Newsflash: Car Network Security Is Still A Horrible, Very Dangerous Joke

from the I'm-sorry-I-can't-do-that,-Dave dept

As we've noted for years, the security on most "smart" or "connected" cars is aggressively atrocious. And in fact it's getting worse. As car infotainment systems get more elaborate, and wireless carriers increasingly push users to add their cellular-connected car to shared data plans, the security of these platforms has sometimes been an afterthought. Hackers this week once again made that perfectly clear after they demonstrated to a Wired reporter that they were able to manipulate and disable a new Jeep Cherokee running Fiat Chrysler's UConnect platform. While the reporter was driving it:
As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission. Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.
Uconnect utilizes Sprint's cellular network, and hacker/researchers Charlie Miller and Chris Valasek were able to pwn manipulate nearly everything about the vehicle with a laptop in a house ten miles away. All thanks to one, unspecified vulnerability:
From that entry point, Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels.
The two used to have to physically modify cars to get access to these systems, but as vehicles have gone cellular, it has opened the door to a world of new exploits. And if you've ever experienced the incomprehensibly-clunky in-car GUI of most in-car infotainment platforms, rest assured that the quality of the system's security is usually in the same ballpark. Miller and Valasek will publish a portion of their exploit online during a presentation at the Black Hat security conference in Las Vegas next month.

The exploit appears to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. Chrysler/Fiat posted a notice to its website last week informing users that they need to update their in-car software either via USB stick (you can download the update here) or by taking it in to a dealer. Of course like many patches, most users won't be paying much attention to the warning. And we're only talking about Chrysler's UConnect; there's a bounty of half-assed security measures implemented in infotainment systems from automakers worldwide just waiting to be tinkered with by pranksters (or worse).

Of course cars aren't the only tech sector where security has failed to keep pace with ambition. "Smart" TVs have been shown to have similarly awful security, often sharing unencrypted user info (even conversations) with any hacker with a modicum of talent. In the rush to embrace the gee whizzery of the "Internet of things," there are more than a few companies that apparently forgot to bring security and intelligence along for the ride.

Reader Comments

Subscribe: RSS

View by: Time | Thread


  1. identicon
    Anonymous Coward, 22 Jul 2015 @ 7:01am

    Re: Re: Re: Re: Re:

    If I own a car, and I want to tinker with it, I will do so. If I cause something to go wrong and kill someone, then I am responsible. That is how it works. I understand you don't like it, but that is the way it is.

    If I buy a "insert any device here" and modify it, and it malfunctions and kills someone... my fault.

    In almost any case you can try and shift personal liability over to the Government by certification and testing but it's not going to help you when shit goes wrong. You tweak it, and it messes up and hurts someone or their property, it doesn't matter how much certification it had, YOU are responsible. That is how it is, and that is how it should be in a free country.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: I Invented Email
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.