Beware your thirst for a HiTech center stack

[LukerDooker]

...so far cheap and thoughtless implementation of OEM auto systems could jeapordize all new cars using a cellular based communication system.

http://www.autoblog.com/2015/02/06/...ning-feature-video/?ncid=txtlnkusaolp00000588http://www.autoblog.com/2015/02/06/bmw-hack-cyber-security-warning-feature-video/?ncid=txtlnkusaolp00000588

"Messages Were Sent Unencrypted

Security analysts described the BMW infiltration as a "man in the middle" attack. Researchers mimicked a cellular base station and captured traffic between the car and the BMW Connected Drive service, which drivers can access and control via an app on their cell phones. When they looked at the underlying code contained in that traffic, they found it unencrypted, so they copied the "unlock" command and replayed it to an unsuspecting vehicle.

"Your mobile phone would think it's talking to a normal station, but in fact, it wasn't," Parris said. "What I think happened was they decided they wanted to offer this unlock service, and if anybody thought they might need to encrypt this, they just ultimately decided to rely on the security of the mobile network."

 

[LukerDooker]

...Pic for this CNET article shows MFT...:roll:

http://www.cnet.com/news/our-cars-are-more-hackable-than-we-thought-senate-report-finds/#ftag=YHF65cbda0

"A security investigation finds that nearly 100 percent of new cars on the market today may be vulnerable to security and privacy violations, and automakers have done little to plug the holes."

 

[scotted73]

The other side:

http://www.autoconnectedcar.com/201...-worry-about-your-connected-car-being-hacked/

http://www.cthreereport.com/60-minutes-joins-car-hacking-hype/

 

[LukerDooker]

Just my opinion but...its hype that it is hype.
Its happening and seems to be building in interest.

Pretty soon war driving will be available for autos in real time.
(War driving is going around and compromising any wifi gear you can find with a laptop, some dubious software, & a modified Pringles can as a (strong) antennae. Much more sophisticated now.)

The moment Carplay or Android for Auto goes live exploits will begin.
Infected mobile device will infect car and vice versa. If mobile device is a form of payment as well, hooo boy..mobile banking anyone?

Android is the Swiss cheese of mobile OS's, their marketplace is a potential sea of malware.

Apple is not telling consumers enough about bugs, they seem to only talk when people post proof of exploits. Their mobile marketplace is more closed off but likely no better off than Google once accessed by infected devices.

Windows, well, no challenge there, they are American swiss cheese all around.
:roll:

14 year old at car hacking symposium hacks into vehicle by preparing just overnight and with Radio Shack parts, while industry says it would take weeks of planning.
Radio Shack is going out of business, so we are safe.

http://www.autoblog.com/2015/02/18/14-year-old-hacker-caught-industry-by-surprise-featured/

 

[dco43054]

If someone really wants to learn about your life, they will just go to your mailbox and grab your mail. Even with email, much easier to find lots of stuff there.

As for hacking my phone and car, of course it can be done. Lots of stuff can be done. If you have enough money, you can steal the key strokes off someone's computer without a direct connection.

I'll worry about things likely to happen before I worry about stuff like this.

 

[LukerDooker]

http://www.computerworld.com/article/2895057/lawsuit-seeks-damages-against-automakers-and-their-hackable-cars.html

A Senate report backs up claims that automakers haven't addressed electronic security
Lucas Mearian By Lucas Mearian
Computerworld | Mar 10, 2015 12:10 PM PT

A Dallas law firm has filed a lawsuit against three major automakers claiming they have failed to take basic measures to secure their vehicles from hackers.

The lawsuit, filed in the U.S. District Court for the Northern District of California by attorney Marc Stanley, is on behalf of three vehicle owners and "all others similarly situated." It alleges that the automobiles are open to hackers who can take control of basic functions and endanger the safety of the driver and passengers.

"Toyota, Ford and GM have deliberately hidden the dangers associated with car computer systems, misleading consumers," Stanley said in a statement.

The suit claims that vehicles without proper electronics safeguards are "defective" and worth far less than similar non-defective vehicles and seeks unspecified monetary damages and injunctive relief.

Modern cars and light trucks contain more than 50 separate electronic control units (ECUs) -- small computers connected through a controller area network (CAN) or other network such as Local Interconnect Networks or Flexray.

The lawsuit claims hackers could access ECUs on a vehicle's CAN bus and take control of basic functions such as braking, steering and acceleration, "and the driver of the vehicle would not be able to regain control.

"Disturbingly, as defendants have known, their CAN bus-equipped vehicles for years have been (and currently are) susceptible to hacking, and their ECUs cannot detect and stop hacker attacks on the CAN buses. For this reason, defendants' vehicles are not secure, and are therefore not safe," the lawsuit states.

Ford declined comment on the matter. Neither GM or Toyota responded to a request for comment.

Scott Morrison, a distinguished engineer at CA's Layer 7 Technologies, said that nothing dates a car more quickly than its electronics.

"You can get into five-year-old luxury car and it...feels like a Nintendo game...compared to the experience on your smartphone," Morrison said in an earlier interview with Computerworld.

Car manufacturers are in a race to deploy wireless connectivity to vehicle head units (infotainment systems).

Last year, at the Black Hat security conference in Las Vegas, two industry experts released a 92-page report revealing "the 20 most hackable cars."

Also last year, a 14-year-old during a cybersecurity challenge was able to hack into a car's CAN with an electronic remote auto communications device he assembled overnight with $15 worth of Radio Shack parts.

The lawsuit claims car owners were charged "substantial premiums" for CAN bus-equipped vehicles. And it argues that the automakers engaged in "unfair, deceptive, and/or fraudulent business practices" by failing to disclose security flaws.

"Had plaintiffs and the other class members known of the defects at the time they purchased or leased their vehicles, they would not have purchased or leased those vehicles, or would have paid substantially less for the vehicles than they did," the lawsuit said.

The lawsuit cites several studies revealing security flaws in vehicle electronics. A 2013 study by the Defense Advanced Research Projects Agency (DARPA) found researchers could make vehicles "suddenly accelerate, turn, [and] kill the brakes."

DARPA reported that the defect represents a "real threat to the physical well-being of drivers and passengers." Before releasing its study, DARPA shared its finding with car manufacturers so they could address the vulnerabilities, "but they did nothing," the lawsuit states.

The lawsuit also cites a study released last month by Sen. Edward Markey (D-Mass.) that claims automakers have fallen far short in their responsibility to secure their vehicles' electronics.

The 14-page report is based on responses from 16 automakers to questions about security vulnerabilities and how driver information is collected and protected.

The report states that automakers have adopted technology without addressing the possibility of hacker infiltration into vehicle systems. Most automobile manufacturers were unaware of, or unable to report on, past hacking incidents, the report states.

The first part of the report focuses on how modern technologies give hackers windows of opportunity. It claims that only two automobile manufacturers were able to describe any capabilities to diagnose or meaningfully respond to an infiltration in real-time, "and most say they rely on technologies that cannot be used for this purpose at all.
What Readers Like

"Nearly 100% of vehicles on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions," the report states.

Last November, the world's 19 biggest automakers agreed to principles they said will protect driver privacy in an electronic age where in-vehicle computers collect everything from location and speed to what smartphone the driver uses.

A 19-page letter committing to the principles was submitted to the Federal Trade Commission from the industry's two largest trade associations, the Alliance of Automobile Manufacturers (AAM) and the Association of Global Automakers (AGA).

The AAM represents Detroit's Big Three automakers -- Ford, GM and Chrysler -- along with Toyota, Volkswagen AG and others. The AGA also represents Toyota, along with Honda Motor Co., Nissan Motor Co. and Hyundai Motor Co. among others.

Markey stated that the principles are an important first step, but fall short in a number of key areas by not offering explicit assurances around choice and transparency.

 

[WayneonLI]

If someone really wants to learn about your life, they will just go to your mailbox and grab your mail. Even with email, much easier to find lots of stuff there.

As for hacking my phone and car, of course it can be done. Lots of stuff can be done. If you have enough money, you can steal the key strokes off someone's computer without a direct connection.

I'll worry about things likely to happen before I worry about stuff like this.

I couldn't agree more, dco. While I'm not saying don't take some precautions (like shredding your documents, credit card statements) and the normal protections against identity theft and hacking, but you can't live your life with today's technology and worry about it constantly that someone could hack in.

 

[dco43054]

but you can't live your life with today's technology and worry about it constantly that someone could hack in.

Edit - Sorry - misread the response.

Agree

 

[WayneonLI]

Actually, I can. I take normal precautions and worry about stuff that is worth worrying about.

I'm with you 100% dco that's what I was trying to say. I agree.

 

[LukerDooker]

Hackers Discover Way to Remotely Control Jeeps

http://www.foxbusiness.com/technology/2015/07/21/hackers-discover-way-to-remotely-control-jeeps

Hackers discovered a security vulnerability in Jeep Cherokees that allows remote users to take control of the sport-utility vehicles, according to a report from Wired.

The report on Tuesday said hackers Charlie Miller and Chris Valasek developed code that can send commands to the engine, transmission, brakes and other components. In a test, they wirelessly accessed a Cherokee through its Uconnect infotainment system and cellular connection.

Miller and Valasek believe their attack can work on other cars made by Fiat Chrysler Automobiles (FCAU). They said approximately 471,000 vehicles equipped with Uconnect from late 2013 through early 2015 may be vulnerable.

Just in the U.S., Jeep has sold 309,720 Cherokees since the SUV hit showrooms in late 2013.

Last week, FCA released a software update to “improve vehicle electronic security and communications system enhancements,” according to the company’s website.

The update can be downloaded and installed by customers using a USB drive, or owners can bring their vehicles to a dealer.

“FCA has a dedicated team from System Quality Engineering focused on identifying and implementing software best practices across FCA globally,” the automaker said in a statement. “The team’s responsibilities include development and implementation of cybersecurity standards for all vehicle content, including on-board and remote services.”

FCA also criticized the hackers for their reported plan to release the code at a conference in Las Vegas.

“Under no circumstances does FCA condone or believe it’s appropriate to disclose ‘how-to information’ that would potentially encourage, or help enable hackers to gain unauthorized and unlawful access to vehicle systems,” FCA said.

FCA shares were trading 5 cents higher at $15.52 on Tuesday. The stock is up 34% since the start of 2015.

Follow Matthew Rocco on Twitter [MENTION=158466]Matthewr[/MENTION]occo

 

[LukerDooker]

This Gadget Hacks GM Cars to Locate, Unlock, and Start Them

http://www.wired.com/2015/07/gadget-hacks-gm-cars-locate-unlock-start/

GM’s Onstar service offers some of the most futuristic features on any connected car, including the ability to locate the vehicle, unlock it, and even start its ignition—all from a smartphone app. But if a hacker like Samy Kamkar has hidden a small, $100 box anywhere on your Onstar-equipped car or truck, those same conveniences could fall into unintended hands.

At the DefCon hacker conference next week, Kamkar plans to present the details of a new attack on GM’s OnStar RemoteLink system he’s developed that can allow a hacker to track a target vehicle, effortlessly unlock it, trigger the horn and alarm or even start its engine—everything but put the car in gear and drive it away, one function that thankfully still requires the presence of the driver’s key. Kamkar’s shown that if a hacker can plant a cheap, homemade Wi-Fi hotspot device somewhere on the car’s body—such as under a bumper or its chassis—to capture commands sent from the user’s smartphone, the results for vulnerable vehicle owners could range from nasty pranks to privacy breaches to actual theft.

“If I can intercept that communication, I can take full control and behave as the user indefinitely,” says Kamkar, a well-known security researcher and freelance developer. “From then on I can geolocate your car, go up to it and unlock it, and use all the functionalities that the RemoteLink software offers.”
Samy Kamkar.
Samy Kamkar. Julian Berman for WIRED

When the driver comes within Wi-Fi range of Kamkar’s $100 contraption, which he’s named “OwnStar” in a reference for the hacker jargon to “own” or control a system, it impersonates a familiar Wi-Fi network to trick the user’s phone into silently connecting. (Modern smartphones constantly probe for known networks, so the trade-paperback-sized box, packed with three radios and a Raspberry Pi computer, can listen for and then impersonate a friendly network, or by default call itself “attwifi” to appear as a common Starbucks connection.) If the user launches their GM RemoteLink Android or iOS app while their phone’s within Wi-fi range and unwittingly connected, OwnStar is designed to exploit a vulnerability in GM’s app to steal the user’s credentials and send that data over a 2G cellular connection to the hacker. “As soon as you’re on my network and you open the app, I’ve taken over,” Kamkar says.

With the user’s RemoteLink login credentials, Kamkar says a hacker could patiently track a car, retrieve his or her hacking device, and unlock the car’s doors to steal anything inside. From across the Internet, they can start the vehicle’s ignition to drain its gas or fill a garage with carbon monoxide, or use its horn and alarm to create mayhem. The hacker can also access the user’s name, email, home address, and last four digits of a credit card and expiration date, all of which are accessible through an OnStar account. Kamkar demonstrates parts of the attack in the video above, in which he tested the attack on a friend’s 2013 Chevy Volt.

Kamkar cautions that he’s only tried his OwnStar attack on that friend’s Volt. But he believes the hack likely works with any RemoteLink-enabled vehicle: It takes advantage of an authentication problem in the OnStar smartphone app, not a vulnerability specific to any vehicle. And that app has been installed on at least a million Android devices alone according to the count of Google’s Play store. Although the app does use SSL encryption, Kamkar says it doesn’t properly check the certificate that ensures the user’s phone is communicating only with the OnStar server. That means the OwnStar device can perform a “man-in-the-middle” attack, impersonating the server to intercept all the user’s data. Kamkar says he’s contacted GM Onstar to help the company fix the problem, which he believes could be achieved through a simple update of its RemoteLink app, and had an initial conversation with the company’s security team Wednesday.

In a statement to WIRED, a GM representative confirmed that the company is working on a patch for Kamkar’s hack. “Our customers’ safety and security is paramount and we are taking a multi-faceted approach to secure in-vehicle and connected vehicle systems, monitor and detect cybersecurity threats, and design vehicle systems that can be updated with enhanced security as these potential threats arise,” writes GM spokesperson Renee Rashid-Merem. “GM Product Cybersecurity representatives have reviewed the potential vulnerability recently identified by Mr. Kemkar, [sic] and an immediate fix is being implemented to address this concern.”

We need to start paying attention to this, or cars will continue to get owned. Samy Kamkar

Kamkar’s goal isn’t to use his attack to help thieves steal the contents of cars or unleash a remote honking-hack epidemic on GM vehicles. Instead, he says his research is intended to draw attention to the larger problem of cars being vulnerable to digital attackers—along with other devices in the so-called “internet of things”—as they’re increasingly computerized and networked. “I do play Grand Theft Auto a lot, but my motivation isn’t to steal cars,” says Kamkar. “I want to point out the lack of security here and the fact we need to pay more attention as we make more devices connected and quote ‘smart.’ The proof of concept is to show that it’s reasonably trivial for someone in my industry to do this.”

Car hacking in particular seems likely to dominate this year’s Black Hat and DefCon hacker conferences, where much of the most interesting security research of the year is unveiled. Already, researchers Charlie Miller and Chris Valasek have demonstrated to WIRED that they could wirelessly hack a Jeep or any of hundreds of thousands of Chrysler vehicles over the Internet to control steering, brakes and transmission. That hacker exploit, which led to a 1.4 million vehicle recall, took advantage of a flaw in the Uconnect feature in Chrysler vehicles’ dashboards. Kamkar’s hack shows that the same connected features in other vehicles likely have their own vulnerabilities. “We need to start paying attention to this, or cars will continue to get owned,” he says.

In fact, Kamkar, a serial hacker who has recently revealed hacks for garage doors, combination locks and drones, also plans to reveal a second set of security vulnerabilities in cars’ digital key systems. He’s holding the details of those techniques until his DefCon talk. Before focusing on GM OnStar, he adds that he had found yet another vulnerable automobile system that he had planned to speak about, but the company responsible for the flaws fixed them without his help. (Kamkar declined to reveal any more about that aborted research.)

The fact that Kamkar was able to switch his focus to GM OnStar and within weeks find another gaping vulnerability shows how bountiful the flaws in cars’ internet security have become, Kamkar says. “It’s a wide-open field…the carmakers are new to this,” he says. “If you continue to look at other cars or really anything in the Internet of things, you’re going to continue to see massive issues.”