Can Your Car Be Hacked?

JockVSJock

This is a new field of infosec and I haven't put much thought into this, other then I have bluetooth in my car and I use it everyday.

https://www.lewrockwell.com/2016/04/jerry-reynolds/can-car-hacked/

Here is some basic security from the article:

First and foremost, watch for recalls that strengthen your car’s cyber security. Check your VIN at safercar.gov on a regular basis, and watch your manufacturer’s website for information. Sign up for information on the automaker’s website if it discovers a hacking incident. Ironically, some of these updates can be done remotely.

clarson

yes your car can be hacked. Because it is all about getting the product to market and making money. Doing security right takes time and money to do. And, most customers don't care until it is happening to them. And, if it isn't a quick software fix it isn't getting fixed until people are dying. Such as GM, they would rather put their customers in the hospital or a coffin instead of spending 50 cents to fix a key. then pay teams of lawyers to use every trick there is not to pay for your injuries. So, the only people getting paid a lot for this is going to be insurance companies and lawyers.
I'd bet there is already some legalese in the small print about limiting their liability and anyone seeking damages has to go to an arbiter. Probably someone in Flint, MI that thinks poisoning 100,000 people is an acceptable risk.

636-555-3226

People ask me these kinds of questions all the time. I tell them anything that has a computer in it can be hacked. Then I get the dumb look and explain to them that there is indeed a computer in their car. Sometimes even multiple computers.

scaredoftests

It is kind of scary that some people don't realize there are computers in their cars.

markulous

Along with safety ratings, this is probably the first thing I'll be looking at when I purchase a vehicle within the next few years.

What is the security like on the car?
What features can I disable for more security?
What type of fail-safe is there if it does get hacked?

Hoping by then more information will be out to make an educated decision on which vehicle is the most secure.

wastedtime

I feel like I am a very security minded person so I think my next vehicle should be a 1968 Chevelle SS with a 427.

scaredoftests

wastedtime wrote: »

I feel like I am a very security minded person so I think my next vehicle should be a 1968 Chevelle SS with a 427.

68 baby blue mustang...

Edin

A lot of these cars are susceptible to replay attacks, which, for a security oriented person are pretty easy to do!

alias454

David Hasselhoff never had this kind of trouble with kit.

kiki162

There's a class on this at BlackHat this year

https://www.blackhat.com/us-16/training/car-hacking-hands-on.html

Nans

Look at those road side JEEPS on interstates which were hacked when they are at cruising speeds...scary and I read about those a couple of times.. well there will days when even a toilet flush can be hacked with IoT revolutionizing everything.. be prepared for the the unprepared flushes lol

clarson

security is an afterthought and devices are often unpatchable:
​Linux founder Torvalds on the Internet of Things: Security plays second fiddle | ZDNet

The small legalese removes the liability from the manufacturer if your hacked or lose data:
Oculus Rift's privacy policy says it's not liable if it's hacked | ZDNet

and if it becomes a problem for the manufacturer, they just brick your device so you can buy brand new one with updated security:
Nest to deliberately brick old smart hubs | ZDNet

Lots to be said for the productivity gains with new devices. Not much to be said about your security, privacy, or for how long the device with be usable.

markulous

"Not liable if it's hacked". That's such a crock. I saw an article today on SC Magazine stating that a large percentage of C-level execs have the same mindset. Let me ask this, if a bank leaves all of it's doors unlocked and it's vault wide open with no one there to monitor it, are they not liable if people walk in and grab bags of cash?

I'm normally not a guy that wants to get the government involved in capitalist ventures, but with the way things are now days, I think we almost have to have laws set in place so they can stop saying this and actually put some effort towards security. I'll boycott any of these products that have these kinds of jokers sitting behind them.

TechGromit

I don't think so, at least not remotely. I don't have a model car that supports wi-fi or wireless access.

clarson

And, here are the guys that should be looking out for you
U.S. Government 'Worse Than All Major Industries' on Cybersecurity - NBC News
http://www.zdnet.com/article/how-hackers-can-listen-in-on-your-calls-and-read-your-texts/?tag=nl.e589&s_cid=e589&ttag=e589&ftag=TREc64629f

NOC-Ninja

This hacking has been there for awhile. Actually, a lot of security people have been screaming about this.
Look for Michael Hasting hack.

clarson

Why the Internet of Things is the next target for ransomware | ZDNet
http://www.zdnet.com/article/three-years-until-connected-cars-are-cyber-attack-proof/
http://www.zdnet.com/article/does-connecting-your-phone-to-your-car-open-up-new-security-risks/

clarson

with the Nice truck killings
you now can have a front row seat to a terrorist action. Complete with police firing squad.

Automakers Turn to Hackers for Help in Improving Cybersecurity - NBC News

volunteer hackers are so much better then actual security professionals that you have to pay.