Hack attacks mounted on car control systems

Datatek said:

Here is a precis of the FAQ's section of the report. As you can see they were accessing the vehicles OBDII port, read the last line.

As BBS Guy says, as far as current generation vehicles are concerned it's a load of nonsense.

"We believe that car owners today should not be overly concerned at this time. It requires significant sophistication to develop the capabilities described in our paper and we are unaware of any attackers who are even targeting automobiles at this time.
However, we do believe that our work should be read as a wake-up call. While today's car owners should not be alarmed, we believe that it is time to focus squarely on addressing potential automotive security issues to ensure that future cars — with ever more sophisticated computer control and broader wireless connectivity — will be able to offer commensurately strong security guarantees as well.

How much of a modern automobile is computerized?
There are over 250 million registered passenger automobiles in the United States. The vast majority of these are computer controlled to a significant degree and virtually all new cars are now pervasively computerized. Computers (in the form of self-contained embedded systems) have been integrated into virtually every aspect of a car's functioning and diagnostics, including the throttle, transmission, brakes, speedometer, climate and lighting controls, external lights, and entertainment.

How can the computers in a car be accessed?
The primary direct interface to the computers in a U.S. automobile is the federally-mandated On-Board Diagnostics (OBD-II) port. It is under the dash in virtually all modern vehicles and provides direct and standard access to internal automotive networks. In many cars a range of wireless devices are also attached to these networks, as can be some after-market products (e.g., entertainment units). In our experiments, we connected our equipment to the OBD-II port.

Click to expand...

Exactly Data, i too was wondering which part of the paper OXO had read.

wammers said:

Exactly Data, i too was wondering which part of the paper OXO had read.

Click to expand...

The whole thing.. here

https://docs.google.com/viewer?url=http://www.autosec.org/pubs/cars-oakland2010.pdf

Especially read the bit where it say they were able to bridge the subnets, thus allowing access to ALL the systems on the car.

This is a scientific paper, not a bit of speculation, so while you may not want to agree with what it says, you can't say it's not true!

OXO said:

The whole thing.. here

https://docs.google.com/viewer?url=http://www.autosec.org/pubs/cars-oakland2010.pdf

Especially read the bit where it say they were able to bridge the subnets, thus allowing access to ALL the systems on the car.

This is a scientific paper, not a bit of speculation, so while you may not want to agree with what it says, you can't say it's not true!

Click to expand...

I did not say i disagreed with what it says. However, unless the vehicle has a radio link, there is no possiblity of controlling it. In the experiment they had a laptop with radio link connected to the OBDII socket. Of course software to do several things could be written and transmitted to the laptop to be inputed through the OBDII socket. If future vehicles are fitted with radio telemetry as explained earlier it would be possible for a rouge to do this but at the present time it is not possble. Unless you think that a person would not notice his vehicle had been entered, and had a wire running from the OBDII socket to a laptop on the passenger seat.

Well I agree that the likelihood of this is zero. There are just too many obstacles.

Earlier posters claimed this can not be done from the OBDII socket.. but it certainly can.

(p4) `Threat Model` the report states only temporary access is required to OBDII port to implant malware, it also identifies 5 digital radio receptors in the cars examined. So does this not mean that a target could be remotely hacked? Although not specifically mentioned the GPS system would surely be a suitable vector to gain access to the vehicle. I won`t be losing any sleep as I`m a nice guy with no enemies and no money, but some people may want to invest in a safe vehicle with no ABS, no ESR, carburettors instead of fuel injection, and a wind-up gramophone instead of a radio. Oh, and better dig that map out of the bin!

gtland said:

(p4) `Threat Model` the report states only temporary access is required to OBDII port to implant malware, it also identifies 5 digital radio receptors in the cars examined. So does this not mean that a target could be remotely hacked? Although not specifically mentioned the GPS system would surely be a suitable vector to gain access to the vehicle. I won`t be losing any sleep as I`m a nice guy with no enemies and no money, but some people may want to invest in a safe vehicle with no ABS, no ESR, carburettors instead of fuel injection, and a wind-up gramophone instead of a radio. Oh, and better dig that map out of the bin!

Click to expand...

We are talking Range Rovers here. The only thing OBDII compliant is the connector and the codes. Everything thing else is pure Land Rover customer confusing electronics. Load of bollocks if you ask me.

I apologize for my previous off the cuff remark on this subject without first actually reading the documents.
Now i have read and studied them to a large degree, i would like to forward a much more considered comment.

What an utter and complete load of manure :doh:

The problem is that the Documents are so generilized, un defined and broad spectrum, you could debate the many aspects bought up in them and the right and wrongs, as well as the possible implications almost forever.

In some cases they discuss old technology like it was some news worthy thing. EG, We plugged into the OBDII socket and were able to access all vehicle data busses and ALL ECU's. Errm guess what guys, thats why the socket is actually fitted in the first place, how else would you be able to diagnose all the ECU's electronically. :doh:

OXO, you said to me "They are not talking about doing it through the OBDII connector" to which i could respond by saying you are wrong because, patently they are, But the truth is neither of us are "Right" because connectivity is also a vague element in the documents, existing vehicle wireless communication possibilities, such as the Blue tooth phone of the 05 on models, direct OBDII physical connectivity or a wireless / bluetooth dongle that connects to the OBDII socket directly but has a wireless / BT link to a laptop are all intermixed.

Some parts of the document talk about futuristic aspects and future ramafications like some sci fi novel, hinting about both James bond style aspects as well as big brother watching you.

So exactly what generation of vehicles are they talking about, again undefined and varied.

Terms like Hacking and Unauthorised access are undefined and bandied about like candy. We are not Authorized by anyone, and regularly Hack Vehicle ECU's figuring how to bypass their built in security features, and even worse, for over 10 years we have been supplying equipment to any vehicle owner or Indie to allow them to do this too. Yet we have had not one complaint.

What sort of modifications, are they talking about. Stopping an engine by changing a setting and directly driving stuff like the gauges while plugged into the OBDII socket is something our customers have been able to do for ages. Hell the P38 can do that all on its own.

Then they talk about the future possibility of downloading modified intelligent self deleting code into the ECU's. What of remotely controlled anti Hijack devices, vehicle tracking with or without remote control capabilities, Number plate recognition and so on.

Surely these have as much worth in such debates.

The bottom line for me is that as vehicles get more technologically advanced, better connected and more like mobile computers, they will naturally attain the same risks as computers currently face every day.

As vothers have posted...............load of bollix.
:hysterically_laughi

BBS Guy said:

I OXO, you said to me "They are not talking about doing it through the OBDII connector" to which i could respond by saying you are wrong because, patently they are..

Click to expand...

Yes, I made a mistake. Sorry about that.

Nah OXO, as i pointed out, neither of us is right or wrong because in some instances they are talking about Via the OBDII connector and in others, via other wireless means.

As my post points out, there are so many variables in play in those papers and so much depends on specific circumstances, that it could be debated forever. Much of the high risk stuff they describe is mere hypothetical thought of futuristic fiction and not really applicable to most current vehicles.