Slashdot Mirror
Insurance Company Dongles Don't Offer Much Assurance Against Hacking
According to a story at Forbes, Digital Bond Labs hacker Corey Thuen has some news that should make you think twice about saving a few bucks on insurance by adding a company-supplied car-tracking OBD2 dongle:
It’s long been theorised that [Progressive Insurance's Snapshot and other] such usage-based insurance dongles, which are permeating the market apace, would be a viable attack vector. Thuen says
he’s now proven those hypotheses; previous attacks via dongles either didn’t name the OBD2 devices or focused on another kind of technology, namely Zubie, which tracks the performance of vehicles for maintenance and safety purposes. ... He started by extracting the firmware from the dongle, reverse engineering it and determining how to exploit it. It emerged the Snapshot technology, manufactured by Xirgo Technologies, was completely lacking in the security department, Thuen said. “The firmware running on the dongle is minimal and insecure. It does no validation or signing of firmware updates, no secure boot, no cellular authentication, no secure communications or encryption, no data execution prevention or attack mitigation technologies basically it uses no security technologies whatsoever.”
http://www.forbes.com/sites/ha...
The Myth of Tamiflu: 5 Things You Should Know
Influenza-like-illness is sweeping the country with the Centers for Disease Control & Prevention reporting that most areas of the country experiencing high rates. I should know, my family is in the midst of it despite having been vaccinated. This year may rival some of the worst years in recent history.
These illnesses are more than uncomfortable Ã" they can cause life-threatening complications. Worries about complications lead many people to want to be prepared with a treatment. I have a friend who once stockpiled Tamiflu, an antiviral agent sold by Roche, wanting to be prepared to protect his friends and family. He was not alone. The US actually reportedly stockpiled $1.5 billion of the drug prior to the global outbreak of H1N1 influenza and while the vaccine was being prepared.
The problem is that we actually know little about the effectiveness and safety of Tamiflu Ã" and Roche is not willing to share all the relevant data they have. Last year the Cochrane group, the worldÃ(TM)s most respected organization devoted to synthesizing evidence and providing assessments on medical interventions, updated their review of the Tamiflu studies. If you are enamored by the idea of Tamiflu, then here are 5 things you should know from their report.
1. The manufacturer of the drug sponsored all the trials and the reviewers found evidence of publication and reporting biases. With so much at stake I was surprised that there had been no prospective, placebo-controlled trials conducted that were funded by an independent source. Industry trials can be well conducted, but there are many situations where a lack of independence has had an influence on the way the study was designed and the results that are released. At the very least, it is worth noting that they were probably designed to have the best chance of showing benefit. And that the reviewers had concerned about whether all the information was released. In addition the experts found evidence of reporting bias. According to Tom Jefferson, one of the authors of the Cochrane study: 60% of randomized data from the Tamiflu treatment trials (i.e. in people with influenza-like-illness symptoms) have never been published including the biggest trial ever conducted (which was done in the US, so itÃ(TM)s of great relevance to you).Ã
2. The studies did not show that Tamiflu reduced the risk of hospitalization. One of the reasons people might take an antiviral is to prevent the illness progressing to the point where they would need to be hospitalized. Unfortunately there was no evidence that the drug produced that benefit.
3. The studies were inadequate to determine the effect of Tamiflu on complications. Even though the drug did not reduce hospitalizations, some people may think it would prevent less severe complications. Unfortunately, the reviewers found that limitations in the design of the trials, their conduct, and the way they were reported precluded any conclusions about the effect of the drug on complications. To expect that Tamiflu can reduce complications would be a leap of faith currently unsupported by the available evidence. You should also know that the FDA requires Roche to print on the label: ÃoeTamiflu has not been shown to prevent such complications [serious bacterial infections].Ã
4. The studies were inadequate to determine if Tamiflu reduced transmission of the virus. Same story. Some people might prescribe the drug to prevent the spread of the virus. The expert reviewers simply said that with what information they had available; they could not assess the effect of the drug on transmission. I asked Peter Doshi, one of the authors of the Cochrane report about this issue of transmission and here is what he wrote me: ÃoeRocheÃ(TM)s prophylaxis trials were not designed to answer the questi
That most people don't give a damn about security "because it is hard"?
I've long thought there could be a really lucrative market for OBD2 spoofers. Instead of plugging the dongle directly into your car, plug it into a middle-man that feeds it the "happiest" possible data to make it think your driving is perfect. There is no authentication in the OBD2 protocol so there is no way for the dongle to tell the difference between a real OBD2 data feed and a spoofed one.
The most obvious reason for an attack here is to commit insurance fraud. At present, an insurance company is forced to base an insurance premium on all the meta-data they can possibly gather about the prospective client, excepting their sex if they are in the EU (although this may well lead to a quite astonishing number of men called "Sue", if insurance companies attempt to bypass this and link first names to insurance risk).
A data-gathering dongle would seem to offer a much better deal, allowing the company to charge more if the user indulges in risky behaviour of some description.
A possible reason for hacking into the module would therefore be to falsify the data sent back to the company; a boy racer who regularly breaks speed limits, corners absurdly fast and brakes late if at all would gain substantially from a fraudulent data recording which portrayed him as someone with the driving habits of an octogenarian grandmother; such a person might also think that the gamble of sending such phoney data was well worth the savings when set against the fairly low risk of getting caught.
It therefore worries me that companies are this lazy when building such equipment. It really doesn't take all that much to keep out the majority of crackers right from the start, and as the skilled ones are in the minority, taking a little care initially would pay dividends down the line.
Seems like a massive invasion of privacy and a potential big gotcha to raise rates or deny payouts in certain instances.
Technically, I speed 90% of the time. But it's appropriate speed for the road and my driving 22 years no without an accident attests to that. Should be good enough for the insurance company.
Even if you could put these dongles in a makeshift faraday cage, afraid the insurance will refuse to pay out one day if it's not plugged in and reading data.
As it is now, I think they are more to collect marketing data to sell to other companies. They have your private info, and now where you exactly go to? Sounds like a marketers wet dream.
If you want to drive your car again, send $500 to .... until then the ignition is locked.
fuck the planet
"confidential and detailed input" ... Emphasis mine.
How long until he is hit with a gag order, "to protect the public", and "to prevent terrorists from exploiting it". That is why I have always supported the full disclosure (bugtrac) movement, as it is too easy for a company to practice Security by Obscurity by gagging the security researcher discovering a vulnerability.
In other news, nerds flock to progressive insurance and claim safe driving styles resulting in the lowest possible insurance rates. Progressive in press release say 'we hypothesize it's because nerds don't party or stay out late'
So what? You can hack the connection without any dongle. What's the point? That the dongle itself can be fudged? So what? Go ahead and try it and see how long before your brought up on fraud charges for a few extra $$ for a few months or even a year.
Do you kids have any morality?
What do we know about the security of systems such as onStar?
Sheesh, evil *and* a jerk. -- Jade
I'm glad the insurance companies are so lax with those peoples security as to make them a target for crackers. It shows they are subject to the same type of contempt the insurance companies demonstrated in the first place. People too insular to be concerned deserve to be subject to every exploit there is.
My ism, it's full of beliefs.
From the article.
By hooking up his laptop directly to the device he says he would have been able to unlock doors, start the car and gather engine information, but he chose not to “weaponise” his exploits
SO only direct connect has been proven.
The researcher noted that for a remote attack to take place, the concomitant u-blox modem, which handles the connection between Progressive’s servers and the dongle, would have to be compromised too. Such systems have been exploited in the past, as noted in a paper here from Ralf-Philipp Weinmann, from the University of Luxembourg.
Remote access has only been shown by similar systems.
Call me when you can actually show a remote exploit through the dongle.
This is the kind of tracking that would make despotic regimes like East Germany or the United States very happy indeed. It should be illegal for anyone to track individuals as they go about their daily business. Do you want to live in a totalitarian state or not?
Any of those features cost money to develop.
Why would anyone develop security features for a thingy that, at least to beancounters and managers, looks like it would be obviously secure because nobody else knows how it works.
I had a client who actually bought holy Mary anti-virus stickers to put on the outside of the computer.
It's a gamble between two opposing forces of insurance:
1) On one hand, insurance companies are bureaucracies and handling claims is a bureaucratic process with a certain amount of inertia, where obvious fraud needs to be caught but time/people/resources don't exist to fine-grain protect against all possible marginal fraud, otherwise the system would grind to a halt. A tracking device with a minor deviation from observed damaged may just get written off as the strangeness of physicals or the brittleness of plastic cars -- I mean, we have the data, right?
2) On the other hand, IMHO, the insurance company is almost in the primary business not of supplying insurance or processing claims, but in DENYING claims. Insurance fraud is a huge risk, the more claims they can deny the more money they make and they have deep and long-term investments in actuarial data and statistics. They may already have enough tracking device data in their databases to *know* that your physical damage doesn't align with the tracking data.
I received a letter from my State Farm agent indicating that I would be required to install their dongle in my car if I wanted my policy to renew. So, I went down the street to the Allstate agent, who told me that they were requiring their dongle for all new policyholders.
So, fuck them.
Wow. I wonder what I'd do if my State Farm agent pulls this stunt on me. My cars predate OBD II or any other diagnostic ports by a few decades.
I'd be happy to put them in the ashtray or something.
Have gnu, will travel.
There might be a market for a defice that can be placed between any such 'required' dongles and a vehicle's actual systems. Something that can pass certain data in only one direction (read-only vehicle parameters) and block requests (and spoof handshake signals) should dongle attempt to make an unwanted request of the vehicle's systems.
I can also see a market for such a device where emissions tests are done by reading the data port. Just tell the port filter to always reply with an 'all is well' code.
Have gnu, will travel.
If you're worried about it, solve the problem at the communications layer. Wrap the dongle in such a way that it can't transmit or receive data. "What you're not getting the data? Wow that's strange. I have it plugged in." Either that or find another insurance company that doesn't track you. The fact that you've allowed a device to track you in the first place means that you've exposed yourself to risks, some overt such as your lead footed behavior is know a known quantity and inadvertent in terms of a hacker potentially changing your ECM or some other system in your car. What we need are stronger privacy protection laws as well as some insurance reform that says your rates are based on what you drive, how much you drive and your driving record. Every time you have somebody do an oil change, that information is sold and mined (Carfax etc.) so Insurance companies can verify mileage and tickets/accidents are all a matter of public record. Therefore there's no need for this kind of tech.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
I'd tell them they can install it on my vehicle and let them sort out a positive ground pre-emissions little british roadster. Of course the Lucas Electric components may let magic smoke out of their device but it wouldn't be my problem.
Time to offend someone
It is nice to know that these security hole exist. Others have pointed out how these might be ... put to use.
I found the article lacking. Here's what I'm missing - nowhere in the article did I gain an understanding of the feasibility of attacking this system. We've elsewhere seen people unlocking cars from the outside (either breaking a window and using the port or wirelessly). Breaking the glass is just that - Break Glass and people would notice.
Having to unplug this device and write new firmware isn't really a hack. Yes - it would be nice if these things had security codes stamped into them for access to the mothership. Still - from outside the car how do I attack this thing? How do I take over this thing and make use of it?
I'm sure there's a way, I'm just not getting a feeling of the priority here. I won't signup for these devices because of the big brother aspect. Shaming the companies for low security is fun. And there are hypothetical attacks on the cell system. But how serious is this? What is my attack surface right now?
Whether or not a system is "secure" depends on whose security you're talking about. Lets think about the purpose of these black boxes, and whose interests they are intended to serve.
One thing I noticed when I saw a snail mail ad from my insurance company for one of these, is that it looked like the box would actually be coming from a third party who would be supplying the insurance company with information about my driving. (Interestingly, I saw no indicator that my insurance company would be the only party they would be supplying information to.)
If the machine causes a problem, that might be "insecure" from the PoV of the driver or the insurance company, but would it have a cost to whoever created the device? If not, then the vulnerabilities aren't "insecure."
I'm sure they would just tell you F off with our old ass car and cancel your insurance at the next renewal.
I'm guessing you have something in your recent driving history that caused them to do this, i.e. an accident, DWI, or habitual moving violations.
My State Farm policy doesn't require it.