By Lucas Mearian, Computerworld | August 4th, 2014
An attacker who penetrates a vehicle’s radio or Bluetooth connection can gain access to other critical functions.
A report to be presented this week at the Black Hat USA conference in Las Vegas will detail which vehicles are most vulnerable to hacker attacks via a car’s Bluetooth, telematics or on-board phone applications.
Researchers Charlie Miller and Chris Valasek, who in the past have issued reports on the most vulnerable vehicles, intend to release an update showing the most and least hackable cars.
Ford’s Sync Infotainment System. At last year’s Def Con conference, researchers pointed to the Toyota Prius and Ford Escape as vehicles whose internal networks they could gain access to in order to control critical functions.
“A malicious attacker leveraging a remote vulnerability could do anything from enabling a microphone for eavesdropping to turning the steering wheel to disabling the brakes,” the researchers said in a brief outlining their upcoming report. “Unfortunately, research has only been presented on three or four particular vehicles. Each manufacturer designs their fleets differently; therefore analysis of remote threats must avoid generalities.”
The most hackable vehicles include the 2014 Jeep Cherokee, the 2015 Cadillac Escalade and the 2014 Toyota Prius. The most secure cars include the Dodge Viper, the Audi A8, and the Honda Accord, according to an interview the researchers had with Dark Reading.
The report is expected to also address how automotive network security has changed over the last five years and how to better protect vehicles from cyberattacks in the future.
At the 2013 Def Con conference, Miller, a security engineer at Twitter, and Valasek, director of security intelligence at security service IOActive, described ways to launch cyberattacks to control brakes and steering on a Prius and Ford Escape.
The two researchers also revealed a prototype device that could thwart vehicle hacking. Their intrusion prevention device plugs into a vehicle’s OBD-II port, watches data traffic on a car’s internal network and then blocks any anomalies.
Miller and Valasek didn’t physically test the vehicles cited in this year’s report for vulnerabilities, relying instead on information about the vehicles’ automated capabilities and internal network.
“We can’t say for sure we can hack the Jeep and not the Audi,” Valasek told Dark Reading. “But… the radio can always talk to the brakes” because both are on the same network.
All modern vehicles have a controller area network (CAN), which is an internal bus that allows microcontrollers and devices to communicate with each other. Gaining access through a wireless connection could potentially offer access to critical systems such as brakes and steering.
Nick Colella, Infotainment Manager for Ford, said his and other companies are researching the use of Ethernet as a separate, more secure and faster network for vehicles.
Unlike mobile device makers that use state-of-the-art technology to secure smartphones and tablets, the automotive industry has generally been a technology laggard. The computer systems in automobiles, like so many other systems, can be relatively old because of the three- to five-year vehicle development cycle.
“Nothing dates a car quicker than the electronics. You can get into five-year-old luxury car and it…feels like a Nintendo game…compared to the experience on your smartphone,” said Scott Morrison, a distinguished engineer at CA’s Layer 7 Technologies.
Mobile devices are being connected to vehicles through APIs such as Apple’s CarPlay, Google’s Automotive Link and the OS-agnostic standard MirrorLink.
In a sense, the car is becoming a large mobile device, according to Morrison and others. As the automobile industry moves toward connected vehicles, capable of communicating with each other and the infrastructure around them, it also has to address how they’ll protect the security of the vehicle’s microprocessors.
Lucas Mearian covers consumer data storage, consumerization of IT, mobile device management, renewable energy, telematics/car tech and entertainment tech for Computerworld. Follow Lucas on Twitter at @lucasmearian or subscribe to Lucas’s RSS feed. His e-mail address is firstname.lastname@example.org.