Car-hacking: Remote access and other security issues

Computerworld - A disgruntled former employee of Texas Auto Center chose a creative way to get back at the Austin-based dealership: He hacked into the company's computers and remotely activated the vehicle-immobilization system, which triggered the horn and disabled the ignition system in more than 100 of the vehicles. The dealership had installed the system in its cars as a way to deal with customers who fell behind on their payments.

Police arrested the man and charged him with breach of computer security. His legal status was unclear as of our deadline for this story.

Out-of-control honking horns may be annoying, but other types of hacking, such as cutting the engine of unsuspecting drivers, could have deadly consequences. Although most experts agree there isn't an immediate risk, vehicle hacking is something that bears watching.

A 2011 report (PDF) by researchers at the University of California, San Diego and others site numerous "attack vectors," including mechanics' tools, CD players, Bluetooth and cellular radio as among the potential problems in today's computerized cars.

With the increasing computerization of vehicles of all types, observers have longer-term concerns over the vulnerabilities of trucks, delivery vans, rental cars and consumer autos. A malicious hacker could, in theory, disable the vehicles, re-route GPS signals or otherwise put employees, customers and the company as a whole in danger.

Consumers are getting worried about the safety and privacy risks that come with today's connected cars, according to a Harris Interactive poll released last week. For their part, auto makers and industry association spokesmen responded that they are adding electronic features carefully and based on market research.

Modern vehicle engines bear little resemblance to the engines of the past. Engines originally consisted of various mechanical devices assembled around a combustion engine. Within the past 20 years, cars have evolved to contain a complex network of as many as 50 to 70 independent computers, electronic control units (ECUs) with up to 100MB of binary code. Automotive ECUs originally entered production in the U.S. largely in response to California's automotive-emissions reduction law, first passed in 1961, and then the subsequent federal Clean Air Act, passed originally in 1963, strengthened considerably in 1970 and updated since then.

ECUs measure the oxygen present in exhaust fumes and adjust the fuel/oxygen mixture before combustion, which improves efficiency and reduces pollutants. Over time these systems have become integrated into nearly every aspect of a car's functioning, including air bag deployment, steering, braking and other real-time systems.

In the mid-1990s car manufacturers began integrating more powerful ECUs with peripherals such as GM's OnStar system, which is a combination GPS, emergency response unit and vehicle recovery system. An OnStar-equipped car can analyze its on-board diagnostics as the car is being driven, detecting problems and alerting the driver to any issues that require a visit to the repair shop.

These ECUs connect to one another and to the Internet, making car computers as vulnerable to the same digital dangers widely known among PCs and other networked devices: viruses, Trojans, denial-of-service attacks and more.

"The Austin case is a fairly particular case in that they had an add-on system that specifically gave them the ability to wirelessly immobilize the cars," says Stefan Savage, professor in the department of computer science and engineering at the University of California, San Diego. "It's not a standard feature on most automobiles."

Generally speaking, these types of systems are there to disable the vehicle in the event of theft and enable their eventual recovery, says Savage. "This was not a case of hacking into a system or creating new functionality that didn't exist before," he explains. But that's not to say it can't be done. "In our research we demonstrated taking over a car through a software vulnerability and creating a completely new piece of functionality that did not exist before," he says.

GM's OnStar service, which also helps recover stolen vehicles, is currently the only vendor advertising that capability as a standard feature, says Savage. "However, the set of cars for which a clever adversary could create a new capability to shut down the car is likely quite a bit larger."

Motive behind the madness

One of the saving graces is there are relatively few motivations to stealing vehicles via a sophisticated hack, Savage adds, because of the complexity involved and the need to spend some serious cash to be able to pull it off. "There is a theft motivation. But while we've been able to demonstrate a computer attack and steal cars, frankly it's still easier to use a Slim Jim," he says, referring to the classic lock pick.

"The Austin scenario could not happen to a system that is not networked," says Dan Bedore, director of product communications at Nissan North America. "Our vehicle control modules are discrete systems and are not networked. So any scenario that involves hacking a car would be limited to a single unit."