Hackers Commandeer Moving Jeep From Miles Away

[Borg 386]

Fiat Chrysler has released an urgent software update for a number of its Internet-connected vehicles after learning that two hackers were able to take control of a Jeep Cherokee from miles away and crash it into a ditch.

The possibility that hackers could gain access to hundreds of thousands of FCA vehicles was revealed in a story in Wired magazine. The potential was demonstrated by two professional hackers, including one who previously worked for the National Security Agency. They plan to reveal at least some of their tricks during a so-called Black Hat security conference in Las Vegas next month.

Jeep Owners Urged to Get Update After Hackers Commandeer Vehicle - NBC News

Hackers Remotely Kill a Jeep on the Highway?With Me in It | WIRED

 

[Layback Bear]

I was telling Representatives from another auto manufacture that anytime a external signal can enter the systems on a vehicle a hack is possible.
Now that many vehicles have steer and brake by wire it is even worse.
Keep in mind that most modules in a vehicle are networked to most if not all other modules in the vehicle. Even your audio system and wiper systems knows how fast the car is going and if you accelerate or brake.
Why you say. Well they have the systems set up to change the volume and the wiper speed according to the speed of the vehicle.

Now I don't have the knowledge to do such a thing but I knew years ago that hackers would figure a way to do a hack. Now all the hacker has to do is cause a few accidents and then blackmail the auto manufacture for the proper repair.

Remote access or remove start also gives access paths to modules which communicate with other modules through networks in the vehicle.

Todays vehicles can have 20 plus modules that are networked and control or monitor most everything on the vehicle.


They just looked at me like some sort of a lug nut that gets his hands dirty.
They had the opinion that no hacker was smart enough to access their systems.
B/S is what I told them.
A quality hack could be millions of dollars worth in blackmail money.

 

[lehnerus2000]

This is why IoT is going to be an unmitigated nightmare.

Unless there are massive penalties imposed ($1B+ fines and jail for executives) for each security failure, they will keep releasing insecure junk.

I've said it before and I'll say it again, this technology has the potential to turn entire countries into Orwellian prison camps.

 

[RoasterMen]

Nothing beats a key.

 

[Ranger4]

Soon we will hear about how the vehicle manufacturers have fixed this loophole & that it will be impossible to break into the system again.

Well we have heard all that for, how many years is it now, about mainframe & personal computer systems being hacked & how the loopholes have been fixed & yet the problem continues, in fact it's getting dramatically worse.

Software updates being sent by the internet to motor vehicles will never be hacker proof so we may as well admit it now & forget the whole idea. Just notify the vehicle owners & have the vehicles systems updated in the dealers workshop in the old way.

The dangers of having the system updated via the internet is just too horrible to imagine. Accelerators, brakes & steering among a host of other safety items could be manipulated remotely, to cause major traffic accidents & deaths, apart from the cost.

 

[Borg 386]

I saw an article a couple years ago where some universities conducted tests & were able to grab control of a new vehicle by driving alongside it with a laptop to hack into it.

Consider, a computer savvy carjacker no longer needs to physically hijack a car. You just grab control, drive the car out to a desolate area & take the car with little fear of interference from anyone. Also, how long before some high ranking official gets his car hijacked & driven to either a hideout, to be held for ransom, or they simply drive it off a bridge?

The auto industry was made aware of the tests conducted 2 years ago by some of these universities. From what I read, they basically turned a blind eye.

Yes, some electronics can be quite useful, and indeed most people demand the latest bells & whistles when it comes to tech in cars. But some tech should not be allowed. And any that is should be locked down properly.

More disturbing is the fact that most insulin pumps & pacemakers are also controlled by wireless. These have significant hackable flaws in them that have been pointed out. The response, based on what I have read, has thus far been minimal.

 

[lehnerus2000]

Software updates being sent by the internet to motor vehicles will never be hacker proof so we may as well admit it now & forget the whole idea. Just notify the vehicle owners & have the vehicles systems updated in the dealers workshop in the old way.

The dangers of having the system updated via the internet is just too horrible to imagine. Accelerators, brakes & steering among a host of other safety items could be manipulated remotely, to cause major traffic accidents & deaths, apart from the cost.

Agreed 100%.

Recent Sci-Fi shows have showcased this (e.g. "The new BSG Series", "I Robot").

There have been Internet conspiracies/rumours about "Acroynm Agencies" doing this.

The response, based on what I have read, has thus far been minimal.

It will only be taken seriously after some big executives are jailed and all of their assets have been confiscated.

 

[jamis]

This leap of internet connectivity in cars brings to mind the old saying "Just because you can do something, doesn't mean you should". And to paraphrase: If you do it, do the due diligence to do it right. I continuously see the automotive industry do something new, screw it up, and spend several years correcting it in subsequent model years while doing nothing for the previous screwed up MYs. This failure with FCA cars was fixed for the 2015s, but there is no formal recall for the affected 2014s. If you know about the flaw, you can voluntarily take your car to the dealership for a free software update, or you can find the web site that has it, download it to a thumb drive, and to the update yourself.

 

[strollin]

Nothing beats a key.

Don't bet on that. I'm sure there are more people out there in the world that can pick a lock (not to mention those that would physically break a lock) than there are people smart enough to hack a car's system. The scary thing about the hack is that it can be done remotely, the hacker never actually comes in contact with the vehicle.

 

[Layback Bear]

You can't get people to get free security updates for their computer. What would make anybody think these people would take their car to a dealership to keep getting security updates over and over and over.

No manufacture is going to have a system that can be accessed by a customer using a usb thumb drive. The lawyers would be lined up from coast to coast on every accident that happened. Blaming everything on the improper access to the vehicles systems by the customer who is untrained.

The auto manufactures have opened a bag of worms with allowing external access to the vehicles modules that they will not be able to shut.

It's just something we will just have to accept like Adobe and Microsoft updates.
The only thing I can think of, is to stop all external access to the vehicles computer/module system.
No blue tooth.
No wifi
No GPS
No remote start
No remove entry/access to vehicles.
No anything that can access the vehicle externally.
You would also have to disconnect the audio system from networking to other modules in the vehicle. Driving by wire are good systems if nobody messes with them.
Problem is that hackers do have access to them and will find more ways to hack when the money is right.

If one wonders why manufactures make vehicles in this fashion.
Well it's not because the manufactures wanted to spend years and billions of dollars on these methods.

1. Customers like and want these little goodies.
2. Many of these goodies like steer and brake by wire is part of the methods used to reach the government mandate MPG.

Just think of power steering without belts, pumps, hoses ect. Less drag on the engine and less weight. Which equals better MPG.
Just think of power brakes without vacuum or hydraulic assist. Less weight again and less strain on the engine. Again more MPG.

I got out of the business a few years ago when vehicles with these drive by wire just started to come out and can't even think how far it has advanced in the last 5 or 6 years.

Hands off auto driving will be a hackers Walmart. One stop shopping.

 

[jamis]

No manufacture is going to have a system that can be accessed by a customer using a usb thumb drive. The lawyers would be lined up from coast to coast on every accident that happened. Blaming everything on the improper access to the vehicles systems by the customer who is untrained.

Mine does for map and software updates to the navigation system (2013 Civic). The updates are from a third party (here.com) and come on a thumb drive. You need the access key that comes with the drive to get to the data on the thumb drive and the button sequence (well known) to get the maintenance display panels. Since the navigation system is tied into the car's ECU and other electronics, it should not be a big task to install some virus code onto the SD card that the navigation system runs on. This system is NOT connected to the internet, but does allow one to load stuff into the system. This navigation system is used by Honda, Porsche, and Mitsubishi (the maker), to name a few. So far, the only issues reported with this set up are corrupted files and access codes on the drives themselves, so the owner is unable to actually install the updates they paid for. Oh yeah, the auto companies are lobbying congress for a law that makes it illegal for the vehicle owner to alter or modify the electronics of their car. I guess it's supposed to be left to the manufacturers to screw up the cars, not the owners.

 

[Indianatone]

Jeep breach: Scared? You should be, it could be you next

Why the hell connect cars to the net anyway?

read the full story here at The Register:


Jeep breach: Scared? You should be, it could be you next • The Register

 

[Indianatone]

One of the comments is a little scary..........

Just why are these systems not air-gapped?
Because it makes life extremely difficult for the Feds when they need to make someone disappear.
https://en.wikipedia.org/wiki/Micha...t)#Allegations_of_foul_play.2C_and_assertions

 

[Borg 386]

Chrysler Recalls 1.4 Million Cars After Remote Hacking of Jeep

Looks like the list has been expanded....

The recall, which includes Dodges, Jeeps, Rams and Chryslers, comes after Wired magazine published an article Tuesday in which two hackers were able to manipulate remotely a Jeep Cherokee's computer software.

Chrysler Recalls 1.4 Million Cars After Remote Hacking of Jeep - NBC News