Slashdot Mirror
GM Performs Stealth Update To Fix Security Bug In OnStar
An anonymous reader writes: Back in 2010, long before the Jeep Cherokee thing, some university researchers demonstrated remote car takeover via cellular (old story here). A new Wired article reveals that this was actually a complete exploit of the OnStar system (and was the same one used in that 60 Minutes car hacking episode last year). Moreover, these cars stayed vulnerable for years -- until 2014, when GM created a remote update capability and secretly started pushing updates to all the affected cars.
The only fix for the security problems with Onstar and any similar system is total removal of the hardware and software!!!!!
What you propose is at variance with how the market works.
People will get upset every time an exploit is found. The vendor will give assurances that the problem has been fixed (whether it has or not), and business will proceed as usual.
You can pound your fist and say it shouldn't be that way all you like. But it is that way. All you can really do is figure out the best way to adapt to it.
Trying to control the world will only bring you stress.
As I graduated last year and assumed my engineering role at mcdonalds (ketchup extrusion/mustard analytics) I became aware of this 2010 exploit and, in keeping with slashdots hacker culture, created my own workaround in case my vehicle were to make the list of coveted hackable hardware.
my 2001 crown victoria police interceptor has been modified slightly to emit a protective haze of burnt oil to stealthfully evade hackers. Whats more, the suspension has been recalibrated to bob and duck at the slightest bump, and shake violently at speeds above 40 miles per hour in an attempt to elude hackers signals. Finally, I use crippling student debt technology to ensure that flipping on my dome light and barking orders to OnStar does virtually nothing to the vehicle. For added protection, you can put the car into 'stealth mode' if you have an arts degree by avoiding oil changes and fuel in exchange for more ramen this month.
Good people go to bed earlier.
From GM chief product cybersecurity officer Jeff Massimilla:
“We were able to find a way to deliver over-the-air updates on a system that was not necessarily designed to do so.”
They hacked it so they could hack it. I'm glad GM has my back.
It is unwise to ascribe motive
As someone who drives a GM car that came with an OnStar antenna, a rearview mirror full of OnStar buttons, and an OnStar free trial... How do I determine whether or not my car is vulnerable? Whether it received the patch? Which generation of OnStar my car has?
I haven't had anything to do with OnStar since I was driving down the interstate and suddenly received a loud and unexpected phone call from a fucking OnStar telemarketer. My trial, which came with the car and which I hadn't used, was about to expire, so they decided to make a sales call. To my car. While I was driving. Out of nowhere, the car muted the radio, made some very loud dinging noises, and started blasting an unknown woman's voice over the stereo system while I was driving down the highway. She's asking me if I want to sign up for OnStar at such and such monthly rate. I have never been so distracted by anything while behind the wheel of a car, and vowed never to use any OnStar service again.
I'd just like to know whether or not the OnStar in my car, which I had hoped was disabled after not paying for it, will attempt to kill me again.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!