Security experts warn that more than 470,000 cars made by Fiat Chrysler could be at risk of being attacked by similar means – including those driven in the UK
Hackers took control of a car and crashed it into a ditch by remotely breaking into its dashboard computer from 10 miles away.
In the first breach of its kind, security experts killed the engine
and applied the brakes on the Jeep Cherokee, sending it veering off the
road – all while sitting on their sofa.
The US hackers said they used just a laptop and mobile phone to access the Jeep’s on-board systems via a wireless Internet connection.
They claim that more than 470,000 cars made by Fiat Chrysler could be
at risk of being attacked by similar means – including those driven in
the UK.
The breach was revealed by security researchers Charlie Miller, a former NSA employee, and Chris Valasek.
They worked with Andy Greenberg, a writer with tech website Wired, who drove the Jeep Cherokee on public roads in St Louis, Missouri.
In his disturbing account Greenberg described how the air vents started blasting out cold air and the radio came on full blast when the hack began. The windscreen wipers turned on with wiper fluid, blurring the glass, and a picture of the two hackers appeared on the car’s digital display to signify they had gained access.
Greenberg said that the hackers then slowed the car to a halt just as he was getting on the highway, causing a tailback behind him – but the worst was yet to come.
He wrote: “The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch.
“The researchers say they’re working on perfecting their steering control – for now they can only hijack the wheel when the Jeep is in reverse.
“Their hack enables surveillance too: They can track a targeted Jeep’s GPS coordinates, measure its speed, and even drop pins on a map to trace its route.”
The hack was possible thanks to Uconnect, the software that has been built into the dashboard computers of hundreds of thousands of cars made by Fiat Chrysler Automobiles since late 2013.
The feature controls the entertainment system, deals with navigation and allows phone calls. It also allows owners to start the car remotely, flash the headlights using an app, and unlock doors.
But according to Miller and Valasek, the on-board Internet connection is a “super nice vulnerability” for hackers. All they have to do is work out the car’s IP address and know how to break into its systems and they can take control.
Independent security expert Graham Cluley said: “Note that the researchers believe that, although they’ve only tested it out on Jeeps, the attacks could be tweaked to work on any Chrysler car with a vulnerable Uconnect head unit.”
The incident is the latest hacking episode which shows just how vulnerable we are to modern technology. Miller and Valasek have carried out similar hacking stunts on a Toyota Prius and a Ford Escape.
A US hacker also recently took control of a passenger jet he was on, in the first known incident of its kind, according to the FBI. Chris Roberts is said to have plugged into the plane’s computer systems through the electronics box under his seat – and briefly moved the aircraft sideways.
Meanwhile, it emerged earlier this week that hackers were threatening to release the confidential details of millions of people after stealing information from adultery website AshleyMadison.com.
After being contacted by the hackers nine months ago, Fiat Chrysler released an update to its car systems. However, users have to download it onto a memory stick and plug it into their USB port, or take the vehicle to a local dealership to have it installed.
The security researchers are now urging drivers of Fiat Chrysler to get the update installed as soon as possible, to protect themselves from similar attacks.
In a statement to Wired Fiat Chrysler said: “Under no circumstances does Fiat Chrysler Automobiles condone or believe it’s appropriate to disclose ‘how-to information’ that would potentially encourage, or help enable hackers to gain unauthorised and unlawful access to vehicle systems.
“We appreciate the contributions of cybersecurity advocates to augment the industry’s understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety.”
https://thematrix70.wordpress.com/2015/07/31/cars-can-be-hacked/
They worked with Andy Greenberg, a writer with tech website Wired, who drove the Jeep Cherokee on public roads in St Louis, Missouri.
In his disturbing account Greenberg described how the air vents started blasting out cold air and the radio came on full blast when the hack began. The windscreen wipers turned on with wiper fluid, blurring the glass, and a picture of the two hackers appeared on the car’s digital display to signify they had gained access.
Greenberg said that the hackers then slowed the car to a halt just as he was getting on the highway, causing a tailback behind him – but the worst was yet to come.
He wrote: “The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch.
“The researchers say they’re working on perfecting their steering control – for now they can only hijack the wheel when the Jeep is in reverse.
“Their hack enables surveillance too: They can track a targeted Jeep’s GPS coordinates, measure its speed, and even drop pins on a map to trace its route.”
The hack was possible thanks to Uconnect, the software that has been built into the dashboard computers of hundreds of thousands of cars made by Fiat Chrysler Automobiles since late 2013.
The feature controls the entertainment system, deals with navigation and allows phone calls. It also allows owners to start the car remotely, flash the headlights using an app, and unlock doors.
But according to Miller and Valasek, the on-board Internet connection is a “super nice vulnerability” for hackers. All they have to do is work out the car’s IP address and know how to break into its systems and they can take control.
Independent security expert Graham Cluley said: “Note that the researchers believe that, although they’ve only tested it out on Jeeps, the attacks could be tweaked to work on any Chrysler car with a vulnerable Uconnect head unit.”
The incident is the latest hacking episode which shows just how vulnerable we are to modern technology. Miller and Valasek have carried out similar hacking stunts on a Toyota Prius and a Ford Escape.
A US hacker also recently took control of a passenger jet he was on, in the first known incident of its kind, according to the FBI. Chris Roberts is said to have plugged into the plane’s computer systems through the electronics box under his seat – and briefly moved the aircraft sideways.
Meanwhile, it emerged earlier this week that hackers were threatening to release the confidential details of millions of people after stealing information from adultery website AshleyMadison.com.
After being contacted by the hackers nine months ago, Fiat Chrysler released an update to its car systems. However, users have to download it onto a memory stick and plug it into their USB port, or take the vehicle to a local dealership to have it installed.
The security researchers are now urging drivers of Fiat Chrysler to get the update installed as soon as possible, to protect themselves from similar attacks.
In a statement to Wired Fiat Chrysler said: “Under no circumstances does Fiat Chrysler Automobiles condone or believe it’s appropriate to disclose ‘how-to information’ that would potentially encourage, or help enable hackers to gain unauthorised and unlawful access to vehicle systems.
“We appreciate the contributions of cybersecurity advocates to augment the industry’s understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety.”
https://thematrix70.wordpress.com/2015/07/31/cars-can-be-hacked/
No comments:
Post a Comment