Slashdot Mirror
GM Performs Stealth Update To Fix Security Bug In OnStar
An anonymous reader writes: Back in 2010, long before the Jeep Cherokee thing, some university researchers demonstrated remote car takeover via cellular (old story here). A new Wired article reveals that this was actually a complete exploit of the OnStar system (and was the same one used in that 60 Minutes car hacking episode last year). Moreover, these cars stayed vulnerable for years -- until 2014, when GM created a remote update capability and secretly started pushing updates to all the affected cars.
The only fix for the security problems with Onstar and any similar system is total removal of the hardware and software!!!!!
Did it install Windows 10?
What you propose is at variance with how the market works.
People will get upset every time an exploit is found. The vendor will give assurances that the problem has been fixed (whether it has or not), and business will proceed as usual.
You can pound your fist and say it shouldn't be that way all you like. But it is that way. All you can really do is figure out the best way to adapt to it.
Trying to control the world will only bring you stress.
Not touched upon in the story is that the update also included a stealth download of systemd.
Just cruising through this digital world at 33 1/3 rpm...
Whack-A-Mole is fun when your life is on the line!
As I graduated last year and assumed my engineering role at mcdonalds (ketchup extrusion/mustard analytics) I became aware of this 2010 exploit and, in keeping with slashdots hacker culture, created my own workaround in case my vehicle were to make the list of coveted hackable hardware.
my 2001 crown victoria police interceptor has been modified slightly to emit a protective haze of burnt oil to stealthfully evade hackers. Whats more, the suspension has been recalibrated to bob and duck at the slightest bump, and shake violently at speeds above 40 miles per hour in an attempt to elude hackers signals. Finally, I use crippling student debt technology to ensure that flipping on my dome light and barking orders to OnStar does virtually nothing to the vehicle. For added protection, you can put the car into 'stealth mode' if you have an arts degree by avoiding oil changes and fuel in exchange for more ramen this month.
Good people go to bed earlier.
This glacial speed of fixing critical bugs demonstrates that automotive industry cannot be trusted with networking anything.
"Created a remote update capability" by exploiting the very same bug.
From GM chief product cybersecurity officer Jeff Massimilla:
“We were able to find a way to deliver over-the-air updates on a system that was not necessarily designed to do so.”
They hacked it so they could hack it. I'm glad GM has my back.
It is unwise to ascribe motive
That's pretty laden with strong, negative emotional connotations. What's the justification?
Why not just read it as they started quietly pushing updates?
"I don't know, therefore Aliens" Wafflebox1
I didn't know stealth was an available upgrade, not sure how I'd use it accept to avoid speeding tickets.... Oh wait....
I'm getting sick and tired of this. The stuff that so many engineers and technical people have been touting for so many years is happening right before our eyes. I'm still waiting for the phone armageddon which is already happening with so many phones being hacked (Even your old phone won't help you here with the baseband exploits). Pretty soon we'll be tossing all our phones in the garbage.
These people touting the exploits end up getting laughed out of IEEE conferences by manufacturers and their butt buddies, that's how bad it is.
Until the industry decides to take things seriously, nothing is going to change.
Secretly pushing updates is absolute BULLSHIT
As someone who drives a GM car that came with an OnStar antenna, a rearview mirror full of OnStar buttons, and an OnStar free trial... How do I determine whether or not my car is vulnerable? Whether it received the patch? Which generation of OnStar my car has?
I haven't had anything to do with OnStar since I was driving down the interstate and suddenly received a loud and unexpected phone call from a fucking OnStar telemarketer. My trial, which came with the car and which I hadn't used, was about to expire, so they decided to make a sales call. To my car. While I was driving. Out of nowhere, the car muted the radio, made some very loud dinging noises, and started blasting an unknown woman's voice over the stereo system while I was driving down the highway. She's asking me if I want to sign up for OnStar at such and such monthly rate. I have never been so distracted by anything while behind the wheel of a car, and vowed never to use any OnStar service again.
I'd just like to know whether or not the OnStar in my car, which I had hoped was disabled after not paying for it, will attempt to kill me again.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
NEVER respond to calls from people you don't know, let them talk... to voicemail.
Especially sales calls.
NEVER talk, let alone clearly in your normal voice, until you know who they are and what they want.
Otherwise they will voiceprint you and add your voice to their database and sell your voice along with it.
Take back your privacy...
https://mcafee16.com/
Onstar is easily compromised vial MTM attack and has been for 2 decades now. They need to give it decent encryption and allow the car owners to set passwords/pin numbers in the car system themselves that the car will ignore all communication attempts without it.
Do not look at laser with remaining good eye.
I will never have anything to do with Onstar or any vehicle supported Wifi system. Your just asking for trouble and its why Wifi in aircraft is supposed to be separated from airplane electronics. In most of the automotive wifi its just too tied to the vehicle systems. Run away from that stuff. Much better options that work better.
Think of all the terror if they didn't have logs of our every moment to and from work and lunch each day?
I don't understand why the same computer needs to handle both work loads as they do not cross over in functionality or need.
There is a half-truth here.
The underlying problem is that a lot of the electronic systems within most modern cars probably communicate using an insecure channel. The systems were designed with the assumption that the other devices on the same bus were trustworthy. And of course, they typically were, before remote access came along.
Today that assumption no longer holds, but a lot of systems that seem unrelated do actually have genuine reasons to interact to some degree. For example, consider a modern system that will call the emergency services in the event of a crash, which is obviously a beneficial feature other than in contrived situations. However, that system needs to know whether a crash has occurred, and how is it going to do that? It needs access to some sort of sensor, but by its nature that same sensor is probably also used by some of the other modern systems that provide collision avoidance/mitigation features. Bang, now you've a link between a system that has remote communication capabilities and a system that has a need for direct control of essential vehicle systems.
One possible solution to this is to have proper internal firewalls so that trust is only given where it's actually necessary, and it can also be a one-way relationship. However, this simply isn't possible with the current generation of bus-based designs that a lot of these modern vehicles use. So, the car companies don't want to acknowledge the problem because that would potentially increase their liability if anything later goes horribly wrong. Since they can't ship a software update to fix the numerous potentially at-risk vehicles they already sold, nor retrofit more secure infrastructure in a financially viable way, there would be nothing they could do to control that risk.
The result is the three wise monkeys calling the shots, and unfortunately the commercial incentives are likely to keep it that way until either serious laws with meaningful penalties are passed or something awful happens.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.