Researchers Hack Corvette Via SMS

A vulnerability ( pdf ) in a dongle which is used by insurance companies and fleet managers to monitor cars remote makes it possible for attackers to operate all kinds of parts via SMS. That the researchers today at the Usenix Security Conference show in Washington.

The C4 OBD2 dongle of the French Mobile Devices makes it possible to monitor the location, speed and efficiency of vehicles. The devices are plugged into the diagnostic port (OBD-II) of the car, that is usually located under the steering wheel.The device features a GPS receive, mobile phone chip and onboard microprocessor. If the car driving is the dongle communicates with CAN bus of the car. This is the internal network that controls the physical components of the car.

The dongle then sends information from the car via the GSM network to the provider. Researchers at the University of California managed by sending text messages to the dongle to control the CAN bus of the car. For their demonstration, the researchers used a red Corvette, as in the video below shows. Via text message, they could eventually turn the brakes and turn off and turn on the windshield wipers.

Update

The US insurance company which distributes the Metro Mile dongles in the US was warned in June by investigators for the leak. Both Mobile Devices as Metro Mile argue that they have rolled out an update that automatically over-the-air is installed.The CERT Coordination Center (CERT / CC) at Carnegie Mellon University warns that there is no way to verify that the update is installed.

Users who do not know whether their dongle is vulnerable therefore be advised to remove the device until the update can be confirmed. Through the leak, an attacker can cause damage to the car or provide human injury, according to the CERT / CC.According to Wired would still driving thousands of vulnerable cars, mainly in Spain.

Tesla Model S Patches Vulnerabilities Via Update

Cars manufacturer Tesla is well protected against hacking, according to two researchers who eventually painstakingly did manage to hack a Tesla Model S. Marc Rogers of CloudFlare and Kevin Mahaffey of Lookout Mobile found a total of six vulnerabilities in the Tesla, as they leave today via a blog posting know. The two researchers will present their findings this week at the Def Con conference presenting in Las Vegas.

For the study, about two years confiscated, they had to get the car literally falling apart. Through the vulnerabilities they had full control of the infotainment system of the vehicle. They then installed malware was remotely controlled and which they could carry out all actions that could also be implemented through the touchschreen or smartphone app of the Tesla. Thus it was possible to switch from the car while it was driving, so the examiner opposite Forbes know.

In addition to the required physical access to the researchers discovered that it was possible to attack the remote infotainment system. The system used a vulnerable browser, with a four year old WebKit vulnerability, reports Wired . This allows an attacker would the car remotely attacks as a Tesla user from the car a malicious website would visit. In this case it would also be possible to start the engine remotely or turn off.

However, the researchers discovered that Tesla had introduced a security measure. In case the engine is switched off when the car is driving, the brake is activated and stop the car if the speed falls below 8 km per hour. The researchers reported the problems to Tesla, which has delivered an update. Unlike Chrysler, which because of security issues had to recall 1.4 million cars so that they could be updated using a USB stick, Tesla updates brings "over-the-air" and require customers to bring their vehicle back to the dealer. However, they must accept the update, because there is no automatic installation location.

Chrysler Raises 1.4 Million Cars Back Because Of Vulnerability

Carmaker Chrysler raises some 1.4 million cars and trucks back because of a vulnerability in the software that allow attackers over the internet can access the vehicles. It is then possible to switch on the brakes, to turn off and to turn off the motor at low speeds.

The vulnerability was by researchers Charlie Miller and Chris Valasek discovered . The problem is in Uconnect, a component that gives the cars online capabilities and that the entertainment and navigation are operable. The functionality even offers a wifi hotspot and makes phone calls possible. Uconnect allows anyone with a vehicle connection as long as the IP address of the car is known.

After the connection was made with a car, the researchers succeeded in order to adapt the firmware of the system. This custom firmware can then send instructions via the internal network of the car to the physical components such as the engine and the wheels.

Recall

After Chrysler nine months ago was informed, was the manufacturer on July 16 with a security update . The update must be installed via a USB stick by car owners. The fear was that many owners would not do this. Therefore Chrysler now launched a voluntary recall, let the manufacturer through their own website to know. It is about 1.4 million vehicles. According to Chrysler there are no attacks still in the "wild" that have been observed using the vulnerability.

The problem is present in the MY Dodge Viper and different models of RAM pickup, the Jeep Grand Cherokee and Cherokee SUVs, Dodge Durango SUVs, different My Chrysler and Dodge Charger sedans and Dodge Challenger sports coupe.Customers of an affected vehicle will have received a USB device that they can use to upgrade the car software. The upgrade not only resolves the vulnerability, but also adds additional security measures, according to Chrysler.