Telematics Watch

Researchers to name the most hackable cars at Black Hat

An attacker who penetrates a vehicle's radio or Bluetooth connection can gain access to other critical functions

A report to be presented this week at the Black Hat USA conference in Las Vegas will detail which vehicles are most vulnerable to hacker attacks via a car's Bluetooth, telematics or on-board phone applications.

Researchers Charlie Miller and Chris Valasek, who in the past have issued reports on the most vulnerable vehicles, intend to release an update showing the most and least hackable cars.

"A malicious attacker leveraging a remote vulnerability could do anything from enabling a microphone for eavesdropping to turning the steering wheel to disabling the brakes," the researchers said in a brief outlining their upcoming report. "Unfortunately, research has only been presented on three or four particular vehicles. Each manufacturer designs their fleets differently; therefore analysis of remote threats must avoid generalities."

The most hackable vehicles include the 2014 Jeep Cherokee, the 2015 Cadillac Escalade and the 2014 Toyota Prius. The most secure cars include the Dodge Viper, the Audi A8, and the Honda Accord, according to an interview the researchers had with Dark Reading.

The report is expected to also address how automotive network security has changed over the last five years and how to better protect vehicles from cyberattacks in the future.

According to the "Connected Car Cybersecurity" report from ABI Research, there have been "quite a few proof of concepts" demonstrating interception of wireless signals of tire pressure monitoring systems, impairing anti-theft systems, and taking control of self-driving and remote control features through a vehicle's internal bus, known as controller area network (CAN).

All modern vehicles have a CAN, which is an internal bus that allows microcontrollers and devices to communicate with each other. Gaining access through a wireless connection could potentially offer access to critical systems such as brakes and steering. Vehicles also have a standardized physical port called an OBD-II bus that can be plugged into.

"The cars OBD-II bus is one of the weak points but wireless technologies such as cellular, V2X and Wi-Fi constitute additional breach points, allowing hacking from a remote wireless device outside of the vehicle compromising the authentication and integrity of messages," the report states.

Many of the risks are caused by car makers starting to offer developers access to their vehicles' CANs and critical vehicle functions. Whether some cars are more vulnerable than others will ultimately depend on the protocols and the technology that they adopt, the report notes.

At the 2013 Def Con conference, Miller, a security engineer at Twitter, and Valasek, director of security intelligence at security service IOActive, described ways to launch cyberattacks to control brakes and steering on a Prius and Ford Escape.

The two researchers also revealed a prototype device that could thwart vehicle hacking. Their intrusion prevention device plugs into a vehicle's OBD-II port, watches data traffic on a car's internal network and then blocks any anomalies.

Miller and Valasek didn't physically test the vehicles cited in this year's report for vulnerabilities, relying instead on information about the vehicles' automated capabilities and internal network.

"We can't say for sure we can hack the Jeep and not the Audi," Valasek told Dark Reading. "But... the radio can always talk to the brakes" because both are on the same network.

Nick Colella, Infotainment Manager for Ford, said his and other companies are researching the use of Ethernet as a separate, more secure and faster network for vehicles.

Unlike mobile device makers that use state-of-the-art technology to secure smartphones and tablets, the automotive industry has generally been a technology laggard. The computer systems in automobiles, like so many other systems, can be relatively old because of the three- to five-year vehicle development cycle.

"Nothing dates a car quicker than the electronics. You can get into five-year-old luxury car and it...feels like a Nintendo game...compared to the experience on your smartphone," said Scott Morrison, a distinguished engineer at CA's Layer 7 Technologies.

Mobile devices are being connected to vehicles through APIs such as Apple's CarPlay, Google's Automotive Link and the OS-agnostic standard MirrorLink.

In a sense, the car is becoming a large mobile device, according to Morrison and others. As the automobile industry moves toward connected vehicles, capable of communicating with each other and the infrastructure around them, it also has to address how they'll protect the security of the vehicle's microprocessors.

Lucas Mearian covers consumer data storage, consumerization of IT, mobile device management, renewable energy, telematics/car tech and entertainment tech for Computerworld. Follow Lucas on Twitter at  @lucasmearian or subscribe to Lucas's RSS feed . His e-mail address is lmearian@computerworld.com.

See more by Lucas Mearian on Computerworld.com.

From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies