3 ms·
The article says that Kamkar intercepts the connection from a user's phone. Wouldn't that either imply this only works for phones on weak 2/3g connections or th
by merpnderp 11y ago
The article says that Kamkar intercepts the connection from a user's phone. Wouldn't that either imply this only works for phones on weak 2/3g connections or that the hack is much more impressive in that 4g/lte connections can be intercepted?
- nly 11y agoPossibly 2G attack. Hardware visible in the video is fairly ordinary - Raspberry Pi - RTL8187L USB 2.0 WiFi module - Adafruit FONA mini GSM/GPRS module[0]. Not LTE capable. [0] https://learn.adafruit.com/adafruit-fona-mini-gsm-gprs-cellular-phone-module/overview https://learn.adafruit.com/adafruit-fona-mini-gsm-gprs-cellu...
- cotillion 11y agoJamming LTE to force a switch to 3G is possible. It does imply this was in some part a TLS fail. Either none or failing to verify trust..
- inversionOf 11y agoI don't think the hack involves the cellular data connection, and it would be a very different hack if it did. To clarify, the OnStar system in your vehicle talks to a data center at GM or wherever. When you use the app, it talks to that data center, and if you have an authenticated, actived session, the data center intermediates commands from the app to the vehicle. This looks and smells like an entirely standard MITM type attack. He runs a rogue WAP, or listens in on low encryption APs, and when someone uses the app it exploits some weakness in the SSL/TLS process of the app (maybe DNS poisoning coupled with an app that doesn't demand a root signed cert from the peer). That can be fixed immediately and really is remarkably limited in utility and threat.