Slashdot Mirror
Car Hackers Mess With Speedometers, Odometers, Alarms and Locks
mask.of.sanity writes "Researchers have demonstrated how controller area networks in cars can make vehicles appear to drive slower than their actual speed, manipulate brakes, wind back odometers and set off all kinds of alarms and lights from random fuzzing (video). The network weaknesses stem from a lack of authentication which they say is absent to improve performance. The researchers have also built a $25 open-source fuzzing tool to help others enter the field."
How many idiots will use this in the safe knowledge that they can't be busted for speeding anymore, I wonder...
I gave up sigs almost a year ago.
I used to write software for aircraft instruments.
What's surprising to me is that single-function devices can have their functions changed. The speedometer has one function: to report the vehicle's speed. What requirement is satisfied by allowing this to change? Why would you even need to upgrade it?
I would have thought that certain features of the car would be fixed program/unchangeable, at the very least to simplify the design.
Not really. ABS for example modulates the braking power. In one test, researchers were able to put the brakes into 'maintenance mode" normally used when changing the pads. In that mode, the brakes don't work. If I understand correctly, that mode is used instead of the old trick of compressing the wheel cylinder with a c clamp.
To complete the lunacy, in some cars, the parking/emergency brake is electrically activated now.
In other breaking news, cutting the brake lines of cars can prevent them from operating correctly. Somebody issue a recall, quick!
This is not news, a CAN bus is viewed by the industry in the same way as analog wiring in the car, physically vulnerable. It's an issue when the side view mirror actuators are on the CAN bus, and thieves can open the door and start the engine with this technique. However, this research is stating the obvious for anyone in the know. Next thing you know, one of these researchers will find a copy of the J1939 protocol standard used by the automotive industry and discover what the CAN messages mean without fuzzing the problem space.
If someone found an On Star exploit that allowed a hacker to remotely accomplish these things on the CAN bus, then it would be news, this is not.
CAN was never developed with security in mind. What for, it was supposed to be a LOCAL, WIRED bus on a closed system that should only be accessed by someone whose authority to access it has been verified by different means (i.e. he has the keys to the car in the first place). Now, we can see how CAN can be abused with local access. Well, duh. Insecure system is insecure. Film at 11. Right? Well, technically, yes, but let's look a hint further, shall we?
The news here is that cars get more and more wireless features. It's simply more convenient for you to plug in all your nifty toys, from cellphone to iToy to navigator system without actually having to PLUG them somewhere. Now it's very tempting for the makers of said cars to stuff them onto the very same bus. CAN is already in your car, pretty much every kind of electronics can talk to it, ain't it the perfect thing to tie your toy into?
In theory, yes. In practice, I predict that unless car makers take special care to secure those wireless entry points we'll see a lot of similar hacks in the future, only that this time they'll be done from outside the car without physical access to it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Cars come with different wheel/tire size combinations. In the past, getting another circumference wheel on your car meant that your odometer/speedo was off and you had to fiddle with magnetic fields or gear boxes in the cable to correct that. Because you want a different size/width tire for winter tires (narrower, higher side) than for summer (wide tire, low profile) you will eventually have to deal with this somehow if you want optimal grip during both summer and winter. Car manufacturers chose to deal with this by making the tire size programmable, so there would be an electronic correction for this.
I was promised a flying car. Where is my flying car?
Of course you can do all sorts of things exactly like this with the CAN bus; that is what it was designed for, that's what it's used for every day. Just about every make has software available (around for over a decade in many instances) to do every single one of those things; in most cases (except odometer rollbacks) they are replicas of the dealer tools to do the same thing. This includes speedometer adjustments (in place to account for wheel/tire diameter), diagnostic tests like cycling locks, ABS valves, various engine bits, etc.
Exactly what "research" was required to discover this? Is it "hacking" for me to purchase a piece of commercial software and use it's well-documented functions, most of which are also detailed in the service manual they sold me for $50?
Let me know when somebody has actually developed a Bluetooth-based attack vector and get back to me. (And plugging a Bluetooth transceiver into the OBD II port doesn't count) Until that point: snooze...
Correction: the US government can't build a web site. US companies build web sites all the time.
Gamingmuseum.com: Give your 3D accelerator a rest.