4 ms·

Aren't these Bluetooth sensors a great access point for hackers? I can't find the article but I think this was in the news lately.

by huuu 12y ago

klez 12y ago
I used to develop OBD diagnostic software[0], the ones used by mechanics. For the cars I developed for, usually actuators had some preconditions that had to be met before they could go off. For example you shouldn't be able to tell the car to brake via OBD if the car is not still. At the moment, I can't think of something 'dangerous' that could be done via ODB. [0] http://www.texa.com/ http://www.texa.com/
- VLM 12y ago
  One thing you can do without connecting is sniff -n- track. Regardless if you connect, you can sniff things like tire pressure monitor transmitters or bluetooth addresses. At least officially there is no publicly known database of license plate pix and sniffed MAC addresses. Obviously being blindingly obvious idea, there probably is a secret one. So you only need enough optical data gathering to match MACs to plates with excellent lines of sight and OCR and so forth, then you can get away with deploying simple RF sniffers all over the place that don't need LOS and can be much cheaper. Note that you can track cops this way, not just victims ^H^H err consumers I mean. And obviously the "smarter" the car the easier this tracking works, you're not going to track a restored 1972 Gran Torino off its bluetooth.
- bri3d 12y ago
  Via documented OBD mechanisms? Yeah, probably not much. Via a standard Bluetooth<-> CAN interface plugged into the OBD port? Lots can be done, because generally the OBD port will expose the main CAN network and once you reverse engineer whatever inter-module messaging the manufacturer is using, you can act as a real module (for example, the throttle pedal) and all sorts of Bad Things are possible. Here's a great write-up, which is also a good primer on automotive control reversing techniques for the uninitiated: http://illmatics.com/car_hacking.pdf http://illmatics.com/car_hacking.pdf
rcpt 12y ago
I haven't tried to use the device to control my car. Though I just learned that this week's Security Now is all about it: http://twit.tv/show/security-now/497 http://twit.tv/show/security-now/497
wkearney99 12y ago
Many vehicles separate the bus on which the OBD resides from the one that actually controls anything. Here's how Chrysler handles it (and by extension, most modern Jeeps): http://tucrrc.utulsa.edu/DodgeRam_files/NetworkTopology.jpg http://tucrrc.utulsa.edu/DodgeRam_files/NetworkTopology.jpg

Aren't these Bluetooth sensors a great access point for hackers? I can't find the article but I think this was in the news lately.

by huuu 12y ago

Aren't these Bluetooth sensors a great access point for hackers? I can't find the article but I think this was in the news lately.

klez 12y ago

I used to develop OBD diagnostic software[0], the ones used by mechanics. For the cars I developed for, usually actuators had some preconditions that had to be met before they could go off. For example you shouldn't be able to tell the car to brake via OBD if the car is not still. At the moment, I can't think of something 'dangerous' that could be done via ODB. [0] http://www.texa.com/ http://www.texa.com/

VLM 12y ago
One thing you can do without connecting is sniff -n- track. Regardless if you connect, you can sniff things like tire pressure monitor transmitters or bluetooth addresses. At least officially there is no publicly known database of license plate pix and sniffed MAC addresses. Obviously being blindingly obvious idea, there probably is a secret one. So you only need enough optical data gathering to match MACs to plates with excellent lines of sight and OCR and so forth, then you can get away with deploying simple RF sniffers all over the place that don't need LOS and can be much cheaper. Note that you can track cops this way, not just victims ^H^H err consumers I mean. And obviously the "smarter" the car the easier this tracking works, you're not going to track a restored 1972 Gran Torino off its bluetooth.
bri3d 12y ago
Via documented OBD mechanisms? Yeah, probably not much. Via a standard Bluetooth<-> CAN interface plugged into the OBD port? Lots can be done, because generally the OBD port will expose the main CAN network and once you reverse engineer whatever inter-module messaging the manufacturer is using, you can act as a real module (for example, the throttle pedal) and all sorts of Bad Things are possible. Here's a great write-up, which is also a good primer on automotive control reversing techniques for the uninitiated: http://illmatics.com/car_hacking.pdf http://illmatics.com/car_hacking.pdf

rcpt 12y ago

I haven't tried to use the device to control my car. Though I just learned that this week's Security Now is all about it: http://twit.tv/show/security-now/497 http://twit.tv/show/security-now/497

wkearney99 12y ago

Many vehicles separate the bus on which the OBD resides from the one that actually controls anything. Here's how Chrysler handles it (and by extension, most modern Jeeps): http://tucrrc.utulsa.edu/DodgeRam_files/NetworkTopology.jpg http://tucrrc.utulsa.edu/DodgeRam_files/NetworkTopology.jpg