Security Experts Hack Into Moving Car and Seize Control

[RedFox]

http://gadgets.ndtv.com/internet/news/security-experts-hack-into-moving-car-and-seize-control-718325

A pair of veteran cyber-security researchers have shown they can use the Internet to turn off a car's engine as it drives, sharply escalating the stakes in the debate about the safety of increasingly connected cars and trucks.
Former National Security Agency hacker Charlie Miller, now at Twitter, and IOActive researcher Chris Valasek used a feature in the Fiat Chrysler telematics system Uconnect to break into a car being driven on the highway by a reporter for technology news site Wired.com.

In a controlled test, they turned on the Jeep Cherokee's radio and activated other inessential features before rewriting code embedded in the entertainment system hardware to issue commands through the internal network to steering, brakes and the engine.

"There are hundreds of thousands of cars that are vulnerable on the road right now," Miller told Reuters.

Fiat Chrysler said it had issued a fix for the most serious vulnerability involved. The software patch is available for free on the company's website and at dealerships.

"Similar to a smartphone or tablet, vehicle software can require updates for improved security protection to reduce the potential risk of unauthorised and unlawful access to vehicle systems," the company said. It didn't immediately answer other questions.

Miller and Valasek have been probing car safety for years and have been among those warning that remote hacking was inevitable. An academic team had previously said it hacked a moving vehicle from afar but did not say how or name the manufacturer, putting less pressure on the industry.

National Highway Traffic Safety Administration chief Mark Rosekind on Tuesday said his agency is increasingly concerned about the security of vehicle control systems.

"We know these systems will become targets of bad actors," he told a conference on autonomous and connected vehicle technology in Ypsilanti, Mich. If consumers don't believe that connected vehicle systems are safe and secure, he said, "they will not engage it."

Members of Congress have also expressed concern, and on Tuesday senators Ed Markey and Richard Blumenthal, both Democrats, introduced a bill that would direct the NHTSA to develop standards for isolating critical software and detect hacking as it occurs.

Miller and Valasek said they had been working with Fiat Chrysler since October, giving the company enough time to construct a patch to disable a feature that the men suspected had been turned on by accident. They plan to release a paper at the Def Con security conference next month that includes code for remote access, which will no longer work on cars that have been updated.

They said the harder problem for an attacker, moving from the entertainment system to the core onboard network, would take months for other top-tier hackers to emulate.

Many Jeeps could remain unpatched, leaving them open to attack. But the researchers said hackers would need to know the Internet Protocol address of a car in order to attack it specifically, and that address changes every time the car starts.

Otherwise, "You have to attack random cars," Valasek said.

The men stressed that it would be easy to make modest adjustments to their code and attack other types of vehicles.

They said that manufacturers, who are racing to add new Internet-connected features, should work much harder on creating safe capability for automatic over-the-air software updates, segregation of onboard entertainment and engineering networks, and intrusion-detection software for stopping improper commands.

"Anything that connects to the outside world is an attack vector, from my point of view," Valasek said.

http://<iframe width="635" height="...xs" frameborder="0" allowfullscreen></iframe>

 

[kalibex]

This makes me want to know what (if anything) current out there isn't vulnerable to this kind of hack.

 

[MusicMan]

What if the G00gle Maps guys were actually pinging your cars as well as your home internet IP addresses while they were mapping your street address at the same time.
These sort of chips have all sorts of capabilities, and you can't be sure that they are turned off when the key is removed from the ignition.
If they can access your car's circuitry, they can reprogram it to do whatever they want, whenever they want, and turn your car into a mechanical Manchurian candidate.
That's my paranoid input for the day.

 

[angelburst29]

Fiat-Chrysler have announced a recall - over the "hack."

1.4M Vehicles Recalled; Hackers Could Take Over Steering Wheels
_http://patch.com/michigan/farmington-mi/breaking-major-automaker-announces-recall-over-hacking-scare

Fiat-Chrysler announced it is recalling 1.4 million vehicles over a software vulnerability that could allow hackers to remotely break into certain cars and control their steering wheels from afar.

The voluntary safety recall does not apply to specific car models, but rather cars containing Uconnect radio systems.

The hack was exposed in a recent Wired article, where authors were able to break into a car’s Uconnect radio and control basic things like the air conditioning, the radio and, eventually, the steering.

eventually, the steering.

Uconnect is a special type of car radio that uses internet connectivity to give users access to GPS, internet radio and more.

Fiat-Chrysler said in a statement that it is not aware of any injuries related to that software vulnerbility.

It said that it has ”applied network-level security measures to prevent the type of remote manipulation demonstrated in a recent media report.” Those security measures were tested an implemented Thursday with owners not having to do anything.

But, if owners want to take additional security steps, they can request a recall here, and if they qualify, they will receive a USB drive to install even more safety features.

Cars that included the specific radio included:

2013-2015 MY Dodge Viper specialty vehicles
2013-2015 Ram 1500, 2500 and 3500 pickups
2013-2015 Ram 3500, 4500, 5500 Chassis Cabs
2014-2015 Jeep Grand Cherokee and Cherokee SUVs
2014-2015 Dodge Durango SUVs
2015 MY Chrysler 200, Chrysler 300 and Dodge Charger sedans
2015 Dodge Challenger sports coupes

Fiat-Chrysler also assured that the type of software hack in the Wired article ”required unique and extensive technical knowledge, prolonged physical access to a subject vehicle and extended periods of time to write code.”

 

[Andrian]

I've read it on Sott and the first thought was the same as the comment that has been left by Lemuel Gulliver at the end of the article:

ANYONE REMEMBER....??

...MICHAEL HASTINGS?? Google the name if you do not know what I'm talking about. He was the investigative reporter that was burned to a crisp in his Mercedes after it sped at 80 mph down the boulevard and crashed into a tree so hard the engine flew out the front end and landed 80 feet away. Everyone said he was murdered, but there was no investigation. Check out the story - very interesting.
By: Lemuel Gulliver

 

[Carl]

This is seriously worrying and absolutely brings to mind Michael Hastings.

"Anything that connects to the outside world is an attack vector, from my point of view," Valasek said.

He is 100% correct. Exploits are discovered constantly! Even software that we use every day is routinely exploited in novel ways by top-level hackers. Windows is constantly updates with security patches. They even hold conferences such as Black Hat, where we are shown repeatedly that 100% security is impossible. For anyone to think that an internet-connected car would somehow be safe from this is ridiculous.

Makes you wonder the real motivations for not simply isolating the two systems.

Many Jeeps could remain unpatched, leaving them open to attack. But the researchers said hackers would need to know the Internet Protocol address of a car in order to attack it specifically, and that address changes every time the car starts.

LOL. As if someone capable of breaking into the steering control system through a car radio would not be able to figure out the IP of a car they are targeting..

And all of this says nothing of the built-in back doors in these systems, well known by top level intelligence agencies. Or perhaps these hackers are simply discovering these same back doors.