What Happens When Your Car Gets Hacked?

Connected cars could give cybercriminals a whole new range of targets.

National Journal
Alex Brown
July 23, 2014, 10:41 a.m.

One day soon, your new car will come loaded with apps that can play live base­ball games from across the coun­try or read news art­icles aloud. Buy a Toyota? Apple’s Car­Play will turn it in­to an iPhone on wheels. Opt for a Hy­undai, and you’ll get Google’s An­droid op­er­at­ing sys­tem built in­to the dash­board. And most ma­jor auto­makers are plan­ning to of­fer both.

That’s sure to stir up ex­cite­ment among tech-savvy con­sumers, but it also has hack­ers ima­gin­ing a whole new world of op­por­tun­ity.

“Can some 14-year-old in In­done­sia fig­ure out how to [hack] this and just shut your car down “¦ be­cause everything is now wired up?” asked Sen. Jay Rock­e­feller in a hear­ing last year.

That worry, while sound­ing rather dystop­ic, isn’t ne­ces­sar­ily un­real­ist­ic, said Chris Valasek, who handles se­cur­ity in­tel­li­gence for IO­Act­ive, a se­cur­ity firm. That’s be­cause Valasek, while not a teen­ager from South­east Asia, has taken car-hack­ing to a scary level.

Last year, Valasek and hack­ing part­ner Charlie Miller linked a laptop to the data port of a Ford Es­cape. Sit­ting in the back­seat while a re­port­er drove, they changed the fuel in­dic­at­or level, upped the speedo­met­er read­ing to 199 mph and ac­tiv­ated the horn. Then, mid-drive, they jerked the steer­ing wheel back and forth and de­ac­tiv­ated the vehicle’s brakes (an earli­er test sent Miller in­to the back wall of his gar­age).

If that sounds fright­en­ing, Valasek says, it’s time to ima­gine the pos­sib­il­ity that to­mor­row’s hack­ers won’t need a plug-in cable — and they could do more than give their vic­tims a little scare. “There’s a lot of wire­less com­mu­nic­a­tions in the car, and I as­sume con­nec­ted vehicles will add more wire­less com­mu­nic­a­tions,” he said. “The more ways to wire­lessly com­mu­nic­ate with something, the more at­tack sur­face there is. Ad­ded com­plex­ity many times gives an at­tack­er more ways to at­tempt to get in­to a vehicle.”

At­tack sur­face is an­oth­er way of de­scrib­ing the wire­less entry points to a vehicle. Cars can use cel­lu­lar net­works to place calls or re­ceive nav­ig­a­tion. They use Wi-Fi to con­nect devices in the vehicle to the In­ter­net. They link to phones with Bluetooth. Even their tires can send wire­less sig­nals to in­dic­ate low pres­sure.

Today’s cars have up­ward of 100 mi­cro­pro­cessors to sort this data and send sig­nals throughout the vehicle. The prob­lem comes when one of these sig­nals is breached. A com­puter, by con­trast, has safe­guards to pro­tect sys­tems like disk stor­age if an­oth­er area, such as a Web browser, is hacked. This is known as pre­vent­ing “lat­er­al move­ment.”

“Cars aren’t really there yet,” Valasek said. “Many auto­mo­biles don’t have a layered ap­proach to se­cur­ity right now. They just as­sume some­body can’t break in.”¦ You want to se­greg­ate por­tions.”

And while the in­tern­al work­ings of today’s cars lack pro­tec­tion, the soft­ware of to­mor­row’s vehicles will add an­oth­er chal­lenge. With An­droid and Car­Play on the ho­ri­zon — and most auto­makers on board — a whole gen­er­a­tion of cars will soon hit the road en masse with vir­tu­ally identic­al op­er­at­ing sys­tems.

“The new op­er­at­ing sys­tems will make the mar­ket less het­ero­gen­eous, which po­ten­tially is more dan­ger­ous,” said Vi­cente Diaz, a se­cur­ity re­search­er at Kasper­sky Lab. “At­tack­ers will be more fa­mil­i­ar with these sys­tems.”

Of course, hack­ers have already had years to prac­tice break­ing in­to those sys­tems on mo­bile devices. “People have been hack­ing those op­er­at­ing sys­tems for a long time,” Valasek said. “It may give them a more fa­mil­i­ar meth­od to get in.”

An­oth­er is­sue, Diaz warned, is that while phones tend to get re­placed every few years, the longer lifespan of a car could make it in­creas­ingly vul­ner­able as time goes on.

Without fur­ther test­ing, it’s hard to say just what a cy­ber­crim­in­al could do with a giv­en hack. No one knows how hard it would be to wire­lessly rep­lic­ate Valasek’s com­plete con­trol of a car — or how many vehicles will suf­fer that vul­ner­ab­il­ity.

But oth­er con­cerns could give car buy­ers pause. Hack­ers could steal a driver’s loc­a­tion data or use Bluetooth to ac­tiv­ate a phone’s mi­cro­phone and eaves­drop. Some re­mote un­lock ap­plic­a­tions could even let hack­ers gain entry to a vehicle.

These vi­ol­a­tions won’t ne­ces­sar­ily hap­pen be­cause a hack­er tar­gets a spe­cif­ic car. In most cases, hack­ers will gain ac­cess to a user’s on­line pro­file first, then wait for it to get linked to a vehicle. “[If] the app in your phone or your Web portal cre­den­tials get hacked, an at­tack­er will have ac­cess to the data of your car,” Diaz said. “They could see all the de­tails of your car, even its loc­a­tion, and in some cases be able to un­lock the doors. All this may start with a simple phish­ing mes­sage, so con­sumers should be aware of what this new eco­sys­tem rep­res­ents and the con­sequences.”

Auto­makers say they take such threats ser­i­ously and are work­ing to pre­vent them, though some point out that no one has suc­cess­fully pulled off a real-world wire­less hack. But that doesn’t mean it can’t or won’t hap­pen, se­cur­ity ex­perts warn. “Man­u­fac­tur­ers need to really start con­sid­er­ing what hap­pens when someone does com­prom­ise a por­tion of their vehicle in­stead of as­sum­ing no one will,” Valasek said.

For now, he and his fel­low “good-guy” hack­ers will keep mak­ing cars go hay­wire, warn­ing of the threats they ex­pose and hop­ing their finds help keep the road free of ma­li­cious hack­ers.

What We're Following See More »
STAFF PICKS
When It Comes to Mining Asteroids, Technology Is Only the First Problem
2 days ago
WHY WE CARE

Foreign Policy takes a look at the future of mining the estimated "100,000 near-Earth objects—including asteroids and comets—in the neighborhood of our planet. Some of these NEOs, as they’re called, are small. Others are substantial and potentially packed full of water and various important minerals, such as nickel, cobalt, and iron. One day, advocates believe, those objects will be tapped by variations on the equipment used in the coal mines of Kentucky or in the diamond mines of Africa. And for immense gain: According to industry experts, the contents of a single asteroid could be worth trillions of dollars." But the technology to get us there is only the first step. Experts say "a multinational body might emerge" to manage rights to NEOs, as well as a body of law, including an international court.

Source:
STAFF PICKS
Obama Reflects on His Economic Record
2 days ago
WHY WE CARE

Not to be outdone by Jeffrey Goldberg's recent piece in The Atlantic about President Obama's foreign policy, the New York Times Magazine checks in with a longread on the president's economic legacy. In it, Obama is cognizant that the economic reality--73 straight months of growth--isn't matched by public perceptions. Some of that, he says, is due to a constant drumbeat from the right that "that denies any progress." But he also accepts some blame himself. “I mean, the truth of the matter is that if we had been able to more effectively communicate all the steps we had taken to the swing voter,” he said, “then we might have maintained a majority in the House or the Senate.”

Source:
STAFF PICKS
Reagan Families, Allies Lash Out at Will Ferrell
2 days ago
WHY WE CARE

Ronald Reagan's children and political allies took to the media and Twitter this week to chide funnyman Will Ferrell for his plans to play a dementia-addled Reagan in his second term in a new comedy entitled Reagan. In an open letter, Reagan's daughter Patti Davis tells Ferrell, who's also a producer on the movie, “Perhaps for your comedy you would like to visit some dementia facilities. I have—I didn’t find anything comedic there, and my hope would be that if you’re a decent human being, you wouldn’t either.” Michael Reagan, the president's son, tweeted, "What an Outrag....Alzheimers is not joke...It kills..You should be ashamed all of you." And former Rep. Joe Walsh called it an example of "Hollywood taking a shot at conservatives again."

Source:
PEAK CONFIDENCE
Clinton No Longer Running Primary Ads
2 days ago
WHY WE CARE

In a sign that she’s ready to put a longer-than-ex­pec­ted primary battle be­hind her, former Sec­ret­ary of State Hil­lary Clin­ton (D) is no longer go­ing on the air in up­com­ing primary states. “Team Clin­ton hasn’t spent a single cent in … Cali­for­nia, In­di­ana, Ken­tucky, Ore­gon and West Vir­gin­ia, while” Sen. Bernie Sanders’ (I-VT) “cam­paign has spent a little more than $1 mil­lion in those same states.” Meanwhile, Sen. Jeff Merkley (D-OR), Sanders’ "lone back­er in the Sen­ate, said the can­did­ate should end his pres­id­en­tial cam­paign if he’s los­ing to Hil­lary Clin­ton after the primary sea­son con­cludes in June, break­ing sharply with the can­did­ate who is vow­ing to take his in­sur­gent bid to the party con­ven­tion in Phil­adelphia.”

Source:
CITIZENS UNITED PT. 2?
Movie Based on ‘Clinton Cash’ to Debut at Cannes
2 days ago
WHY WE CARE

The team behind the bestselling "Clinton Cash"—author Peter Schweizer and Breitbart's Stephen Bannon—is turning the book into a movie that will have its U.S. premiere just before the Democratic National Convention this summer. The film will get its global debut "next month in Cannes, France, during the Cannes Film Festival. (The movie is not a part of the festival, but will be shown at a screening arranged for distributors)." Bloomberg has a trailer up, pointing out that it's "less Ken Burns than Jerry Bruckheimer, featuring blood-drenched money, radical madrassas, and ominous footage of the Clintons."

Source:
×