7 ms·

Hacked Jeep USB update criticised

26 points by daledavies 11y ago

Ninn 11y ago
>"Hackers will be able to pull the data off the USB stick and reverse-engineer it. They'll get an insight into how these cars receive their software updates and may even find new vulnerabilities they can exploit," he told the BBC. So? Never thought I would hear a "Security Expert" argue for, and not against security through obscurity. Perhaps this is not the best source for critique.
- pixelcort 11y ago
  If the USB stick accidentally contains private keys for signing, that might be of concern. The more important concern is the phishing issue.
  - mmarx 11y ago
    > If the USB stick accidentally contains private keys for signing, that might be of concern. That would still be a problem if the updates were only distributed to repair shops, however (you'd need someone on the inside, but given the number of people involved, that probably wouldn't be too hard).
  - Ninn 11y ago
    Sure, but there is no evidence of that, so why even bring it up as an example/excuse as to why anyone would argue this way? It is totally unfair to assume that the content has not already been signed prior to distribution without evidence.
    - jamesbrownuhh 11y ago
      Unfortunately modern "news" is not based on evidence, merely the event of a claim.
- venomsnake 11y ago
  Also they could download the bin from the car itself.
  - Ninn 11y ago
    No, that's not how it works. In some cases sure, but this is not something you just do out of the blue like plugging in a USB.
ck2 11y ago
Research the last year your favorite car model was made with mechanical steering and mechanical accelerator and only buy those. You only have to go a decade back at most like I did. You might want to stick with those years considering industries that have little knowledge or care about security are endangering your very life at highway speeds. It's going to take them another half decade to care about these things and they will probably just solve it by lobbying politicians to waive liability instead.
- jnbiche 11y ago
  Mechanical steering? You'd have to go back significantly more than a decade to find cars without power steering for most cars.
  - coryrc 11y ago
    Fluid pumping is still mechanical. They mean electric steering.
  - ck2 11y ago
    My last car the power steering pump was out half the time and I could still drive everywhere - it just gave my arms a bit of a workout at low speeds.
    - brudgers 11y ago
      Operating a vehicle with that level of maintenance would seem to pose a substantially more proximate risk than the unrealized potential risk posed by hackers.
- akerl_ 11y ago
  I feel like this is one of those examples of attempting to prevent a low-risk concern and instead increasing overall risk. Is the risk savings of avoiding a car with modern steering and accelerator worth the added risk of lacking other safety features of more recent advances in designing safe automobiles?
altharaz 11y ago
After the False Promises of Inheritance emails, it seems that we'll switch to False Security Updates USB keys letters. If hackers goes into hardware, maybe should we also start working on Scam letters filters?
Retr0spectrum 11y ago
Does anyone know where I could download an image of the update? I just want to poke around.
- yeldarb 11y ago
  The disk image is available via their website but requires your VIN number. I poked around a past update and it appeared to just be a *nix disk image. Wasn't sure if it was signed or if there was much security or not so I wasn't brave enough to change anything for fear of borking my car. But I would have loved to figure out how to enable the nav system that's already built into my car but disabled (Jeep charges $XXXX for the privilege)
  - BillinghamJ 11y ago
    It's incredibly easy to get the VIN of a car. For example, most (UK) DVLA APIs include the VIN when you put a registration plate in.
    - sokoloff 11y ago
      Or you could walk through a parking lot and look at the corner of the windshield...
- Retr0spectrum 11y ago
  I can't edit my original comment, but I eventually figured it out. here's a link: https://mega.nz/#!51V1zBIJ!u4Ewgv-yOJR-fsRTUKSVov4lzDqM9iuyjlZZ8FaKMTo https://mega.nz/#!51V1zBIJ!u4Ewgv-yOJR-fsRTUKSVov4lzDqM9iuyj...
  - voltagex_ 11y ago
    Do you mind if I write a short article on this?
    - Retr0spectrum 11y ago
jnbiche 11y ago
Can't believe that they didn't think to include a way to verify the USB's integrity with strong crypto, and clear instructions on how to do this. Yes, non-tech savvy customers would be vulnerable to phishing (since such a letter would simply omit this step), but at least it would be possible for tech-savvy individuals to do so. If they had done this right, they would have sent the USB with a validation step and widely advertised this step, so that all users would be aware of the need to do it, maybe even branding a simple software package to verify the contents as something like "UConnect SafeCheck". Hopefully, they at least have a secure way to download it online (but given actions up to now, I'm not optimistic). Edit: Owners can download it via https (albeit with SHA-1), but I'd be surprised if there's a way to validate the integrity of the downloaded file. Also, they're advertising that link without the SSL (and indeed, it allows non-SSL connections).
- ricardobeat 11y ago
  I wonder what the 'Secure' printed on it stands for. Maybe each car has it's own private key, meaning you'd have to physically hack the car first in order to get a fake update stick to work?
- deleted 11y ago
  [deleted]
- tokenizerrr 11y ago
  Better would be to have the car perform the validation. I'd be shocked if this didn't actually happen.
  - brudgers 11y ago
    My understanding of the original hack is that the root of the hack is a flaw in the existing platform validation. In particular that the random seed is set from the clock [not a bad practice in itself] and the clock is activated the first time the car is fired up [a somewhat problematic, since an attacker can be assumed to have the vehicle date via the VIN]. However, it's not even that hard since the first time the vehicle is fired up, the clock is at it's default time and date, and this narrows down the seeds to the range of potential latencies between the clock coming on line and the generation of the entropy pool. In other words, the USB key can't use stronger crypto than vehicle and that crypto is poorly implemented [again, based on my understanding of the original hack].

26 points by daledavies 11y ago

Ninn 11y ago

>"Hackers will be able to pull the data off the USB stick and reverse-engineer it. They'll get an insight into how these cars receive their software updates and may even find new vulnerabilities they can exploit," he told the BBC. So? Never thought I would hear a "Security Expert" argue for, and not against security through obscurity. Perhaps this is not the best source for critique.

pixelcort 11y ago
If the USB stick accidentally contains private keys for signing, that might be of concern. The more important concern is the phishing issue.
- mmarx 11y ago
  > If the USB stick accidentally contains private keys for signing, that might be of concern. That would still be a problem if the updates were only distributed to repair shops, however (you'd need someone on the inside, but given the number of people involved, that probably wouldn't be too hard).
- Ninn 11y ago
  Sure, but there is no evidence of that, so why even bring it up as an example/excuse as to why anyone would argue this way? It is totally unfair to assume that the content has not already been signed prior to distribution without evidence.
  - jamesbrownuhh 11y ago
    Unfortunately modern "news" is not based on evidence, merely the event of a claim.
venomsnake 11y ago
Also they could download the bin from the car itself.
- Ninn 11y ago
  No, that's not how it works. In some cases sure, but this is not something you just do out of the blue like plugging in a USB.

ck2 11y ago

Research the last year your favorite car model was made with mechanical steering and mechanical accelerator and only buy those. You only have to go a decade back at most like I did. You might want to stick with those years considering industries that have little knowledge or care about security are endangering your very life at highway speeds. It's going to take them another half decade to care about these things and they will probably just solve it by lobbying politicians to waive liability instead.

jnbiche 11y ago
Mechanical steering? You'd have to go back significantly more than a decade to find cars without power steering for most cars.
- coryrc 11y ago
  Fluid pumping is still mechanical. They mean electric steering.
- ck2 11y ago
  My last car the power steering pump was out half the time and I could still drive everywhere - it just gave my arms a bit of a workout at low speeds.
  - brudgers 11y ago
    Operating a vehicle with that level of maintenance would seem to pose a substantially more proximate risk than the unrealized potential risk posed by hackers.
akerl_ 11y ago
I feel like this is one of those examples of attempting to prevent a low-risk concern and instead increasing overall risk. Is the risk savings of avoiding a car with modern steering and accelerator worth the added risk of lacking other safety features of more recent advances in designing safe automobiles?

altharaz 11y ago

After the False Promises of Inheritance emails, it seems that we'll switch to False Security Updates USB keys letters. If hackers goes into hardware, maybe should we also start working on Scam letters filters?

Retr0spectrum 11y ago

Does anyone know where I could download an image of the update? I just want to poke around.

yeldarb 11y ago
The disk image is available via their website but requires your VIN number. I poked around a past update and it appeared to just be a *nix disk image. Wasn't sure if it was signed or if there was much security or not so I wasn't brave enough to change anything for fear of borking my car. But I would have loved to figure out how to enable the nav system that's already built into my car but disabled (Jeep charges $XXXX for the privilege)
- BillinghamJ 11y ago
  It's incredibly easy to get the VIN of a car. For example, most (UK) DVLA APIs include the VIN when you put a registration plate in.
  - sokoloff 11y ago
    Or you could walk through a parking lot and look at the corner of the windshield...
Retr0spectrum 11y ago
I can't edit my original comment, but I eventually figured it out. here's a link: https://mega.nz/#!51V1zBIJ!u4Ewgv-yOJR-fsRTUKSVov4lzDqM9iuyjlZZ8FaKMTo https://mega.nz/#!51V1zBIJ!u4Ewgv-yOJR-fsRTUKSVov4lzDqM9iuyj...
- voltagex_ 11y ago
  Do you mind if I write a short article on this?
  - Retr0spectrum 11y ago

jnbiche 11y ago

Can't believe that they didn't think to include a way to verify the USB's integrity with strong crypto, and clear instructions on how to do this. Yes, non-tech savvy customers would be vulnerable to phishing (since such a letter would simply omit this step), but at least it would be possible for tech-savvy individuals to do so. If they had done this right, they would have sent the USB with a validation step and widely advertised this step, so that all users would be aware of the need to do it, maybe even branding a simple software package to verify the contents as something like "UConnect SafeCheck". Hopefully, they at least have a secure way to download it online (but given actions up to now, I'm not optimistic). Edit: Owners can download it via https (albeit with SHA-1), but I'd be surprised if there's a way to validate the integrity of the downloaded file. Also, they're advertising that link without the SSL (and indeed, it allows non-SSL connections).

ricardobeat 11y ago
I wonder what the 'Secure' printed on it stands for. Maybe each car has it's own private key, meaning you'd have to physically hack the car first in order to get a fake update stick to work?
deleted 11y ago
[deleted]
tokenizerrr 11y ago
Better would be to have the car perform the validation. I'd be shocked if this didn't actually happen.
- brudgers 11y ago
  My understanding of the original hack is that the root of the hack is a flaw in the existing platform validation. In particular that the random seed is set from the clock [not a bad practice in itself] and the clock is activated the first time the car is fired up [a somewhat problematic, since an attacker can be assumed to have the vehicle date via the VIN]. However, it's not even that hard since the first time the vehicle is fired up, the clock is at it's default time and date, and this narrows down the seeds to the range of potential latencies between the clock coming on line and the generation of the entropy pool. In other words, the USB key can't use stronger crypto than vehicle and that crypto is poorly implemented [again, based on my understanding of the original hack].