Never be ON TIME Again!
by OMK
The Problem
This spring, I bought a 1997 Subaru Impreza from a friend. I paid cash for it, and was in the process of cleaning it up on a Sunday afternoon when I opened the glove box.
Inside was a small plastic device with a green LED, and four buttons numbered 1-4. A cable ran out the back of the box into the dashboard. Curious, I unplugged the device from the cable, and turned it over in my hand.
There was a label on the back that read "ON TIME - Payment Protection Systems, Inc." It didn't mean anything to me, so I shrugged, plugged it back in, and the green LED was now red. And my car wouldn't start. Lovely.
Some reading on the Internet confirmed what I suspected. ON TIME is an ignition interrupt.
In a nutshell, it disables the vehicle ignition if a borrower fails to make an auto loan payment on time. These types of "payment protection systems" are intended to make it safer for a lender to make high-risk (and high-interest) auto loans.
They install an ignition interrupt, program it with a payment schedule and ransom codes, and send the borrower home with a car that they probably can't afford. When the borrower makes a payment, they are supplied with a six-digit ransom code that they punch in to the device, buying them another thirty days.
When they fail to make a payment, they don't get the code for that month, and the car no longer starts. Some of these systems also include a GPS, so the repo-man can cruise casually out to the location of the now-disabled vehicle, enter the code, and drive it back to the car lot. And probably sell the vehicle again to somebody else who can't afford it...
Of course, such systems fail.
In my case, I had purchased the car used, not even knowing that it had an ignition interrupt installed. When the last payment had been made by the original buyer (or when the repo-man took the vehicle back), the ON TIME unit had never been removed.
The battery in the control unit was apparently dead, so when I disconnected the cable, I essentially reset the unit, and it was awaiting a ransom code input before I was allowed to drive anywhere. I called the girl from whom I had bought the car, and she didn't know anything about it.
She had bought the car used from a dealer, and had also paid in full up-front. I called the dealer, but they were closed on Sunday. Even if they had been open, they probably couldn't have helped; the paperwork showed that they had received the vehicle as a trade-in.
Whoever knew the codes for the ON TIME device had programmed them in 1997, and I wasn't likely to find them, particularly not on a Sunday afternoon. In the meantime, my car was dead in the driveway.
The Solution
So I went back to the ON TIME control device.
I pushed a few buttons. They beeped and the LED flashed red again. Brute-forcing combinations by hand wasn't an attractive option. According to the ON TIME website, the codes are six-digits long, so there are 4096 possible codes using the numbers 1-4.
Not a lot for a computer to guess, but a lot of buttons for me to push. I unplugged the device again. The data cable had eight pins, presumably used to program the device. And then plugged in... to what?
I traced the cable behind the dashboard, toward the steering column. Four or five screws later, I had the steering column open. The other end of the data cable terminated at a relay box with a wiring harness plugged into it. The harness had only four wires going into it, so I traced those. Two of the wires were spliced into existing factory wires. Those presumably provided power to the control unit. The other two were the interesting ones. A section of the vehicle ignition wire was cut out, and the circuit was routed through those two leads in the relay's wiring harness.
From here, it was easy to fix.
A circuit has two positions: open or closed. So the ignition circuit routes through the relay box. The relay box receives signals from the control unit with the buttons. If the control unit doesn't receive the ransom code in time, it tells the relay to open the circuit, and the ignition no longer works. So: no reason to mess with the control unit.
I disconnected the data cable and threw it into the yard. The control unit went in my shirt pocket. From the relay box, I disconnected the wiring harness, cut the ignition wires from it, and twisted them back together with a wire nut and some electrical tape. Circuit closed.
I turned the key to make sure the car started, and then put the steering column back together. And marveled that the stupid thing had been in there for fifteen years.
Lessons Learned
Ultimately, what I did wasn't particularly difficult or clever. I just snipped a couple of wires and twisted them back together. Finding and replacing a bad fuse in my clothes dryer had been more difficult than that.
What I found interesting upon reflection was my first instinct: get the codes for the ON TIME control unit.
Because that was the interface that I could see - the one with which I was supposed to interact. And it was entirely the wrong instinct.
If I had messed only with pushing buttons on the control unit, I would probably still be trying to brute force guess the ransom codes. As it is, I still have no idea what the codes are. But I don't care, because the control unit is in pieces on my desk.
I could have wasted a lot of time trying to read I/O from the data cable, but the problem was easily solved in five minutes by going to the power source with a screwdriver, a set of wire cutters, and some electrical tape.
Find and mess with the parts of things that you aren't supposed to find and mess with, and not just the parts that you can see at first glance. And don't insist on a complex solution when a simple one will do!
References