Hacking a Jeep

[tynopik]

But there surely should have been physical security. I.e. It can ONLY be accessed by physically plugging in something inside the car.

Making it (CAN bus) accessible via wi-fi (or similar) is asking for trouble.

They aren't making it directly accessible

the problem is EVERYTHING connects to the CAN bus

so the cellular module is on the CAN bus, just like the brakes, transmission, wipers, etc

it's not supposed to give you direct access to it, but they found a vulnerability . . .

 

[SunnyD]

I understand where you're coming from and I do not assume to speak for Chris and Charlie, but it's naive to think that someone who would willingly use this for evil isn't already fully aware of the potential for these kinds of issues. They don't need poc code, they'd just write it themselves. The vulnerability potential for cars has been publicly known and had information directly related to it published since 2011.

Casual script kiddie type hackers are not going to know how to use this information, and anyone capable of knowing what to do with it could have just written their own in my opinion.

We live in a world now filled with a ridiculous amount of things connected to the Internet... this is only the beginning. Companies need to take things more seriously and they just aren't. Good job security for me, but a bad situation in general.

While that's true, what they do is move the bar for entry into the realm of mischief (using that term very loosely) a lot lower. Script kiddie no, but there are a lot more people with a lot more knowledge, and yes as you said there's that thing called the internet out there. Making proof of concept widely available makes an exploit like this much, much more dangerous. It only takes one moderately interested party who didn't previously have access to the baseline work to take what they've done and go a lot farther with it than that person would have been able to get on their own.

 

[desertdweller]

I just don't understand how something like the brakes can be so tied into the electrical system that they're able to be triggered remotely. I understand how anything on the infotainment screen could be messed with (radio, AC, etc) but it just doesn't make sense why every electrical input on the vehicle would be accessed in the same way.

Anyway, this whole problem goes away if they stop sticking fucking modems in everything. I'd much rather them spend time figuring out how to connect to my phone's network vs. this current bullshit of turning cars into mobile hotspots. I don't want that, it'll never be as fast as my phone.

Anti-lock breaks are computer controlled. A tone ring on the end of the axle that sends a signal through the computer to the ABS system. Cars that can automatically park themselves already have most of the engine functions including throttle, breaks and steering controlled by the computer.

They will absolutely need to deal with this before self driving cars start hitting the markets.

 

[SOFTengCOMPelec]

They aren't making it directly accessible

the problem is EVERYTHING connects to the CAN bus

so the cellular module is on the CAN bus, just like the brakes, transmission, wipers, etc

it's not supposed to give you direct access to it, but they found a vulnerability . . .

I see, thanks, that makes a lot of sense suddenly.

Yes, once you have controlled any device on the CANbus, it can potentially pretend to be anything else, such as an external CAN (mechanics) tester. Allowing the hackers to mess about like crazy.

Yes, that could be very dangerous by the sound of it.

 

[Platypus]

They're not controlled through the electrical system. All of these devices are now controlled by various separate computers (control modules) located around the vehicle, and communicating over a common network using a serial protocol (the CAN bus).

Correct, this communication is possible in many models because the interconnections that exist allow messages to be passed between these separate components. The 'hack' is sending a legitimate message that would normally be sent anyway, just manually inserting that message into the bus. Other techniques like flooding this bus with illegitimate messages such that the real ones are drowned out can be used.

 

[Platypus]

While that's true, what they do is move the bar for entry into the realm of mischief (using that term very loosely) a lot lower. Script kiddie no, but there are a lot more people with a lot more knowledge, and yes as you said there's that thing called the internet out there. Making proof of concept widely available makes an exploit like this much, much more dangerous. It only takes one moderately interested party who didn't previously have access to the baseline work to take what they've done and go a lot farther with it than that person would have been able to get on their own.

Another angle to consider is that cars are very expensive, while not a silver bullet, this significantly reduces the availability of hardware to test and modify this kind of code on. It's trivial to get a rental car for example, but it will take a lot more effort, time and money than most other equipment would to test on and you can seriously damage or render it inoperable to the average user who has no experience in fixing such things.

 

[SOFTengCOMPelec]

Other techniques like flooding this bus with illegitimate messages such that the real ones are drowned out can be used.

That shouldn't be TOO bad, because the car designers, will have taken that into account, when they designed the safety systems on the vehicle.
The CANbus is just a bunch of cables, which can open/short circuit, or break at any time. So the separate units are designed to work (safely) without the CAN working.
But it might cause some units to be forced to partly reduce functionality and/or go into fault shut down.

 

[Platypus]

That shouldn't be TOO bad, because the car designers, will have taken that into account, when they designed the safety systems on the vehicle.
The CANbus is just a bunch of cables, which can open/short circuit, or break at any time. So the separate units are designed to work (safely) without the CAN working.
But it might cause some units to be forced to partly reduce functionality and/or go into fault shut down.

It does work, and it IS bad...

If you keep the legitimate messages from receiving their targets you can just sustain a DoS against the component to keep control.

 

[Markbnj]

But there surely should have been physical security. I.e. It can ONLY be accessed by physically plugging in something inside the car.

Making it (CAN bus) accessible via wi-fi (or similar) is asking for trouble.

Yeah I'm not arguing that it's a great design, but what Platypus said is the most relevant point: the cars on the road today were designed 3-5 years ago. It's a slow moving business.

 

[Markbnj]

They will absolutely need to deal with this before self driving cars start hitting the markets.

Remote kidnappings. Target is tooling along reading a blog, suddenly door locks, cell phone is disabled, car drives to dark warehouse down by docks. Ta da!

 

[SOFTengCOMPelec]

Yeah I'm not arguing that it's a great design, but what Platypus said is the most relevant point: the cars on the road today were designed 3-5 years ago. It's a slow moving business.

I guess the quick solution (already mentioned in this thread, I think) would be to remove the cellular/wi-fi/radio part of it and/or disconnect it from the CANbus devices.

It sounds to me, like they should have considered using a discrete, point to point connection, rather than something connected to the CANbus. To massively reduce the risk of external hacking.

The huge timescales are a big factor. But if this vulnerability was started to be used by hackers, to cause accidents, steps should/would have to be taken, to remove this vulnerability now, rather than in 5+ years time.

 

[SOFTengCOMPelec]

It does work, and it IS bad...

If you keep the legitimate messages from receiving their targets you can just sustain a DoS against the component to keep control.

I agree.

(If) They are malicious hackers, then they could mess about like crazy. Causing all sorts of problems, with whatever the CANbus is capable of achieving.

But to put things into perspective, we often see in the movies, criminals cutting the brake pipes on cars, and then the driver being killed, later in the movie.

In practice (since a criminal really could cut your brake pipes), a mechanical hacker, if you like, could be done now (and for a long time).
Yet I can't recall a single news item (going back a long time), where this has been done in practice.
Partly because the driver would probably notice the failing/bust brakes, long before they need to use them to avoid a collision.

I.e. Fortunately most people are not psychotic/homicidal maniacs.

 

[MarkXIX]

probably something that reports over OBD and is easily checked against a vendor provided list

in fact, it will probably be automated where it just plugs in and gives a green light if it's current

Who is ready to develop and sell THAT product? I'm in!

 

[destrekor]

there's two different parts

1. releasing redacted code after the vendor has been notified and had time to develop a fix: perfectly fine

2. demonstrating on a live highway: not fine at all

Yeah, I found the demonstration far more risky than they let on, and the driver certainly agreed and did panic slightly. An established test track or large open parking lot should have been used for this purpose. They realized they should when cutting the brakes, I think they just didn't actually think through the true risk potential. He was physically safe, but you cannot account for the perfect reactions of all other motorists on an otherwise smooth-flowing highway when encountering a slowed vehicle. Perhaps he and immediate cars would have been fine, but some hard braking could have actually induced a crash a quarter or half a mile back. One bad driver with bad reactions or distracted by phone or head unit would have been all that was necessary. Nobody typically expects to come upon a vehicle going 20mph when everyone else is going 60mph. Had that happen recently and that actually scared me a little, it was broad daylight thankfully, but I feared it would have caused an accident and kept an eye behind me to see if anything happened once I got myself far away from that risk.

As for public release of potentially very harmful code: I'm fine with it when it is handled properly, that is, they give the original developers more than enough time to address the issue. Public release serves not only as a means to give real black hat hackers a tool to do devious things, but more importantly, give code to the community so that more people can take the idea, find additional holes elsewhere, and help implement fixes. Many white-hatters follow the black-hat community so that they can help develop fixes with original developers so that the public risk is minimized.

As long as they give Chrysler plenty of time, and also help extensively with creating a fix, I find zero issue with that idea. The key thing here is it does not require a trip to a service center. It only requires creating a USB disk and plugging that into the car, and following a few on screen directions.

Ideally, Chrysler would mail out pre-loaded USB disks to all registered owners, and do as much as they can otherwise to get the warning to everyone who needs it and provide thorough instructions. I suspect they'll at least do the latter, but I'd love to see them take on the former concept. It's a small cost to chiefly maintain public safety, and it also maintains customer loyalty. It's a small touch with truly a very small cost for such a large corporation, especially compared to the potential lawsuit costs if anyone were to become a victim to the security flaw.

 

[BUTCH1]

If it can be done to a Cherokee it probably can be done to a Hellcat. Now you can remotely unleash 707 HP, this will end badly!.

 

[destrekor]

If it can be done to a Cherokee it probably can be done to a Hellcat. Now you can remotely unleash 707 HP, this will end badly!.

Oooo... scary badass awesomness.

 

[Ichinisan]

I'm confused. If they're presenting at a conference for "black hat" hackers, why did they cooperate at all with the vehicle manufacturer?

Sounds like an identity crisis. Are they black-hat or white-hat?

 

[destrekor]

I'm confused. If they're presenting at a conference for "black hat" hackers, why did they cooperate at all with the vehicle manufacturer?

Sounds like an identity crisis. Are they black-hat or white-hat?

It is common. The Black Hat Conference is less about hardcore black hat activity and more about distributing the latest intel in infosec.
see: https://www.blackhat.com/about.html

 

[ultimatebob]

From what I've read, the UConnect system cannot be updated OTA. It requires a USB download, which would probably take months to complete through dealers once Fiat Chrysler issues a recall.

Most people probably wouldn't even bother to install it themselves it until someone gets hacked and ends up in a crash.

 

[destrekor]

From what I've read, the UConnect system cannot be updated OTA. It requires a USB download, which would probably take months to complete through dealers once Fiat Chrysler issues a recall.

Most people probably wouldn't even bother to install it themselves it until someone gets hacked and ends up in a crash.

They already said it is something that can be done at home by the end user, it does not require a service visit.

The said, how long until people are advised and can find someone who can do it "because I ain't so good with computers. Those steps there look like a foreign language."
I think it would behoove Chrysler to ship out disks to all registered owners, but fat chance that'll happen. Hopefully they can push the message out to all owners and stress the urgency of the situation.
The other issue is that we are still at a point where not everyone actually owns a computer.

 

[marvdmartian]

That's what I like about my 'dumb' Wrangler. The only option on it is the A/C. No power anything, no fancy electronics in the dash. Hand crank windows and manual door locks.

Hack that, bitches!

 

[Markbnj]

That's what I like about my 'dumb' Wrangler. The only option on it is the A/C. No power anything, no fancy electronics in the dash. Hand crank windows and manual door locks.

Hack that, bitches!

What year is it? Even basic vehicles still have the same bus and controller architecture.

 

[Hugo Drax]

Not to worried about my weekend jeep (2004) The one with the AMC based inline 6 engine.

 

[gorcorps]

They already said it is something that can be done at home by the end user, it does not require a service visit.

The said, how long until people are advised and can find someone who can do it "because I ain't so good with computers. Those steps there look like a foreign language."
I think it would behoove Chrysler to ship out disks to all registered owners, but fat chance that'll happen. Hopefully they can push the message out to all owners and stress the urgency of the situation.
The other issue is that we are still at a point where not everyone actually owns a computer.

Even people who are good with computers might struggle. I've applied a couple updates to my Grand Cherokee, and their website to download the update is so fucked up it only worked in IE in compatibility mode. It took me several tries before I figured out that it wasn't working right in Chrome. It's a shitty website.

 

[Exterous]

But to put things into perspective, we often see in the movies, criminals cutting the brake pipes on cars, and then the driver being killed, later in the movie.

In practice (since a criminal really could cut your brake pipes), a mechanical hacker, if you like, could be done now (and for a long time).
Yet I can't recall a single news item (going back a long time), where this has been done in practice.
Partly because the driver would probably notice the failing/bust brakes, long before they need to use them to avoid a collision.

I.e. Fortunately most people are not psychotic/homicidal maniacs.

Your example isn't a great one because it requires localized access to individual vehicles. Thus the maniac has to be local. With the new Chrysler issue the maniac doesn't have to be anywhere near the vehicle. I can think of more than a few groups world wide that would love to suddenly disable the breaks on ~500,000 vehicles. Its also going to be harder to notice failing breaks a head of time when they suddenly stop working while you are on the highway