Posted by: Ken Harthun
Automobile Computer, Hacking, Security
Do you trust your mechanic? If you have any doubts, you had better find one you can trust because your safety – maybe even your life – is in his hands. A recently completed study by researchers in the Departments of Computer Science and Engineering at the University of Washington and University of California San Diego entitled “Experimental Security Analysis of a Modern Automobile” reveals alarming vulnerabilities.
Someone—such as a mehanic, a valet, a person who rents a car, an ex-friend, a disgruntled family member, or the car owner—can, with even momentary access to the vehicle, insert a malicious component into a car’s internal network via the ubiquitous OBD-II port (typically under the dash). . . . A similar entry point is presented by counterfeit or malicious components entering the vehicle parts supply chain—either before the vehicle is sent to the dealer, or with a car owner’s purchase of an aftermarket third-party component (such as a counterfeit FM radio). . . . In our car we identified no fewer than five kinds of digital radio interfaces accepting outside input, some over only a short range and others over indefinite distance. While outside the scope of this paper, we wish to be clear that vulnerabilities in such services are not purely theoretical.
Feeling a bit uneasy now? I was, too. I was quite disturbed by the time I finished reading what the researchers were able to do to the car. See the illustration above? Not only were they able to display an arbitrary message, but also a false speedometer reading (Note that the car is in park). They had full control of the instrument panel cluster. They were also able to completely control – and disable user control of – the radio and display arbitrary messages as well as produce various sounds. The really scary stuff involves the ability completely disable the brakes and power steering, disrupt engine timing, kill the engine, lock the doors and windows.
Theoretically, someone could pull off a perfect murder with the right malware. Enter the dangerous new world of murder-by-software.
We also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car’s telematics unit [think OnStar] and that will completely erase any evidence of its presence after a crash. . . . Combining our control over various BCM components, we created a “Self-Destruct” demo in which a 60-second count-down is displayed on the Driver Information Center (the dash), accompanied by clicks at an increasing rate and horn honks in the last few seconds. In our demo, this sequence culminated with killing the engine and activating the door lock relay (preventing the occupant from using the electronic door unlock button).
What if the sequence culminated in locking the brakes on the two wheels on the driver’s side of the car?