back to article TXT message leaves Corvette wrecked

Four University of California researchers have popped aftermarket vehicle tracking devices used by insurance companies to hijack the brakes, steering, and locks of a Corvette with little more than a text message. The hack targets Mobile Device telematic control units (TCUs) used by Uber and US insurer Metromile which, when …

  1. Anonymous Coward
    Unhappy

    Next!

    When they start hacking buses I am so screwed.

    1. petur

      Re: Next!

      No. Next, combine this with auto-driving vehicles and car thieves don't need to leave the sofa, they can even deliver the 'goods' automatically

      1. Ole Juul

        Re: Next!

        and car thieves don't need to leave the sofa, they can even deliver the 'goods' automatically

        The recipient of the stolen car subsequently getting a surprise when they discover the original owner still onboard.

      2. Anonymous Coward
        Anonymous Coward

        Re: Next!

        > No. Next, combine this with auto-driving vehicles and car thieves don't need to leave the sofa, they can even deliver the 'goods' automatically

        No it will allow terrorists/bored teenagers to cause bloody mayhem when they workout how to turn left and apply the back brakes when they realise you're on the freeway. They'll know coz they can read your location too.

  2. a_yank_lurker Silver badge

    How Far?

    What is the practical distance for one to use this hack? It is serious and needs to be fixed but if it requires one to be 150 feet/50 meters from the target it makes for a very clean mob hit but probably not much of a danger to the average person. If one can target a specific car from a distance, then it really becomes nasty.

    1. Captain DaFt

      Re: How Far?

      From the article:

      -Their hack grants "complete access" at any distance-

      So yep, Corvettes're screwed!

    2. Anonymous Coward
      Anonymous Coward

      Re: How Far?

      >> What is the practical distance for one to use this hack?

      It's done via SMS.

      How far away can you SMS?

    3. big_D Silver badge

      Re: How Far?

      It is SMS, so anywhere in the world, where your phone has a signal and anywhere in the world where the cars black box has a signal... Although it is only going to be fun if you can actually see the vehicle when you send the SMS...

    4. Jamesit

      Re: How Far?

      You exploit it by TXT. You could be anywhare and take over the car I think.

    5. Anonymous Coward
      Anonymous Coward

      Re: How Far?

      How Far?

      What is the practical distance for one to use this hack?

      OK, clearly you're unfamiliar with SMS. You could do this from a sunny beach whilst having drinks..

      Now for the fun bit: this is kit provided by the insurance. This could bring some seriously juicy liability issues. WTF where they thinking?

      1. Mark 85 Silver badge

        Re: How Far?

        Now for the fun bit: this is kit provided by the insurance. This could bring some seriously juicy liability issues. WTF where they thinking?

        How about profit? The devices can allow them rate up some drivers and avoid paying out on claims. When profit is the motive, nothing else, including security, matters.

        1. Anonymous Coward
          Anonymous Coward

          Re: How Far?

          Now for the fun bit: this is kit provided by the insurance. This could bring some seriously juicy liability issues. WTF where they thinking?

          How about profit? The devices can allow them rate up some drivers and avoid paying out on claims. When profit is the motive, nothing else, including security, matters.

          Ah, but providing a device that can CAUSE an accident not only creates consequential liability (as it's fairly clear there was f*ck all design review & due diligence), it also creates reasonable doubt regarding the cause of accidents. If your device is found to be a potential source of accidents you're not going to win many court cases once the lawyers wake up to the potential of this, and at that point you can very much say bye bye to your profits.

          It is, quite simply, incredibly negligent that security clearly was never even *considered* during design, because that's really the only conclusion you can draw here.

    6. d3vy

      Re: How Far?

      From.what I read its delivered via SMS

      .. So I could in theory text a car in the US from the UK and clean its windows... :)

  3. Jonski
    FAIL

    'This process contained "unfortunate design choices"'

    In other words, incompetence and/or malpractice. Someone, somewhere, deserves an arse-kicking into next year. For god's sake why don't they know by now?

    1. big_D Silver badge

      Whoever thought it was a good idea to attach a device that can adjust the vehicles behaviour to the CAN-bus and SMS (or any external network) at the same time should not be allowed anywhere near a computer, let alone a car!

      This stinks of lab technicians with no experience of the real world - that or Pointy-Haired-Boss syndrome.

      1. Anonymous Coward
        Anonymous Coward

        Worse still...

        It may need to monitor the CAN (e.g. for road speed etc.), but there is no reason why it should have it's CAN transceiver enabled for transmission - and I mean at the hardware level, so a hack can't enable the ability to send messages.

      2. John Brown (no body) Silver badge

        "Whoever thought it was a good idea to attach a device that can adjust the vehicles behaviour to the CAN-bus and SMS "

        From what I've read of these devices in the past, some are designed to limit certain types of drivers such as young or new drivers. So yes, some are designed from the ground up to talk to the cars network and make adjustments. eg cheaper insurance if dad fits a box which limits his testosterone fulled son to 55mph. I would assume there is some way to identify the driver, eg PIN or an RFID in the keyfob

        But, having this ability and NOT using proper security is incompetence at best or negligence at worst.

        1. Fungus Bob

          If dad wants cheaper insurance, he should only let his testosterone addled son drive a car with a 3 cylinder engine (preferably an engine that started out with six working cylinders).

    2. Meerkatjie

      They do know but realised that it's expensive to make something good so decided to go with cheapness and faith that not enough bad stuff would happen to cause it to cost them more.

  4. Captain DaFt

    Sign of the times

    It seems impossible to design any device theses days, down to freakin' light bulbs, without including insecure wireless access.

    Is it stupidity?

    A plot by the Five Eyes?

    Or just plain lazy, "Throw the latest buzz word tech on that puppy and sell it, PRONTO!", mindless marketeering?

    Unfortunately, based on History, I actually believe it's the last one.

    1. Anonymous Coward
      Anonymous Coward

      Re: Sign of the times

      Or as my boss jokes:

      "Compiles on my machine! SHIP IT!"

  5. xerocred

    Next, the cops will want this functionality.

    Save them going on car chases...

    1. Fred Flintstone Gold badge

      Re: Next, the cops will want this functionality.

      Next, the cops will want this functionality.

      Save them going on car chases...

      Only until the cops' insurance insists on it too. At that point they probably won't even make it out of the car park :)

  6. Anonymous Coward
    Anonymous Coward

    how long before?

    having a tracker in your car results in an insurance premuim INCREASE rather than a reduction?

    Having just gone through the pain of insuring a new car (because my current insurer could would cover a hybrid???? Wtf???) one company would not quote because it was NOT fitted with a tracker I read this article with interest.

    This whole rather sorry episode should be a wakeup call to every car manufacturer.

    But will they learn from it rather than putting sticking plaster over the problem in the hope that it goes away.

    1. Anonymous Coward
      Anonymous Coward

      Re: how long before?

      Not saying that a car manufacturer wouldn't do something equally braindead, but the shoddy devices unwisely plugged into the CAN Bus that this article's about are third party aftermarket devices.

  7. Tezfair
    Coat

    Its Q's fault.

    He hacked a BMW for James Bond in 'Tomorrow never dies' and now looked what's happened.

  8. Alan Edwards

    The other way around?

    I wonder if you can hack the telematics unit from something else on the CAN bus, say a phone connected over Bluetooth.

    Something gets disabled when the car is moving? Tell the telematics unit the speed is zero, regardless of the actual speed.

    Get fined/insurance goes up when certain limits are exceeded? Set max/min values on data sent to the telematics unit so the limits are never exceeded.

    1. SImon Hobson Silver badge

      Re: The other way around?

      Well you could simply make a "man in the middle" box that all the canbus messages have to go through, and edit them while doing so.

      So receive road speed status from the vehicle canbus, apply a formula to the speed, and transmit the edited speed message to the add-on unit. You'd probably want something formula that starts off more or less accurate (multiplier of 1) and gradually reduces the multiplier as speed rises. Of course, that in itself could trigger other issues - what if you've apparently driven for an hour at "50" miles per hour, but the GPS says you've travelled 70 miles ?

      1. d3vy

        Re: The other way around?

        "what if you've apparently driven for an hour at "50" miles per hour, but the GPS says you've travelled 70 miles ?"

        Bigger problem is likley to be if you ever need to make a claim...

        But the GPS says you weren't even there or somthin' or nufink.

        Or you know, the other issue is that if you tamper with it your insurance is invalid... If they ever figure it out youre screwed.

        Worse if the police pull you and figure it out, driving without insurance will get your car impounded/crushed.

  9. Anonymous Coward
    Anonymous Coward

    CAN bus?

    Is that like the bean can that helps hold on a Morris Minor exhaust?

    1. Anonymous Coward
      Anonymous Coward

      Re: CAN bus?

      No that would be CANned Moggie, CAN bus "Is that like the bean can that helps aim a Bus' exhaust at cyclists ?"

  10. g e
    Joke

    HTC ?

    Hack

    That

    Corvette

  11. joshimitsu

    Insurance black boxen

    This really puts me off accepting telematics "black box" insurance deals.

  12. Stephen Leslie

    "They" have taken the Internet too far

    We don't need our cars hooked up so thoroughly with the Internet / communication systems. The basic systems on cars should operate independent of external signals. The Internet should stick to the map display.

    It's nutzoid otherwise, and, it appears, potentially a serious hazard. They should back away before governments are forced to writing all those rules and regulations gov'ts are so fond of.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021