Slashdot Mirror
Volkswagen, Audi Cars Vulnerable To Remote Hacking (bleepingcomputer.com)
An anonymous reader writes: "A Dutch cyber-security firm has discovered that in-vehicle infotainment (IVI) systems deployed with some car models from the Volkswagen Group are vulnerable to remote hacking," reports Bleeping Computer. The vulnerabilities have been successfully tested and verified on Volkswagen Golf GTE and Audi A3 Sportback e-tron models. Researchers say they were able to hack the cars via both WiFi (remote vector) and USB (local vector) connections. Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said in their paper. "Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added. VW deployed patches.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said in their paper. "Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added. VW deployed patches.
Those infotainment systems were once made by QNX under Harman Becker, now owned by Blackberry. I bet they're still doing them. This is actually surprising to me, as QNX is known for better work than that. If these car companies switched to a different dashboard maker, QNX should jump in at the marketing opportunity.
"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history,"
Why in the fuck does the car have an "address book" or a microphone?
My 1999 Ford gets me around just fine without a microphone or an address book.
What's next? A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around? An in-dash scrolling facebook update for the addicts?
Has the world gone totally crazy now?
Many people happen to like the fact that you can link your phone to your car via Bluetooth and then make completly hands-free phone calls.
Many people like meth. Doesn't make it a good idea.
Hang up and drive.
The brake system is pretty well secured from the infotainment system, exactly because infotaintment systems are often not 100% secure.
They could have tried to go after the brake system, but I doubt they would have been successful.
Doesn't need an address book if the interface is properly designed. It should just pass a command: "call John Smith" or "call 202-555-1212" to the phone itself. No need to save any data in the car itself.
Of course, but automakers want to jump in on the whole "cloud" trend. If they know where their cars are, they can target marketing at consumers or even sell consumers' location data. Or "help them in case of an accident", though that doesn't actually need info about location until after the accident happens.
I do just that - but I do NOT need to share my address book and other stuff with my car. Just pair versus Bluetooth so I can use the car's microphone and speakers during calls. Nothing else needs to be exchanged to make it work.
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
"A video camera pointed at the driver so people can take selfies and live stream themselves while they drive around?"
The car's AI may also use such a camera to detect if the driver is conscious, alert or impaired
Pain is merely failure leaving the body
Researchers hinted they could have also went after the cars' braking and acceleration system, but stopped due to fear of breaking VW's intellectual property on those systems.
This is yet another example of how strong IP laws can help to protect a nations' citizens from evildoers.
.. to make them emissions compliant?
Its catch 22: if he wants a camera pointed at him, he IS mentally impaired.
Sent from my ASR33 using ASCII
"they could have also GONE after", I think you'll find...
WiFi range is a big deal. This could be anyone in an unmarked van 30 meters (or more if they use directional antenna) in front of you on a busy highway that could potentially force your car to slam on the brakes just as you entering a corner, forcing a skid and a general life-threatening wreck.
Expecting journalists to accurately report on technology-intensive topics was empirically shown to be unreasonable.
As Charlie Miller and Chris Valasek showed with their work culminating in sensational remote hacking of a Jeep Cherokee driven by a volunteering journalist, the key issue is that hackable infotainment units are capable of impacting other systems on the car's CAN bus. See Remote Exploitation of an Unaltered Passenger Vehicle for details.
That was a known issue in 2015. There is simply no excuses to still make the same mistakes in 2018. This is not unlike releasing a protocol library that is still vulnerable to Logjam.
I just dial by voice... Works really well!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!