There is a fascinating presentation scheduled at Defcon21, by Charlie Miller of Twitter and Chris Valasek of IOACTIVE in regards to “hacking cars” — Miller and Valasek received a grant from DARPA , The Defense Advanced Research Agency, to perform research on this.
As motor vehicles advance technologically, they incorporate more and more computers.
So far, the threat of them being hacked has largely been ignored, as they have been seen as “stand alone” systems.
There is a trend to increase vehicle connectivity, and with this comes the potential risks of vehicles falling prey to malicious software. Suddenly, the glowing magnet devices of the latest iteration of the “Fast and Furious” franchise, that caused the hero’s cars to careen through buildings uncontrollably, do not seem all that far fetched.
I personally liked that it was used as an excuse to showcase awesome classic cars, on account of them not having onboard computers, but hey, I’m also a car guy.
(We won’t mention the airstrip.)
Many cars have systems such as OnStar, a cellular enabled roadside assistance service offered in some GM vehicles. Concerns have been raised on possible use of this system as a surveillance tool, something Onstar says isn’t possible. Their terms of service do say they retain the GPS data, and may sell it to third parties, after “anonymizing” it. I’m curious how you could anonymize this GPS data. I park my car in my driveway. The capabilities of these types of systems, such as unlocking doors, and turning the engine off, if done with a malicious intent are a sobering thought.
In advance to the Defcon talk, a video was released on the Forbes website with an accompanying interview by Andy Greenberg. The video is an eye opener, to say the least. In it, the attacks on the cars computer are demonstrated in real time, with journalist and hackers in the moving vehicles.
The results of the hacks in the video get gradually more and more terrifying. We are shown the instrument cluster lying about the remaining fuel, lying about the speed of the vehicle, going from improbable 190 miles per hour to 0, the horn blasting without intervention, the seat belt tightening, the steering wheel violently jerking, and my favorite, the brakes refusing to stop the vehicle altogether.
These vulnerabilities required local access. A computer, connected to the ODBII interface of the car, a diagnostic port, talking directly to the ECU, or Electronic Control Unit through a special cable such as this one.
All vehicles built in America after 1996 have this port.
If local access to the ODBII port is required for these attacks to be successful, we should be ok, right?
Some cars now come equipped with high end navigation systems that have the ability to update their GPS maps with live traffic congestion reports. MyFord Touch is updated with a USB stick. Interfacing with your car via a smart phone and an app is is a feature that is rapidly trickling down from high end luxury cars to an ever increasing number of vehicles. More and more cars are becoming connected. The internet of things marches on, and cars are not immune to it. Manufacturers insist that these systems are on separate internal networks, and that they cannot talk to the critical systems attacked by these security researchers. This type of research serves as a warning of what might come to pass if car manufacturers don’t secure these systems.
My prediction is to go with the profit model, and expect in the future to see ransomware, asking for payment to stop my horn from honking at 3am, or unlock my car in time for the morning commute.
