Quote:Driving a Jeep today? Not to worry you, but unless the car has been updated in the last week, there’s probably a vulnerability or two in the vehicle, as there are in as many as 471,000 Chrysler automobiles, which could be abused by hackers sitting in front of a laptop anywhere on the planet.

Wired
Hackers Remotely Kill a Jeep on the Highway—With Me in It
Two hackers have developed a tool that can hijack a Jeep over the internet. WIRED senior writer Andy Greenberg takes the SUV for a spin on the highway while the hackers attack it from miles away.

According to researchers Chris Valasek of IOActive and Charlie Miller, a former NSA staffer, there are issues in the Uconnect system that provides the connected infotainment and other internet-powered systems in Fiat Chrysler automobiles. They were able to create attacks that could connect to that system, jump over to a chip powering the in-vehicle entertainment and rewrite the firmware on that little piece of hardware. From there, their exploit code could send commands across the car, from killing the brakes to shutting off the engine and playing with the steering, as shown in a video on Wired. It’s total car compromise.

Miller and Valasek were able to connect to the Uconnect system via an Android phone running on the Sprint network (only devices using the Sprint cellular network can “speak” with Uconnect). Using that phone, hooked up to a MacBook, they were able to scan for vulnerable vehicles too. After repeated scans, they believe as many as 471,000 vehicles are carrying the vulnerabilities the benevolent hackers uncovered.

Thus far they’ve only tested on a Jeep Cherokee, but they believe any Chrysler vehicle with Uconnect manufactured from late 2013, all of 2014, and early 2015 is affected. The long-time car hacking buddies plan to detail their full exploits at the Blackhat security conference in two weeks’ time in Las Vegas.

Pretty terrifying stuff and another example of a remote attack on a vehicle, which has been demonstrated before and will continue to be shown if car manufacturers continue to create insecure networks-on-wheels. But there is an update from Fiat Chrysler and drivers can either upload it to their vehicles by first downloading the patch onto a memory stick (via this link) and then plugging the device in, or taking it to a local dealership.

“Similar to a smartphone or tablet, vehicle software can require updates for improved security protection to reduce the potential risk of unauthorized and unlawful access to vehicle systems,” read the advisory accompanying the Fiat Chrysler release.

The company had not responded to FORBES’ request for comment at the time of publication, though Miller seemed satisfied with the patch.

“This is the type of vulnerability that is, or at least should be, looked out when doing a 3rd party review… That type of vulnerability isn’t specific to that Jeep and it is why it is important to have responsible disclosure policies,” noted car security expert and Open Garages founder Craig Smith.

Miller and Valasek’s findings should act as a clarion call to the whole automotive industry, which has been repeatedly criticised for shortcomings in security over the last year. Just this year, other researchers have demonstrated attacks on vehicles from afar, whilst highlighting vulnerabilities in widely-used insurance dongles that could provide leverage on a car’s network. At Defcon, a security conference taking place down the road from Blackhat in the same week, researchers also plan to show off remote attacks on a Tesla car.

Miller and Valasek have been tooting their horns about vehicular insecurities for the last two years, whilst Senator Ed Markey issued a report in February slamming major manufacturers’ response to the issue. At the same time, vehicle owners want the right to be able to hack their own cars to make modifications, but automotive manufacturers, in particular GM, want to stop that practice. In both departments, it seems they’re letting customers down.

Quote:Driverless cars promise to be safer than cars driven by humans… but that’s assuming they don’t get hacked by malicious actors. Hackers Charlie Miller and Chris Valasek recently used Wired’s Andy Greenberg as a human guinea pig for their latest experiment that involved taking over his car while it was driving at a high speed.

“I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold,” Greenberg writes, in a sly reference to Hunter S. Thompson. “Though I hadn’t touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass.”

Thankfully Greenberg wasn’t hurt by this attack, which he knew was coming at some point. That said, the fact that hackers figured out how to successfully pull off such an attack is fairly unnerving.

In short, Miller and Valasek have written code that can “send commands through the Jeep’s entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.” The hackers plan to give their research a full vetting at the big Black Hat conference in Las Vegas next month in what will surely be a highlight of the show.

Miller, in case you aren’t familiar with his work, has made a name for himself over the years by finding major exploits in NFC-based mobile payments technology, in Apple’s own App Store, and, yes, cars. He and Valasek started working in earnest on car hacking a couple of years ago and it seems their work has become frighteningly more advanced since then.

(Jul 21, 2015 09:25 PM)TheNakedEmperor Wrote:  watchdogs - real life edition

(Jul 22, 2015 08:22 PM)Dmitriy Wrote:  I'm surprised this site is called hack forums and nobody is giving a shit about the breaches and what's being effected. What the hell is this site about then?

(Jul 22, 2015 08:31 PM)Blаckhat Wrote:  👍 Money. 👍

(Jul 23, 2015 12:14 AM)Linkin Park Wrote:  Imagine if this got into the hands of terrorists, it would be absolute fucking chaos.

(Jul 23, 2015 01:03 AM)D3RP Wrote:  uh... brakes aren't connected to the vehicles entertainment system, nor are the windshield wipers. Sorry but this isn't real.

OH GOD. I just watched the video "watch as the hackers disable the breaks so that the car slides into the ditch"... NONE of this shit is even remotely available in the stock entertainment system, they clearly are doing POC to show that the vehicle can be 3rd party chipped (connecting to ecu) to allow control of these things, such as wiring it that way. this shit is pitiful.

leave it to the news skids to act like any jeep 2014 etc is vulnerable to some mass hacking by some keyboard warrior.. they dont mention that the 'hacker' would have had to have internal access to your car to install their shit.

(Jul 27, 2015 12:21 PM)Jhawkfootball06 Wrote:  If you would have read the wired article, you would have found out that upon connecting to the central dashboard, they were able to override the car's firmware and install their own, giving them access to features such as control of the gas/break pedal, control of steering, control of wipers, etc. All done remotely. These cars are not equipped with a "3rd party chip" as you said.

Everything in cars nowadays is all electric, even that gas and break pedal. And they are all connected to the central CPU. That explains how services such as OnStar can remotely disable your vehicle.

Please don't belittle people's accomplishments merely because of your own ignorance.