Unpatchable 'Flaw' Affects Most of Today's Modern Cars (bleepingcomputer.com)

Catalin Cimpanu, writing for BleepingComputer: A flaw buried deep in the hearts of all modern cars allows an attacker with local or even remote access to a vehicle to shut down various components, including safety systems such as airbags, brakes, parking sensors, and others. The vulnerability affects the CAN (Controller Area Network) protocol that's deployed in modern cars and used to manage communications between a vehicle's internal components. The flaw was discovered by a collaborative effort of Politecnico di Milano, Linklayer Labs, and Trend Micro's Forward-looking Threat Research (FTR) team. Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable.

Comments

Re:All of these have this flaw

[TWX]

Except that as infotainment systems get more complex and more heavily integrated with the vehicle's CANBUS system and with the Internet via cellular networks, suddenly the possibility that someone can sabotage your car without having ever come within a thousand miles of you becomes a real prospect. Now add drive-by-wire where the vehicle controls are just inputs and the computer more directly controls acceleration, braking, and even steering, and you've got a recipe for a disaster if someone figures out how to exploit all models of a manufacturer with the same flaw. Imagine if all Honda Accords with lane-departure and adaptive cruise control suddenly accelerate at full-speed for five seconds then suddenly turn fifteen degrees to the left. If an attack like that was successful it would probably hurt or kill thousands of people.

Re:All of these have this flaw

[amorsen]

Because all they need to do is send a malicious RDS message through the FM network to a vulnerable car radio. Many radios are on the CANBUS these days, and it is highly unlikely that the developers of the radio software care about security or that secure channels for expedient software updates were designed in.

However, there are much more exciting things that you can do once you're on the CANBUS, instead of just shutting down ABS.