Slashdot Mirror
Car Hackers Mess With Speedometers, Odometers, Alarms and Locks
mask.of.sanity writes "Researchers have demonstrated how controller area networks in cars can make vehicles appear to drive slower than their actual speed, manipulate brakes, wind back odometers and set off all kinds of alarms and lights from random fuzzing (video). The network weaknesses stem from a lack of authentication which they say is absent to improve performance. The researchers have also built a $25 open-source fuzzing tool to help others enter the field."
How many idiots will use this in the safe knowledge that they can't be busted for speeding anymore, I wonder...
I gave up sigs almost a year ago.
It's not like the systems were ever intended to be secure, or anything like that...
I used to write software for aircraft instruments.
What's surprising to me is that single-function devices can have their functions changed. The speedometer has one function: to report the vehicle's speed. What requirement is satisfied by allowing this to change? Why would you even need to upgrade it?
I would have thought that certain features of the car would be fixed program/unchangeable, at the very least to simplify the design.
all they could do with the brakes is turn off and on any "skid control" systems, the brake system on cars is STILL a mechanical/hydrochloric system , link from steering wheel to steering rack is not fly by wire in the EU, and cars still have "butterfly" valves for air intake, that is linked to pedal postion .. via mechanical cable
So you're trying to tell me, If I physically tap into the wires that drive the speedo/alarm/etc I can make them do funny stuff? Thats CRAZY!
The only thing that makes this more dangerous than doing the same thing on an old car is you only need to get 2 wires to have access to many systems. Besides that, it's the modern day equivalent of getting underneath the car and cutting brake lines. Why is all this so surprising?
The car factory builds a number of different cars on one assembly line. Also the service points and supporting logistics must be capable of fitting a replacement for 10-15 years after the car is made. Maybe the instrument is not simplified but the manufacture and support of the vehicle range is.
If the speedometer can be told some information about the car then it can be installed in many cars. For instance, the number of pulses to travel 1000 m will account for variants in drive ratios and wheel sizes.
The speedometer is actually part of a higher integration, the combined instrument cluster. Every instrument on it will have some adaptation to the specific vehicle it is installed in. The tachometer should know the number of cylinders in the engine, the temperature gauge should know the normal operating temperature of that engine so it will point straight up when normal. Maybe it measures fuel consumption and calculates driving range so it should know about the size of the fuel tank and the amount of fuel dispensed with each pulse. Maintenance reminder? Schedules are different for different engines and even markets (one european automaker does not remind the driver to change his brake fluid on cars delivered to north america.)
So we have hundreds of variant combinations that can be solved with one part running the one software project. Maybe the same electromechanical unit can be placed in a different housing to be used in different car platforms with different dashboard shapes.
It's of no consequence that module variant coding makes it more difficult for the user to repair his own car by exchanging parts, since many of these also are storing unique data about the individual car such as serial number, backup of odometer, running hours, etc.
In other breaking news, cutting the brake lines of cars can prevent them from operating correctly. Somebody issue a recall, quick!
This is not news, a CAN bus is viewed by the industry in the same way as analog wiring in the car, physically vulnerable. It's an issue when the side view mirror actuators are on the CAN bus, and thieves can open the door and start the engine with this technique. However, this research is stating the obvious for anyone in the know. Next thing you know, one of these researchers will find a copy of the J1939 protocol standard used by the automotive industry and discover what the CAN messages mean without fuzzing the problem space.
If someone found an On Star exploit that allowed a hacker to remotely accomplish these things on the CAN bus, then it would be news, this is not.
Not every bloody thing need authentication. To gain access to the CAN bus you need physical access to the car. If you had that you could just cut a brake line, or simply plant a bomb. Not everything needs authentication / encryption. If it all does you end up with a form of lockout.
I saw another comment here saying that the entertainment system is also connected to the CAN bus and that offers wireless or bluetooth connections. Well why not take that leap and identify if you can somehow hack THAT entry vector and affect the vehicle in the same way. If so, great, let's plug THAT hole.
Car Hackers are hacking.
What could've been an impressive technology continually reveals an increasingly scary weakness, who would've thought?
So if you see a hacker hiding under your dashboard you need to worry, as NON OF THIS CAN BE DONE without physical access of the vehicle from inside.
Call me when they can hack Any car wirelessly from 300 feet away using their laptop, until then all of this is nothing but fearmongering.
Do not look at laser with remaining good eye.
break into the car, cut open the seat cushion, and put a bear trap there.
But, if you fuck with people's ride and injure their friends and family members, someone's gonna shoot your ass, so why not invent something better?
CAN was never developed with security in mind. What for, it was supposed to be a LOCAL, WIRED bus on a closed system that should only be accessed by someone whose authority to access it has been verified by different means (i.e. he has the keys to the car in the first place). Now, we can see how CAN can be abused with local access. Well, duh. Insecure system is insecure. Film at 11. Right? Well, technically, yes, but let's look a hint further, shall we?
The news here is that cars get more and more wireless features. It's simply more convenient for you to plug in all your nifty toys, from cellphone to iToy to navigator system without actually having to PLUG them somewhere. Now it's very tempting for the makers of said cars to stuff them onto the very same bus. CAN is already in your car, pretty much every kind of electronics can talk to it, ain't it the perfect thing to tie your toy into?
In theory, yes. In practice, I predict that unless car makers take special care to secure those wireless entry points we'll see a lot of similar hacks in the future, only that this time they'll be done from outside the car without physical access to it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Somewhere there is a low-level engineer who pointed out that security was broken who was shouted down in meetings by asshole middle managers and then fired.
The middle manager was then given a bonus while the substandard product became standard.
This is America in 2013, where the United States of America can't build a web site.
Cars come with different wheel/tire size combinations. In the past, getting another circumference wheel on your car meant that your odometer/speedo was off and you had to fiddle with magnetic fields or gear boxes in the cable to correct that. Because you want a different size/width tire for winter tires (narrower, higher side) than for summer (wide tire, low profile) you will eventually have to deal with this somehow if you want optimal grip during both summer and winter. Car manufacturers chose to deal with this by making the tire size programmable, so there would be an electronic correction for this.
I was promised a flying car. Where is my flying car?
This is bad for car manufacturers. Why? Because they have to warrant that cars live a long time and will be emissions compliant too. If people can hack around in these systems, all sorts of things can happen that will make them unable to do this. I'm all for having the systems open and being able to tinker with them myself, but from a manufacturer standpoint, this is bad.
I was promised a flying car. Where is my flying car?
Recent model BMWs have been hacked wireless from 30 ft away. That is enough for the thief to hide the device used for the hack near a spot where the owner would normally park the car. They would sniff/block the central locking, so they would be able to gain access to the inside of the car. They would then trigger a buffer overflow by removing and replacing certain fuses in a certain sequence and that would gain them access to the key secrets stored inside the car's computer. They would use a device to have the car's own transponder clone one of those IDs into a blank key and as a result, they would drive away with the car, with a functioning key and no damage to it whatsoever.
I'm fairly certain that with bigger antennas and a more powerful transmitter, you would be able to do this trick at 300 feet, but I doubt that'd make a difference. By the way, the hacker doesn't have to hide under the dashboard, they have access to the CAN bus on the outside of the car too. All light units and the plug for the trailer hitch are connected to this bus. Wires for the bus are usually exposed on the underside of the car, or easily accessible with the removal of a panel only held on by a few screws. Even if one of those notoriously leaky programmed BT enabled center consoles wouldn't be pwnable, physical access would be 2 minutes and a philips screwdriver away.
No, it's not universal for all brands yet, but current developments and product announcements indicate that it won't be long before that *will* happen, unless the car industry starts asking security professionals how to deal with this instead of reinventing the wheel themselves.
I was promised a flying car. Where is my flying car?
I bought a used Volvo S80 about 4 years ago. I added the iPod connector for the stereo -- a factory option my car didn't come with.
The dealer had a real problem getting it to work -- the stereo would indicate the input was there, but when you switched to it it would work for about a minute and then stop working. The description they told me was that the car's data bus was rejecting the accessory because it wasn't authenticating.
Now, I don't know if this was an accurate assessment or not, but it took some kind of software patch specific to my car to make this work.
I'm also not sure if this is the car's CAN bus, either, or if its some private data bus within the car.
I've noticed several comments revolving around the idea that direct access to the vehicle is needed, so there's no need for concern.
It seems to me that while this certainly influences the application of such technology, it doesn't mean all is cool. How long would it take to come up with a purpose-built device that would attach to the relevant access port the same way illegal bank card readers attach to ATM's?
For the sake of argument, let's say it would have WiFi or Bluetooth capability, feed off the car battery, and sit there doing nothing until activated in any of a number of ways. Right now some cars allow a very wide range of options and functions to be accessed through direct access and a laptop...engine performance, ABS, air bags and much more. I'm sure this list will grow steadily over time. It isn't difficult to think of many useful tasks that could be performed with remote access to one or more cars.
All it would take is one crooked mechanic at a dealership or service center to install a bunch of them, or to target a fleet of cars or an individual's car. As always, the weakest link in computer security is the one with a heartbeat.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Of course you can do all sorts of things exactly like this with the CAN bus; that is what it was designed for, that's what it's used for every day. Just about every make has software available (around for over a decade in many instances) to do every single one of those things; in most cases (except odometer rollbacks) they are replicas of the dealer tools to do the same thing. This includes speedometer adjustments (in place to account for wheel/tire diameter), diagnostic tests like cycling locks, ABS valves, various engine bits, etc.
Exactly what "research" was required to discover this? Is it "hacking" for me to purchase a piece of commercial software and use it's well-documented functions, most of which are also detailed in the service manual they sold me for $50?
Let me know when somebody has actually developed a Bluetooth-based attack vector and get back to me. (And plugging a Bluetooth transceiver into the OBD II port doesn't count) Until that point: snooze...
And where exactly is this $25 tool? What is it even? The hardware obd adapter you can get from ebay/amazon/chinese site? Is it $25 for some software that sends CAN packages? Why are internet articles such shit these days?
the speedometer is supposed to be a fixed device (or nowadays, daemon) that converts the turns of the transmission shaft, with tables of which gear does what, to an approximation of linear speed.
two gotchas... output of the shaft sensor hardware, and table lookup. depending on how much processing is between A and Z, fertile ground.
your readout device may be pristine, but as we all know, GIGO.
if this is supposed to be a new economy, how come they still want my old fashioned money?
or some other old car from 20th century?
My (expensive, factory) service manual did not have all the codes, and the Internet has found only a few.
But fuzz testing... ah, fuzz testing. It's great as long as you're not doing it on your own car!
I have a bluetooth ODBII interface permanently mounted in my car and have already fixed several of the auto maker's stupid programming mistakes with it.
I have a car that has no computers and nearly no electronics in it. I live in a blissful state of simplicity and reliability. Everything simply works.
Nothing people didn't already know, but shows people how simple it is.
It has been known for years CAN bus needs authentication.
New things are always on the horizon