Volkswagen, Audi Cars Vulnerable To Remote Hacking (bleepingcomputer.com)
An anonymous reader writes: "A Dutch cyber-security firm has discovered that in-vehicle infotainment (IVI) systems deployed with some car models from the Volkswagen Group are vulnerable to remote hacking," reports Bleeping Computer. The vulnerabilities have been successfully tested and verified on Volkswagen Golf GTE and Audi A3 Sportback e-tron models. Researchers say they were able to hack the cars via both WiFi (remote vector) and USB (local vector) connections. Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said in their paper. "Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added. VW deployed patches.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said in their paper. "Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added. VW deployed patches.
Those infotainment systems were once made by QNX under Harman Becker, now owned by Blackberry. I bet they're still doing them. This is actually surprising to me, as QNX is known for better work than that. If these car companies switched to a different dashboard maker, QNX should jump in at the marketing opportunity.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history,"
Why in the fuck does the car have an "address book" or a microphone?
My 1999 Ford gets me around just fine without a microphone or an address book.
What's next? A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around? An in-dash scrolling facebook update for the addicts?
Has the world gone totally crazy now?
Many people happen to like the fact that you can link your phone to your car via Bluetooth and then make completly hands-free phone calls.
Many people like meth. Doesn't make it a good idea.
Hang up and drive.
The brake system is pretty well secured from the infotainment system, exactly because infotaintment systems are often not 100% secure.
They could have tried to go after the brake system, but I doubt they would have been successful.
A car is supposed to be a vehicle. Adding computers, satellite links, networks, automated control to the whole thing adds a whole lot more failure modes.
Doesn't need an address book if the interface is properly designed. It should just pass a command: "call John Smith" or "call 202-555-1212" to the phone itself. No need to save any data in the car itself.
I do just that - but I do NOT need to share my address book and other stuff with my car. Just pair versus Bluetooth so I can use the car's microphone and speakers during calls. Nothing else needs to be exchanged to make it work.
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
"A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around?"
The car's AI may also use such a camera to detect if the driver is conscious, alert or impaired
Pain is merely failure leaving the body
Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.
This is yet another example of how strong IP laws can help to protect a nations' citizens from evildoers.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history,"
Why in the fuck does the car have an "address book" or a microphone?
My 1999 Ford gets me around just fine without a microphone or an address book.
What's next? A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around? An in-dash scrolling facebook update for the addicts?
Has the world gone totally crazy now?
Subaru will/does offer a "feature" that where a camera watch your face to see if you get drowsy while driving.
I suppose that could be alright IF it was not connected to any extra-vehicular connectivity. However that is never how these things appear to go in the end...
If you are plugging in a USB you probably know exactly where the car is already, also you would have a general idea if it's in WiFi range.
.. to make them emissions compliant?
Its catch 22: if he wants a camera pointed at him, he IS mentally impaired.
Sent from my ASR33 using ASCII
"they could have also GONE after", I think you'll find...
I find these head units control too much of the car. Its like your combining infotainment with critical functions of the vehicle just to save money. Even beyond this hacking issues, these head units will only cause more headaches for these vehicles in the used car market for their owners. After all the support has expired and fixing them will definitely be a problem.
Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time
Actually, I installed an Android stereo in my old Porsche exactly for that reason. It is one of several security measures that were added. If you successfully steal my car, I will know exactly where it is simply by going to my Google Dashboard.
Also, know that there is no communication between the stereo and the ECU. That is a huge mistake that manufacturers are making.
That's all well and good. But it's not what happened here. And has nothing to do with what I mentioned. Specifically sensationalizing things in the summary that are not that a big of a deal.
Is it possibly because they didn't have an actual big deal, but still desperately needed people to read their report?
That's fine for incoming calls. The address book lets you dial out using the car's interface (dashboard display + steering wheel controls).
I wish one car company would just make a generic interface in the dashboard where I can purchase and install the in-vehicle infotainment console of my choice. I can then choose between multiple 3rd party computers and OS vendors. And upgrade it in the future. Instead they all want to lock us into their system which they are not interested in supporting long-term.
Surprise surprise can we get back to cars designed to be driven not a phone booth, video booth Internet cafe on wheels
I just dial by voice... Works really well!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!