10 ms·
Hacker shows he can locate, unlock and remote start GM vehicles
- shultays 11y agoWhy embedded platforms does not give a damn about security? It looks like they just don't care.
- malka 11y agowhy do you specify "embedded" ? after each hack, when I see that X company stores password either unhashed, or weakly hashed, the conclusion is that almost no ones gives a damn about security. and no one will until failing to properly secure sensitive customer data is enforced with hefty fines.
- munin 11y agohere's a scenario, let's say that GM goes hog wild after this and hires every expert security researcher with experience in this domain. they create an internal tiger team for security. they re-organize their entire product delivery pipeline to incorporate internal and external security audits and they publish everything they do. and they create and fund an open bug bounty program for bugs in all auto manufacturers (proxied through a non-profit) and make a "pwn2own for cars" or something and after five years, GM cars are measurably more secure than any other car manufacturer. in this future in five years, do you buy GM? no? that's why they don't give a damn about security.
- summerdown2 11y agoSecurity is balanced against cost in a risk-based assessment. One of those factors is certainly bad publicity and lost sales, and that might actually be a fairly small number. But there are still other ways to weight the argument in favour of security. For example: regulatory fines, senate investigations, class action lawsuits, directors going to prison, cost of recalls, etc. So although GM may not have much security pressure from the consumer, depending on the surrounding legal and regulatory environment, creating more secure cars might end up being a sensible move. I guess what I'm saying is that I agree that currently there isn't as strong pressure for security as I'd like. But that can change and not just from the consumer/sales side.
- luso_brazilian 11y agoThere are two factors in play here and your scenario only accurately measure one: 1) If GM cars security is the best of the market will it carry any weight in the purchase decision (as compared to all the other factors)? 2) If GM cars security is not the best of the market and one of their security incidents make headlines in mainstream TV and newspapers will it carry any weight in the purchase decision (as compared to all the other factors)? People don't pay attention when things that are supposed to work properly do so but when they don't it carries a lot of weight in the purchase decision. See the Toyota slump [1] in the U.S. market share between 2009 and 2011 caused by many factors but certainly with a contribution of the bad news related to the recalls [2] [1] http://online.wsj.com/mdc/public/page/2_3022-autosales.html#autosalesD http://online.wsj.com/mdc/public/page/2_3022-autosales.html#... [2] https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle...
- kabdib 11y agoYou could make a "drive by" (in the literal sense) gizmo that bricks vulnerable cars, maybe even causes expensive physical damage. Can you start a car fire by controlling fuel pressure pumps and injectors, or destroy a turbocharger? Stick a ten minute delay in your injected code and you're long gone. GM (or really, virtually any car manufacturer with the possible exception of Tesla) would be caught flat-footed. Firmware in consumer products (especially where radio or network access is present) needs to have a security model. Car makers have been betting they didn't need to spend much money worrying about security; it doesn't look like that bet is going to pay off. If this becomes a thing that any kid with $30 of electronics can do, dinosaur makers are toast.
- grkvlt 11y agoI hate to break it to you, but any kid with USD 0.10 can start a fire in a car today. It requires a.) one rock and b.) one box of matches. Break a window with the rock, then throw lit matches onto the upholstery. Really, the threat model is NOT disaffected kids.
- sschueller 11y agoIt's not only embedded systems. In general businesses care about short term profit (sure in the long term a hack is bad for business but share holders don't care except in the cases were it would be fatal to the business). Engineers are pressed to get it done anyway possible and as fast a possible. The ones that push back get fired or moved to another project. The fact remains that adding security and encryption requires more knowhow and adds a layer of complexity which results in more time required.
- ricklancee 11y ago> Engineers are pressed to get it done anyway possible and as fast a possible. The ones that push back get fired or moved to another project. This. Also incompetent engineering teams could be a major factor.
- kofejnik 11y agoWhy would a car be online at all, especially when parked? What is the benefit to consumer?
- SlashmanX 11y agoExactly my thoughts, what is the use of the OnStar stuff in the first place apart from just being a "gimmick": "Hey look, I can beep my horn from my phone!".
- atlbeer 11y agoWhere is my car in this parking lot? "Hey look, I can beep my horn from my phone!"
- SlashmanX 11y agoSurely there's better ways of achieving the goal of finding your car in a car park
- toxican 11y agoIt's a shame we don't have like little keychains that can unlock or beep our cars from afar. We're not living _that_ far in the future though, I suppose.
- JustSomeNobody 11y agoYeah, it's called being observant when you park your car. I mean, how hard is it to look around and remember a few landmarks?
- thfuran 11y agoThat kind of depends how drunk you are. And that might matter a lot more once the cars start driving themselves.
- zyM7A6bQzJKBHnS 11y ago
- Aoyagi 11y agoI'm curious - what happens to these cars (not specifically GM's, just these "smartcars" in general) when you disable/disconnect/destroy the (presumably) SIM card or whatever it uses to connect to cell data?
- lrm242 11y agoProbably nothing? OnStar is an optional service. It's not required for your car to run.
- amalcon 11y agoProbably the same thing that happens when you enter an area without cell reception, which is that the "smart" features stop working.
- Aoyagi 11y agoOh.... I didn't think of the fact that the cars need to be fully operational in those areas as well. Dumb question >.>
- computator 11y agoAnother question you should ask is How difficult is it to disable OnStar? The answer: Quite difficult. OnStar's module is in deeply embedded inside the car and in different locations in different models. OnStar is tied into the vehicle diagnostics and electrical system. If you manage to find it, and pull its cables out or something straightforward like that, your car will probably report an engine error and not start. (This issue has been reported and discussed extensively in car hacking forums.) I asked my local GM dealer--a very large dealer, by the way--about disabling OnStar permanently (at the hardware level). They told me (a) they don't know how to do it, (b) I'm the first person to ever ask about it, (c) they think it might void the warranty (I don't know if they are right or wrong), and (d) they're unwilling to do it.
- Aoyagi 11y agoYeah, I was wondering about that as well (hence "if possible at all"[1]) since I intend to buy a GM vehicle this year (maybe, money is hard), but I guess OnStar isn't very relevant in Europe. [1] Edit: Which is something I wanted to use in the sentence, but now I see I didn't. This is not a good day for me.
- codewithcheese 11y agoSamy does some great hacks, always impressed with the amount of effort he puts into developing the hack. Here's his video which the article is based on https://www.youtube.com/watch?v=3olXUbS-prU https://www.youtube.com/watch?v=3olXUbS-prU Also his motorized combo lock breaker has made HN front page before https://www.youtube.com/watch?v=YcpSvHpbHQ4 https://www.youtube.com/watch?v=YcpSvHpbHQ4
- comrh 11y agoAlso Evercookie and a drone that seeks and hacks other drones. His output is seriously impressive.
- aleh 11y agoI would never ever want to be in a car which acceleration can be controlled remotely via Internet, even in theory.
- quonn 11y agoThese are security issues, it's not by design. We will see more issues like this one and they _are_ bad, but this would be the least of my worries. There is no money in exploiting these bugs and even so-called script kiddies will probably not want to risk killing anyone. There are real risks, like buggy software in your ECUs wich can be deadly without any Internet connection.
- tomp 11y agoIt is by design, it must be. There is the acceleration module, then there is a wireless networking me dule, and there is a physical wire connecting them. Very shitty, very dangerous design.
- TeMPOraL 11y agoMore like, there is this acceleration module and there is this pedal that must hook into it, and there is this handy bus going through the car that you can connect the two systems to in order to make them talk with each other. And then you add a radio, and a knob under the steering wheel to control it, and think - hey, I have this handy bus I can reuse so that they talk with each other. And suddenly, your radio talks to your brakes. I don't think it's malicious design. More likely stupid one, or just a result of people being used to treating car hardware as trusted environment - where obsessing over security is just a waste of resources. It's just that when you introduce an Internet-connected device to that environment, it's not trusted anymore.
- tomp 11y agoI'd still argue that anyone who connects radio, travel computer or air condition systems (non-critical, not real time) with breaking, acceleration and external lightning systems (mission-critical, realtime, potentially lethal) is maliciously stupid.
- merpnderp 11y agoThe article says that Kamkar intercepts the connection from a user's phone. Wouldn't that either imply this only works for phones on weak 2/3g connections or that the hack is much more impressive in that 4g/lte connections can be intercepted?
- nly 11y agoPossibly 2G attack. Hardware visible in the video is fairly ordinary - Raspberry Pi - RTL8187L USB 2.0 WiFi module - Adafruit FONA mini GSM/GPRS module[0]. Not LTE capable. [0] https://learn.adafruit.com/adafruit-fona-mini-gsm-gprs-cellular-phone-module/overview https://learn.adafruit.com/adafruit-fona-mini-gsm-gprs-cellu...
- cotillion 11y agoJamming LTE to force a switch to 3G is possible. It does imply this was in some part a TLS fail. Either none or failing to verify trust..
- inversionOf 11y agoI don't think the hack involves the cellular data connection, and it would be a very different hack if it did. To clarify, the OnStar system in your vehicle talks to a data center at GM or wherever. When you use the app, it talks to that data center, and if you have an authenticated, actived session, the data center intermediates commands from the app to the vehicle. This looks and smells like an entirely standard MITM type attack. He runs a rogue WAP, or listens in on low encryption APs, and when someone uses the app it exploits some weakness in the SSL/TLS process of the app (maybe DNS poisoning coupled with an app that doesn't demand a root signed cert from the peer). That can be fixed immediately and really is remarkably limited in utility and threat.
- btbuildem 11y agoSelf driving cars are going to be fun
- uptown 11y agoOnStar sent this email out on July 31st: Thank you for being a loyal OnStar customer. We're happy to have you as part of the OnStar family and appreciate the confidence you have in us. We are writing to inform you that we have recently made a security update to your OnStar RemoteLink mobile app. As a result, the current version of the app you have on your Apple device will no longer be functional and you will need to update to the most recent version. Click here to download the Remote Link app. We hope that you will continue to use OnStar services and experience all that OnStar has to offer. OnStar advisors are ready and available 24/7 to assist you. Sincerely, Onstar Terry M. Inch OnStar, Chief Operating Officer
- tylercubell 11y agoIs the car receiving commands indirectly through OnStar itself or directly from a smartphone connected to the in-car wifi?
- travelton 11y agoThe commands are likely brokered through a cloud based service. It sounds like the OnStar hack captured the authentication token and used that to talk to the central service to send commands to the vehicle.
- ams6110 11y agoI'm sticking with my old cars that have no computers and start with a key.
- ChrisArgyle 11y agoSame here although I wonder if any vehicles allow you to shut off the wireless radios a la "airplane mode".
- lips 11y agoIs there any sort of hardware network "OFF" switch in these bad-ideas-on-wheels?
- tunap 11y agoI'm not certain, but I imagine removing the comms would mitigate the threat. First thing I did when I bought my new~ish GMC was remove the OnStar module from under the backseat. I'm sure there is still a 'blackbox' somewhere, but never found *ny indication it has WAN capabilities. Of course, I disabled XM too... not so much for paranoia's sake, I just needed an input for my media device.
- rogeryu 11y agoImagine this: smart kid creates app that let horns of multiple cars in parking lot honk like in a symphony. Even more fun: someone walks over that parking lot, and you follow them with honks from different cars. Man, I would love to see that!
- Sir_Cmpwn 11y agoThe sci-fi movie version of hackers in the future, who can bend everything around them to their will, is perhaps not so far fetched. Instead of future hackers being really good at it, maybe the vendors that build everything are just incompetent.
- mtgx 11y agoAnd we don't even have fully autonomous cars on the street yet. That's when the real fun will begin.
- PinguTS 11y agoActually, that is not really a car hack. He intercepted the communication from the app. So it is an app hack like we have seen numerous times. It my be different, but it sound like cookie stealing what was possible with the Facebook app and the Instagram app. Then with those credentials you can do all those things that you are supposed to do like if you where the legit user. All those functions are functions supposed to be done by the app. So there is no hacking on the car side done. The interesting piece of information would be: can that be used to actually hack the car?
- travelton 11y agoHaving purchased an internet connected Hyundai (via their BlueLink service)... I've been curious whether I can access the vehicle directly through it's internet connection. So far, sniffing the packets from the iOS BlueLink app, it appears to broker requests through a service by Covisint [http://www.covisint.com/ http://www.covisint.com/]. From there, I cannot figure out how the vehicle communicates to receive these messages. The payloads between iOS and Covisint contain tons of information about the vehicle, but nothing that exposes the communications between the vehicle and BlueLink or Covisint. The vehicle has the ability to connect to Wifi... I will prod at that next. :)
- michaelt 11y agoFrom there, I cannot figure out how the vehicle communicates to receive these messages. Prediction: 3G/4G, with specific settings on the SIM giving it access to a private APN.
- JonathonW 11y agoAnd, if you're lucky, it's connecting to a private IP network. The Chrysler hack was possible because the cars' built-in cell connection [i]wasn't[/i] connecting to a private network; the cars were unfirewalled and accessible to anything else that happened to be on Sprint's cellular data network.
- gardnr 11y agoYou had me at locate.
- jgalt212 11y agoFor reasons like this, I am remain very wary of the Internet of Things.
- maxerickson 11y agoWe should start calling the Internet of Things the Software Apocalypse.
- Panoramix 11y agoIoT is one of the most useless large-scale projects that humanity has embarked on. A giant waste of resources across thousands of companies, so your fridge can order more milk for you. Spending billions in solving a non-problem, and creating a myriad of vulnerabilities everywhere. It would be amazing if we as a society would spend all that money and effort in worthy problems.
- tunap 11y ago"It would be amazing if we as a society would spend all that money and effort in worthy problems." On the contrary, monetization for the sake of wealth generation is a worthwhile effort in a society based on materialism & selfish desires. We have been programmed all our lives to take & want & connive(perfected to a science in the US & most 1st World countries), that's what capitalism has evolved to, IMO. This Internet Of Other Peoples' Things is just the latest, most efficient way they have found to wheedle, cajole and manipulate us fools from our money!Plus, don't forget the data collection opportunities! Hitler would love the IOOPTs. Although, Windows 10 looks to be breaking some pretty scary ground. Google & Apple eat your hearts out!
- hoopism 11y agoI am a volt owner and have the app mentioned in the article... It appears that the hacker can gain access to whatever the phone app is capable of... which is not THAT much really. You can absolutely start and stop the car but you need the key fob to actually drive the car and I don't believe you can stop it when it is actually being driven. There is no speed or braking controls in the app. You can unlock/lock, start/stop and trigger the alarm. In addition the the device must be near the car and the user must be using the app. I am glad they are patching this, but it's really not on par with prior vulnerabilities as far as I can tell.
- kordless 11y agoIf I recall, there was an article a few years ago about OnStar helping the cops turn off a car that had been stolen. Turning off a car while you are driving it is a big deal.
- logfromblammo 11y agoThe official GM OnStar app exposes certain do-it-yourself features to the phone user, such as remote start, lock/unlock, and "I forgot where I parked" alerting. These are the same functions that often appear on key fob buttons. OnStar is capable of performing more functions, such as locating the car when it is out of sight/sound range, slowing down the engine, locking down the ignition, and performing remote diagnostics. I couldn't confirm this by reading the article, but it might be possible that the protocols and APIs used by the app could be hacked to perform OnStar functions that were not intended for use through the app. So if the app sends OnStarApp( REMOTE_UNLOCK, VEHICLE_ID, APP_AUTH_KEY ), someone might try skimming the authentication credentials, and then send OnStarApp( STOLEN_ENGINE_SLOWDOWN, VEHICLE_ID, APP_AUTH_KEY ). In GM's mind, the app is trusted software, so any message that looks like it came from the app must have been requested by the owner, through the app. And since the app can only send "safe" commands, like those performed by a radio key fob, OnStar can simply execute whatever command the app message requests without checking it. That would be the same way the CANbus works. If a valid message appears on the bus, addressed to your microcontroller, you act on it as though it were genuine. They aren't software developers. They're automotive engineers. The design goals are different. In their world, Eve never listens to other people's conversations, cosmic rays never flip bits in memory, and no one outside the company will ever understand your car better than your own engineers. But there are people out there who will try to figure out if they can pop the trunk release using any component of the car except the trunk release button. Hackers do that kind of thing for fun. And, in doing so, they may find out that not only can they do that, but they can also do things like shut off the engine with a maliciously malformed digital radio station signal. Then they connect a handheld yagi to their laptop, broadcast the signal at a friend's car, and tell them to hit the "scan" button on their radio while idling in their driveway. Then it hits 88.1-3, a recording of "I'm sorry Dave, I'm afraid I can't do that" plays over the car speakers, and then the engine shuts off. It is a source of great amusement, until the "Oh, shit" thought occurs: "We did this for giggles. Someone else could do the same thing to murder people." Then they contact the auto manufacturers, who don't do much about it. Then they present it to DefCon, and talk to the media. And we still don't have an acceptable solution. Certain models of car are potentially vulnerable to attacks that we can demonstrate in controlled tests, and which are possibly occurring in the wild in a way that cannot be easily detected.
- at-fates-hands 11y agoWhile the paranoia about this has been rampant for a while, this article (from last year) points out that manufacturers ARE working on this and have been for some time: http://money.cnn.com/2014/06/01/technology/security/car-hack/ http://money.cnn.com/2014/06/01/technology/security/car-hack... Continental, one of the world's three major auto parts suppliers, is partnering with IBM (IBM) and Cisco (CSCO) to make firewalls that control the information flow between the car's devices. Until it gets security all figured out, the German company is holding back from adding full Internet connectivity features, such as real-time information from the engine that alerts the local car shop ahead of time. Ford (F) hardware has built-in firewalls to prevent malicious tampering, and the company has a team of noble hackers constantly probing for weaknesses. Toyota (TM) does all that too, plus it embeds security chips in the tiny computers throughout the car, narrowing how they communicate and lessening the chance of outsider interference. The company even has forward-thinking plans this year to visit the world's largest hacker conference, Black Hat. It should be no surprise that Tesla (TSLA) is ahead of the pack. The Model S is the most advanced and connected car currently available. It's worth noting the company's mature approach to addressing vulnerabilities. Instead of hunting down hackers who spot weaknesses, they reward them with an "Information Security" badge that works like a Willy Wonka golden ticket, granting exclusive access to Tesla's factory in Fremont, Calif. The company recently sent one to a British hacker who goes by Jon of Bitquark. But of course the government isn't helping much either. . . ...federal regulators will soon demand that cars automatically relay information wirelessly to one another as part of the U.S. government's vehicle-to-vehicle communication program. Those car-to-car messages will one day be able to engage brakes -- or your steering wheel.
- jakeogh 11y ago"...federal regulators will soon demand that cars automatically relay information wirelessly to one another as part of the U.S. government's vehicle-to-vehicle communication program. Those car-to-car messages will one day be able to engage brakes -- or your steering wheel" That's bad. Governments are (by far) the most violent organizations on earth. They expand to control everything they can. The actions of power are always to increase one's reliance on it. It's almost a law of nature. If we give up our ability to control our momentum and kinetic energy, it's more than a slippery slope. It's a path to black boxes in everything, including people.
- rootbear 11y agoThe prefix code to control my car's shields is 16309. Maybe I should change it.
- bradleyland 11y agoYour car is insured and is easily replaceable. Car theft has declined precipitously in recent years. According to the NY Times [1], in 1990 there were 147,000 cars reported stolen in NYC. In 2013, that number had dropped to 7,400. On a per capita basis, it went from 1:50 to 1:1,100; a 96% drop. This dramatic reduction in theft cannot be solely attributed to an overall reduction in crime either. This is not an argument for the status quo. I'm just pointing out that the principles being espoused in the responses here aren't axioms, they're value judgements. As software developers, we're taught to be hyper-paranoid when it comes to security, and we should be. That's how a culture of security is built. However, in a broad sense, a balance must be struck. Like it or not, there is an acceptable rate of car theft, and that rate is non-zero. The acceptable theft rate is defined by what consumers are willing to pay to insurance companies to take on the risk and the assessment of the balance between probability and the anticipated inconvenience of having their car stolen. Consumer choices are defined by the alternatives, though. If the solution is that cars shouldn't have these features at all, can you find that car? What else do you give up in the process? Unless automakers ignore the problem, and theft rates skyrocket, buyers are still going to seek out these network enabled features because their convenience outweighs the risks. Of course, it could be argued that we'll see a rise in theft again as criminals learn to use new technologies to steal cars. This has already happened in some places. BMW has run in to a couple of fairly high profile cases of this recently. In one case, attackers combined the easy accessibility of the ODB II port from a broken window with a security weakness in the cars software to bypass all the theft protection. No network access required! The linking of the CANbus to network systems is too enticing from a consumer convenience perspective. That genie is out of the bottle. 1: http://www.nytimes.com/2014/08/12/upshot/heres-why-stealing-cars-went-out-of-fashion.html?_r=0&abt=0002&abg=1 http://www.nytimes.com/2014/08/12/upshot/heres-why-stealing-...
- markbnj 11y ago>> We take all cyber matters seriously Because nothing says serious security like using the word "cyber" twice in your statement.