I’ve already ranted about cars and technology making it unsafe for all of you to drive around me, but I fear I must take it further. Car hacking isn’t totally new, but with the advances in wireless communications, we all knew this was coming.
Car Shark software has been used in the past to disrupt communications on the CAN (Controller Area Network) via the OBD-II diagnostic port and the brief wireless communications between air pressure sensors in the tires. The OBD-II connections are fairly safe for hacking, because it requires direct access to the interior of the car. You might notice that. The wireless pressure sensors just proved that injected signals can mess with the car. Now we have the mix of both.
The newer technologies of GM’s OnStar and Ford’s Sync technologies have opened up new doors to car hackers. Since both systems make use of Bluetooth to provide safer, hands-free calls to the driver, this leaves a giant area open to hackers. BlueJacking isn’t new – in fact it was quite a problem with Bluetooth 1.0. Tools are widely available to hack encrypted Bluetooth signals. Combine them with new research presented to the Committee on Vehicle Controls and Unintended Acceleration, and you get people driving your car from afar. Well, afarther away than the drivers seat.
In their findings, assistant professor Tadayoshi Kohno of University of Washington and professor Stefan Savage, of UCSD discuss a vulnerability in the Bluetooth system that allows execution of code from within the cars network. They weren’t limited to just the Bluetooth system, which was easily accessed via illegitimate pairings. The car’s media players also presented attack surfaces. But these are the least of my worries. What’s really problematic is what can be done once the vehicle’s computer is accessed.
Once the digital hull is breached, the car can be controlled in a surprising number of ways, from blatantly evil to mildly mischievous. The attackers can disable a vehicle’s electronic braking system, or just force the car to send it’s GPS location in planned intervals. I see one major problem with this: Why are the vehicles control systems so easily accessed via superfluous systems like the stereo or Bluetooth?
One answer may lie in the main selling point of OnStar. It detects a crash (using digital sensors – part of the control system) and dials 911 (using the OnStar system, which is tied to the Bluetooth calling) and this is a weak point. Even though your cell signal is not used for the emergency call, it is still tied to the same system, which was (probably) designed with the idea that no one would try to bridge the gap.
What does this mean for our cars? First, the scary: Since so many new cars have a metric ass-ton of drive-by-wire controls, a lot of damage could be done with this kind of hacking. Steering, brakes, throttle, etc could all (in theory) be controlled by some dude with a Bluetooth dongle and a netbook. But it gets better: according to the researchers:
“This took 10 researchers two years to accomplish, it’s not something that one guy is going to do in his garage.”
Doesn’t that make you feel better? Well, the car used was “a 2009 mass production car” and probably a GM product. Also, it seems that with a quick update to the firmware, a pseudo-wall could be placed between the two sides of the system. Also, with the awareness of the problem, automakers can implement better systems in the future, keeping the nasties out of my car. Until then, my Jeep will suffice, as it will not fall victim to some script kiddies with a smartphone.
Source: MIT Technology Review
You must be logged in to post a comment.