4 ms·

Cars hacked through wireless tire sensors

26 points by sil3ntmac 16y ago

sil3ntmac 16y ago
According to wikipedia (http://en.wikipedia.org/wiki/Tire-pressure_monitoring_system http://en.wikipedia.org/wiki/Tire-pressure_monitoring_system), most Tire-pressure monitoring systems nowadays use RF as their communication link. I'm no EE major, but I do like to tinker with stuff like this... Anyone know what would be the best way to 'view' the RF signal? Hook something like this http://www.mouser.com/ProductDetail/Linx-Technologies/RXM-433-LR_/?qs=1hp3elAyKCmAgU90q27DmQ%3d%3d http://www.mouser.com/ProductDetail/Linx-Technologies/RXM-43... up to an oscilloscope? Edit: This looks pretty useful as well: http://focus.ti.com/docs/toolsw/folders/print/ez430-rf2500.html http://focus.ti.com/docs/toolsw/folders/print/ez430-rf2500.h...
- silentOpen 16y ago
  http://gnuradio.org/redmine/wiki/gnuradio http://gnuradio.org/redmine/wiki/gnuradio
NathanKP 16y ago
The worst thing about this security flaw is that cars don't really have a good update system for their OS. You have to take your car in to a dealership to get the ECU software updated. If cars were designed so you could plug in an Ethernet cable to update the firmware, then patches for security flaws like this would be easier to distribute. With cars becoming more and more computerized we might reach that point some day.
- js4all 16y ago
  I am not sure, if user service updates are a good idea. This would open a path to other risks. Anyway, I agree, there is currently no good solution for updates.
  - jonah 16y ago
    Other risks sure, but other benefits as well. Modern ECUs are pretty flexible and can be reflashed through the ODB-II port with extended functionality. cf. EMCS: http://www.goapr.com/products/ecu_upgrade_s4.html http://www.goapr.com/products/ecu_upgrade_s4.html
    - TeHCrAzY 16y ago
      Something I use, along a similar line: www.evoscan.com Don't mind the wall of text website: I think it appeals to the revheads or something. The software is really quite clever (it can monitor and display variables from the ecu, along with allowing you to tinker with the software).
underscore 16y ago
The paper is here, I think: http://ftp.cse.sc.edu/reports/drafts/2010-002-tpms.pdf http://ftp.cse.sc.edu/reports/drafts/2010-002-tpms.pdf (I didn't see a link in the article)
Groxx 16y ago
>the tire sensors only send a message every 60-90 seconds, giving attackers little opportunity to compromise systems or cause any real damage. I fail to see how the normal rate of the system at all implies what rate can be achieved if attempting to hack the system. Unless it's peak receiving rate is 0.5 baud.
- bajsejohannes 16y ago
  I was equally confused. I assume they must mean that the low frequency makes it impractical for _tracking_ vehicles.
heycarsten 16y ago
With the robustness of modern ECUs I'm surprised that these signals are not checked before being evaluated. Even my Arduino is capable of doing that.
lr 16y ago
Ok, I guess I shouldn't feel so bad when I miss a test case or get an occasional exception in my web apps.
js4all 16y ago
This is serious. Even bad sensor readings open the system for attacks.
wil2k 16y ago
I've once seen something on TV (iirc Discovery Channel or so) about certain government agencies using this together with certain antenna's to be able to track vehicles on the freeway.. so this is not completely new when it comes to the tracking bit..

26 points by sil3ntmac 16y ago

According to wikipedia (http://en.wikipedia.org/wiki/Tire-pressure_monitoring_system http://en.wikipedia.org/wiki/Tire-pressure_monitoring_system), most Tire-pressure monitoring systems nowadays use RF as their communication link. I'm no EE major, but I do like to tinker with stuff like this... Anyone know what would be the best way to 'view' the RF signal? Hook something like this http://www.mouser.com/ProductDetail/Linx-Technologies/RXM-433-LR_/?qs=1hp3elAyKCmAgU90q27DmQ%3d%3d http://www.mouser.com/ProductDetail/Linx-Technologies/RXM-43... up to an oscilloscope? Edit: This looks pretty useful as well: http://focus.ti.com/docs/toolsw/folders/print/ez430-rf2500.html http://focus.ti.com/docs/toolsw/folders/print/ez430-rf2500.h...

silentOpen 16y ago
http://gnuradio.org/redmine/wiki/gnuradio http://gnuradio.org/redmine/wiki/gnuradio

NathanKP 16y ago

The worst thing about this security flaw is that cars don't really have a good update system for their OS. You have to take your car in to a dealership to get the ECU software updated. If cars were designed so you could plug in an Ethernet cable to update the firmware, then patches for security flaws like this would be easier to distribute. With cars becoming more and more computerized we might reach that point some day.

js4all 16y ago
I am not sure, if user service updates are a good idea. This would open a path to other risks. Anyway, I agree, there is currently no good solution for updates.
- jonah 16y ago
  Other risks sure, but other benefits as well. Modern ECUs are pretty flexible and can be reflashed through the ODB-II port with extended functionality. cf. EMCS: http://www.goapr.com/products/ecu_upgrade_s4.html http://www.goapr.com/products/ecu_upgrade_s4.html
  - TeHCrAzY 16y ago
    Something I use, along a similar line: www.evoscan.com Don't mind the wall of text website: I think it appeals to the revheads or something. The software is really quite clever (it can monitor and display variables from the ecu, along with allowing you to tinker with the software).

underscore 16y ago

The paper is here, I think: http://ftp.cse.sc.edu/reports/drafts/2010-002-tpms.pdf http://ftp.cse.sc.edu/reports/drafts/2010-002-tpms.pdf (I didn't see a link in the article)

Groxx 16y ago

>the tire sensors only send a message every 60-90 seconds, giving attackers little opportunity to compromise systems or cause any real damage. I fail to see how the normal rate of the system at all implies what rate can be achieved if attempting to hack the system. Unless it's peak receiving rate is 0.5 baud.

bajsejohannes 16y ago
I was equally confused. I assume they must mean that the low frequency makes it impractical for _tracking_ vehicles.

heycarsten 16y ago

With the robustness of modern ECUs I'm surprised that these signals are not checked before being evaluated. Even my Arduino is capable of doing that.

lr 16y ago

Ok, I guess I shouldn't feel so bad when I miss a test case or get an occasional exception in my web apps.

js4all 16y ago

This is serious. Even bad sensor readings open the system for attacks.

wil2k 16y ago

I've once seen something on TV (iirc Discovery Channel or so) about certain government agencies using this together with certain antenna's to be able to track vehicles on the freeway.. so this is not completely new when it comes to the tracking bit..