6 ms·

I am a volt owner and have the app mentioned in the article... It appears that the hacker can gain access to whatever the phone app is capable of... which is n

by hoopism 11y ago

I am a volt owner and have the app mentioned in the article... It appears that the hacker can gain access to whatever the phone app is capable of... which is not THAT much really. You can absolutely start and stop the car but you need the key fob to actually drive the car and I don't believe you can stop it when it is actually being driven. There is no speed or braking controls in the app. You can unlock/lock, start/stop and trigger the alarm. In addition the the device must be near the car and the user must be using the app. I am glad they are patching this, but it's really not on par with prior vulnerabilities as far as I can tell.

kordless 11y ago
If I recall, there was an article a few years ago about OnStar helping the cops turn off a car that had been stolen. Turning off a car while you are driving it is a big deal.
- logfromblammo 11y ago
  The official GM OnStar app exposes certain do-it-yourself features to the phone user, such as remote start, lock/unlock, and "I forgot where I parked" alerting. These are the same functions that often appear on key fob buttons. OnStar is capable of performing more functions, such as locating the car when it is out of sight/sound range, slowing down the engine, locking down the ignition, and performing remote diagnostics. I couldn't confirm this by reading the article, but it might be possible that the protocols and APIs used by the app could be hacked to perform OnStar functions that were not intended for use through the app. So if the app sends OnStarApp( REMOTE_UNLOCK, VEHICLE_ID, APP_AUTH_KEY ), someone might try skimming the authentication credentials, and then send OnStarApp( STOLEN_ENGINE_SLOWDOWN, VEHICLE_ID, APP_AUTH_KEY ). In GM's mind, the app is trusted software, so any message that looks like it came from the app must have been requested by the owner, through the app. And since the app can only send "safe" commands, like those performed by a radio key fob, OnStar can simply execute whatever command the app message requests without checking it. That would be the same way the CANbus works. If a valid message appears on the bus, addressed to your microcontroller, you act on it as though it were genuine. They aren't software developers. They're automotive engineers. The design goals are different. In their world, Eve never listens to other people's conversations, cosmic rays never flip bits in memory, and no one outside the company will ever understand your car better than your own engineers. But there are people out there who will try to figure out if they can pop the trunk release using any component of the car except the trunk release button. Hackers do that kind of thing for fun. And, in doing so, they may find out that not only can they do that, but they can also do things like shut off the engine with a maliciously malformed digital radio station signal. Then they connect a handheld yagi to their laptop, broadcast the signal at a friend's car, and tell them to hit the "scan" button on their radio while idling in their driveway. Then it hits 88.1-3, a recording of "I'm sorry Dave, I'm afraid I can't do that" plays over the car speakers, and then the engine shuts off. It is a source of great amusement, until the "Oh, shit" thought occurs: "We did this for giggles. Someone else could do the same thing to murder people." Then they contact the auto manufacturers, who don't do much about it. Then they present it to DefCon, and talk to the media. And we still don't have an acceptable solution. Certain models of car are potentially vulnerable to attacks that we can demonstrate in controlled tests, and which are possibly occurring in the wild in a way that cannot be easily detected.
- hoopism 11y ago
  Admittedly I have no idea whether that is true via the app... but if so, then yes... it's a bigger issue.

by hoopism 11y ago

kordless 11y ago

If I recall, there was an article a few years ago about OnStar helping the cops turn off a car that had been stolen. Turning off a car while you are driving it is a big deal.

logfromblammo 11y ago
The official GM OnStar app exposes certain do-it-yourself features to the phone user, such as remote start, lock/unlock, and "I forgot where I parked" alerting. These are the same functions that often appear on key fob buttons. OnStar is capable of performing more functions, such as locating the car when it is out of sight/sound range, slowing down the engine, locking down the ignition, and performing remote diagnostics. I couldn't confirm this by reading the article, but it might be possible that the protocols and APIs used by the app could be hacked to perform OnStar functions that were not intended for use through the app. So if the app sends OnStarApp( REMOTE_UNLOCK, VEHICLE_ID, APP_AUTH_KEY ), someone might try skimming the authentication credentials, and then send OnStarApp( STOLEN_ENGINE_SLOWDOWN, VEHICLE_ID, APP_AUTH_KEY ). In GM's mind, the app is trusted software, so any message that looks like it came from the app must have been requested by the owner, through the app. And since the app can only send "safe" commands, like those performed by a radio key fob, OnStar can simply execute whatever command the app message requests without checking it. That would be the same way the CANbus works. If a valid message appears on the bus, addressed to your microcontroller, you act on it as though it were genuine. They aren't software developers. They're automotive engineers. The design goals are different. In their world, Eve never listens to other people's conversations, cosmic rays never flip bits in memory, and no one outside the company will ever understand your car better than your own engineers. But there are people out there who will try to figure out if they can pop the trunk release using any component of the car except the trunk release button. Hackers do that kind of thing for fun. And, in doing so, they may find out that not only can they do that, but they can also do things like shut off the engine with a maliciously malformed digital radio station signal. Then they connect a handheld yagi to their laptop, broadcast the signal at a friend's car, and tell them to hit the "scan" button on their radio while idling in their driveway. Then it hits 88.1-3, a recording of "I'm sorry Dave, I'm afraid I can't do that" plays over the car speakers, and then the engine shuts off. It is a source of great amusement, until the "Oh, shit" thought occurs: "We did this for giggles. Someone else could do the same thing to murder people." Then they contact the auto manufacturers, who don't do much about it. Then they present it to DefCon, and talk to the media. And we still don't have an acceptable solution. Certain models of car are potentially vulnerable to attacks that we can demonstrate in controlled tests, and which are possibly occurring in the wild in a way that cannot be easily detected.
hoopism 11y ago
Admittedly I have no idea whether that is true via the app... but if so, then yes... it's a bigger issue.