Hackers to demonstrate exploits against CAN bus and OBD2

[MoreBeer]

https://mocana.com/blog/2013/06/26/charlie-miller-to-hack-cars-at-defcon-21/

As our cars have gotten smarter, there has been a lot of attention to the onboard electronics lately. Famous Apple "hacker" Charlie Miller is going to demonstrate exploits against 2 vehicles at DEFCON 21 (A computer security conference) in Las Vegas this summer. The abstract specifically mentions reading and altering CAN bus as well as OBD2 functionality. After seeing the decked out electronics and UCONNECT in the Gen V, this is something I have been wondering about for a while now... Especially if there is an attack vector via the UCONNECT WIFI hotspot!

I am curious what it may also mean to the previous gen's. I go to DEFCON almost every year, so I will make sure to attend these sessions. Anyone else?

https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Miller

https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Staggs

Personally I am happy to see these kinds of research being done and presented. The vast majority of security researchers practice Responsible Disclosure, ie informing the companies what they have found and are planning to present months in advance. In most cases, the companies are receptive to the free consulting and try to patch or fix their product before the talk. In other cases (Boston transit), they subpoena, arrest, and prosecute the researcher to keep their dirty secrets hidden.

 

[Fatboy 18]

Please keep us posted on the outcome

 

[ViperSmith]

I am in the infosec world myself. I would never enable the WiFi on your car. It is too big of an attack vector.

Granted, I don't really see anything happening, but - still.

 

[Grisoman]

Saw this story on the news last week: http://arstechnica.com/security/201...tery-car-unlocking-device-has-police-stumped/

 

[Bugman Jeff]

PBS's NOVA ScienceNOW did an episode about hacking a year or so ago. The researcher they followed, Tadayoshi Kohno, was able to hack into a car and remotely, unlock it, start it up, and worst of all, activate the brakes through the ABS system. Scary stuff. You can see it about starting about half way through the video here:
http://www.pbs.org/wgbh/nova/tech/tadayoshi-kohno.html

 

[DrumrBoy]

Not to be a complete ******* (which I am IT-wise), is in-car wifi for picking up signals from devices really close (like your iPod or phone) or for getting signals from the air closeby?

 

[spartan]

id imagine its for "in the car" but the range im sure could be extended.

 

[MoparMap]

I think the in-car wifi basically turns your car into a mobile wifi hotspot so other devices can connect to the internet, similar to the little hotspots Verizon sells. I think it essentially just converts a cell signal into wifi for devices that can't operate on the cell signal to start with. So your car effectively becomes a cell phone that broadcasts a wifi signal.

 

[Coloviper]

Sounds like the perfect government excuse to force ODB-III on everyone. I would not buy into the hype of the scare. Once the Regs get their way with ODB-III, kiss the automobile as a freedom machine goodbye. ODB-III is pure communism and pure evil. ODB is bad enough considering the government taps into your computer for emissions anyway.

 

[ViperSmith]

I am also going to hack the UConnect App for the iPhone soon and see if it is actually secure or not. See if I can exploit the lock/unlock on my 2013 Viper. Seems to store the PIN locally from what I can tell, so that isn't good.

 

[MoreBeer]

Paros Proxy or Burp suite and i-funbox should be a good start.

I would imagine if you can manage this and disclose to SRT then publicly you would be getting some decent street cred