Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[05omegav6]

After your passive/aggressive vulnerability testing

[Viral_Jim]

Right, this strikes at the heart of an issue I just don't get.

Why the fudge does a car need to be connected to the internet, or be a wifi hotspot?? I have never been in a car and thought "you know what it'd be great if this thing had youtube". In the sam way I've never put some bread in a toaster and thought "wouldn't it be great if this thing gave massages".

Its just so oppsing pointless! perhaps if mainstream manufacturers concentrated - even just a bit on making cars nice places to be instead of horrible s**ty plastic boxes, people wouldn't feel the need to dissociate themselves from the driving process and watch youtube on them!


Sorry, rant over, I'm currently stuck in rural sweden where beer is getting on £7 a pint and I've been given a Renault clit estate as my only nmeans of transport. Honestly, I've spent the last 4 days praying for a stretch of black ice so I can wrap it round a tree. Its done 16,000km and several bits of trip have already fallen off. Oh and its either implausibly economical, or the fuel gauge has stopped working 

[Gaffers]

Nothing illegal or which would contravene a warranty agreement in a passive pentest/vulnerability assessment.

[Kevin Wood]

Right, this strikes at the heart of an issue I just don't get.

Why the fudge does a car need to be connected to the internet, or be a wifi hotspot?? I have never been in a car and thought "you know what it'd be great if this thing had youtube". In the sam way I've never put some bread in a toaster and thought "wouldn't it be great if this thing gave massages".

Its just so oppsing pointless! perhaps if mainstream manufacturers concentrated - even just a bit on making cars nice places to be instead of horrible s**ty plastic boxes, people wouldn't feel the need to dissociate themselves from the driving process and watch youtube on them!


Sorry, rant over, I'm currently stuck in rural sweden where beer is getting on £7 a pint and I've been given a Renault clit estate as my only nmeans of transport. Honestly, I've spent the last 4 days praying for a stretch of black ice so I can wrap it round a tree. Its done 16,000km and several bits of trip have already fallen off. Oh and its either implausibly economical, or the fuel gauge has stopped working 

It's set to become an EU requirement for all new vehicles to include telematics soon (if not already implemented) so hold on to that Omega if you don't like the idea. 

[Gaffers]

Right, this strikes at the heart of an issue I just don't get.

Why the fudge does a car need to be connected to the internet, or be a wifi hotspot?? I have never been in a car and thought "you know what it'd be great if this thing had youtube". In the sam way I've never put some bread in a toaster and thought "wouldn't it be great if this thing gave massages".

Its just so oppsing pointless! perhaps if mainstream manufacturers concentrated - even just a bit on making cars nice places to be instead of horrible s**ty plastic boxes, people wouldn't feel the need to dissociate themselves from the driving process and watch youtube on them!


Sorry, rant over, I'm currently stuck in rural sweden where beer is getting on £7 a pint and I've been given a Renault clit estate as my only nmeans of transport. Honestly, I've spent the last 4 days praying for a stretch of black ice so I can wrap it round a tree. Its done 16,000km and several bits of trip have already fallen off. Oh and its either implausibly economical, or the fuel gauge has stopped working 

It's set to become an EU requirement for all new vehicles to include telematics soon (if not already implemented) so hold on to that Omega if you don't like the idea. 

Yes.  Certain agencies want need the metadata

[aaronjb]

http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html

Complete technical details there, including how much information is returned about trip details from the telematics unit.  Interesting reading..

[Gaffers]

What suprises me is that different countries/regions have different APIs.

That just beggars belief.

[Kevin Wood]

What suprises me is that different countries/regions have different APIs.

That just beggars belief.

Yep, it's like they leave it to the individual national agencies to farm it out to the lowest bidder.

What I'd be worrying about is how secure the API between the telematics box in the car and the internet is, because I'm guessing that's a whole lot more "feature rich".

I can arrange an observable mobile network if you fancy observing the traffic there.

[aaronjb]

Now that would make for some interesting research

[Gaffers]

That would be handy.  In theory it should be encrypted on some level at least.  But let's see 

[aaronjb]

C'mon Matt, you've worked in security long enough to not be that naive.. 

[Gaffers]

Just leant some info about hacking GSM with some stuff off ebay.   Mobile data is normally encrypted unless demand increases.  3g and 4g are more difficult ergo more expensive.

If I can fix it on GSM and then forcefeed it some settings then it should be easy to hack.

[Andy H]

Nothing illegal or which would contravene a warranty agreement in a passive pentest/vulnerability assessment.

I think the DMCA prohibits probing security software and as long as we have extradition to America there is a theoretical risk of being whisked off to Lakenheath and onto a flight to the US.

[Kevin Wood]

Just leant some info about hacking GSM with some stuff off ebay.   Mobile data is normally encrypted unless demand increases.  3g and 4g are more difficult ergo more expensive.

If I can fix it on GSM and then forcefeed it some settings then it should be easy to hack.

I can do all 3 network types. Can you get to the antenna connector for the telematics?

Network will normally encrypt, but that's only over the radio interface, leaving the data that enters the internet unencrypted. I really hope they use something on top of that.

[Gaffers]

I hope they do too but I suspect not.  My fear is that they have wrongly assumed that all mobile traffic from GSM to lte is automatically encrypted.