Don't worry, you're not in danger, yet.
The key to hacking a car is that the vehicle communications bus, typically a mix of high and low speed CAN bus, is not encrypted. By connecting to the OBD-II port with the right tools (such as a laptop with a CAN communications interface device), a determined hacker could monkey with key signals. To do so, he would have to either reverse engineer or obtain from other sources the CAN messaging protocol. Then, by reading in, modifying, and rebroadcasting key messages, he could indeed do bad things, like shut down the car. For example, a hacker could broadcast an erroneous vehicle speed on the bus, causing the speedometer to display the wrong speed, and other systems to think the car is moving (or not) at a different speed than it actually is.
However, the only practical way to do this is to attach a foreign device to the cars CAN bus. So your car would have to be physically compromised, either by having the wiring modified, or by having some sort of dongle installed on the OBD-II port. The ECUs that form the vehicle CAN network are not typically easy to reflash with unauthorized firmware, so "hijacking" an ECU or installing a car virus is not really feasible. The ECUs I have worked with all have memory checksum functions, and VIN compare software, to verify that the ECU has valid software and is in the correct vehicle. According to the research paper, the team was able to compromise a telematics module and run malicious code on it.
The paper does point out some holes in vehicle bus security, and there are some things which can be done in the shorter term to mitigate such a threat. ECUs should have robust challenge/response sequences before accepting diagnostic and test commands, for example. They should also have robust checks against invalid software, so that it is difficult or impossible for a hacker to flash a module with homegrown software.
8 comments:
And just what wuld be the point to hacking a car's ECU? I cannot come up with a scheme to make money or send spam (and indirectly make money) with it, which is the point of 90% of 'hacking' (as opposed to 'exploiting') today. If you went to all that model-make-VIN specific trouble to hack an ECU, then you could (a) shut the car down, (b) possible screw up the vehicle's operation to MAYBE kill the occupants. As the Mob will tell you, a bomb is much simpler and sure.
If new challenge and response protocols are added, all that will do is reduce the capability of owners to legitimately access their vehicles systems and make maintenance by legit professionals more difficult and expensive.
A good lock will deter 99% of all theives, and the safeguards in place are for now also good enough.
Now, as soon a all cars get wireless internet access built in, these rationales may change - you will then be bombarded by penis enlargement ads popping up on your GPS diaplay...
As things stand now, the chance of your ride being "hacked" is nearly non existent. But as West said, the instant car makers start building wireless networking capability into the ECM, that all changes. The first car that can wirelessly interact with the auto shop's diagnostic computer will be eminently suitable for hacking.
West - If I can command your car's brakes to not work when the car experiences G forces then I can kill someone and make it look like an accident.
What about the GM on star system they can monitor your ECU.
So now I need to worry about my digital speedometer trying to sell me mail order viagra?
While I agree there is no point in going to the trouble of getting individual access to a car just to hack the ECU (vs. other more nefarious ways of harming someone if you have such physical access), rewriting the ECU is not difficult, at all.
There is open source software out there, or at a minimum, low cost software that will allow you to do just that. It is used almost exclusively by performance enthusiasts to extract more power, but that does not mean it cannot be turned in other directions. Performance enthusiasts have already hacked stock ECUs to add a variety of features that were not originally there, either by doing their own creative engineering, or enabling features in the system that the OEM did not originally use.
I personally have software and hardware that allows me to reprogram most vehicles from all the major Japanese makes, GM, Ford and most European cars using Bosch or Siemens ECUs. This reprogramming allows me to alter any part of the ECU coding and generates new checksums, etc. In some cases, an inspection by a dealer would easily see the changes, in others, they are invisible without a ECU dump and compare. And virtually all of this basic capability is commercially available right now (although knowing what to alter is sometimes hard won knowledge).
I was quite surprised when reading the article that the researchers had to go to such trouble when they could have purchased an existing piece of software to do the same thing.
In summary, I agree that until WiFi access is readily available on cars, external hacking of ECUs is not an issue to worry about. But as soon as WiFi is common, it will probably become a big problem if safeguards are not put in place in advance (such as isolating the ECU physically from any WiFi connection, or at least preventing bi-directional communication).
Ever wonder how can I sell my car fast? Visit Jersey Car Cash and get the most cash for cars today.
Well this is great, one day we when we least expect it - a highschool drop out hacker will get into our automobile computer and destroy everything
boom trucks
Post a Comment