Watch remote hackers easily take control of this Jeep and more

guest · Jul 15, 2019

Tesla Awards Researcher $10,000 After Finding XSS Vulnerability
July 15, 2019
https://www.securityweek.com/tesla-awards-researcher-10000-after-finding-xss-vulnerability

Nebraska-based white hat hacker Sam Curry analyzed the software on his Tesla Model 3 and decided to insert an XSS payload in the “Name Your Vehicle” field in the car’s infotainment system.
The harvested information is then sent back to the user via a control panel.

The payload injected by Curry into the vehicle name field was triggered a few months later, after his windshield was cracked by a rock and he used the mobile app to contact Tesla support and set up an appointment to get it fixed.

“The thing that was very interesting was that live support agents have the capability to send updates out to cars and, most likely, modify configurations of vehicles. My guess was that this application had that functionality based off the different hyperlinks within the DOM,” Curry explained.
The researcher reported his findings to Tesla, which assigned the vulnerability the highest severity rating. A hotfix was pushed out by the company within 12 hours and Curry was awarded $10,000 for responsibly disclosing the flaw.
Click to expand...

guest · Jul 30, 2019

Hackers could use connected cars to gridlock whole cities
July 29, 2019
https://www.sciencedaily.com/releases/2019/07/190729111337.htm

The researchers want to expand the current discussion on automotive cybersecurity, which mainly focuses on hacks that could crash one car or run over one pedestrian, to include potential mass mayhem.
They warn that even with increasingly tighter cyber defenses, the amount of data breached has soared in the past four years, but objects becoming hackable can convert the rising cyber threat into a potential physical menace.

"[...] You don't necessarily have separate systems to run your car and run your satellite radio. If you can get into one, you may be able to get into the other," said Jesse Silverberg of Multiscale Systems, Inc., who co-led the study with Yunker.
Not all cars on the road would have to be connected, just enough for hackers to stall 20 percent of all cars on the road. For example, if 40 percent of all cars on the road were connected, hacking half would suffice.
Click to expand...

guest · Aug 2, 2019

Autonomous vehicle sensors tricked by "invisible" drone projections of road signs
August 2, 2019
https://www.scmagazineuk.com/autono...-drone-projections-road-signs/article/1592846

A group of researchers developed an attack to trick "Level 0" autonomous vehicle sensors by using drones which project images too quick for humans to see but slow enough for the vehicle’s sensors.
[...] were able to spoof various traffic signs including one that tricked the car’s sensors into believing false speed limits, according to the report.

Although the experiments posed no immediate threat with the Level 0 autonomy system, researchers stressed that the attacks would have greater consequences had they been carried out against more advanced systems and could make vehicles swerve, travel at unsafe speeds, and detour into unsafe territory.
Click to expand...

MobilBye: Attacking ADAS with Camera Spoofing (PDF - 4.41 MB): https://arxiv.org/pdf/1906.09765.pdf

Advanced driver assistance systems (ADASs) were developed to reduce the number of car accidents by issuing driver alert or controlling the vehicle. In this paper, we tested the robustness of Mobileye, a popular external ADAS.
Our experiments show that it is possible to fool Mobileye so that it interprets the drone carried spoofed traffic sign as a real traffic sign.
Click to expand...

ronjor · Aug 8, 2019

New cars 'can be broken into in 10 seconds'

BBC
Some of the UK's newest and most popular cars are at risk of being stolen in seconds by exploiting weaknesses in keyless entry systems.
The systems let drivers open and start their cars without taking their key out of their pocket.
Click to expand...

guest · Aug 10, 2019

A Remote-Start App Exposed Thousands of Cars to Hackers
August 10, 2019
https://www.wired.com/story/mycar-remote-start-vulnerabilities/

[...] Jmaxxz had the idea to buy her a remote starter that would connected to her car’s dashboard and, with an accompanying device and app called Linkr, allow her to start the car's engine with a tap on her phone.
A security-minded software engineer for a company he declined to name, Jmaxxz wondered what sort of remote hacking he might have left his girlfriend’s car susceptible to.

"In the back of my head I kept thinking, what’s the risk of this system, I’m putting her car on the internet," he remembers. "I told myself, 'ignorance is bliss. I’m not going to look at it. Don’t look at it.'"

In a talk at the Defcon hacker conference today in Las Vegas, Jmaxxz described a series of vulnerabilities in MyCar, a system made by Canadian company Automobility, whose software is rebranded and distributed under names including MyCar Kia, Visions MyCar, Carlink, and Linkr-LT1.
[...] But with any of three different security flaws present across those apps—which Jmaxxz says he reported to the company and have since been fixed—he says he could have gained access to MyCar's database backend, letting him or a less friendly hacker pinpoint and steal any car connected to the MyCar app, anywhere in the world.
Click to expand...

guest · Aug 11, 2019

Automakers warm up to friendly hackers at cybersecurity conference
August 11, 2019
https://www.reuters.com/article/us-...ers-at-cybersecurity-conference-idUSKCN1V10H9

Attendees who visited the car hacking site had to escape a vehicle by deciphering the code to open its trunk, control its radio volume and speed, and lock the doors through their computers.

“A big part of it is redefining the term ‘hacker’ away from that of a criminal to make automakers understand that we’re here to make their systems more secure,” said Sam Houston, senior community manager at Bugcrowd [...]
The conference provides a rare opportunity for enthusiasts to learn about car hacking, a resource-intense research field that requires specialized knowledge and lots of preparation.

Volkswagen AG VWOG_p.DE, Fiat Chrysler and suppliers Aptiv PLC (APTV.N) and NXP Semiconductors NV (NXPI.O) were among the sponsors of this year’s car hacking village - as some have done at previous DEF CON conventions.
More connections and technological features in modern vehicles also increasingly attract security professionals from other research areas, said Aaron Cornelius, senior researcher at cybersecurity company Grimm.
Click to expand...

guest · Aug 23, 2019

Video appears to show thieves stealing a locked Tesla in 30 seconds by tricking its computer into thinking they had the key
August 23, 2019
https://www.insider.com/locked-tesla-stolen-30-seconds-london-signal-relay-2019-8

Footage from a home in the UK posted on a user-generated video site appears to show hooded thieves stealing a locked Tesla in just 30 seconds by tricking the car's computers into thinking its key was nearby.
The homeowner uploaded the video on Newsflare and said that "it was absolutely shocking how quickly it went." He said the car was being loaned to his brother.

Business Insider cannot independently verify the video.
The thief did this by capturing its "passive entry" signal, which automatically unlocks the doors when someone approaches the car with the key.
Click to expand...

guest · Aug 24, 2019

Cisco released 4CAN hardware tool to find flaws in automotive computers
August 24, 2019
https://securityaffairs.co/wordpress/90317/hacking/4can-automotive-testing-tool.html

Computer systems in modern vehicles are very complex, they contain a huge quantity of devices and units that exchange a lot of data in real-time.
These components communicate via the vehicle’s network, dubbed Controller Area Network (CAN). Modern cars have multiple CAN buses combined with a gateway.

Cisco has released a new hardware open-source tool called 4CAN that aims to help the automotive industry in security vehicles.
Researchers could use 4CAN to test their on-board computers for potential security flaws, according to the company it is very easy to use.

The 4CAN tool is available on GitHub, licensed under a Creative Commons Attribution Share-Alike license.
Click to expand...

Cisco Talos: New 4CAN tool helps identify vulnerabilities in on-board car computers

guest · Aug 25, 2019

Hacker Claims He Can 'Immobilize 25,000 Cars' At The Push Of A Button
August 25, 2019
https://www.forbes.com/sites/thomas...mmobilize-25000-cars-at-the-push-of-a-button/

Every day millions of us rely on tech to protect our cars from thieves. Immobilizers, for instance, ensure only the owner of the right key fob can start the vehicle.
But now that technology has become a security threat, after hackers told Forbes they could lock down up to 25,000 cars at once. It's all thanks to a vulnerability (now fixed) that made it frighteningly simple to quickly take remote control of a car’s immobilizer and prevent drivers from starting their vehicle.
'We own your immobilizer'
Ken Munro, cybersecurity researcher and partner at Pen Test Partners, first described the hack to Forbes at the DEF CON convention in Las Vegas.
He found that it was possible to turn the immobilizer on and the car off by sending a simple request via a browser.
Click to expand...

ronjor · Aug 26, 2019

Senators Question NHTSA on Risks of Connected Vehicles

By Ionut Arghire on August 26, 2019
Two United States senators have sent a letter to the National Highway Traffic Safety Administration (NHTSA) to inquire about cyber-risks associated with connected vehicles.
In their letter, Senator Edward J. Markey (D-Mass.) and Senator Richard Blumenthal (D-Conn.), members of the Commerce, Science and Transportation Committee, also expressed concerns regarding the lack of publicly available information on the cyber-vulnerabilities associated with these automobiles.
Click to expand...

guest · Aug 27, 2019

Hackers Could Steal a Tesla Model S by Cloning Its Key Fob—Again
August 27, 2019
https://www.wired.com/story/hackers-steal-tesla-model-s-key-fob-encryption/

Two weeks shy of a year ago, researchers revealed a serious flaw in the security of Tesla's vehicles. With little more than some standard radio equipment, they were able to defeat the encryption on a Model S's keyless entry system to wirelessly clone the sedan's key fob in seconds, unlocking a car and driving it away without ever touching the owner's key.

In a talk at the Cryptographic Hardware and Embedded Systems conference in Atlanta today, researcher Lennert Wouters of Belgian university KU Leuven revealed that his team has again found a technique capable of breaking the Model S key fob's encryption. That would allow them to again clone the keys and stealthily steal the car.
But their analysis was convincing enough that Tesla has acknowledged the possibility of thieves exploiting the technique, rolling out a software fix that will be pushed out over-the-air to Tesla dashboards.
Click to expand...

guest · Sep 3, 2019

Car Trackers Could Let Hackers Track and Immobilize Vehicles
September 2, 2019
https://www.bitdefender.com/box/blo...aws-car-trackers-allow-tracking-immobilizing/

Statistics show that car trackers contribute significantly to lowering the car theft rate. The rate drops as much as 40% in countries where such devices are mandatory. But when developers ignore basic security practices, bad actors can use them to track vehicles, suppress alarms or steal personal information.

Security researchers from Pen Test Partners tested the SmarTrack, LoJack/Tracker and TrackStar devices used across Europe and found they did not verify whether commands come from a trusted source. In one case, this could even let an attacker immobilize a car mid-traffic and make it impossible to start again.
The app server of all these devices had trouble checking whether a command came from an authorized party. This could be exploited to affect thousands of cars.

SmarTrack is the only tracker of the three with a car immobilization function that prevents the car from driving.
Cars fitted with this device would no longer start after receiving the immobilize command; the owner must physically remove the immobilizer to start the car.
Click to expand...

guest · Sep 5, 2019

BlackBerry To Offer Cybersecurity For Future Jaguar Land Rover Models
September 5, 2019
https://auto.ndtv.com/news/blackber...y-for-future-jaguar-land-rover-models-2096228

Jaguar Land Rover and technology firm BlackBerry today announced the expansion of the companies' corporate partnership to develop next-generation intelligent vehicles for the carmaker. As part of the extended collaboration, the BlackBerry, a trusted security software and services company, will help JLR develop future-ready vehicle safety technology for the automotive market.

For instance, the BlackBerry QNX, an integrating software will be used to help develop Jaguar Land Rover's next-generation vehicle architecture, making it safer. On the other hand, its consultants and security testing technology, BlackBerry Cybersecurity Consulting services will help identify security vulnerabilities in connected and autonomous vehicles, across the full software library used in a vehicle.
[/qote]
Click to expand...

guest · Sep 9, 2019

Riding in Cars with Hackers
September 9, 2019
https://www.natlawreview.com/article/riding-cars-hackers

Imagine, however, that instead of threatening to take control of email accounts and other intangible products, hackers threaten to immobilise our cars. Tough luck if you rely on your car to get to work, or to drop off the kids at school, or to get to a medical appointment.

Critics may argue that the idea of a hacker immobilising a car is too sophisticated and beyond the capabilities of current-day hackers. You may even think this is just the domain of Hollywood movies like the Fast and the Furious franchise (not that we watch…actually never mind). However, the concept was put to the test by researchers at Pen Test Partners who demonstrated that by targeting a cars’ immobiliser – which functions to stop the engine of the car to prevent physical theft – they were able to immobilise 25,000 cars at once. This was independently verified as an accurate assessment.

A 2016 report has estimated that car data will be worth US$450-750 billion by 2030. The market for car data will only increase between now and then and so too will the ability to recognise and exploit its value. Unless security flaws are resolved, the vulnerability of this data threatens to disrupt everyday users from using their cars.
Would an impact on such tangible and functional aspects of our daily lives cause victims to respond more readily to ransom requests?
Click to expand...

guest · Sep 12, 2019

Preventing GPS spoofing is hard—but you can at least detect it
September 12, 2019
https://arstechnica.com/gadgets/2019/09/regulus-cybers-pyramid-gnss-software-detects-gps-spoofing/

Today at the IAA (International Motor Show) in Frankfurt, Regulus Cyber announced a new software-only GPS spoof detection product. This product, Pyramid GNSS, is what the company was hyping when it executed a Pied Piper attack on a Tesla Model S this June.

In the real world, you can look at this as downgrading an actual GPS hack to a simple denial of service. A navigation system protected by Pyramid GNSS would not be misled by false GPS data, but it still wouldn't have access to real GPS data either. Such a navigation system would be forced to make do with its other sensors (cameras, accelerometers, inertial navigation) as long as the spoofed signal was targeting it.

It's important to recognize what this solution isn't, of course. Pyramid GNSS does not enable a protected system to get correct positioning data when its GPS receiver is being spoofed—it just prevents the system from believing and acting on the false data.
Ars requested a test kit, but Regulus Cyber's attorneys denied it due to concerns around "teaching someone to hack GPS."
Click to expand...

guest · Sep 13, 2019

Security on the road: Locking down tomorrow’s connected vehicles
September 13, 2019
https://venturebeat.com/2019/09/13/security-on-the-road-locking-down-tomorrows-connected-vehicles/

According to Information is Beautiful, an average high-end car uses more than 100 million lines of code across its various computers. That’s double the codebase of Windows Vista. And do you think the automotive industry is more diligent about security than Microsoft?
Not according to a 2018 study conducted by the Ponemon Institute. Of 593 surveyed professionals responsible for contributing to or assessing the security of automotive components, 63% of them stated that they test less than half of the hardware, software, and other technologies for vulnerabilities.

The need for better cybersecurity practices in the automotive industry is only going to become more urgent as we accelerate into a world populated by advanced driver-assistance systems.
It’s time to get serious about security on the road
Fortunately, the word is out that tomorrow’s connected vehicles require a revamped approach to security.
Click to expand...

Automakers are painfully aware that security is an expectation, not a feature, and they’re building up their own cybersecurity teams. Companies like Synopsys are augmenting those efforts by helping develop, implement, and verify security initiatives.
Click to expand...

Minimalist · Sep 14, 2019

Volkswagen’s bold plan to create a new car operating system

The cars we drive are increasingly defined as much by the software they run as their engines or chassis. It started slowly. Discrete electronic control units started to appear under the hood, controlling fuel management or anti-lock brakes. New functions required new code, run on new little black boxes, metastasizing to the point where today, a new car might have up to 70 different modules, with software from as many as 200 different vendors. If that sounds like a recipe for disaster, it can be. Which is why Volkswagen Group—parent company to brands like VW, Audi, and Porsche—is saying "enough!"
Click to expand...

https://arstechnica.com/cars/2019/09/volkswagen-audi-porsche-vw-group-plans-one-os-to-rule-them-all/

guest · Sep 20, 2019

Once hacked, twice shy: How auto supplier Harman learned to fight cyber carjackers
September 20, 2019
https://www.reuters.com/article/us-...arned-to-fight-cyber-carjackers-idUSKBN1W517K

When researchers remotely hacked a Jeep Cherokee in 2015, slowing it to a crawl in the middle of a U.S. highway, the portal the hackers used was an infotainment system made by supplier Harman International.

Harman, now part of Samsung Electronics, has since developed its own cybersecurity product, and bought Israel-based cybersecurity company TowerSec for $70 million to help it overhaul manufacturing processes and scrutinize third-party supplier software.
The expensive efforts have prevented another public breach and helped it become a key player in automotive cybersecurity, but they show the strain suppliers and automakers face in dealing with this new dimension of automotive technology.

“It’s really shifting the burden onto the suppliers because the automaker is not able to test and verify everything along the supply chain,” said Dennis Kengo Oka, senior solutions architect at Synopsys Inc, who conducts research on automotive cybersecurity.
Click to expand...

guest · Oct 9, 2019

How easy is it to hack a car?
Security experts warn too much technology in cars
October 9, 2019
https://www.wptv.com/news/science-tech/how-easy-is-it-to-hack-a-car

Internet and security expert Alan Crowetz took us on a drive in his fully-equipped car. Ironically, he warned of how easily it could be hacked.
"What kind of vulnerability does that expose me to?" he said as he showed WPTV the Alexa auto device in his car.

"There is a risk with (that type of technology), and hackers love to find these kinds of things," said Crowetz. "If they can control your systems, perhaps they turn your gas mileage down to nothing. Perhaps they track where you are, when you are coming and going. There are safety concerns. They can make the car slam its breaks on, deploy the air bag."
He explained he's wary of technology.

"The more you start intertwining technology into anything, it’s opportunity for people to access, hack," said Bernard.
Click to expand...

guest · Oct 9, 2019

Dozens of documents remain sealed in Chrysler hacking class action; Magistrate compliance with discovery requests
October 9, 2019
https://madisonrecord.com/stories/5...magistrate-compliance-with-discovery-requests

Chrysler shared its science with plaintiffs in a half secret class action over the vulnerability of its vehicles to hacking, yet it needed a court order to find out where plaintiffs took their vehicles for maintenance.
U.S. Magistrate Judge Reona Daly ruled in Chrysler’s favor on Oct. 2, requiring plaintiffs to supplement their responses to document requests.

He sued Chrysler in 2015, after Wired magazine reported that remote hackers gained access to a Chrysler vehicle under controlled conditions.
They seek damages not only from Chrysler but also from Harman Industries, maker of UConnect information devices that the hackers exploited.
Click to expand...

guest · Oct 18, 2019

As car manufacturers focus on connectivity, hackers begin to exploit flaws
October 18, 2019
https://www.helpnetsecurity.com/2019/10/18/connected-cars-target/

Widespread cloud connectivity and wireless technologies enhance vehicle functionality, safety, and reliability but expose cars to hacking exploits.
In addition, the pressure to deliver products as fast as possible puts a big strain on the security capabilities of cars, manufacturing facilities, and automotive data, a IntSights report reveals.

“The automotive manufacturing industry is wrought with issues, stemming from legacy systems that can’t be patched to the proliferation of vehicle connectivity and software as consumers demand more integration with personal devices and remote access,” said Etay Maor, Chief Security Officer, IntSights.
Click to expand...

IntSights: Under The Hood: Cybercriminals Exploit Automotive Industry's Software Features

ronjor · Oct 21, 2019

Georgia court rules police need a warrant to get data from your car

Jon Fingas, @jonfingas 21 oct 2019
Your connected car data might be safer from prying eyes -- Georgia's Supreme Court has ruled that police need a warrant to obtain personal data from cars. The decision overturns an earlier state Court of Appeals ruling that defended police obtaining crash data from a car in a vehicular homicide case. The state and appeals court "erred" by claiming that the data grab didn't violate defendant Victor Mobley's Fourth Amendment rights protecting against unreasonable searches and seizures, according to the Supreme Court.
Click to expand...

guest · Oct 23, 2019

Who's Responsible When Your Car Gets Hacked?
October 23, 2019
https://www.rand.org/blog/rand-review/2019/10/whos-responsible-when-your-car-gets-hacked.html

In the future, when cars can drive themselves, grand theft auto might involve a few keystrokes and a well-placed patch of bad computer code. At that point, who will be liable for the damages caused by a hacker with remote control of a 3,000-pound vehicle?
Cars are becoming “fast, heavy artificial intelligences on wheels,” a recent RAND report cautioned—and that means they're becoming vulnerable.

The FBI has since warned that hackers could exploit many of the electronic selling points of modern cars, from their internet radios to their critical control systems. Mercury Insurance even has a tool on its website: “How hackable is your car?”
Anderson's new study looks at how courts might assign blame if a hacker taps into an autonomous vehicle and causes trouble. That could be the nightmare scenario, a hacker cutting the brakes, commandeering the wheel, and steering the car into a collision. But it also could be a hacker swiping personal information from a car's driver logs; or threatening to disable a car's electronics if its owner doesn't pay a ransom.

If the hacker gets away, who else might expect a lawsuit?
Click to expand...

ronjor · Oct 31, 2019

How Hackers Exploit Automotive Software to Overtake Cars

October 31, 2019
Cybersecurity firm IntSights recently released, "Under The Hood: Cybercriminals Exploit Automotive Industry's Software Features," study details how hackers are managing to get into cars and do damage.
Click to expand...

ronjor · Nov 7, 2019

Black Hat Q&A: Hacking a '90s Sports Car

By Alex Wawro 11/7/2019
Security researcher Stanislas Lejay offers a preview of his upcoming Black Hat Europe talk on automotive engine computer management and hardware reverse engineering.
Click to expand...

Log in or Sign up

Watch remote hackers easily take control of this Jeep and more

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

Watch remote hackers easily take control of this Jeep and more

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Useful Searches