War Texting Lets Hackers Unlock Car Doors Via SMS

alphadogg writes "Software that lets drivers unlock car doors and even start their vehicles using a mobile phone could let car thieves do the very same things, according to computer security researchers at iSec Partners. Don Bailey and fellow iSec researcher Mathew Solnik say they've figured out the protocols that some of these software makers use to remote control the cars, and they've produced a video showing how they can unlock a car and turn the engine on via a laptop. According to Bailey, it took them about two hours to figure out how to intercept wireless messages between the car and the network and then recreate them from his laptop. Bailey will discuss the research at next week's Black Hat conference in Las Vegas, but he isn't going to name the products they've hacked — they've looked at two so far — or provide full technical details of their work until the software makers can patch them."

Comments

Pathetic

[Anrego]

I can understand small keychain devices being breakable but with all the power you’ve got available in a cell phone to not be able to come up with a secure challenge/response system seems ridiculous.

Re:Pathetic

[mlts]

What is ironic is that if one looks at cell phone CPUs, anything since the old TI OMAP chips almost certainly have special instructions to deal with the needs of array shifting (for AES), or for exponentiation (for RSA).

Maybe the CPU in the car might be different, but common sense says that dropping a low power ARM chip in to handle this would be the best thing for car makers.

In these days where security is actually being tried by blackhats constantly, it is inexcusable to not take reasonable measures.

Re:That's all well and good, but...

[Anonymous Coward]

Your mom.

Re:How?

[Abstrackt]

How would a manufacturer force people to upgrade the unlock mechanism in the cars?

"If you don't upgrade your car will be a lot easier to steal."?

How long before someone bricks an expensive car

[djl4570]

Hacking these features to steal cars is one possibility. How long before some vindictive prat uses this tech to brick the cars on the lot at a dealership.

Re:How long before someone bricks an expensive car

[DeadCatX2]

Or someone bricks your car on the highway while you're driving it because you cut them off.

Re:How long before someone bricks an expensive car

[MacGyver2210]

This. I want this. Must shutdown asshole drivers.

Re:How long before someone bricks an expensive car

[BitterOak]

Or someone bricks your car on the highway while you're driving it because you cut them off.

Is that necessarily a bad thing?

Re:How?

[Qwell]

They won't send such a notice unless they're told to by a court (or the lawsuit vs. recall formula).

Re:Feature bloat vs. the KISS principle...

[ilo.v]

If I want to unlock the car, presumably I want to drive it. For that I'm going to need a key anyway, so...??

My car doesn't have a key, just a button to press. (Volkswagon, not a Ferrari or something else fancy). It just has a fob that needs to be in range for the "start" button to be enabled. This would be more convenient if my cell phone could be the fob, but only if it can't be hacked like this.

Re:Feature bloat vs. the KISS principle...

[Compaqt]

Speaking of KISS, it's hard to understand what the need for the new press a button thing on cars was supposed to be. (Fulfill a nonexistent need?)

Were there people crying out they were unable to start their cars with keys?

And the dead simple and foolproof way of turning the engine off if you need to? Now it's hold for 3 seconds to turn off?

Replay attack?

[Lord Grey]

From TFA:

With these mobile car apps, the phone connects to a server that then sends secret numerical keys to the car in order to authenticate itself, but the iSec researchers figured out ways to get around this by looking at the messages sent between the server and the car over the mobile network, Bailey said in an interview. "We reverse-engineer the protocol and then we build our own tools to use that protocol to contact that system," he said.

Without knowing the details, this sounds a lot like a replay attack. Or possibly a version of one of the attacks used against ATMs, back when ATMs were new and relatively unguarded. You could tap into an ATM line and basically send commands like, "eject five $20 bills" over and over again, without too much trouble.

I have a 2010 Camaro SS, which has the older version of the OnStar firmware that is not compatible with their mobile app. Now I'm relatively happy about that. One less attack vector to worry about.