Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[omega2018]

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Hackers Remotely Kill a Jeep on the Highway

[zirk]

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Hackers Remotely Kill a Jeep on the Highway

Yea give a few years, and each Vehicle ECU will have its own IP Address, then we'll all by stuffed by Big Brother and the Authorities.

[deviator]

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Hackers Remotely Kill a Jeep on the Highway

Yea give a few years, and each Vehicle ECU will have its own IP Address, then we'll all by stuffed by Big Brother and the Authorities.

From the article I read about this (different source), they already have an IP address. This is part of the problem. The IP addresses used by Jeep belong to Sprint mobile. IE they are using them as the carrier. The hack requires a Sprint mobile as the addresses used are classed as 'private' (IE 10.x.x.x and 192.168.X.X). However they are wide open if you are on the same network.

The hack then works by rewriting the firmware in the uConnect headunit. They can then instruct the headunit to put signals out on the canbus that the radio shouldn't be producing. There is obviously no error checking here to see where the signal has come from.

[Varche]

Marvellous.

Maybe time to avoid anything Smart

Just imagine when someone disables a fleet of 50 Smart driverless taxis with a simple hack- or better sends them all to the same address.

Mr L. Uddite

[deviator]

The problem I have with this is, WHY? Why connect so much of the car up to internet?

I can see why you'd have a mobile built into your car in case of accident, GPS location etc; but why does everything else need to be connected?

Even if you argue that the stereo should be connect (internet music etc), you could at least put it on a separate network or some form of firewall to protect the cars important systems.

[r1]

this isn't new
KITT did it years ago!

[Nick W]

The problem I have with this is, WHY? Why connect so much of the car up to internet?

I can see why you'd have a mobile built into your car in case of accident, GPS location etc; but why does everything else need to be connected?

They do it because it has become so easy to do. It's probably easier to get the accountants to authorise a flashy we can control the cigarette lighter remotely over the internet gizmo than it is to buy a reliable throttle position sensor, or not make thermostat housings out of plastic.

[Gaffers]

It has been a concern in my industry for a while but manufacturers have only just started to get interested in it.

With the CANBUS it wont be as easy as a Firewall as that works differently, but such attacks could be thwarted by using a Firewall principle.  If messages on to the CANBUS were filtered through one point and this checked the source with a list of permitted actions this could stop the radio from killing the brakes for example but it wont thwart a device from doing something it is allowed to do if it is taken over by an external source.  I suppose this means some type of encryption on that traffic but I would have to get to know the architecture a bit better to go any deeper in to the possibilities.

An interesting field, that is for sure

[Kevin Wood]

I remember working with canbus when i was doing my electronics a level. Security certainly wasn't a consideration then.

[Gaffers]

I remember working with canbus when i was doing my electronics a level. Security certainly wasn't a consideration then.

True, and without any technical knowledge of it I have no idea how easy it would be to implement.  It might require routing all the inputs to a converter, running the logic and spitting the instructions without a separate bus.

[Kevin Wood]

I remember working with canbus when i was doing my electronics a level. Security certainly wasn't a consideration then.

True, and without any technical knowledge of it I have no idea how easy it would be to implement.  It might require routing all the inputs to a converter, running the logic and spitting the instructions without a separate bus.

The whole attraction of it is that it's a single bus that everything can hang off, though, eliminating the arm-sized wiring looms you get in an Omega. Isolation between the safety critical bits of the bus and the eye candy would be a start. Then again, what do you isolate it with? Some sort of bridge.. Which, when hacked...

The best answer is probably some sort of authentication scheme between the safety critical bits on top of the basic CAN signalling, in that they won't accept commands from each other unless they are able to authenticate the sender using some sort of key exchanged when they were first paired. Then again, that makes maintenance and replacing parts more awkward.

As with everything, the cheapest route will do until customers start to notice it's woefully insecure.

[Rods2]

It is not only the non-existent CANBUS security but also the many flaws and exploits in the firmware that will cause problems in the future along with lagging behind with security updates.

Mind you these are going to be the very problematic areas for the Internet of things anyway.

Where hackers and criminals are winning at the moment and in the very unlikely event of them being caught the sentences on the odd rare conviction being little more than token gestures, it means it can only grow as the criminal exploitation area of choice from private individuals to public governmental criminal organizations.

[omega2018]

now they've recalled 1.4 million cars due to this hack

http://www.bbc.co.uk/news/technology-33650491