Slashdot Mirror
Hackers Remotely Cut a Corvette's Brakes
An anonymous reader writes: Security researchers presented work at the USENIX conference today showing an easy way to hack into a car's electronics using a small gadget that plugs into modern dashboards. The port they're taking advantage of is commonly used to monitor the location and speeds of these vehicles. Once the researchers' dongle is attached, they can use SMS messages to transmit commands to the car's internal network. They demonstrated this by remotely cutting a Corvette's brakes. "Though the researchers say their Corvette brake tricks only worked at low speeds due to limitations in the automated computer functions of the vehicle, they say they could have easily adapted their attack for practically any other modern vehicle and hijacked other critical components like locks, steering or transmission, too."
The NSA demonstrated a clever hack where they attached a small device to the underside of a Pontiac Grand Prix, remotely pushed a button, and the car blew up! General Motors says this is not a serious security breach and the vulnerability is not limited to their vehicles. They will not issue a recall.
Let's keep this in perspective. If the hack requires you to physically attach dongles to the vehicle, the hacker could just as easily attach a remote controlled bomb.
This is silly. The brake pedal on every car that currently leaves a production line is still physically connected to the master cylinder and wheel callipers. What they likely meant by 'disabled the brakes' is that they disabled the ABS or brake assist module. While troubling, these components are all designed with mechanical overrides for if the electronics goes hey-wire, so this is really scare mongering.
We have known for years about CAN bus insecurity and how you can control indicators and wipers once you get physical access. There was even a model of car where you could just snap a wing mirror off and plug directly into the CAN system through the exposed mirror connector. These people haven't done anything new and are just being intentionally sensationalist to get attention.
...which basically consists of "drive a '92 Jeep where the only major electronics in the car are my cell phone".
It doesn't even have power windows.
Hack that wirelessly, bitches.
Oh, there are people doing it they just have the law on their side.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Yep, FedEX vans ... or armoured van fleets?
A practical application of this for criminals would be to use it to stop and rob an armoured van.
Windows is a bonfire, Linux is the sun. Linux only looks smaller if you lack perspective.
This exploit is unlike the Chevy exploit - in that to remotely use it, you had to get into the car in the first place. Well, if you're already in the car, then all bets are off.
It's like saying Linux is vulnerable because you can install a keylogger ... by first getting access to the PC. Well, if you have access to the PC already, then installing a keylogger is just one of the many things you can do. Nevermind that software security is bunk once you have physical access.
Or perhaps houses are vulnerable because you can install all sorts of surveillance equipment in them... once you get inside. You can even install remote controlled lighting to freak out the homeowner.
Now, maybe the OBD-II dongle is defective, which is a fair point, but it goes less against the car manufacturer and more against the dongle manufacturer for making it so easy to break into.
You don't seriously think the handbrake is an "emergency brake", right? Good grief, please be kidding.
It isn't a handbrake in my vehicle since it is on the floor, and such systems were originally put in place to provide a backup braking system in case the hydraulic system failed, especially since hydraulic braking systems used to be single-cylinder systems and were only mandated to use dual master cylinders starting in 1976. They were later adapted to provide a backup parking brake to supplement the vehicle being left in gear, and are now often also referred to as a parking brake.
So yes, I think of it as an "emergency brake". But then ideas like yours is why most people never think to use it when their regular brakes fail, just like they don't think to turn off the ignition if the throttle sticks.
Can we stop with these fake "researchers" that make claims that are stupid as hell?
They did not hack anything, they compromised the car by having physical access and sent service code activation commands.
Basically if there is a smelly guy wearing a trenchcoat under your dash, you might be hacked.
Do not look at laser with remaining good eye.