012]  binutils-2.19.1.tar.bz2
├── [2.0K Mar 16 14:32]  busybox
│   ├── [ 14K Jul  8  2014]  busybox-1.18.5-r44.0-patches.tar.gz
│   └── [2.0M Jul  8  2014]  busybox-1.18.5.tar.bz2
├── [2.0M Feb  9  2012]  busybox-1.18.2.tar.bz2
├── [2.0K Mar 16 14:32]  cairo
│   └── [ 22M Jul  8  2014]  cairo-1.10.2.tar.gz
├── [592K Mar  8  2013]  capu-2012.zip
├── [653K Feb  9  2012]  console-tools-0.2.3.tar.gz
├── [ 58K Feb  9  2012]  cron-3.0pl1.orig.tar.gz
├── [2.0K Mar 16 14:32]  cronie
│   ├── [1.0K Jul  8  2014]  cronie-1.4.8-r2-patches.tar.gz
│   └── [205K Jul  8  2014]  cronie-1.4.8.tar.gz
├── [2.0K Mar 16 14:32]  cups
│   ├── [1.2K Jul  8  2014]  cups-1.4.6-r2-patches.tar.gz
│   └── [4.3M Jul  8  2014]  cups-1.4.6-source.tar.bz2
├── [3.3M Jan 26  2012]  curl-7.21.0.zip
├── [2.0K Mar 16 14:32]  dbus
│   ├── [2.1K Jul  8  2014]  dbus-1.4.16-r1.0-patches.tar.gz
│   └── [1.8M Jul  8  2014]  dbus-1.4.16.tar.gz
├── [2.0K Mar 16 14:32]  dbus-glib
│   ├── [ 530 Jul  8  2014]  dbus-glib-0.92-r1-patches.tar.gz
│   └── [671K Jul  8  2014]  dbus-glib-0.92.tar.gz
├── [131K Feb  9  2012]  debianutils_3.2.1.tar.gz
├── [479K Feb  9  2012]  deltarpm-3.4.tar.bz2
├── [ 174 Feb 11  7:02]  desktop.ini
├── [3.3M Jan 26  2012]  DevIL-1.7.8.zip
├── [1.0M Feb  9  2012]  dhcp-4.1.0a1.tar.gz
├── [2.0K Mar 16 14:32]  dhcpcd
│   └── [ 69K Jul  8  2014]  dhcpcd-5.2.10.tar.bz2
├── [2.7M Nov 24  2011]  DiBcom_SDK_Release_8.11.18.GPL.tar.gz
├── [1.9M Feb  9  2012]  DirectFB-1.4.3.STM2010.03.10.tar.bz2
├── [2.0K Mar 16 14:32]  dnsmasq
│   ├── [5.0K Jul  8  2014]  dnsmasq-2.55-r2-patches.tar.gz
│   └── [431K Jul  8  2014]  dnsmasq-2.55-r2-prepatch.tar.gz
├── [393K Feb  9  2012]  dnsmasq-2.50.tar.gz
├── [2.0K Mar 16 14:32]  e2fsprogs
│   ├── [2.8K Jul  8  2014]  e2fsprogs-1.42-r1-patches.tar.gz
│   └── [5.4M Jul  8  2014]  e2fsprogs-1.42.tar.gz
├── [2.0K Mar 16 14:32]  eglibc
│   ├── [5.5K Jul  8  2014]  eglibc-2.13-r20+svnr15508-patches.tar.gz
│   └── [ 22M Jul  8  2014]  eglibc-2.13-r20+svnr15508-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  eglibc-initial
│   ├── [5.5K Jul  8  2014]  eglibc-initial-2.13-r20+svnr15508-patches.tar.gz
│   └── [ 22M Jul  8  2014]  eglibc-initial-2.13-r20+svnr15508-prepatch.tar.gz
├── [127K Feb  9  2012]  ethtool-6.tar.gz
├── [2.0K Mar 16 14:32]  eventlog
│   └── [296K Jul  8  2014]  eventlog_0.2.12.tar.gz
├── [2.0K Mar 16 14:32]  exosip
│   └── [222K Jul  8  2014]  exosip-3.5.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  exosip4
│   └── [247K Jul  8  2014]  exosip4-4.0.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  expat
│   ├── [ 543 Jul  8  2014]  expat-2.0.1-r1-patches.tar.gz
│   └── [436K Jul  8  2014]  expat-2.0.1.tar.gz
├── [ 16K Feb 10  2012]  ezxml-0.8.6.tar.gz
├── [2.0K Mar 16 14:32]  fastjar
│   ├── [1.4K Jul  8  2014]  fastjar-0.98-r1-patches.tar.gz
│   └── [701K Jul  8  2014]  fastjar-0.98.tar.gz
├── [ 27K Feb  9  2012]  fbset_2.1.orig.tar.gz
├── [760K Feb  9  2012]  findutils_4.1.20.orig.tar.gz
├── [2.0K Mar 16 14:32]  flex
│   └── [1.2M Jul  8  2014]  flex-2.5.35.tar.bz2
├── [2.0K Mar 16 14:32]  fontconfig
│   ├── [ 534 Jul  8  2014]  fontconfig-2.8.0-r4-patches.tar.gz
│   └── [1.5M Jul  8  2014]  fontconfig-2.8.0.tar.gz
├── [2.0K Mar 16 14:32]  FreeScale
│   ├── [4.7M Jan 30  2015]  linux-2.6.35.3-imx_10.12.01.bz2
│   └── [ 67M Jan 30  2015]  linux-2.6.35.3.tar.bz2
├── [2.0K Mar 16 14:32]  freetype
│   ├── [ 399 Jul  8  2014]  freetype-2.4.8-r0-patches.tar.gz
│   └── [1.4M Jul  8  2014]  freetype-2.4.8.tar.bz2
├── [1.4M Feb  9  2012]  freetype-2.3.11.tar.bz2
├── [160K Jan 26  2012]  freetype-doc-2.1.10.tar.bz2
├── [653K Aug 19  2011]  fribidi-0.19.2.tar.gz
├── [156K Feb  9  2012]  ft2demos-2.3.11.tar.bz2
├── [ 63M Feb  9  2012]  gcc-4.5.0.tar.bz2
├── [ 20M Feb  9  2012]  gdb-6.8.tar.gz
├── [2.0K Mar 16 14:32]  gdk-pixbuf
│   ├── [1.2K Jul  8  2014]  gdk-pixbuf-2.24.0-r2-patches.tar.gz
│   └── [1.6M Jul  8  2014]  gdk-pixbuf-2.24.0.tar.bz2
├── [2.0K Mar 16 14:32]  giflib
│   └── [494K Jul  8  2014]  giflib-4.1.6.tar.bz2
├── [ 15M Feb  9  2012]  glibc-2.10.1.tar.bz2
├── [571K Feb  9  2012]  glibc-ports-2.10.1.tar.bz2
├── [3.9M Jul  3  2014]  glm-0.9.5.3.zip
├── [2.0K Mar 16 14:32]  gnujaf
│   ├── [153K Jul  8  2014]  activation-1.1.1.tar.gz
│   └── [1.1K Jul  8  2014]  gnujaf-1.1.1-r1-patches.tar.gz
├── [2.0K Mar 16 14:32]  gnumail
│   ├── [ 522 Jul  8  2014]  gnumail-1.1.2-r1-patches.tar.gz
│   └── [310K Jul  8  2014]  mail-1.1.2.tar.gz
├── [2.0K Mar 16 14:32]  gtk+
│   ├── [4.0K Jul  8  2014]  gtk+-2.24.8-r1-patches.tar.gz
│   └── [ 16M Jul  8  2014]  gtk+-2.24.8.tar.bz2
├── [2.0K Mar 16 14:32]  hostap-git-r3
│   └── [2.2M Jul  8  2014]  hostap-git-r3-prepatch.tar.gz
├── [338K Feb  9  2012]  ifupdown_0.6.7.tar.gz
├── [2.0K Mar 16 14:32]  inetlib
│   ├── [ 528 Jul  8  2014]  inetlib-1.1.1-r1-patches.tar.gz
│   └── [238K Jul  8  2014]  inetlib-1.1.1.tar.gz
├── [2.0K Mar 16 14:32]  initscripts
│   └── [ 16K Jul  8  2014]  initscripts-1.0-r129-patches.tar.gz
├── [2.0K Mar 16 14:32]  inputproto
│   └── [152K Jul  8  2014]  inputproto-2.0.2.tar.bz2
├── [2.0K Mar 16 14:32]  iproute2
│   ├── [1014 Jul  8  2014]  iproute2-3.2.0-r0-patches.tar.gz
│   └── [521K Jul  8  2014]  iproute2-3.2.0-r0-prepatch.tar.gz
├── [362K Feb  9  2012]  iproute2-2.6.33.tar.bz2
├── [2.0K Mar 16 14:32]  iptables
│   └── [462K Jul  8  2014]  iptables-1.4.12.1.tar.bz2
├── [ 87K Feb  9  2012]  iputils-s20071127.tar.bz2
├── [102K Feb 10  2012]  jasherai-oniguruma-09254fa.zip
├── [2.0K Mar 16 14:32]  jpeg-8c-r3
│   ├── [ 12K Jul  8  2014]  jpeg-8c-r3-patches.tar.gz
│   └── [964K Jul  8  2014]  jpegsrc.v8c.tar.gz
├── [938K Feb  9  2012]  jpegsrc.v7.tar.gz
├── [968K Jan 26  2012]  jpegsrc.v8d.tar.gz
├── [115K Jul  3  2014]  jsoncpp-src-0.6.0-rc2.tar.gz
├── [2.0K Mar 16 14:32]  kbd
│   └── [1016K Jul  8  2014]  kbd-1.15.2.tar.bz2
├── [2.0K Mar 16 14:32]  kbproto
│   └── [109K Jul  8  2014]  kbproto-1.0.5.tar.bz2
├── [2.0K Mar 16 14:32]  keymaps
│   └── [7.1K Jul  8  2014]  keymaps-1.0-r20-patches.tar.gz
├── [ 37K Feb  9  2012]  keyutils-1.2.tar.bz2
├── [286K Feb  9  2012]  less-394.tar.gz
├── [2.0K Mar 16 14:32]  libasrc
│   └── [ 36K Jul  8  2014]  libasrc-1.0.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  libcap
│   └── [ 59K Jul  8  2014]  libcap-2.22.tar.bz2
├── [ 52K Feb  9  2012]  libcap-2.16.tar.gz
├── [2.0K Mar 16 14:32]  libffi
│   └── [736K Jul  8  2014]  libffi-3.0.10.tar.gz
├── [2.0K Mar 16 14:32]  libgcrypt
│   ├── [1.0K Jul  8  2014]  libgcrypt-1.5.0-r0-patches.tar.gz
│   └── [1.7M Jul  8  2014]  libgcrypt-1.5.0.tar.gz
├── [2.0K Mar 16 14:32]  libgpg-error
│   ├── [1.0K Jul  8  2014]  libgpg-error-1.10-r1-patches.tar.gz
│   └── [429K Jul  8  2014]  libgpg-error-1.10.tar.bz2
├── [2.0K Mar 16 14:32]  libhardware-git-r4
│   ├── [ 899 Jul  8  2014]  libhardware-git-r4-patches.tar.gz
│   └── [ 39K Jul  8  2014]  libhardware-git-r4-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  libice
│   └── [316K Jul  8  2014]  libICE-1.0.7.tar.bz2
├── [2.0K Mar 16 14:32]  lib-libmnl
│   └── [ 45K Jul  8  2014]  lib-libmnl-1.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  liblinenoise
│   └── [ 13K Jul  8  2014]  liblinenoise-1.0-r0-prepatch.tar.gz
├── [522K Feb  9  2012]  libmtp-0.2.6.1.tar.gz
├── [2.0K Mar 16 14:32]  libogg
│   └── [415K Jul  8  2014]  libogg-1.3.0.tar.gz
├── [803K Feb  9  2012]  liboil-0.3.15.tar.gz
├── [2.0K Mar 16 14:32]  libol
│   └── [338K Jul  8  2014]  libol-0.3.18.tar.gz
├── [2.0K Mar 16 14:32]  libpcap
│   ├── [ 550 Jul  8  2014]  libpcap-1.1.1-r1-patches.tar.gz
│   └── [568K Jul  8  2014]  libpcap-1.1.1.tar.gz
├── [508K Feb  9  2012]  libpcap-0.9.8.tar.gz
├── [615K Feb  9  2012]  libpng-1.2.40.tar.bz2
├── [805K Jan 26  2012]  libpng-1.4.3.tar.gz
├── [2.0K Mar 16 14:32]  libpthread-stubs
│   └── [199K Jul  8  2014]  libpthread-stubs-0.3.tar.bz2
├── [2.0K Mar 16 14:32]  libsm
│   └── [278K Jul  8  2014]  libSM-1.2.0.tar.bz2
├── [2.0K Mar 16 14:32]  libtool-cross
│   ├── [2.5M Jul  8  2014]  libtool-2.4.2.tar.gz
│   └── [7.1K Jul  8  2014]  libtool-cross-2.4.2-r1.1-patches.tar.gz
├── [380K Feb  9  2012]  libusb-0.1.12.tar.gz
├── [2.0K Mar 16 14:32]  libusb1
│   └── [324K Jul  8  2014]  libusb-1.0.8.tar.bz2
├── [2.0K Mar 16 14:32]  libusb-compat
│   ├── [245K Jul  8  2014]  libusb-compat-0.1.3.tar.bz2
│   └── [ 606 Jul  8  2014]  libusb-compat-1_0.1.3-r2-patches.tar.gz
├── [2.0K Mar 16 14:32]  libx11
│   ├── [ 975 Jul  8  2014]  libx11-1.4.4-r0-patches.tar.gz
│   └── [2.2M Jul  8  2014]  libX11-1.4.4.tar.bz2
├── [2.0K Mar 16 14:32]  libxau
│   └── [255K Jul  8  2014]  libXau-1.0.6.tar.bz2
├── [2.0K Mar 16 14:32]  libxcb
│   └── [364K Jul  8  2014]  libxcb-1.8.tar.bz2
├── [2.0K Mar 16 14:32]  libxdmcp
│   └── [282K Jul  8  2014]  libXdmcp-1.1.0.tar.bz2
├── [2.0K Mar 16 14:32]  libxext
│   └── [333K Jul  8  2014]  libXext-1.3.0.tar.bz2
├── [2.0K Mar 16 14:32]  libxi
│   └── [413K Jul  8  2014]  libXi-1.4.3.tar.bz2
├── [2.0K Mar 16 14:32]  libxinerama
│   └── [260K Jul  8  2014]  libXinerama-1.1.1.tar.bz2
├── [2.0K Mar 16 14:32]  libxml2
│   ├── [ 827 Jul  8  2014]  libxml2-2.7.8-r5-patches.tar.gz
│   └── [4.7M Jul  8  2014]  libxml2-2.7.8.tar.gz
├── [2.0K Mar 16 14:32]  libxrender
│   └── [252K Jul  8  2014]  libXrender-0.9.6.tar.bz2
├── [2.0K Mar 16 14:32]  libxt
│   ├── [ 577 Jul  8  2014]  libxt-1_1.1.1-r1-patches.tar.gz
│   └── [699K Jul  8  2014]  libXt-1.1.1.tar.bz2
├── [2.0K Mar 16 14:32]  libxtst
│   └── [275K Jul  8  2014]  libXtst-1.2.0.tar.bz2
├── [2.0K Mar 16 14:32]  linphone
│   ├── [1.1K Jul  8  2014]  linphone-3.5.2-r0-patches.tar.gz
│   └── [6.6M Jul  8  2014]  linphone-3.5.2-r0-prepatch.tar.gz
├── [ 61M Feb 14  2012]  linux-2.6.32.28.tar.bz2
├── [2.0K Mar 16 14:32]  linux-libc-headers
│   ├── [ 74M Jul  8  2014]  linux-3.1.tar.bz2
│   └── [ 756 Jul  8  2014]  linux-libc-headers-3.1-r1-patches.tar.gz
├── [2.0K Mar 16 14:32]  linux-quic-git-2186caf8a22515c67d814a04143f421a789b874d-r3
│   ├── [102M Jul  8  2014]  linux-quic.tar.gz
│   └── [   0 Jul  8  2014]  symlinks_resolved
├── [713K Feb  9  2012]  lirc-0.8.6.tar.bz2
├── [2.0K Mar 16 14:32]  lk-git-r3
│   ├── [ 694 Jul  8  2014]  lk-git-r3-patches.tar.gz
│   └── [3.2M Jul  8  2014]  lk-git-r3-prepatch.tar.gz
├── [840K Feb  9  2012]  lm_sensors-2.9.2.tar.gz
├── [2.0K Mar 16 14:32]  loc-api-git-r3
│   └── [279K Jul  8  2014]  loc-api-git-r3-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  loc-api-test
│   └── [9.2K Jul  8  2014]  loc-api-test-1.0-r2-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  logrotate
│   ├── [ 627 Jul  8  2014]  logrotate-3.7.9-r1-patches.tar.gz
│   └── [ 44K Jul  8  2014]  logrotate-3.7.9.tar.gz
├── [273K Feb  9  2012]  ltrace_0.5.1.orig.tar.gz
├── [212K Jan 26  2012]  lua-5.1.4.tar.gz
├── [916K Feb  9  2012]  LVM2.2.02.73.tgz
├── [528K Jan 14  2014]  lwip-1.3.0.zip
├── [2.0K Mar 16 14:32]  lzo
│   ├── [2.4K Jul  8  2014]  lzo-2.06-r1-patches.tar.gz
│   └── [569K Jul  8  2014]  lzo-2.06.tar.gz
├── [9.7K Feb  9  2012]  makedev-2.3.1.tar.gz
├── [2.0K Mar 16 14:32]  mediastreamer2
│   └── [537K Jul  8  2014]  mediastreamer2-2.8.8-r0-prepatch.tar.gz
├── [2.7K Jul  8  2011]  memio-1.1.tar.bz2
├── [ 21K Feb  9  2012]  memstat_0.4.tar.gz
├── [120K Feb  9  2012]  module-init-tools-3.1.tar.bz2
├── [102K Mar  7  2013]  mongoose-3.0.tgz
├── [2.0K Mar 16 14:32]  ncurses
│   ├── [ 898 Jul  8  2014]  ncurses-5.9-r9.1-patches.tar.gz
│   └── [2.7M Jul  8  2014]  ncurses-5.9.tar.gz
├── [2.2M Feb  9  2012]  ncurses-5.5.tar.gz
├── [2.0K Mar 16 14:32]  netbase
│   ├── [1.4K Jul  8  2014]  netbase-4.47-r0-patches.tar.gz
│   └── [ 35K Jul  8  2014]  netbase_4.47.tar.gz
├── [ 32K Feb  9  2012]  netbase_4.34.tar.gz
├── [131K Feb  9  2012]  netkit-telnet_0.17.tar.gz
├── [ 20K Feb  9  2012]  netkit-tftp_0.10.orig.tar.gz
├── [259K Feb  9  2012]  net-tools_1.60.orig.tar.gz
├── [260K Feb  9  2012]  nfs-utils-1.0.6.tar.gz
├── [3.2M Feb  9  2012]  ntp-4.2.4p7.tar.gz
├── [1.2M Feb  9  2012]  nvi-1.79.tar.gz
├── [2.0K Mar 16 14:32]  ocf-linux-20100325-r3
│   └── [596K Jul  8  2014]  ocf-linux-20100325.tar.gz
├── [1.9M Sep 15  2014]  OpenCTM-1.0.3-src.zip
├── [2.0K Mar 16 14:32]  openjdk-7-jre-25b30
│   ├── [ 65M Jul  8  2014]  openjdk-7-jre-25b30-2.3.12-r5.1-patches.tar.gz
│   └── [4.4M Jul  8  2014]  openjdk-7-jre-25b30-2.3.12-r5.1-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  open-source-kernel-tests-git-r2
│   └── [ 21K Jul  8  2014]  open-source-kernel-tests-git-r2-prepatch.tar.gz
├── [1016K Feb  9  2012]  openssh-5.1p1.tar.gz
├── [2.0K Mar 16 14:32]  openssl
│   ├── [ 31K Jul  8  2014]  openssl-1.0.0f-r15.0-patches.tar.gz
│   └── [3.9M Jul  8  2014]  openssl-1.0.0f.tar.gz
├── [3.6M Jan 26  2012]  openssl-0.9.8j.tar.gz
├── [3.7M Jan 26  2012]  openssl-0.9.8k.tar.gz
├── [3.8M Feb  9  2012]  openssl-1.0.0a.tar.gz
├── [2.0K Mar 16 14:32]  opkg
│   ├── [5.0K Jul  8  2014]  opkg-1_0.1.8+svnr633-r7.0-patches.tar.gz
│   └── [170K Jul  8  2014]  opkg-1_0.1.8+svnr633-r7.0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  ortp
│   └── [176K Jul  8  2014]  ortp-0.20.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  osip
│   └── [355K Jul  8  2014]  osip-3.5.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  osip4
│   └── [359K Jul  8  2014]  osip4-4.0.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  pango
│   ├── [3.5K Jul  8  2014]  pango-1.28.4-r6-patches.tar.gz
│   └── [2.0M Jul  8  2014]  pango-1.28.4-r6-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  perl
│   ├── [ 49K Jul  8  2014]  perl-5.14.2-r2-patches.tar.gz
│   └── [ 15M Jul  8  2014]  perl-5.14.2.tar.gz
├── [2.0K Mar 16 14:32]  pimd-git-r1
│   ├── [ 632 Jul  8  2014]  pimd-git-r1-patches.tar.gz
│   └── [235K Jul  8  2014]  pimd-git-r1-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  pixman
│   └── [457K Jul  8  2014]  pixman-0.24.2.tar.bz2
├── [382K Feb  9  2012]  pmount_0.9.20.orig.tar.gz
├── [2.0K Mar 16 14:32]  popt
│   └── [686K Jul  8  2014]  popt-1.16.tar.gz
├── [ 18K Feb  9  2012]  portmap_5beta.tar.gz
├── [2.0K Mar 16 14:32]  powerapp-git-r5
│   └── [5.3K Jul  8  2014]  powerapp-git-r5-prepatch.tar.gz
├── [275K Feb  9  2012]  procps-3.2.7.tar.gz
├── [1.8M Jan 14  2014]  protobuf-2.3.0.tar.gz
├── [2.4M Jan 26  2012]  protobuf-2.4.1.zip
├── [565K Jan 14  2014]  ptpd-2.1.0.tar.gz
├── [2.0K Mar 16 14:32]  reboot-daemon
│   └── [3.0K Jul  8  2014]  reboot-daemon-1.0-r2-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  recordproto
│   └── [110K Jul  8  2014]  recordproto-1.14.1.tar.bz2
├── [2.0K Mar 16 14:32]  renderproto
│   └── [103K Jul  8  2014]  renderproto-0.11.1.tar.bz2
├── [  44 Feb 10  2012]  rootfs readme.txt
├── [2.0K Mar 16 14:32]  run-postinsts
│   └── [ 536 Jul  8  2014]  run-postinsts-1.0-r7-patches.tar.gz
├── [ 90K Feb  9  2012]  SaWMan-1.4.3+git0.9dd19ef38313.tar.gz
├── [ 51K Feb  9  2012]  setserial_2.17.orig.tar.gz
├── [ 26K Aug 26  2013]  SHA1INDEX.idx
├── [2.0K Mar 16 14:32]  shadow
│   ├── [3.1K Jul  8  2014]  shadow-4.1.4.3-r7-patches.tar.gz
│   └── [1.7M Jul  8  2014]  shadow-4.1.4.3.tar.bz2
├── [1.6M Feb  9  2012]  shadow-4.1.2.tar.bz2
├── [2.0K Mar 16 14:32]  shadow-sysroot
│   └── [4.6K Jul  8  2014]  shadow-sysroot-4.1.4.3-r0-patches.tar.gz
├── [2.0K Mar 16 14:32]  shared-mime-info
│   ├── [478K Jul  8  2014]  shared-mime-info-0.91-r3-patches.tar.gz
│   └── [1.0M Jul  8  2014]  shared-mime-info-0.91-r3-prepatch.tar.gz
├── [ 32K May 17  2011]  ShrRAM-baseline.tar.bz2
├── [2.0K Mar 16 14:32]  sipgateway
│   ├── [2.9K Jul  8  2014]  sipgateway-1.0-r0-patches.tar.gz
│   └── [ 49K Jul  8  2014]  sipgateway-1.0-r0-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  speex
│   └── [1.0M Jul  8  2014]  speex-1.2rc1.tar.gz
├── [2.0M Feb  9  2012]  sqlite-3.6.0.tar.gz
├── [1.3M Jan 26  2012]  sqlite-amalgamation-3071000.zip
├── [ 61K Mar 24  2011]  stlinux23-sh4-vid_firmware-dev-hv10-36.sh4.rpm
├── [ 62K Sep  2  2011]  stlinux24-host-havana-frontend-source-2.6-4.tar.bz2
├── [180K Sep 13  2011]  stlinux24-host-infrastructure-source-1.7-1.noarch.rpm
├── [258K Mar 24  2011]  stlinux24-host-linux-fusion-source-8.2.0-1.noarch.rpm
├── [1.5M Sep 13  2011]  stlinux24-host-multicom-source-4.0.5+4.0.51.Orly-4.noarch.rpm
├── [1.2M Sep 12  2011]  stlinux24-host-player2-source-int228-1.noarch.rpm
├── [1.4M Sep 13  2011]  stlinux24-host-stmfb-source-4.0_stm24_0216-1.noarch.rpm
├── [7.1M Feb  9  2012]  stlinux24-host-u-boot-source-sh4-1.3.1_stm24_0047-47.src.rpm
├── [112K Mar 24  2011]  stlinux24-sh4-fdma-firmware-20101130-4.noarch.rpm
├── [5.4K Mar 24  2011]  stlinux24-sh4-linux-fusion-headers-8.2.0-2.noarch.rpm
├── [721K Sep 13  2011]  stlinux24-sh4-linux-kernel-headers-2.6.32.16-44.1havana5.noarch.rpm
├── [ 10K Mar 24  2011]  stlinux24-sh4-stmfb-firmware-1.20-1.noarch.rpm
├── [ 20K Sep 13  2011]  stlinux24-sh4-stmfb-headers-4.0_stm24_0216-1.noarch.rpm
├── [ 75K Sep 13  2011]  stlinux24-sh4-vid_firmware-dev-hv11-2.sh4.rpm
├── [4.5M Sep 13  2011]  stlinux24-sh4-vid_firmware-mpeg4p2-hv11-2.sh4.rpm
├── [2.8K Feb 14  2012]  stlinux24-target-directfb-multi-1.4.3+STM2010.10.tar.gz
├── [148M Feb 10  2012]  stlinux24-target-qt-embedded-4.6.0-27.src.rpm
├── [447K Feb  9  2012]  strace-4.5.16.tar.bz2
├── [770K Feb  9  2012]  sysfsutils-2.1.0.tar.gz
├── [ 85K Feb  9  2012]  sysklogd-1.5.tar.gz
├── [2.0K Mar 16 14:32]  syslog-ng
│   ├── [2.4K Jul  8  2014]  syslog-ng-3.4.7-r6.1-patches.tar.gz
│   └── [3.1M Jul  8  2014]  syslog-ng_3.4.7.tar.gz
├── [205K Feb  9  2012]  sysstat-8.0.0.tar.gz
├── [2.0K Mar 16 14:32]  system-core-git-r6
│   └── [915K Jul  8  2014]  system-core-git-r6-prepatch.tar.gz
├── [2.0K Mar 16 14:32]  sysvinit
│   ├── [4.3K Jul  8  2014]  sysvinit-2.88dsf-r5-patches.tar.gz
│   └── [103K Jul  8  2014]  sysvinit-2.88dsf.tar.bz2
├── [ 96K Feb  9  2012]  sysvinit_2.86.ds1.orig.tar.gz
├── [2.0K Mar 16 14:32]  sysvinit-inittab
│   └── [ 643 Jul  8  2014]  sysvinit-inittab-2.88dsf-r8-patches.tar.gz
├── [2.0K Mar 16 14:32]  tcpdump
│   ├── [1.7K Jul  8  2014]  tcpdump-4.1.1-r1-patches.tar.gz
│   └── [1.5M Jul  8  2014]  tcpdump-4.1.1.tar.gz
├── [ 97K Feb  9  2012]  tcp_wrappers_7.6.tar.gz
├── [262K Feb  9  2012]  termcap-2.0.8.tar.gz
├── [129K Feb  9  2012]  thttpd-2.25b.tar.gz
├── [1.3M Feb  9  2012]  tiff-3.9.1.tar.gz
├── [2.0K Mar 16 14:32]  tinylogin
│   ├── [9.4K Jul  8  2014]  tinylogin-1.4-r8-patches.tar.gz
│   └── [ 96K Jul  8  2014]  tinylogin-1.4.tar.bz2
├── [114K Sep 17  2014]  tinyxml2-1.0.11.zip
├── [177K Jan 26  2012]  tinyxml_2_4_2.zip
├── [284K Mar  8  2013]  tinyxml_2_6_2.zip
├── [ 11K Jan 26  2012]  tlsf-2.0.zip
├── [7.3K Jan 26  2012]  trex_1_3.tar.gz
├── [ 46K Feb  9  2012]  tslib-1.0.tar.bz2
├── [6.0K May 17  2011]  uCblaze-baseline.tar.bz2
├── [535K Feb  9  2012]  udev-162.tar.bz2
├── [ 43K Feb  9  2012]  udhcp-0.9.8.tar.gz
├── [241K Feb  9  2012]  usbutils-0.86.tar.gz
├── [2.0K Mar 16 14:32]  util-linux
│   ├── [4.7K Jul  8  2014]  util-linux-2.20.1-r2-patches.tar.gz
│   └── [4.4M Jul  8  2014]  util-linux-2.20.1.tar.bz2
├── [4.6M Feb  9  2012]  util-linux_2.16.1.orig.tar.gz
├── [2.0K Mar 16 14:32]  util-macros
│   └── [ 89K Jul  8  2014]  util-macros-1.16.1.tar.gz
├── [172K Feb  9  2012]  vlan.1.9.tar.gz
├── [ 41K Feb  9  2012]  vlms-0.2.3.tar.gz
├── [2.3M Feb  9  2012]  wget-1.12.tar.gz
├── [2.0K Mar 16 14:32]  wireless-tools-1_29-r2
│   ├── [1.8K Jul  8  2014]  wireless-tools-1_29-r2-patches.tar.gz
│   └── [288K Jul  8  2014]  wireless_tools.29.tar.gz
├── [2.0K Mar 16 14:32]  xcb-proto
│   └── [102K Jul  8  2014]  xcb-proto-1.7.tar.bz2
├── [2.0K Mar 16 14:32]  xcmiscproto
│   └── [100K Jul  8  2014]  xcmiscproto-1.2.1.tar.bz2
├── [2.0K Mar 16 14:32]  xextproto
│   └── [203K Jul  8  2014]  xextproto-7.2.0.tar.bz2
├── [2.0K Mar 16 14:32]  xf86bigfontproto
│   └── [ 48K Jul  8  2014]  xf86bigfontproto-1.2.0.tar.bz2
├── [2.0K Mar 16 14:32]  xineramaproto
│   └── [ 94K Jul  8  2014]  xineramaproto-1.2.1.tar.bz2
├── [295K Feb  9  2012]  xinetd-2.3.14.tar.gz
├── [2.0K Mar 16 14:32]  xproto
│   ├── [ 655 Jul  8  2014]  xproto-1_7.0.22-r1-patches.tar.gz
│   └── [275K Jul  8  2014]  xproto-7.0.22.tar.bz2
├── [2.0K Mar 16 14:32]  xtrans
│   └── [153K Jul  8  2014]  xtrans-1.2.6.tar.bz2
├── [2.0K Mar 16 14:32]  zip
│   └── [1.1M Jul  8  2014]  zip30.tgz
├── [485K Feb  9  2012]  zlib-1.2.3.tar.gz
└── [532K Jan 26  2012]  zlib-1.2.5.tar.gz

122 directories, 317 files

In my blog post about BMW's unencrypted software updates, I said:

Judging from the files, it would appear that the infotainment system is made by Magneti Marelli with components by Wind River, AutoSAR, and Nvidia Tegra. Looking at the copious mentions of systemd and freedesktop it's a Linux system!

Hmmm... I wonder if they're respecting the GPL...?

I want to make it clear that, at the time, I had no evidence to suggest that any Open Source Software was being used in my vehicle. It was idle speculation on my part.

Anyway, some kind Internet stranger decided to fire off an email to BMW Australia demanding access to the source code. The customer service agents refused.

...customer must provide the 7 digit VIN and accept the usage rights agreement. Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence

BMW Australia

It would be an exaggeration to say "at which point all hell broke loose" - but there were some sternly worded tweets and comments condemning BMW for their abuse of Free Software.

Here's the thing - contacting customer services like that was entirely the wrong approach. Customer services aren't trained for the 0.001% of people who might be interested in an esoteric matter of legal licensing. Crying foul because a minimum wage rep didn't understand an obscure technical reference is counter productive.

A quick search shows a BMW Open Source site which is highly active. An email to them, or to BMW's head office, or their legal team, would have generated a far more useful reply.

As it happens, someone within BMW contacted me to explain where the Open Source Licences are within the vehicle. I'll be honest, they are well hidden - and not referenced in the user manual as far as I could see - but they are there.

Here's proof:

Now, this is a somewhat of a "beware of the leopard" situation, I grant you. But, somewhere in that mass of text is the email address you need to contact if you want copies of the code.

So, I've dropped BMW an email and will update you if/when I hear back. They may not respond - in which case we can heap opprobrium upon them - but let's give them a chance rather than flailing about and calling every scratch a palpable hit, eh?

Update! I've received a response from BMW.

Terence Eden is on Mastodon

@edent

As a follow up to last week's blog post.
BMW are going to ship me a copy of the source code.
shkspr.mobi/blog/2016/03/b… pic.x.com/kwa0wfcgcr

---

I've sent them my details and will report back on what they send me.

We used to have separate categories of device: washing machines, VCRs, phones, cars, but now we just have computers in different cases. For example, modern cars are computers we put our bodies in and Boeing 747s are flying Solaris boxes, whereas hearing aids and pacemakers are computers we put in our body.

The Coming Civil War over General Purpose Computing - Cory Doctorow Emphasis added.

The i3 has numerous software defects. Despite having a capable 3G modem, all major software updates have to be performed by an authorised dealer. That means booking your car in and waiting for a day or two for the update to take place.

So, that's the major software updates, what about the minor ones? It turns out that the entertainment system can be updated by anyone with a USB stick and access to your vehicle.

The BMW Group allows part of the vehicle software to be updated, to enable compatibility of the latest tested Bluetooth or USB devices in the vehicle. This offer is available for selected vehicles manufactured after March 2010.

You can perform this software update yourself. To do so, all you need is a standard USB memory stick with sufficient memory capacity.

BMW Connected Drive - Software Updates

The website doesn't use SSL. I mean, everything is unencrypted including the software download!

The user enters their Vehicle Identification number, it is sent across to an unencrypted API.

http://www.bmw.com/_common/shared/owners/bluetooth/jsp/serviceV2.jsp
   ?op=getVINData
   &requestType=bluetooth
   &language=en
   &vin=1234567
   &domain=kisu-check

The user is asked to agree to a "usage right agreement" - but it's not necessary; the software is available to anyone without requiring authentication.

For example, the i3's software is available at

• http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07012.bin

No need to guess a VIN or agree to any terms. Just click and download.

A look through the various BMW forums shows that software updates for different cars all follow a similar pattern.

Why Is This A Bad Thing™?

Because the software download goes via http rather than https, it is theoretically possible for an attacker to modify the file before it gets to you.

One would hope that the firmware is cryptographically signed so that it cannot be maliciously modified - but given BMW's fairly poor record on securing their cars (original in German), it's not guaranteed.

OK, what's the worst that could happen with a phony software update for a glorified car radio?

My friend Marc Rogers successfully hacked the Tesla Model S in part using the car's infotainment system. It turns out that entertainment systems often talk to the rest of the car via a CAN bus. If the car isn't fully secured, it is theoretically possible that a rogue internal component would be able to endanger the car and its passengers.

There's a secondary issue - car manufacturers are training people to stick untrusted USB sticks into their cars.

When FIAT had to update the software on 1.4 million cars, they opted to send USB sticks in the post to affected drivers.

Terence Eden is on Mastodon

@edent

Oh, a *secure* USB.
There's no way that could be malicious…
#antipattern pic.x.com/kqhtw51zq6

---

If you receive a USB stick in the post, how can you be sure that it doesn't contain malicious software?

Hopefully, the car should reject any unauthorised tampering - but we all know that security measures can be bypassed by sufficiently motivated adversaries.

Decoding The Firmware

Alas, dear reader, here is where I must confess my ignorance. Decompiling firmware is way outside my area of expertise. If anyone with greater skills can investigate further, I'd be grateful.

Firstly, a quick run of binwalk gives us:

POSIX tar archive (GNU), owner user name: "01E40_110_005_010.xml"

Renaming the .bin to .tar allows us to extract the 7 firmware files and an XML file.

Within the XML, we find: <SWIP digalg="sha256" signalg="sha256withRSA" version="0.3.6" ... Which would indicate that the software is self-signed and probably secure against forgery.

Each of the firmware files contains a file called "bungstabelle.sgbm" which appears to be another cryptographic signature.

Judging from the files, it would appear that the infotainment system is made by Magneti Marelli with components by Wind River, AutoSAR, and Nvidia Tegra. Looking at the copious mentions of systemd and freedesktop it's a Linux system!

Hmmm... I wonder if they're respecting the GPL...?

The firmware isn't encrypted - so anyone can read the code and comments - but it does appear to be signed which makes it unlikely that a user could accidentally install corrupted software.

The Five Star Automotive Cyber Safety Program suggests to manufacturers that:

While updating is a necessary capability, an insecure update design could facilitate adversaries or trigger accidents. Authenticity and quality verification preserves the integrity of the updates and leads to a safer mechanism that can prevent digital tampering or unexpected failures.

From my limited understanding of the way the firmware is designed, it should be robust enough to prevent malicious users from infecting it with anything nasty.

However, given BMW's troubled history with HTTPS, I think it would be sensible for them to ensure all their software was delivered securely.

I'd love to have it tweet its driving efficiency, or upload its location to my server, or let me turn on its air-conditioning when the temperature gets too warm - there are a hundred interesting things to do with the car's data. The official app has some of these features - but is slow, ugly, and a pain to use.

BMW used to have an API available for hackathons, but they shut it down.

Terence Eden is on Mastodon

@edent

Replying to @BMW@BMW I've just got an i3! Is the Developer API open yet? data.hackthedrive.com/learn looks closed :-(

---

BMW

@BMW

Replying to @edent@edent Access to the API is not possible. The API was accessible during #HacktheDrive Hackathon, but not anymore. data.hackthedrive.com

---

Terence Eden is on Mastodon

@edent

Replying to @BMW_UK@BMW_UK good morning! I've just got an i3. I would love to develop apps for it. Is there an API for ConnectedDrive?

---

BMW UK

@BMW_UK

Replying to @edent@edent Hi Terence, due to a number of factors we can't open our API's up to develop for our i3 platform at present..

---

Right! Only one thing to do - HACK THE MAINFRAME*!

Aim

The ultimate aim is to get access to all the car's functions which are exposed by the API - so I can do something like this:

edent's Car

@edent_car

🚗 4 miles in 13 minutes
Efficiency: 5.36 miles/kWh
🔋 53% (37 miles)
🔌 Unplugged
⚠ Shutdown Secured
2,160 miles total

---

Equipment

For this relatively simple bit of work you will need...

• A BMW i3.
• An account with BMW's ConnectedDrive.
• The BMW i Remote App for Android. (I'm using the non-US version.)
• An Android phone or tablet.
• A way to intercept encrypted communications leaving your device - I recommend Packet Capture by Grey Shirts.

With Packet Capture installed, close all other apps, start the logging, then log in to the i Remote app. Click around on a few functions, then flip back to the Packet Capture app.

You'll see a bunch of API calls which have been captured.

Click on one and you'll see the full API call, plus the JSON response. I've stripped out some of my personal details.

The most important thing you'll need is the Authorization: Bearer token. This is a 32 character alphanumeric string.

Description

The latest version can always be found on GitHub.

These API calls are designed to allow you to interact with your BMW i3. They were reverse engineered from the official BMW i Remote Android app.

Your use of these API calls is entirely at your own risk. They are neither officially provided nor sanctioned.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Servers

There are three API servers.

• https://b2vapi.bmwgroup.cn:8592 China
• https://b2vapi.bmwgroup.us USA
• https://b2vapi.bmwgroup.com Europe / Rest of World

Authorisation

In order to authenticate against the API you will need to be registered on BMW's Connected Drive service.

You will need:

1. Your ConnectedDrive registered email address.
2. Your ConnectedDrive registered password.
3. The i Remote API Key.
4. The i Remote API Secret.

You can get the i Remote details from either decompiling the Android App or from intercepting communications between your phone and the BMW server. This is left as an exercise for the reader ☺

Firstly, we use Basic authentication. That means taking the API Key and Secret and Base64 encoding them.

So key:secret becomes a2V5OnNlY3JldA==

We also need to send the following parameters as

• Content-Type: application/x-www-form-urlencoded

 grant_type=password
&username=whatever%40example.com
&password=p4ssw0rd
&scope=remote_services+vehicle_data

Here's how to do it with curl:

curl \
   -H "Authorization: Basic a2V5OnNlY3JldA==" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "grant_type=password&username=whatever%40example.com&password=p4ssw0rd&scope=remote_services+vehicle_data" \
   "https://b2vapi.bmwgroup.com/webapi/oauth/token/"

If everything has worked, you should get back the following JSON:

{
  "access_token": "RCQ1hLP4AFaUBW9BjcPUN3i4WgkwF90R",
  "token_type": "Bearer",
  "expires_in": 28800,
  "refresh_token": "7WgKmEJ2kD1ydl9Hefp01eS8qDGzKnzjeORpA6vtsoFIEanz",
  "scope": "vehicle_data remote_services"
}

You must include

• Authorization: Bearer RCQ1hLP4AFaUBW9BjcPUN3i4WgkwF90R

in your headers with every request.

The expires_in is in seconds - giving you 8 hours before you have to renew the token.

I've no idea what the refresh_token is for. Once the access_token expires, you can simply re-authenticate and gain a new one.

API

You must include

• Authorization: Bearer RCQ1hLP4AFaUBW9BjcPUN3i4WgkwF90R

in your headers with every request.

Get Vehicle Data

• /webapi/v1/user/vehicles/
  • Remember to include the Authorization: Bearer header.

The most important thing here is the VIN - Vehicle Identification Number. You'll need that for all the other API calls as well as the Authorization Bearer.

Response

{
    "vehicleStatus": {
        "vin": "WAB1C23456V123456",
        "mileage": 1234,
        "updateReason": "VEHICLE_SHUTDOWN_SECURED",
        "updateTime": "2015-10-30T18:45:04+0100",
        "doorDriverFront": "CLOSED",
        "doorDriverRear": "CLOSED",
        "doorPassengerFront": "CLOSED",
        "doorPassengerRear": "CLOSED",
        "windowDriverFront": "CLOSED",
        "windowDriverRear": "CLOSED",
        "windowPassengerFront": "CLOSED",
        "windowPassengerRear": "CLOSED",
        "trunk": "CLOSED",
        "rearWindow": "INVALID",
        "convertibleRoofState": "INVALID",
        "hood": "CLOSED",
        "doorLockState": "SECURED",
        "parkingLight": "OFF",
        "positionLight": "OFF",
        "remainingFuel": 8.9,
        "remainingRangeElectric": 73,
        "remainingRangeElectricMls": 45,
        "remainingRangeFuel": 126,
        "remainingRangeFuelMls": 78,
        "maxRangeElectric": 134,
        "maxRangeElectricMls": 83,
        "fuelPercent": 99,
        "maxFuel": 9,
        "connectionStatus": "DISCONNECTED",
        "chargingStatus": "INVALID",
        "chargingLevelHv": 58,
        "lastChargingEndReason": "UNKNOWN",
        "lastChargingEndResult": "FAILED",
        "position": {
            "lat": 51.123456,
            "lon": -1.2345678,
            "heading": 211,
            "status": "OK"
        },
        "internalDataTimeUTC": "2015-10-30T18:47:44"
    }
}

Values

• mileage is in Km.
• remainingFuel is in Litres.
• maxRangeElectric is in Km.
• maxRangeElectricMls is in miles.
• chargingLevelHv is the percentage of charge left in the (High voltage?) battery.
• maxFuel is in Litres.
• heading is in degrees.

Valid chargingStatuses appear to be:

• CHARGING
• ERROR
• FINISHED_FULLY_CHARGED
• FINISHED_NOT_FULL
• INVALID
• NOT_CHARGING
• WAITING_FOR_CHARGING

Valid connectionStatuses appear to be:

• CHARGING_DONE
• CHARGING_INTERRUPED [sic]
• CHARGING_PAUSED
• CHARGIN_STARTED [sic]
• CYCLIC_RECHARGING
• DOOR_STATE_CHANGED
• NO_CYCLIC_RECHARGING
• NO_LSC_TRIGGER
• ON_DEMAND
• PREDICTION_UPDATE
• TEMPORARY_POWER_SUPPLY_FAILURE
• UNKNOWN
• VEHICLE_MOVING
• VEHICLE_SECURED
• VEHICLE_SHUTDOWN
• VEHICLE_SHUTDOWN_SECURED
• VEHICLE_UNSECURED

Get Last Trip

Shows the details about your most recent trip.

• /webapi/v1/user/vehicles/:VIN/statistics/lastTrip
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
   "lastTrip":{
      "efficiencyValue":0.53,
      "totalDistance":141,
      "electricDistance":100.1,
      "avgElectricConsumption":16.6,
      "avgRecuperation":2,
      "drivingModeValue":0,
      "accelerationValue":0.39,
      "anticipationValue":0.81,
      "totalConsumptionValue":0.79,
      "auxiliaryConsumptionValue":0.66,
      "avgCombinedConsumption":1.9,
      "electricDistanceRatio":71,
      "savedFuel":0,
      "date":"2015-12-01T20:44:00+0100",
      "duration":124
   }
}

Values

Distances appear to be in Kilometres rather than miles, so be sure to adjust accordingly. Multiply by 0.621371 to get miles.

• totalDistance is in Km.
• electricDistance is in Km.
• avgElectricConsumption is in kWh/100Km.
• avgRecuperation is in kWh/100Km.
• duration is in minutes.

To convert kWh/100Km to Miles/kWh.

1 / (0.01609344 * avgElectricConsumption)

Get Charging Times

Shows when the car is scheduled to charge.

• /webapi/v1/user/vehicles/:VIN/chargingprofile
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
   "weeklyPlanner":{
      "climatizationEnabled":true,
      "chargingMode":"DELAYED_CHARGING",
      "chargingPreferences":"CHARGING_WINDOW",
      "timer1":{
         "departureTime":"07:30",
         "timerEnabled":true,
         "weekdays":[
            "MONDAY"
         ]
      },
      "timer2":{
         "departureTime":"13:00",
         "timerEnabled":false,
         "weekdays":[
            "SATURDAY"
         ]
      },
      "timer3":{
         "departureTime":"08:00",
         "timerEnabled":false,
         "weekdays":[

         ]
      },
      "overrideTimer":{
         "departureTime":"07:30",
         "timerEnabled":false,
         "weekdays":[
            "MONDAY"
         ]
      },
      "preferredChargingWindow":{
         "enabled":true,
         "startTime":"05:02",
         "endTime":"17:31"
      }
   }
}

Values

• departureTime appears to be the car's local time.

Get Vehicle Destinations

Shows the destinations you've previously sent to the car.

• /webapi/v1/user/vehicles/:VIN/destinations
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
   "destinations":[
      {
         "lat":51.53053283691406,
         "lon":-0.08362331241369247,
         "country":"UNITED KINGDOM",
         "city":"LONDON",
         "street":"PITFIELD STREET",
         "type":"DESTINATION",
         "createdAt":"2015-09-25T08:06:11+0200"
      }
   ]
}

Values

• An array of locations.

Get All Trip Details

Shows the statistics for all trips taken in the vehicle.

• /webapi/v1/user/vehicles/:VIN/statistics/allTrips
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
    "allTrips": {
        "avgElectricConsumption": {
            "communityLow": 0,
            "communityAverage": 16.33,
            "communityHigh": 35.53,
            "userAverage": 14.76
        },
        "avgRecuperation": {
            "communityLow": 0,
            "communityAverage": 3.76,
            "communityHigh": 14.03,
            "userAverage": 2.3
        },
        "chargecycleRange": {
            "communityAverage": 121.58,
            "communityHigh": 200,
            "userAverage": 72.62,
            "userHigh": 135,
            "userCurrentChargeCycle": 60
        },
        "totalElectricDistance": {
            "communityLow": 1,
            "communityAverage": 12293.65,
            "communityHigh": 77533.6,
            "userTotal": 3158.66
        },
        "avgCombinedConsumption": {
            "communityLow": 0,
            "communityAverage": 1.21,
            "communityHigh": 6.2,
            "userAverage": 0.36
        },
        "savedCO2": 87.58,
        "savedCO2greenEnergy": 515.177,
        "totalSavedFuel": 0,
        "resetDate": "1970-01-01T01:00:00+0100"
    }
}

Values

• chargecycleRange is in Km.
• totalElectricDistance is in Km.

I'm not sure what units of the other values are.

Get Range Map

Generate a polyline displaying the predicted range of the vehicle.

• /webapi/v1/user/vehicles/:VIN/rangemap
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
    "rangemap": {
        "center": {
            "lat": 51.123456,
            "lon": -1.2345678
        },
        "quality": "AVERAGE",
        "rangemaps": [
            {
                "type": "ECO_PRO_PLUS",
                "polyline": [
                    {
                        "lat": 51.6991281509399,
                        "lon": -2.00423240661621
                    },
                    {
                        "lat": 51.6909098625183,
                        "lon": -1.91526889801025
                    },
                    ...
                ]
            },
            {
                "type": "COMFORT",
                "polyline": [
                    {
                        "lat": 51.7212295532227,
                        "lon": -1.7363977432251
                    },
                    {
                        "lat": 51.6991496086121,
                        "lon": -1.73077583312988
                    },
                    ...
                ]
            }
        ]
    }
}

Values

• ECO_PRO_PLUS driving using the efficient Eco mode.
• COMFORT driving using comfort mode.

Sending information to the car

Sending information to the car is slightly complicated.

Your app communicates with the API, the API then communicates with the car's 3G modem, then you have to wait for a response.

If your car is in poor coverage, you can expect significant latency. Often much higher than a typical timeout will allow for.

At a basic level, you can just send a request - for example to lock the doors, or set off-peak charging.

Get Request status

Shows the status of a POSTed request

• /webapi/v1/user/vehicles/:VIN/serviceExecutionStatus?serviceType=:SERVICE
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Response

{
   "executionStatus":{
      "serviceType":"DOOR_LOCK",
      "status":"EXECUTED",
      "eventId":"123456789012345AB1CD1234@bmw.de"
   }
}

Values

Valid statuses are:

• DELIVERED
• EXECUTED
• INITIATED
• NOT_EXECUTED
• PENDING
• TIMED_OUT

The following are valid :SERVICE types, but may not be supported by your vehicle.

• CHARGE_NOW
• CHARGING_CONTROL
• CLIMATE_CONTROL
• CLIMATE_NOW
• DOOR_LOCK
• DOOR_UNLOCK
• GET_ALL_IMAGES
• GET_PASSWORD_RESET_INFO
• GET_VEHICLES
• GET_VEHICLE_IMAGE
• GET_VEHICLE_STATUS
• HORN_BLOW
• LIGHT_FLASH
• LOCAL_SEARCH
• LOCAL_SEARCH_SUGGESTIONS
• LOGIN
• LOGOUT
• SEND_POI_TO_CAR
• VEHICLE_FINDER

POST a command

Instructs the car to perform an action.

• /webapi/v1/user/vehicles/:VIN/executeService
  • Where :VIN is your vehicle's VIN.
  • Remember to include the Authorization: Bearer header.

Available Commands

These commands are all available via the API, but may not be supported by your vehicle.

These are just what I've discovered so far.

Data must be POSTed to the server.

Initiate Charging

If the vehicle is plugged in, but not charging (due to an off peak setting?) it is possible to force the car to charge.

• serviceType=CHARGE_NOW

Start Climate Control

This will activate climate control within your vehicle.

It appears to be limited to the last temperature you set when you were in the car. I can't find a way to instruct the car to reach a specific temperature.

• serviceType=CLIMATE_NOW

Lock the doors

Performs central locking.

• serviceType=DOOR_LOCK

Unlock the doors

This will unlock all the doors on your vehicle.

Please use extreme caution when sending this command. Ensure that you are in sight of the vehicle and are able to lock it if needed.

• serviceType=DOOR_UNLOCK

Flash the headlights

If you can't find the vehicle, or need to illuminate something in its vicinity, you can briefly activate the headlights.

• serviceType=LIGHT_FLASH&count=2
  • I assume that count relates to the number of seconds to keep the light on?

Charging Schedule

Set the peak / off peak charging schedule.

• serviceType=CHARGING_CONTROL
  • I haven't bothered to figure this out, but the error it returns should give you some pointers:

{
   "error":{
      "code":500,
      "description":"(SmartPhoneUtil-A-102) Bad value(s) for parameter(s): Invalid chargingProfile, expected weeklyPlanner or twoTimesTimer"
   }
}

Vehicle Finder

• serviceType=VEHICLE_FINDER
  • I'm not sure what this does.

Response

An example response for all POST commands:

{
    "executionStatus": {
        "serviceType": "LIGHT_FLASH",
        "status": "INITIATED",
        "eventId": "123456789012345AB1CD1234@bmw.de"
    }
}

What's Next

Using these commands you should be able to replicate the functionality of the official app.

As you can see, I've managed to get my car to Tweet:

edent's Car

@edent_car

🚗 4 miles in 13 minutes
Efficiency: 5.36 miles/kWh
🔋 53% (37 miles)
🔌 Unplugged
⚠ Shutdown Secured
2,160 miles total

---

It would be lovely if BMW decided to open up an official API so that people could fiddle with their cars. The API seems secure and there's limited scope for damaging the vehicles.

I've added all the documentation to GitHub. Please raise an issue or send a Pull Request with any changes.