Slashdot Mirror
Car Hackers Mess With Speedometers, Odometers, Alarms and Locks
mask.of.sanity writes "Researchers have demonstrated how controller area networks in cars can make vehicles appear to drive slower than their actual speed, manipulate brakes, wind back odometers and set off all kinds of alarms and lights from random fuzzing (video). The network weaknesses stem from a lack of authentication which they say is absent to improve performance. The researchers have also built a $25 open-source fuzzing tool to help others enter the field."
How many idiots will use this in the safe knowledge that they can't be busted for speeding anymore, I wonder...
I gave up sigs almost a year ago.
I used to write software for aircraft instruments.
What's surprising to me is that single-function devices can have their functions changed. The speedometer has one function: to report the vehicle's speed. What requirement is satisfied by allowing this to change? Why would you even need to upgrade it?
I would have thought that certain features of the car would be fixed program/unchangeable, at the very least to simplify the design.
Not really. ABS for example modulates the braking power. In one test, researchers were able to put the brakes into 'maintenance mode" normally used when changing the pads. In that mode, the brakes don't work. If I understand correctly, that mode is used instead of the old trick of compressing the wheel cylinder with a c clamp.
To complete the lunacy, in some cars, the parking/emergency brake is electrically activated now.
In other breaking news, cutting the brake lines of cars can prevent them from operating correctly. Somebody issue a recall, quick!
This is not news, a CAN bus is viewed by the industry in the same way as analog wiring in the car, physically vulnerable. It's an issue when the side view mirror actuators are on the CAN bus, and thieves can open the door and start the engine with this technique. However, this research is stating the obvious for anyone in the know. Next thing you know, one of these researchers will find a copy of the J1939 protocol standard used by the automotive industry and discover what the CAN messages mean without fuzzing the problem space.
If someone found an On Star exploit that allowed a hacker to remotely accomplish these things on the CAN bus, then it would be news, this is not.
I found an example.
Not every bloody thing need authentication. To gain access to the CAN bus you need physical access to the car. If you had that you could just cut a brake line, or simply plant a bomb. Not everything needs authentication / encryption. If it all does you end up with a form of lockout.
I saw another comment here saying that the entertainment system is also connected to the CAN bus and that offers wireless or bluetooth connections. Well why not take that leap and identify if you can somehow hack THAT entry vector and affect the vehicle in the same way. If so, great, let's plug THAT hole.
So if you see a hacker hiding under your dashboard you need to worry, as NON OF THIS CAN BE DONE without physical access of the vehicle from inside.
Call me when they can hack Any car wirelessly from 300 feet away using their laptop, until then all of this is nothing but fearmongering.
Do not look at laser with remaining good eye.
This is a blatent lie. there is no "maintaince mode" for ABS brakes, not even my BMW, my BMW motorcycle, my honda or my jeep have such a "mode" for changing break pads. and yes I have the same tool they use at all the high end shops, the Snap-On Solus is what is used by 99% of all repair shops out there, there are no magical, "retract the pads please HAL" mode to make brakes easier...
Whoever told you this knows nothing at all about cars and made that up.
Do not look at laser with remaining good eye.
CAN was never developed with security in mind. What for, it was supposed to be a LOCAL, WIRED bus on a closed system that should only be accessed by someone whose authority to access it has been verified by different means (i.e. he has the keys to the car in the first place). Now, we can see how CAN can be abused with local access. Well, duh. Insecure system is insecure. Film at 11. Right? Well, technically, yes, but let's look a hint further, shall we?
The news here is that cars get more and more wireless features. It's simply more convenient for you to plug in all your nifty toys, from cellphone to iToy to navigator system without actually having to PLUG them somewhere. Now it's very tempting for the makers of said cars to stuff them onto the very same bus. CAN is already in your car, pretty much every kind of electronics can talk to it, ain't it the perfect thing to tie your toy into?
In theory, yes. In practice, I predict that unless car makers take special care to secure those wireless entry points we'll see a lot of similar hacks in the future, only that this time they'll be done from outside the car without physical access to it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Cars come with different wheel/tire size combinations. In the past, getting another circumference wheel on your car meant that your odometer/speedo was off and you had to fiddle with magnetic fields or gear boxes in the cable to correct that. Because you want a different size/width tire for winter tires (narrower, higher side) than for summer (wide tire, low profile) you will eventually have to deal with this somehow if you want optimal grip during both summer and winter. Car manufacturers chose to deal with this by making the tire size programmable, so there would be an electronic correction for this.
I was promised a flying car. Where is my flying car?
This is bad for car manufacturers. Why? Because they have to warrant that cars live a long time and will be emissions compliant too. If people can hack around in these systems, all sorts of things can happen that will make them unable to do this. I'm all for having the systems open and being able to tinker with them myself, but from a manufacturer standpoint, this is bad.
I was promised a flying car. Where is my flying car?
Recent model BMWs have been hacked wireless from 30 ft away. That is enough for the thief to hide the device used for the hack near a spot where the owner would normally park the car. They would sniff/block the central locking, so they would be able to gain access to the inside of the car. They would then trigger a buffer overflow by removing and replacing certain fuses in a certain sequence and that would gain them access to the key secrets stored inside the car's computer. They would use a device to have the car's own transponder clone one of those IDs into a blank key and as a result, they would drive away with the car, with a functioning key and no damage to it whatsoever.
I'm fairly certain that with bigger antennas and a more powerful transmitter, you would be able to do this trick at 300 feet, but I doubt that'd make a difference. By the way, the hacker doesn't have to hide under the dashboard, they have access to the CAN bus on the outside of the car too. All light units and the plug for the trailer hitch are connected to this bus. Wires for the bus are usually exposed on the underside of the car, or easily accessible with the removal of a panel only held on by a few screws. Even if one of those notoriously leaky programmed BT enabled center consoles wouldn't be pwnable, physical access would be 2 minutes and a philips screwdriver away.
No, it's not universal for all brands yet, but current developments and product announcements indicate that it won't be long before that *will* happen, unless the car industry starts asking security professionals how to deal with this instead of reinventing the wheel themselves.
I was promised a flying car. Where is my flying car?
I bought a used Volvo S80 about 4 years ago. I added the iPod connector for the stereo -- a factory option my car didn't come with.
The dealer had a real problem getting it to work -- the stereo would indicate the input was there, but when you switched to it it would work for about a minute and then stop working. The description they told me was that the car's data bus was rejecting the accessory because it wasn't authenticating.
Now, I don't know if this was an accurate assessment or not, but it took some kind of software patch specific to my car to make this work.
I'm also not sure if this is the car's CAN bus, either, or if its some private data bus within the car.
I've noticed several comments revolving around the idea that direct access to the vehicle is needed, so there's no need for concern.
It seems to me that while this certainly influences the application of such technology, it doesn't mean all is cool. How long would it take to come up with a purpose-built device that would attach to the relevant access port the same way illegal bank card readers attach to ATM's?
For the sake of argument, let's say it would have WiFi or Bluetooth capability, feed off the car battery, and sit there doing nothing until activated in any of a number of ways. Right now some cars allow a very wide range of options and functions to be accessed through direct access and a laptop...engine performance, ABS, air bags and much more. I'm sure this list will grow steadily over time. It isn't difficult to think of many useful tasks that could be performed with remote access to one or more cars.
All it would take is one crooked mechanic at a dealership or service center to install a bunch of them, or to target a fleet of cars or an individual's car. As always, the weakest link in computer security is the one with a heartbeat.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Of course you can do all sorts of things exactly like this with the CAN bus; that is what it was designed for, that's what it's used for every day. Just about every make has software available (around for over a decade in many instances) to do every single one of those things; in most cases (except odometer rollbacks) they are replicas of the dealer tools to do the same thing. This includes speedometer adjustments (in place to account for wheel/tire diameter), diagnostic tests like cycling locks, ABS valves, various engine bits, etc.
Exactly what "research" was required to discover this? Is it "hacking" for me to purchase a piece of commercial software and use it's well-documented functions, most of which are also detailed in the service manual they sold me for $50?
Let me know when somebody has actually developed a Bluetooth-based attack vector and get back to me. (And plugging a Bluetooth transceiver into the OBD II port doesn't count) Until that point: snooze...
Most cars with an electronic parking brake require that it be put into a service mode to change the rear pads. Most cars will disable the ABS/Traction Control function while the controller is in diagnostics mode, but the braking system will still function and stop the car.
all they could do with the brakes is turn off and on any "skid control" systems, the brake system on cars is STILL a mechanical/hydrochloric system , link from steering wheel to steering rack is not fly by wire in the EU, and cars still have "butterfly" valves for air intake, that is linked to pedal postion .. via mechanical cable
Wow, the EU must be a pretty backward place. From a performance stand point, I know when they unveiled the new 2005 Mustangs in America a lot of people griped that the throttle is electronically controlled, there is no direct linkage. Not to mention, luxury brands like Lexus, Range Rover, etc all use electronic throttle control. Hell, do you remember all of the "unexplained" acceleration problems that Toyota had? It was because of electronic throttle control. PS, they lost the lawsuit that dealt with a 2005 Camry.
And where exactly is this $25 tool? What is it even? The hardware obd adapter you can get from ebay/amazon/chinese site? Is it $25 for some software that sends CAN packages? Why are internet articles such shit these days?
Correction: the US government can't build a web site. US companies build web sites all the time.
Gamingmuseum.com: Give your 3D accelerator a rest.
the speedometer is supposed to be a fixed device (or nowadays, daemon) that converts the turns of the transmission shaft, with tables of which gear does what, to an approximation of linear speed.
two gotchas... output of the shaft sensor hardware, and table lookup. depending on how much processing is between A and Z, fertile ground.
your readout device may be pristine, but as we all know, GIGO.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Look here(scrool down just a bit)>
Now, don't you feel stupid for accusing me of a blatant lie? Kinda like in the cartoons when a dunce cap appears?
Any kraut car (i suppose any car, full stop) with ASR / ESP has electronic throttle, not mechanical cable. (by definition - the system has to be able to cut the throttle, and it can't with a mechanical cable).
Sent from my PDP-11
It is lunacy. When it's a simple cable you can actually use it to stop the car when the main brakes fail. With a bit of finesse you can even use it to limp to a safe place to stop and fix the main brakes.
VW VR6 (don't remember year)... mechanical throttle with all the rest of the electronic crap. The ECU still controls the fuel pump, injectors, and ignition coils. You'll go as fast as the ECU allows.
all they could do with the brakes is turn off and on any "skid control" systems, the brake system on cars is STILL a mechanical/hydrochloric system , link from steering wheel to steering rack is not fly by wire in the EU, and cars still have "butterfly" valves for air intake, that is linked to pedal postion .. via mechanical cable
Wow! what do they make the brake components from to avoid them being eaten away by the 'hydrochloric' system?
Nothing people didn't already know, but shows people how simple it is.
It has been known for years CAN bus needs authentication.
New things are always on the horizon