Slashdot Mirror
Testing Out Cell-Phone Viruses on a Prius
Mikko Hypponen writes "Couple of months ago there were rumours floating around that Bluetooth viruses could infect the on-board computers of some Lexus cars, or at least cause some visible effects on them. We took a Toyota Prius to an underground bunker and tested various Bluetooth mobile phone viruses and assorted Bluetooth attacks against the onboard computer. Results were somewhat surprising. It came as no surprise that we could not infect the car, but the Prius performed in the test even better than expected. No matter what we did the car did not react to the Bluetooth traffic at all. Cabir tried to send itself to the car and the car just did not allow the Bluetooth OBEX transfer to happen. Then, the whole car crashed (but not because of a virus)... Full story with pictures in our weblog."
Apart from the car crashing. Maybe a few less pints of Boddington's next time you head for the bunker, eh?
A feeling of having made the same mistake before: Deja Foobar
The article said "After intensive tests for all morning, the battery of the car was running low".
Does that mean that a similar DOS attack can disable most cars in a car park?
Rock that crushes, Paper & Scissors that don't matter.
Permalink
After all, cell phone virii only attack those who pay way too much for a car, without increased efficiency ...
...
Hmmm, maybe the Matrix is happening
-- Tigger warning: This post may contain tiggers! --
Some cars are cheaper then some servers.
RTFA. It wasn't their car. Toyota lent it to them.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
...And the fact that the low battery is reported as a transmission problem is good how?
Sounds bad enough to me.
Granted, the transmission may not be working -- but there should be a diagnostic saying "OMFG Battery Voltage Low" first. If you lost your arms in an industrial accident you don't start by telling the doctor that you have a hard time holding pens...
Either one will be fine as I wouldn't expect that flock of women any time soon.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Why did they even need to test this? The Bluetooth on the Prius only acts as a BT headset, so until a virus can infect a headset Prius owners are safe.
i think with the tons of money these car companies have and the fact that the computers in them are more proprietary than an old compaq, its no surprise that the viruses did nothing. With the amount of R&D cash on hand these guys have, i think they probably thought of that one.
w00t
It came as no surprise that we could not infect the car, but the Prius performed in the test even better than expected.
We're all doomed!
RTFA.
When I read "pictures in our weblog", I just assumed it would be slashdotted.
NB.
Why would you want to intentionally fuck up your car's computer?
Why did/do people make cars into hotrods?
Because it's there.
Because they can.
Next!
-- Tigger warning: This post may contain tiggers! --
Police have warned all families with nerdy children to be on the look out for unexplained cars turning up in their garage.
Physicist, consultant, science communicator
TFA, further down the page, describes the user experience of a Cabir infection. The recipient must click "yes" a number of times to accept the unknown transmission, install the unknown file, and bypass a security warning about installing something from an unverified supplier. Why do people click "yes" to all this? Because if you click "No" the virus keeps trying to install itself and pester you with the messages.
Definitely reminds me of "Abort/Retry/Fail" error message of so long ago. The first time you ever see the message, you hit "retry" a few times hoping it will work. Eventually, the computer teaches you to never try "retry" because it only puts up the error message again.
This virus is social engineering at its best, just like the whiny kid in the grocery store. Keep pestering until they say "yes."
Two wrongs don't make a right, but three lefts do.
After all, the cell phones use Symbian OS, and the Prius (and Lexus) both do not use it, so it isn't very suprising that the virus wouldn't work. After all, you don't hear very often that a MS-Windows virus infects a Macintosh.
Also, I liked the apparent security features in the car, that it didn't react to the bluetooth traffic, but then again, this is probably just due to an inconpatiblility - i.e. the car won't except any type of data but a specific type, like a valid VCARD phone book.
"Real programmers don't comment their code. If it was hard to write it should be hard to understand."
You do realize that these people (F-Secure) are virus fighters? They intentionally infect all kinds of things all day long, so they can figure out how to cure them.
My amazing wife - Artist, Author, Philosopher - Laurie M
I wonder when someone will be able to install a trojan horse into a cars on board computer and disable important functions like, lets say braking remotely.
Reading the article, they're talking about going undergound in order to not effect any other cellphones in the area, and it stuck me as to how much is the same between a computer virus and a "physical" virus. I mean, scientists who work with e.g. bubonic plague, have to take the same cautions, i.e. not letting the virus out into the "wild", where it can spread. I suppose in a few years, many viruses will be tested like this, taking them into a underground bunker, putting them on a computer that has absolutly no connection to the outside world, and trying to find a cure for it. Then the geeks shall hold the true power.
Well, somebody's gotta test the stuff that's used in the fireproofing in your house, right?
That's what these guys are doing. They want to see if the rumors that Bluetooth virii can infect your car's computer are true.
.... "They got this weird message on the phone, requesting a "Yes" or "No" answer. So they clicked "No". But the message popped up immediatly again. And they clicked "No" - only to see the message pop up again. And since "No" didn't seem to be working, they clicked "Yes"..."
Are people THAT stupid?
if I had cash, I'd get on the list for one now, frankly. they have done a lot of good things in a row with that machine, and toyota is very good about licensing their technology to other automakers. they did a techno-swap agreement with ford, and looks like the GM/DC combine is working on one now.
;) starting about a year or two from now.......
however, I strongly encourage everybody else to hate the car with a purple-veined passion, so when I do get into a position to.... errr, no, I just want you all to hate it. not saying why
if this is supposed to be a new economy, how come they still want my old fashioned money?
Does anyone else feel disturbed by that statement?
We waited hesistantly a moment, turned ignition off and rebooted the car...
Watch the Teaser Trailer for "The Lightning Thief" Her
Please read the fine article, then post.
Kris Kerwin kkerwin@insi__REMOVE_ME__ghtbb.com
With my 1979 Toyota Camry no matter what bluetooth signals I sent there was no response. Needless to say, I was shocked!
Did KITT ever get a virus?
If he ever got sick it would have been that he was just sick of having David Hasselhoff hanging around all the time.
Saying your OS is the best because more people use it is like saying MacDonalds make the best food
Usually when I want to "test" a car, I call Enterprise.
Just make sure you get the insurance.
I love mine .... best part is the car computer has easter eggs - now you can pull the 'engine codes' yourself sitting in the driver's seat and call them in to the dealer ....
I mean, yes.
Free Manning, jail Obama.
into the cellphone industry.
They have done the impossible: they created a bluetooth system that no virus in existant can infect.
Microsoft, are you listening?
God I think I will feel much safer knowing that my cellphone (and probably my comp's OS) is made by Toyota.
Tell me more about this underground lair
um, the fire fighters do test out fireproofing by setting make shift houses on fire, just like these guys test out viruses on computers.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Obviously this test was not sponsored by Microsoft.
This slashdot-related signature is a stub. You can help kihjin by expanding it.
Where they show how to infect Herbie the Love Bug
Perhaps it's time to find a less ambiguous word to describe a system failure. I'm sure I wasn't the only one whose first glance at the article caught a much different meaning than was intended. Crash works fine in contexts where it doesn't already have a use, but when you refer to cars or planes, it does.
Stasis is death. Embrace change.
... was the story from the guy whose cell phone caught the cabir virus, and his phone company's solution was to throw it away and buy a new phone.
...
Now I'm going to be expecting to hear that Microsoft has adopted this approach (and PHBs are ordering their people to do it)
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I'm no professional scientist, but it was my understanding that in order to prove something was not true, you have to demonstrate why it can never happen, not that it doesn't happen on a single car that you test it on.
... "Why Windows never crashes: we tested and it didn't so it never crashes okay ?" No trouble getting funding for that study from Redmond.
There must be hundreds of different versions of the car's software that have varying levels of resilience to the virus.
I can't wait to see the follow up
Servlet v2.4 container in a single 161KB jar file ? Try Winstone
This is really good, you guys are killing me.
1 486620).
Trying to infect Prius with a Symbian "virus" is like trying to infect a tree with a choc chip cookie . Hey I can come up with a better one - it's like trying to infect shampoo with a book on eating disorders (now go picture that in your head for a second).
I won't go into debunking this as I have already done that (http://slashdot.org/comments.pl?sid=137390&cid=1
But this is so sweet - it takes one dumb kid with too much time on their hands and one even dumber kid to moderate at voila! you get slashdot "news".
Don't you love it!
Actualy, there was an episode (don't remember the name, dang!) where a hacker used a voice changer to trick KITT into thinking she was Bonnie (the tech who maintains KITT's systems). When KITT let her inside, she plugged a catridge into it's system that enabled hackers to mess with it's personaly, and turn against Michael Knight.
BTW: KITT's new alter ego and voice was far more menacing than KARR. Scary!
Actually, the Prius has a very small aux (12 volt) battery. Generally, if the key* is in the all-power mode (but not the ready-mode), the engine will kick in every so often to charge the aux battery. The park lock does require power, so I suspect they were either in neutral (which will not charge the battery) or doing something else unusual with the car. The prius is very smart about power management and protecting the traction (main) battery and the 12V aux.
A: Break the antenna off
how about if they got a BSOD
or an RSOD?
shooting is not too good for my enemies
Right before the car crashed, it spoke to the driver, saying, "Hi! How are you? I send you crashing into this wall in order to have your advice. See you later. Thanks"
and shows how much computer people know about automotive engineering. zilch... cars have multiple cpu's each controlling and monitoring a specific aspect of a car's systems. All the sensors and actuators that control the engine are hardwired directly to the ECU so there's really nothing those silly viruses can do to the safety of a car's operation. Same goes for the ABS system and the airbag system. Just because you see something happening doesn't mean you know what is actually going on. So all the idiots that comment about being able to crash a car with a virus are just that...idiots.
Then, the whole car crashed...
I guess bluetooth wasn't the only thing they tested.
If I hang around your car enough time with that viros attacking, I can (D)DOS it by consuming it's battery!
gtkaml.org
Disclaimer: I write Symbian software for a living.
So they went to an underground bunker to be safe. Why? Those so-called viruses will ASK you to accept first the transfer, then you'll have to deliberately click through the installation process - the virus just WILL NOT appear on your cell phone like that. It's a completely different mechanism than in the old DOS viruses which just appeared, or the Windows worms which infect your machine through the network behind your back.
They should call those "Symbian viruses" trojans because that's what those are. But then again, failure to create irrational fear translates directly to bad stock performance causing the imaginary money these people never had (stock options) to diminish.
To receive something and to install it into the device requires too much user interaction to be practical. Therefore, among other things, there is no future for viruses in the Symbian platform. I think F-Secure knows this, and is trying to milk the mobile phone virus fear as long as they can.
They should've at least used a Bluetooth packet analyzer and captured the data stream to and from the phone/car. It should be a good read. And a better disection could be performed.
Yeah, I don't get what's with all the big-shot vandals around here. Destroying hundreds of dollars of tires, and wasting at least a victim's, a tow-truck driver's, and a cop's time is a sick thing to do under almost any circumstance.
Saskboy's blog is good. 9 out of 10 dentists agree.
Probably just that and not a hangar.
There are three engineers in a car; an electrical engineer, a chemical engineer and a Microsoft engineer. Suddenly the car just stops by the side of the road, and the three engineers look at each other wondering what could be wrong. The electrical engineer suggests stripping down the electronics of the car and trying to trace where a fault might have occurred. The chemical engineer, not knowing much about cars, suggests that maybe the fuel is becoming emulsified and getting blocked somewhere. Then, the Microsoft engineer, not knowing much about anything, comes up with a suggestion "Why don't close all the windows, get out, get back in, then open the windows again, and maybe it'll work!?"
This joke doesn't seem too funny anymore...
One good turn - gets all the covers.
did your premium go up after the crash of was your no-claims bonus protected?
I would hope that car manufacturers would take bluetooth security very serious and install the proper check to ensure any data being loaded was from an authenticated source and that it did not contain any suspect code, IE: VCARDs contained only contact data and and software being loaded should be either certified by the manufacture or run on an isolated sub-system that is firewalled either virtualy of physicaly from the cars critical systems.
Any failure to adhear to the these standards could potentialy result in multiple losses of life (imagin a time bomb set to kill the powersteeing/engine that could transmit between any two BT enabled cars when they pass).
In the not too distant future, next Sunday A.D.
Although im not surpised that it passed the virus test (meant for a diffrent application) I was suprised at the security the car offered. Up untill the low battery made it think there was a transmission fault. Great computer you have there guys, that cant even test the battery... but thank god it has shiney bluetooth to keep you busy!
Like the saying goes, never underestimate the bandwidth of a station wagon full of tapes. -Pyrotic
Then, the whole car crashed...
Do you see what happens when you play with your cell phone instead of look at the road?!
The dumb kid is the director of research at FSecure. Feel silly now?
I'm sorry if I haven't offended anyone
Um, no they don't.
Why post crap when facts are easy to check out?
So it's fine that you can't send viruses to the Prius, but how about normal stuff like phone numbers?
I can speak from personal experience, that the Prius has ASS bluetooth support. Not only is it difficult to dump an entire phonebook to it (you might have to resort to sending one at a time!), but if you have multiple entries in your phone per name, it would stall on transfer or install extremely slowly, and have no way to preselect the specific number the Prius would pick up.
Don't get me started on audio distortion sounding like the phone was out of range even with the phone inside the car, and no way to "adjust it" except to get inside the non-user facing "diagnostic" menus.
The other conclusion to virus immunity could be the Prius has horrible bluetooth functionality.
Plus, it's stated in the article the car only replies to bluetooth devices paired with the system. You would have to break into the car, find some way to turn on the on-board computer and pair the on-board computer with your bluetooth device before you could do anything. Sounds like something James Bond would do, but it's impracticable in real life. Or even better, a 00s version of
Bored? Browse Slashdot with a +6 modifier for Troll comme
other than the car's computer can't be infected with CURRENT viruses? I could be mistaken, but isn't there always a possibility that someone could learn more about the car's computer and write a virus that the car's computer would be suceptable to?
In England, if you tip the boot loader he'll be extra careful when putting your suitcases into the trunk.
Ba-dump tss.
Seriously, though, if you press the 'Turbo' button, does your car get 1/3 faster, but become more unstable and likely to crash?
Thanks, folks, I'll be here all week.
steampunk web design
Sure a manual will roll while it is in gear. 5Th gear often does not have the ability to keep the car from moving. Particularly if your engine has 160,000 miles on it, and low compression on one cylinder, like mine does.
Most manual drivers leave their transmission in reverse when they leave the car. Reverse has the highest gear ratio of any gear, so it is the hardest for gravity to work against. (Remember that the driving is happening from the other end of the transmission, so all the gear ratios are backwards)
(Ugh. Why am I even replying?)
First, I was joking when I implied that I have slashed car tires. Get over it.
Second, I was meerly pointing out that if you wanted to make life difficult for someone, the ubergeek way is seldom the easiest; you wouldn't shit on Mitnick for pointing out how Social Engineering works. (Yes, geeks don't do it 'cause it is easy... but most geeks aren't vandals.)
Finally, the whole thread is bunk: "Too much Bluetooth DOSes a Toyota!" The original poster of that comment didn't realize the issue was that the car was on all day with out the alternator spinning, not that teh radi0 wavez were doing nasty things.
I didn't know you were joking, there are people just that rotten in the world, and sometimes what seems absurd to one, is reality to another.
Saskboy's blog is good. 9 out of 10 dentists agree.