Car hackers mess with speedos, odometers, alarms and locks

Powered by SC Magazine
 

Produce cheap, open-source and modular hack tool.

If you lend your car to Ted Sumers and Grayson Zulauf, there's a good chance it'll never work the same again. You might even get it back on a tow truck.

The duo weren't street hoons but rather a pair of capable hardware hackers who know how to mess with a car's speedometre, brakes and alert systems.

They were the latest in a burgeoning scene of academics and security boffins who along with a thriving but fragmented assortment of rev-head hobbyist geeks are battering the digital fabric powering modern-day cars. 

When Sumers and Zulauf began their research, they did not let the lack of computer documentation, the exorbitant costs of proprietary computer analysis kits or tight-lipped mechanics stop them.

Speaking at the Breakpoint security conference in Melbourne, the researchers from automtive startups Automatic and Motiv Power Systems told how together with Chris Hoder of Microsoft the trio set off to discover how the digital bits flew around Controller Area Networks (CANs) embedded into many cars in use today.

With physical access to the cars the men were able to make vehicles appear to drive slower than actual speed, manipulate brakes, alarms and unlock doors. They could also increase a car's odometer and with further research wind it back.

Other researchers have accessed car networks via bluetooth and developed ways to compromise autos through firmware.


The capabilities of CAN hacking were vast. In August, researchers Charlie Miller and Chris Valasek tapped into CANs to cut the brakes of a Ford Escape and caused the wheel of a Ford Focus to jerk out of the hands of a driver at high speed.

Other hobbyists have used CAN bus hacking to alter functions such as the fuel injection levels of cars with some creating legitimate car customisation businesses using their skills.

Criminals too have benefitted. Sumers said recent years a criminal gang sold a device they created to unlock doors for pricey Audis via a port that remarkably could be accessed from an exterior panel on the vehicle. A spate of car thefts resulted until their arrest.

But much of the important parts of the research needed to start hacking CANs was not available, the researchers said.

This forced them in their bid to deliver a project for the University of Dartmouth and open the field to others to effectively "start from ground zero".

After initial trial and error -- and the purchase of a second car -- they gained access to the CAN and began fuzzing against to identitfy which of the arbitration ID packets were sent to particular components of the vehicle such as the speedometre, brakes and dashboard indicators.

"The car started making horrible noises -- every light on the dashboard was blinking," Zulauf said.

"If you do this yourself you might want to use a friend's car," Sumers added.

Like other consumer products such as smart TVs and network-connected white goods, most vehicles were designed for functionality and paid little or no homage to security. The trio, for example, found that CAN transmissions contained no authentication requirements because car designers built the architecture with the intent it would operate in closed secure environments.

Sumers said manufacturers would unlikely be able to introduce authentication because it would slow down the CANs too much.

Indeed Ford and Toyota have not moved to fix the weaknesses, saying that the hacking scenarios were academic and did not place drivers at risk.

The CANs also ran as single networks within all but the high-end vehicles -- notably the "over-engineered" German autos -- meaning that their fuzzing efforts were easier.

Their fuzzing processes worked by a system of sniffing, searching and probing using Travis Goodspeed's GoodTHOPTER10. They would monitor CAN packets, find those that appeared interesting and then seek out what systems within the cars that they controlled.

Breakpoint 2013 Inside car CAN hacking by Darren Pauli on Mixcloud

The trio were keen for others to enter the hacking field and have produced a $25 open-modular source hardware tool for reading CANs that has the capability of those worth tens of thousands.

"The more people play with it, the better it will get," Sumers said, adding that he was keen to learn how different CAN implementations were.

Copyright © SC Magazine, Australia


Car hackers mess with speedos, odometers, alarms and locks
 
 
 
Top Stories
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
Will Nutanix be outflanked before reaching IPO?
VMware muscles in on storage startup in hyper-converged infrastructure.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  11%
TOTAL VOTES: 603

Vote