With telematics a hot topic as operators and vendors push solutions to connect vehicles to the Internet, another hot topic has arisen: better security to prevent people using that connectivity to remotely hack your car and take control of it.
Last week, a team of university researchers in the US demonstrated the ability to do just that on a 2009 model sedan. The attack exploits a vulnerability in the car’s Bluetooth system for hands-free calls that allowed them to use a smartphone to execute code that could take control of the car according to Technology Review:
Nowadays many cars come equipped with cellular connections that perform safety functions, such as automatically calling for help if the driver is in a crash. The researchers found that they could take control of this system by breaking through its authentication system. First, they made about 130 calls to the car to gain access, and then they uploaded code using 14 seconds of audio. The researchers also found other ways to gain access, for example via the car's media player.
The media player hack is interesting in itself, as it involved adding some extra code to an MP3 file that, when played, alters the media player firmware, thus giving attackers another vulnerable component in the car network to exploit, reports IT World. Imagine downloading MP3s from a file sharing site and burning them onto a CD-R to play in your car. Any of those songs could be waiting to hack your car stereo.
The hack is a step up from previous research in 2009 (from the same US research team) that showed vehicle computer systems could be hacked into, but only if the hacker had physical access to the onboard diagnostics port. The new attack – presented last week to the National Academies Committee on Electronic Vehicle Controls and Unintended Acceleration – can be done remotely, although the dashboard attack is technically easier.
Possible attack scenarios include car theft (in which thieves search for specific car models, map their locations and unlock them by remote), malicious surveillance (i.e. GPS tracking) and sabotage.
Team member Stefan Savage, a professor of computer science at the University of California, San Diego, said the risk for the moment was minimal. "This took ten researchers two years to accomplish," Savage told TR. "It's not something that one guy is going to do in his garage."
A well-funded, tech-savvy group of car thieves could well be another story, however.
Which should be no surprise – the “Internet of Things” means more devices connected to the Net, but it also means more potential weak links in network security for attackers to crack. Internet-enabled cars were never going to be the exception.
Fair warning, then, for telematics vendors and service providers, as well as carmakers, to make sure they work together to stay ahead in the security arms race