Slashdot Mirror
Researchers Hack the Mitsubishi Outlander SUV, Shut Off Alarm Remotely (helpnetsecurity.com)
Reader Orome1 writes: Mitsubishi Outlander, a popular hybrid SUV sold around the world, can be easily broken into by attackers exploiting security weaknesses in the setup that allows the car to be remotely controlled via an app. After discovering the SSID and the pre-shared key, they connected to a static IP address within a network's subnet, and this allowed them to sniff the Wi-Fi connection and send messages to the car. Through these messages they were able to turn the car's lights, air conditioning and heating on and off, change the charging programme and, most importantly, to disable the car's anti-theft alarm.
But if you resort to meaningless terms, you aren't doing any science any longer, if you ever were. So, no, you're not researchers.
Also, you said "hack", so now you need to be locked up. It's the law!
More second rate engineering from car manufacturers. After seeing stuff like this, I can't imagine why someone would want an even more complex car like a Tesla.
Pretty soon, poor John Connor will have Mitsubishi after Mitsubishi chasing him down.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Who ever thought of this should get a Nobel Prize.
"Through these messages they were able to turn the car's lights, air conditioning and heating on and off" Has this been done for a 2015 GMC Acadia? If so has anyone rolled them in to an app to compete with onstar?
In their effort to make things ever easier for consumers, and to improve time-to-market, manufacturers skip the most basic security best practices.
This will kill the IOT market in general. Ever more gadgets with ever weaker security.
To Terminate, or not to Terminate, that's the question - SCSIROB
They've been at the top of the list of "Japanese car makers that won't be around much longer" for a few years now. So few of them are sold in the US currently that I was starting to think perhaps they quietly went under or were absorbed by Toyota. Their long running Lando Calrissian approach to car manufacturing can only last so long, really.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I remember about 8 years ago, mentioning that the proposed smart cars the industry was crowing about would be a hacker's paradise, because of compounding costs of manufacture driving security based design out the window.
Seems I was right, despite all the loud objections I got that called me crazy. Fancy that. /shameless self promotion
Really, these recent reports of hackable cars all fail for the same reasons: The car's internal network is presumed secure, instead of presumed hostile. This ignores the primary rule of security-- if you can get local access, the security should be assumed broken.
Ideally, the data being sent through the internal network should be encrypted with unique keys between components, initially seeded at the factory with unique one time pads. The wifi network should be isolated completely from the internal network as well, and any instruction given should have a handshake challenge before being accepted.
All of those things will increase the costs of the vehicle considerably though, which is why none of the manufacturers are doing it.
It will require federal legislation to impose regulations for vehicle safety before that happens.
Every time I read about these, it strikes me that it all goes down to poor system design. The computers and functions dealing with the operation of the car need to be isolated from the entertainment systems, including WiFi, at least so far as inputs are concerned. Apps that allow the user to unlock the doors or start the engine, WiFi and OnStar systems that allow on-the-air updates of control software, these are all inherently insecure and always will be! They tie into systems that need to be air-gapped and only accessible via physical access to the car.
Security is almost always a trade off with utility or convenience. But auto makers have gone way too far, to the point of threatening public safety. These car computer systems need to be redesigned from the ground up with proper security practices and risk assessments in place.
No one wants to steal a Mitsubishi anyway.
Disable all remote access. If necessary to open the hood and find the COM port to use this, then a criminal can steal the whole car as is.
Nissan had this same thing happen back in February for the app they had for the Leaf, although with their vulnerability you could only turn the AC on and drain the battery (https://tech.slashdot.org/story/16/02/24/1739227/nissan-leaf-hvac-hack-vulnerability-disclosed)
I don't understand why a car needs to be connected to the internet. Why do we make these 2000 lbs death sleds accessible to some teenager sitting in a basement halfway around the world. At some point people really need to weigh where this balance between convenience and security lies because right now ZERO though is being put into it.
Here's the original source, not a spammy blog, written in broken english:
https://www.pentestpartners.co...
The status quo will not change until CEOs are held criminally liable or terrorists(hackers) start crashing cars into each other.
Any idiot can do it.
Let me ask you this, have you watched the movie Hackers? Then you have all the skill you need!
Now all you have to do is stand around the vehicle for a 'relatively' short amount of time and perform an easy hack. Just wear a trench coat and fedora and no one will ever suspect you.
It's a wonder how these vehicles aren't disappearing daily!
Horray!
The EU has recently mandated that new cars need wireless technology so they can automatically dial emergency services in an accident. So now even more cars with have vulnerable wireless links to the outside world that could potentially be exploited by hackers.