McAfee: Cyber thugs will turn your car into Christine Poorly secured embedded systems in next-generation cars create a way in for hackers, according to a new study by McAfee. Hackers may be able to gain access everything from the locks to car engines and more, according to a report titled Caution: Malware Ahead that looks at the emerging risks in car system security. McAfee, …
"Researchers have demonstrated that critical safety components of an automobile can be hacked, given physical access to the vehicle’s electronic components."
Well duh! Guess what, if I can get at your engine then I can give you a pretty good denial-of-service with a pair of wirecutters. Or I can nail the throttle half-closed and stop you getting any decent power, or I can nail it fully open and make you fail emissions regs.
Feckwits.
Tis important that they highlight these risks to ensure manufacturers start taking responsibiity for security. The potential rewards will be an enormous incentive for people to work out how to hack these systems.
By the way, presumably examples of such attacks actually happening in real life will always be hard to find- when a car is stolen, who knows how it was stolen?
Sorry, I've a bit of a rant to get through here, having worked in precisely this field, and found very little acknowledgement of the longer term risks. This is not unexpected, newcomers to the field will always underestimate both the efforts and the rewards of exploiting weak computers.
The point is that you only need one clever guy to crack the system, and his exploit can then be packaged and sold to all and sundry.
The "reward potential" for a car is quite high, a sophisticated infotainment system will have all manner of passwords and accounts, phone numbers, possibly NFC (near field comms) e-payment details. This is not to mention any scam exploits - like putting a bogus, urgent fault on the car that directs you to the nearest "friendly" garage, where you are relieved of some money.
At the moment the industry is in the denial phase, it looks like too much effort, on too variable a platform. Good points both of them, cost and risk vs reward are the fundamentals of "the crime equation", but they are on a collision trajectory, costs will fall and rewards will rise.
I was a little disconcerted by The Reg's uncharacteristically poorly informed opinion:
"interesting exercise by F-Secure a few years back singularly failed to infect a car via Bluetooth and we've not seen anything since to suggest that this has changed, even with advances in the sophistication of technology that might make such a scenario more feasible"
I would recommend reading: http://www.autosec.org/pubs/cars-usenixsec2011.pdf
Wherein the following passage appears:"We next assess whether an attacker can remotely exploit the Bluetooth vulnerability without access to a paired device. Our experimental analyses found that a determined attacker can do so, albeit in exchange for a significant effort in development time and an extended period of proximity to the vehicle.
They go on to describe in detail what can be done, today. Read on....
Haven't we already had exploits for the remote keys for some cars?
The manufacturers of wireless gizmos for anything are notorious for getting security wrong, why should car systems be any different?
I'm slightly surprised that there haven't been more attacks on remote car keys, except that, of course, bricks are still pretty cheap.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
