{"id":3778,"date":"2014-08-07T13:51:45","date_gmt":"2014-08-07T17:51:45","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=3778"},"modified":"2020-02-26T18:58:56","modified_gmt":"2020-02-26T14:58:56","slug":"car_hacking_goes_mobile","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/car_hacking_goes_mobile\/3778\/","title":{"rendered":"Car Hacking Goes Mobile at Black Hat"},"content":{"rendered":"

LAS VEGAS \u2013 The last time we checked in with Charlie Miller and Chris Valasek was at the Kaspersky Lab Security Analyst Summit<\/a> where we discussed the means of protecting automobiles<\/a> against a series of attacks they had been developing. Yesterday the duo presented new, broader research looking at different cars and launching different kinds of attacks at the Black Hat security conference in Las Vegas, Nevada.<\/p>\n

\"car<\/a><\/p>\n

First off, Miller, of Twitter, and Valasek, of IOActive, followed through on creating an antivirus-like intrusion detection system<\/a> capable of blocking the very attacks they launch, which included disabling braking systems, making the car initiate auto-park and jerk to one side or the other while in motion and more.<\/p>\n

Perhaps more interestingly, their attacks are evolving. A year ago, when they first started publishing this work, all the attacks were local<\/a>. In other words, Miller and Valasek played around in the backseat with their computers plugged into a torn-apart Toyota Prius while terrified reporters tried in vain to drive a vehicle they could not control.<\/p>\n

Now Miller and Valasek\u2019s attacks are remote<\/a>. No longer do they have to plug in and no longer are the pair limited to attacking the Toyota Prius they haphazardly ripped apart in the garages. The attacks\u00a0 leverage a vulnerability in a wireless communication protocols like Bluetooth and then use that access to pass messages along through the onboard computer systems and ultimately manipulated the car\u2019s behavior.<\/p>\n

\u201cLots more people know how to write a Web exploit than a TPMS exploit. A lot of people can write a malicious app, or pop a browser. If that\u2019s on the same network as your brakes or steering, that\u2019s bad.\u201d<\/div>\n

Part of their briefing was a discussion of the security postures different makes and models and we\u2019ll have much more to report after the researchers release a 95-page paper examining automobiles from Audi, Honda, Infiniti, Jeep, Dodge and others.<\/p>\n

Problematically, Miller explained that hacking a car, which may seem new and novel, doesn\u2019t look all that different than a traditional network hack. You find a vulnerability and you exploit it. Patching a car, however, is not as simple as patching a Web browser.<\/p>\n

Valasek explained that patching an automobile is expensive for manufacturers not only because creating the patch itself costs money but also because the manufacturer then has to contact their customers who in turn must take their vehicles to a dealer for a software update.<\/p>\n

\u201cIt\u2019s going to be really hard when an exploit comes out and everyone has a vulnerability that needs to be fixed,\u201d said Valasek.<\/p>\n

#BlackHat: @0xCharlie and @nudehaberdasher now #hacking cars remotely and developing AV-style protection<\/p>Tweet<\/a><\/blockquote>\n

The list of potentially hackable features on newer model cars is a long one; some fun, others harrowing. Potentially exploitable features include self-parking, active lane control, pre-collision systems and adaptive cruise control, all of which require some level of communication between a sensor and the brakes, acceleration or steering, usually over Bluetooth or some other radio signal. Other \u2013 more criminally desirable features \u2013 include passive antitheft system, tire pressure monitoring system or remote keyless entry. However, these latter features, the researchers explained, offer a limited attack surface, either because they don\u2019t exchange much data or because they require close proximity for communication.<\/p>\n

Bluetooth capabilities, the radio data system and telematics systems that allow cellular or Wi-Fi capabilities, expand a car\u2019s attack surface dramatically. With in-car applications and other Web connectivity features looming, the situation promises to get worse.<\/p>\n

\u201cLots more people know how to write a Web exploit than a TPMS exploit,\u201d Valasek said. \u201cA lot of people can write a malicious app, or pop a browser. If that\u2019s on the same network as your brakes or steering, that\u2019s bad.\u201d<\/p>\n

Stay tuned for more Black Hat coverage here and at <\/em>Threatpost<\/em><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Car hacking is back and Charlie Miller and Chris Valasek no longer have to plug their computers into the cars to make them do their bidding.<\/p>\n","protected":false},"author":42,"featured_media":3779,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[740,749,268],"class_list":{"0":"post-3778","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-black-hat","9":"tag-car-hacking","10":"tag-vulnerabilities"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/car_hacking_goes_mobile\/3778\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/car_hacking_goes_mobile\/3872\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/car_hacking_goes_mobile\/4264\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/car_hacking_goes_mobile\/4518\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/car_hacking_goes_mobile\/4882\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/car_hacking_goes_mobile\/5646\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/car_hacking_goes_mobile\/4469\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/car_hacking_goes_mobile\/4882\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/car_hacking_goes_mobile\/5646\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/car_hacking_goes_mobile\/5646\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/black-hat\/","name":"black hat"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=3778"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3778\/revisions"}],"predecessor-version":[{"id":15889,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3778\/revisions\/15889"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/3779"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=3778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=3778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=3778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}