20 ms·
Black Hat USA 2015: The full story of how that Jeep was hacked
- mzs 11y agoRemote Exploitation of an Unaltered Passenger Vehicle Dr. Charlie Miller Chris Valasek August 10, 2015 http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf
- deleted 11y ago[deleted]
- ghuntley 11y agoWhile some of the research could proceed without the diagnostic equipment, many active tests and ECU unlocking require an analysis of the mechanic’s tools. After both authors of this paper sold plasma for several weeks, we were finally able to afford the system required to do diagnostics on the Jeep Cherokee (and all other Fiat-Chrysler vehicles)
- rasz_pl 11y agoIts a joke. Miller is loaded, and alibaba is full of cheap clones of diagnostic tools (and 'special' dongles that do magical things like cloning BMW keys, or bypassing Mazda 6 security in 4 seconds)
- mzs 11y agoYep, lots of amazing bitsy things for sale from Asia. I liked the very helpful strings output, it's so nice when programers are thoughtful like that and give helpful -h output.
- spudlyo 11y agoThis was an excellent read, and had the technical meat I was looking for. Too much actually, my eyes started glazing over during the CAN protocol checksum part. It was a hair-raising experience learning that up until recently thousands of cars' head units could be controlled remotely at any given time by telneting to port 6667 (irc, hah!) and sending unauthenticated D-Bus commands over the Sprint 3G IP network.
- godgod 11y agoTwo words: Michael Hastings If it can be done by security researchers, why could it not also be done by the shadow government which has unlimited resources? https://en.wikipedia.org/wiki/Michael_Hastings_(journalist) https://en.wikipedia.org/wiki/Michael_Hastings_(journalist) counter-terrorism Richard A. Clarke said that what is known about the crash is "consistent with a car cyber attack". He was quoted as saying "There is reason to believe that intelligence agencies for major powers — including the United States — know how to remotely seize control of a car. So if there were a cyber attack on [Hastings'] car — and I'm not saying there was, I think whoever did it would probably get away with it.
- aembleton 11y agoI'm not so worried about hackers gaining access to change radio stations, but writing to the CANBus is concerning. It sounds like the weak point in this was the ability to rewrite the firmware of the V850 controller. If that could somehow signed then I'd feel safer.
- cryptoz 11y agoEven changing radio stations could be very dangerous, especially if access is also granted to audio controls (which it is). Attackers could easily cause accidents by creating distractions like rapidly changing, loud radio stations.
- deleted 11y ago[deleted]
- bronson 11y agoThe Wired video is a good example. It impaired communication, making that situation even more dangerous. (shouting) "Guys, I'm stuck on the highway." "What'd he say?" "Dunno, I think he's panicking." "Guys, I need the accelerator to work again!" "Accelerator? It won't work. Ha ha!" http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ http://www.wired.com/2015/07/hackers-remotely-kill-jeep-high...
- Asbostos 11y agoDon't forget an FM radio signal itself is trivial to hack. I did this when I was a kid so that's not a new problem at all, and probably not a danger. If the driver is going to crash because of a sound on the radio, they probably aren't safe to be driving in the first place.
- mikeash 11y agoAll you can do with an FM signal is override the audio. The volume is still limited to whatever the driver set, and they can always turn it off. Turning the volume to maximum and preventing the driver from lowering it or turning off the sound would be much worse. As for "probably aren't safe to be driving in the first place," that may be so, but I would estimate that about 80% of people on the road aren't really safe, and just muddle through by luck and generous margins. Causing unsafe drivers to crash when they otherwise wouldn't have is still bad.
- stevecalifornia 11y agoA simple fix would be to allow me, the owner, to turn off the wifi device and the connection to Sprint. I am not using those features and don't wish to have them.
- adrianb 11y agoThe connection is probably at least used to crowd-source live traffic information. Most people would like this feature.
- mhurron 11y agoThat doesn't justify not giving the option to disable it.
- teacup50 11y agoMost people would like live traffic information. Most people would not like to feed their location data to "the cloud", or open their car to anyone with an exploit in their pocket. Traffic information can be distributed to cars via one-way mechanisms without sacrificing privacy -- using mechanisms such as FM RDS and Satellite Radio.
- deleted 11y ago[deleted]
- scintill76 11y agoUh, are you saying s/he should keep the network connected because other people want the data s/he will provide by driving around with the network on?
- imglorp 11y agoYou need to neuter the digital broadcast radio also. There was another way in there. And check the bluetooth and the keyless entry fobs also.
- NickNameNick 11y agoAnd disable the receivers for the tire pressure monitoring system.
- lelandbatey 11y ago> This is the thing that all the manufacturers always refer back to when it comes to IT-security of cyber-physical systems: there is an isolation they say, the air gap between connected and physical parts of these systems. > [the] multimedia system’s controller itself can’t communicate directly with CAN bus, it actually can communicate with another component which is connected to CAN bus, the V850 controller That... that's not what an air gap is. Usually I'm forgiving about security that's fudged, since it's hard and marketing and higher-ups rarely understand. That's the entire point of an air gap: there isn't anything to understand, it's a physical disconnection. It's either plugged in or it's not. When asked "is there an air gap", if the answer is no and you answer yes then you're lying in the most blatant and bare-faced way I can imagine. It's like saying "that car is four wheel drive" when it's only two wheel drive, or saying "that car has an 18 gallon tank" when it has a 7 gallon tank.
- jMyles 11y agoIt's really shocking how blatant and dramatic an official corporate or government statement has to be before we're prepared to call it a lie.
- sitkack 11y agoBasically if you are high up enough, the only way to get caught in a lie to to admit that it was a lie, and that you meant to lie.
- ImJasonH 11y agoRemote control of steering wheel, engine, breaks? Free OTA driverless car update!
- morsch 11y agoEmploying this trick you can find all of Chrysler’s cars equipped with this kind of head unit. Over a million of them were actually recalled by Fiat Chrysler. After that all you need is to choose the right one. Funny thing is that it’s rather hard to do, “it’s much easier to hack all the Jeeps than the certain one,” as the researchers say. However, picking the wanted Jeep is doable as well, thanks to the option of the GPS tracker. Better double check that you're not crashing another Jeep which is in the wrong place at the wrong time...
- Thriptic 11y agoIf you're doing it for nefarious purposes, all you need to know is that the target vehicle in is on the road. You could have every active vehicle crash at the same time. While doing so blows the hack for good, it would make the motive incredibly difficult to determine.
- NeutronBoy 11y agoYou're sorely mistaken if you think Jeep is the only car manufacturer with this setup. I'd bet that most cars produced within the last few years don't have airgapped CANBus systems. By definition, any car with 'drive' settings you can adjust by the headunit console (suspension, sport modes, charging status, etc) is not airgapped. I mean, in a Tesla you have the option to change suspension settings based on location from a Google Maps -based GPS system. It also can drive itself from your garage to your front door based on meetings scheduled in your calendar. We literally have the same information for any auto manufacturer that we have from Jeep - empty assurances that 'we design our cars with the utmost cyber-security protections, trust us'.
- bliti 11y agoCar nut here: Your assumption is correct. The system is not air gapped. Even racing control systems suffer from this (except some really expensive ones, although they use commonly sourced sensors with various form of shielding).
- jessaustin 11y agoHmmm this could lead to some unconventional race techniques.
- nissehulth 11y agoRace conditions would have a totally new meaning.
- nickpsecurity 11y agoThat's awesome
- bliti 11y agoAbsolutely. For example, I'd imagine that teams that participate in major events/series lock down their systems to avoid another team from sabotaging them. The competition is fierce and everybody is looking for an advantage. I've heard of teams stealing or hiding tools/parts during endurance races that I've attended. Messing with another teams engine control setup does not involve anything but a computer. A simple change to the timing or fuel mixture could destroy an engine and take out a competitor. Without putting the driver in much risk.
- hmmmmmmmmm 11y agoCould this have happened in a Mercedes as well? http://www.occupy.com/article/exclusive-who-killed-michael-hastings http://www.occupy.com/article/exclusive-who-killed-michael-h...
- krupan 11y agowell, there's this: https://www.youtube.com/watch?v=k_o-H1j4zZs https://www.youtube.com/watch?v=k_o-H1j4zZs
- sprite 11y agoThis is the recall text from Jeep: Safety Defect/Non Compliance Description and Safety Risk: SOME 2013-2015 MY VEHICLES EQUIPPED WITH SPECIFIC RADIOS HAVE CERTAIN SOFTWARE SECURITY VULNERABILITIES WHICH COULD ALLOW UNAUTHORIZED THIRD-PARTY ACCESS TO SOME NETWORKED VEHICLE CONTROL SYSTEMS. A SUCCESSFUL EXPLOIT OF THIS SECURITY VULNERABILITY COULD RESULT IN UNAUTHORIZED REMOTE MODIFICATION AND CONTROL OF VEHICLE SYSTEMS. FCA US HAS NOT MADE A DETERMINATION THAT THIS SECURITY VULNERABILITY CONSTITUTES A DEFECT. ALTHOUGH FCA US HAS NOT DETERMINED THAT A DEFECT EXISTS, IT HAS DECIDED TO CONDUCT A REMEDIAL CAMPAIGN AS A SAFETY RECALL IN THE INTEREST OF PROTECTING ITS CUSTOMERS. EXPLOITATION OF THE SOFTWARE SECURITY VULNERABILITIES COULD LEAD TO EXPOSING THE DRIVER, THE VEHICLE OCCUPANTS OR ANY OTHER INDIVIDUAL OR VEHICLE WITH PROXIMITY TO THE AFFECTED VEHICLE TO A POTENTIAL RISK OF INJURY. Repair Description: CUSTOMERS AFFECTED BY THE RECALL WILL RECEIVE A USB DRIVE WHICH THEY MAY USE TO UPGRADE VEHICLE SOFTWARE, PROVIDING ADDITIONAL SECURITY FEATURES INDEPENDENT OF THE NETWORK-LEVEL MEASURES. ALTERNATELY, CUSTOMERS MAY VISIT HTTP://WWW.DRIVEUCONNECT.COM/SOFTWARE-UPDATE/ TO INPUT THEIR VEHICLE IDENTIFICATION NUMBERS (VINS) AND DETERMINE IF THEIR VEHICLES ARE INCLUDED IN THE RECALL. IF SO, THEY MAY DOWNLOAD THE SOFTWARE THEMSELVES, OR VISIT THEIR DEALERS, WHERE TECHNICIANS WILL PERFORM THE INSTALLATION. THERE IS NO CHARGE FOR THE SOFTWARE OR, IN THE CASE OF DEALER VISIT, INSTALLATION. I'm getting a 404 on the update page [nevermind it's case sensitive and needs to be downcased]. Does anyone know if this update actually fixes the issue? From reading the exploit details it seems more like a systems design issue that can't easily be patched in software.
- deleted 11y ago[deleted]
- prothid 11y agoChrysler worked with the guys that discovered the vulnerability and no doubt simply patched the current known bug allowing exploit from the cellular uplink. The system could be vulnerable again if a new exploit is discovered. I updated my Jeep a week or so ago and haven't had any issues -- yet. Edit: After reading the paper it looks like the update from Chrysler blocks inbound tcp/ip now, and Sprint is also filtering traffic more aggressively.
- deleted 11y ago[deleted]
- ChuckMcM 11y agoThe sad thing for me, and I see this way too often, is that someone, somewhere, no doubt said "Of course its secure, you can only READ the CANbus, the software doesn't even HAVE a write capability!" and everyone in the room nodded and went on with the rest of the review. Manufacturers and engineers have to get it through their head that IF you can change the firmware ANYONE can change the firmware. If the firmware is SECURITY CRITICAL then the only way to change it can be through physical presence, loading encrypted and and signed firmware, with external validation. (something like the car asking for a third party to authenticate the operation ala nuclear launch codes). You can still get screwed but it will be hard enough to do that otherwise low value targets will remain relatively safe.
- csours 11y agoAnd when manufacturers start doing that, people will complain that they don't "own" their cars anymore. [1] 1: http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-ca.html http://boingboing.net/2015/05/21/gm-says-you-dont-own-your-c... Disclaimer: I work for GM.
- saulrh 11y agoKeep a suitable private key for signing firmware in the car, locked in a secure box that can only be unlocked with two copies of the car's ignition keys? I'd call that sufficient security, but it'd also clearly allow me to get to the keys if I want.
- matteotom 11y agoThere is probably a middle ground here. For example, lock it down like the parent comment suggested, but have a process to unlock it, requiring (for example) physical access and some vehicle specific file from the manufacturer requiring proof of ownership and a scary warning. (I believe some phone manufacturers had a similar process for unlocking bootloaders a while back.) This would still allow enthusiasts and security researchers to "own" their vehicle and would keep malicious actors out (for the most part).
- 11y ago
- retrogradeorbit 11y agoVintage cars have never been more appealing!
- Corrado 11y agoThis whole story reminds me of the Battlestar Galactica reboot a couple of years ago. The premise was that the shiny, new spaceships were all susceptible to hacking and virus injection while the old, "vintage" ones were unhackable.
- jessaustin 11y agoFrom this point forward we should make very few assumptions about electronic systems. I'll just leave these here: http://jalopnik.com/why-its-unlikely-someone-killed-michael-hastings-by-hac-584806047 http://jalopnik.com/why-its-unlikely-someone-killed-michael-... http://jalopnik.com/aols-story-about-terrorist-carhacking-is-fearmongering-514344885 http://jalopnik.com/aols-story-about-terrorist-carhacking-is...
- AgentME 11y agoThose articles say that the idea of a remotely exploitable vulnerability in a car is ridiculous (therefore so is the murder idea), but is that not exactly what happened with Jeep here?
- jessaustin 11y agoYeah that was my point. There are always "experts" to be found who can't imagine a particular exploit working. Reality is not limited to some dude's imagination, so we should have read the initial articles for what they were: "nothing to see here, move along." If we knew then what we know now, such articles would have piqued our curiosity. Therefore, the fact that they were published does pique my curiosity.
- PhantomGremlin 11y agoReality is not limited to some dude's imagination I love that quip. It reminds me a little of something we say, more or less: "this device does not read its data sheet". It comes up a lot when a physical device does not behave the way you might expect from reading its accompanying documentation.
- wkcamp 11y agoI'm sure many engineers overlook the "guy who knows a guy" situation. The whole car itself is one giant system that works in unison; practically everything in that car IS connected. Which obviously means everything is accessible one way or another. Isolation is not really isolation as isolation more than likely depends on something.
- twrkit 11y agoHas there been a consensus reached on whether or not this could have been a factor in the death of Michael Hastings? [0] [0] https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#Death https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)#...
- retrogradeorbit 11y agoIf you can hack a car like this, what about a Boeing?
- deleted 11y ago[deleted]
- joshu 11y ago> They were able to control steering wheel This seems unlikely.
- akira2501 11y agoWhy? https://en.wikipedia.org/wiki/Power_steering#Electric_systems https://en.wikipedia.org/wiki/Power_steering#Electric_system... Plus, the vehicle can park for you. Clearly it has the raw hardware to allow for this.
- joshu 11y agoGenerally cars cannot control their steering. But obviously this one does have that ability. Interesting.
- im3w1l 11y agoSoftware can not be trusted. It is too complicated and people get things wrong. If something really needs to be be read only, enforce it with physical diodes or similar.
- satyajeet23 11y agoWhy would someone who knows how to use a computer want a Jeep?
- rndmind 11y agoI'm going to just ride my honda ruckus moped and forget buying a new car.
- antoinealb 11y agoA lot of automotive manufacturers are migrating to FlexRay (https://en.wikipedia.org/wiki/FlexRay https://en.wikipedia.org/wiki/FlexRay) and Ethernet so hopefully they will use the extra bandwith to implement a bit more of message authentication to their protocol.