Slashdot Mirror
Least Secure Cars Revealed At Black Hat
Lucas123 (935744) writes Research by two security experts presenting at Black Hat this week has labeled the 2014 Jeep Cherokee, the 2015 Cadillac Escalade and the 2014 Toyota Prius as among the vehicles most vulnerable to hacking because of security holes that can be accessed through a car's Bluetooth, telematics, or on-board phone applications. The most secure cars include the Dodge Viper, the Audi A8, and the Honda Accord, according to Researchers Charlie Miller and Chris Valasek. Millar and Valasek will reveal the full report on Wednesday, but spoke to Dark Reading today with some preliminary data. The two security experts didn't physically test the vehicles in question, but instead used information about the vehicles' automated capabilities and internal network. "We can't say for sure we can hack the Jeep and not the Audi," Valasek told Dark Reading. "But... the radio can always talk to the brakes" because both are on the same network. According to the "Connected Car Cybersecurity" report from ABI Research, there have been "quite a few proof of concepts" demonstrating interception of wireless signals of tire pressure monitoring systems, impairing anti-theft systems, and taking control of self-driving and remote control features through a vehicle's internal bus, known as controller area network (CAN).
my apologies to the drivers. i thought it was them.
Because if it starts at all it may very catch on fire.
Bullshit.
They might be on the same network, but that doesn't mean they can talk to each other.
We've been here before. Two days ago.
They did not hack anything, this is just speculation based on documentation. BlackHat used to offer more serious stuff.
I work in the automotive after market (ECU tuning). I can actually back up what they're saying. Even if they did come by it via speculation, they're actually pretty much dead on.
That is primarily because the german cars use what we call a "Can Gateway" but is better of though as a firewall. Every different system in the car has it's own private canbus. Anything that needs to travel between the busses has to go through the gateway. In the case of VW/Audi vehicles, it's locked down quite well. It knows what packets belong on what bus and only allows a very limited subset of properly formatted and required packets to pass between those busses.
Vehicles that share common can without a gateway are readily exploitable. I could plug a can interface into the headlights, A/C or any other system on the global bus and lock/unlock the doors, roll the windows up/down, trigger the traction control/ABS or even start/stop the car (if it uses a push button start).
Doing those things requires access to the can wires, but the bus is used for so much now-a-days, there's always plenty of places to access it. Many of them without requiring keys or an open hood.
Simply letting him get away would be horrible, because of the prevention aspect. If that were standard practice on the part of the cops, then the rate of car theft would certainly go way up.
But there is another possibility besides letting him go and flying off in a risky high speed chase. There's this old-school police technique called a 'tail' where you follow at a distance and let the target think he's getting away (while of course using your radio to get ahead of him.) Much less chance of injury or death that way. Too old-school for US cops these days, but in some backwards jurisdictions it might still be used.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
I bought a 99 Volvo S80 and it has the fancy auto dimming rear view mirror. The car was used so of course expensive mirror no longer dims. You can't even swap out a junked mirror because of the address bullshit. You have to keep the circuitry from your mirror and swap only the mirror itself. Otherwise you need the dealer software to reprogram the main computer.
Only the State obtains its revenue by coercion. - Murray Rothbard
The brakes are controllable on cars with collision avoidance.
Only the State obtains its revenue by coercion. - Murray Rothbard
I can't understand it either. If they are accusing so many car makes of having vulnerabilities, they should have been able to get access to at least one to formulate an actual attack. If everything on the same network was considered vulnerable by default - the Internet would be vulnerable.
@_jeff_nelson +jeffnelsonjeffnelson
I guess the wrangler didn't make the list, but it can hardly count as hacking when the hood doesn't even lock closed.
considering most car thefts are committed by a very small number of people, anytime one of those little buggers gets tossed in the clink, we're all better off.
Well, the criminal then gets to pay for the damage he caused to the car.
Awww, it's so cute you think rich people are stealing old Astra's.
If something was stolen from me I would damn sure want to (preferably) get it back or at least get loss compensated.
This is what we call "Insurance".
In Australia people are taking to stealing keys as immobilisers have become so common and effective it's easier to break into a house and flog the keys before taking the car. I dont really care that much if they do this and steal my 14 yr old Nissan... It's insured for $13,500. Sure it would be a shame as it's a mint condition Silvia S15 but in the end it's a car I have properly insured.*
If you dont have your car insured, that's your problem. As for getting it back, well considering the kind of people who steal cars I'm not sure I'd want that either (the first thing Police do on recovered cars is a sharps check, a check for used needles. Insurers will do the same to make sure the cops didn't miss any).
* I drive a manual, these days that's enough to stop most thieves in their tracks.
Calling someone a "hater" only means you can not rationally rebut their argument.
Only in the Northern America and apparently Australia. In Europe, you can bet that everyone can drive sticks. Technically, you can do your driving license on a automatic, but it usually reserved for the physically disabled and you only are allowed to drive automatics with such a license.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
"Teenagers........are.......walking.......on.........our........lawns!!!"
Quickest way to be rid of them...
Roll out the lawnmower, hedge trimmers, edgers, fertilizer and watch them set new world records as they leave posthaste!!!
Donald Trump, on a crusade to make Nixon look respectable
Not with the protocol itself (because you couldn't trust it anyway), but you could implement crypto on top of the bus to avoid that problem. Everybody signs the messages and only accepts messages from approved sources who have signed their messages correctly.
I read the internet for the articles.
I didn't say we're superior. I said "in Europe every one can drive stick". That is fact, not superiority or anything. You interpret it that way. That says more about you than about me.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
I work at an OEM... I know for a fact The Dodge Viper and the Jeep Cherokee share the same line-up of head units and the CAN architecture is identical.
How are they both the most and least secure?
(Also, the Radio can't talk to the brakes, as much as they'd like you to think - I'd know, because I wrote the code for the interface that talks on the CAN network.)