Testing Out Cell-Phone Viruses on a Prius

Mikko Hypponen writes "Couple of months ago there were rumours floating around that Bluetooth viruses could infect the on-board computers of some Lexus cars, or at least cause some visible effects on them. We took a Toyota Prius to an underground bunker and tested various Bluetooth mobile phone viruses and assorted Bluetooth attacks against the onboard computer. Results were somewhat surprising. It came as no surprise that we could not infect the car, but the Prius performed in the test even better than expected. No matter what we did the car did not react to the Bluetooth traffic at all. Cabir tried to send itself to the car and the car just did not allow the Bluetooth OBEX transfer to happen. Then, the whole car crashed (but not because of a virus)... Full story with pictures in our weblog."

Comments

Well, that's good...

[ackthpt]

Apart from the car crashing. Maybe a few less pints of Boddington's next time you head for the bunker, eh?

Still At Risk

[fembots]

The article said "After intensive tests for all morning, the battery of the car was running low".

Does that mean that a similar DOS attack can disable most cars in a car park?

Re:Still At Risk

[RevDobbs]

It's a very interesting idea to DOS a car.

A much easier to execute Denial-of-Service would be to slash the tires, doncha think? Only takes about 45 seconds to get to all four of 'em, it isn't terribly noisy, and I've never been caught doing it.

I mean, it seems like that detection would be very unlikely.

Re:Still At Risk

[Vellmont]

Yes. This DOS attack has been known for quite a long time. It's only recently become known outside the hacker community. Some people even accidentally do it to themselves. Among laymen it's called "leaving your lights on".

Re:Still At Risk

[Samari711]

a better way to do this is to buy a valve tool at the local auto parts store. rather than do any permenant damage just loosen every tire's stem. Even if the owner could figure out why their tires are flat, they most likely won't have the tool on hand to fix it. even if they have a pump, the tires won't inflate and they'll be very confused. Also note that some car (especially those abominations known as Hummers) have tires that automatically inflate themselves, so doing this to one of them would result in a car with 4 flats and a dead battery :)

what a shitty error message

[RevDobbs]

Granted, the transmission may not be working -- but there should be a diagnostic saying "OMFG Battery Voltage Low" first. If you lost your arms in an industrial accident you don't start by telling the doctor that you have a hard time holding pens...

Re:what a shitty error message

[SagSaw]

Granted, the transmission may not be working -- but there should be a diagnostic saying "OMFG Battery Voltage Low" first.

IAAAEE (I am an automotive electrical engieer)...

From an automotive safety standpoint, a malfunctioning park interlock system is pretty close to the top of the list of bad things. The part interlock is the system that prevents the an automatic transmission from shifting out of park unless the vehicle key is in the ignition and there is a second input from the driver (typically by pressing the brake). If the park interlock malfunctions, a simple bump of the shifter (or possibly even the vehicle) might cause the car to shift out of park and begin to roll away. Typically, any failure that disables the function of the park interlock is given the highest severity (Severe injury or death occurs without warning) on any type of DFMEA analysis.

By prominitly displaying a warning on the dashboard, this failure drops down a few notches in severity as there is clear warning that a failure has occured and instructions from how to minimize the risk.

As a result, if the Prius is only capable of displaying one fault condition at a time, a fault with the park interlock system is much more important to display than a low battery voltage. That having been said, some sort of indication of a low battery condition would also be a good idea, perhaps via a trouble light on the dashboard or elsewhere.

Virus that pummels users into submission

[G4from128k]

TFA, further down the page, describes the user experience of a Cabir infection. The recipient must click "yes" a number of times to accept the unknown transmission, install the unknown file, and bypass a security warning about installing something from an unverified supplier. Why do people click "yes" to all this? Because if you click "No" the virus keeps trying to install itself and pester you with the messages.

Definitely reminds me of "Abort/Retry/Fail" error message of so long ago. The first time you ever see the message, you hit "retry" a few times hoping it will work. Eventually, the computer teaches you to never try "retry" because it only puts up the error message again.

This virus is social engineering at its best, just like the whiny kid in the grocery store. Keep pestering until they say "yes."

Crazy

[XFilesFMDS1013]

Reading the article, they're talking about going undergound in order to not effect any other cellphones in the area, and it stuck me as to how much is the same between a computer virus and a "physical" virus. I mean, scientists who work with e.g. bubonic plague, have to take the same cautions, i.e. not letting the virus out into the "wild", where it can spread. I suppose in a few years, many viruses will be tested like this, taking them into a underground bunker, putting them on a computer that has absolutly no connection to the outside world, and trying to find a cure for it. Then the geeks shall hold the true power.

Funny, the same thing happened...

[ctl4u]

With my 1979 Toyota Camry no matter what bluetooth signals I sent there was no response. Needless to say, I was shocked!